Data has become a prime target and enabler in the highly profitable world of cybercrime. As a result, organisations are constantly fending off a range of malicious activities that are laser-focused on flipping this hot commodity into cold, hard cash or destroying it to inflict irreparable damage.
Ransomware is one common attack approach, but other potential threats also exist, such as rogue administrators, disgruntled employees, and third parties that delete or download files. So, how can you better protect your data from malicious activity?
Despite the Best Ransomware Protection, Your Data May Still Not Be Safe
It’s important to point out that we’re not talking about yet another cybersecurity solution or tool. You probably have multiple layers of cybersecurity defence in place to stop these kinds of attacks before they can bring your business down. And those solutions are necessary.
However, we all know that these solutions and layers aren’t 100% impenetrable. There’s always an exploitable weakness or attack vector—and they can come from anywhere: Poor password choices, an inadvertent click on an email by an unsuspecting employee, or someone with the “keys” to attack from within the organization.
That’s why safer data is so critical, as is having a resiliency architecture. By putting a last line of defence in place, you still have an option for quick recovery even if your prevention solutions fail.
Hacker’s Guide to Ransomware Mitigation and Recovery
Data Backups Aren’t Enough
Here’s an increasingly common scenario. An organisation experiences an attack, either by ransomware or a malicious insider. It has data backups to reduce the damage of the attack and ensure it can get systems back up and running without having to pay off the criminals. But, the company soon discovers that the attackers haven’t just deleted or locked the primary data. They’ve also infected or deleted the backup data. Once that happens, it’s virtually impossible to rebuild.
So, the organization grudgingly pays the ransom. Or it starts the time-intensive data-recovery process from older backups and accepts that it will lose some data. Neither is a great outcome.
But, say the backup data wasn’t affected and the company can start to recover. Recovering all of the primary data could be petabytes of data. It could still take days, weeks, or even months to recover all that data using traditional backup solutions.
Speed Up Recovery and Secure Your Data with Pure Storage® SafeMode Snapshots
When recovering from an attack, speed is critical. To keep focused on the goal of safer data, you also need a mechanism that delivers faster restoration, replication, and recovery of all your data, particularly at scale. And most importantly, it must be impervious to any of the events described above.
Pure Storage SafeMode™ snapshots help mitigate ransomware attacks by creating secure, read-only snapshots of backup data and associated metadata catalogues. Data is locked down and no other process can delete, modify, or encrypt SafeMode snapshots—even when admin credentials are compromised. This means that no matter what level of access hackers may have to your systems, you’ll always be able to recover your data. It’s essentially a virtual air gap without the traditional complexity of other air gap solutions. SafeMode, a built-in feature of the Purity operating system, is available on all FlashArray™ and FlashBlade systems.
With traditional backup solutions, the recovery process is slow. When ransomware strikes, you want to restore your data as quickly as possible. With FlashBlade’s rapid restore capabilities, organisations can accelerate both recovery-point and recovery-time objectives. FlashBlade delivers up to 270TB/hour data-recovery performance for production and test/dev workloads. This doesn’t mean you need to entirely replace your existing backup infrastructure either. It’s an augmentation strategy that builds on what you have (including your existing backup software) and enables you to protect the most valuable parts of your business.
And get them—and your business—back up and running in the event of a ransomware attack.
