Primary Storage Cyber Protection Solutions That Thwart Ransomware Attacks

Ransomware attacks pose a significant threat to primary storage, as they can encrypt and hold data hostage, rendering it inaccessible until a ransom is paid. Regular backups have been the go-to strategy for data restoration to deal with ransomware attacks that break through preventative cyber defenses, allowing for the recovery of primary data from the most recent unaffected backup.

However, a newer option is to use the features built into primary storage arrays to detect and recover from a ransomware attack that damages data.

Point-in-time copies or storage snapshots have long been a mainstay of primary storage to create a history of data images for disaster recovery. These enhanced snapshots are now being used to restore data in a fail-safe way in the event of a ransomware attack that corrupts data.

Lines of Defense

The first line of defense in cybersecurity is networking and access controls. However, those in charge of the data center have quickly realized that having up-to-date, ransomware-free, versioned data copies is a crucial fallback for data recovery if frontend defenses are breached.

In addition to protecting data against corruption and accidental loss, storage array snapshots inside primary storage are now playing a crucial role in thwarting malicious activity and recovering data during a data-damaging attack.

Related:Data Center Storage Systems Revenue Decline Continues – Omdia

Despite claims made by some storage vendors that their array snapshots may be used for ransomware attack data recovery, simple snapshots fall far short of being the complete cybersecurity solutions required to truly secure mission-critical data. In addition, with ransomware data thefts and data ransoming on the rise, stored data should always be encrypted with well-thought-out key management to protect against theft and the threat of exposing company information for ransom. This includes all company secret data, data that contains a competitive advantage, or data that might just be embarrassing if released to the public.

Mission-critical data must have at least two immutable copies made by two different backup processes to guarantee that at least one ransomware-protected copy would survive a ransomware assault, given the increased sophistication of cyber-attacks observed by Omdia in 2022.

A layered protection strategy should also be considered to move the recovery closer to the data inside the storage system, allowing for a speedy shutdown in the event of an attack and quick data recovery afterward.

Storage Array Snapshots

Inside a primary storage system is a great place to deploy other important capabilities that can thwart ransomware attacks. The latest storage system software can instantly recognize and respond to abnormally stored system data being written to it. It can then respond to these occurrences with automatic procedures to ensure the stored data is affected as little as possible. Comprehensive solutions can also scan the storage for data protection security gaps and misconfigurations that ransomware software tries to exploit by changing configuration settings to shut down data recovery measures.

Related:The Ransomware Crisis Deepens, While Data Recovery Stalls

Centralized monitoring for and timely notifications of any ransomware activity are essential components of any complete security plan. Since immutable backups remain a crucial component of any layered protection strategy, Omdia advises that storage-level protection be coupled with the broader backup vendor technology to obtain centralized monitoring and possible integrated application recovery management.

Keeping Copies Under Lock and Key

Last year, data centers experienced increasingly sophisticated cyberattacks, so it is now a must-have requirement to have immutable data copies as a fallback against such attacks. Immutably stored data copies cannot be altered by writing to them. They are locked in time and cannot be deleted through typical administrative actions. Thus, they are great for recovering data.

Omdia analysts have increasingly witnessed companies develop capabilities embedded into primary storage to recover compromised data from immutable copies. These mechanisms often involve snapshots that cannot be altered.

An acceptable initial step for primary storage is simply making array-based immutable recovery copies, especially if an excellent backup procedure intended to guard against ransomware also protects the storage. Beyond that, the following list of key capabilities must be considered to resist ransomware in primary storage completely:

Organizations should always have a strong detection and prevention aspect to their cybersecurity counter-offensive. However, when those security measures eventually fail, guaranteed remediation from an attack is critical for not incurring data loss.

Guaranteed recovery requires organizations to use a layered approach to recover attacked mission-critical data. Array-based solutions for ransomware data recovery are good examples of this layering and provide advantages over just using backups to provide protection.

Storage snapshots have historically been a valuable tool in disaster recovery plans and have been used to successfully recover data from unintentional file deletions. However, simple snapshots are not particularly effective in preventing deliberate attacks on data.

To provide a foolproof ransomware solution, enhanced capabilities added to simple snapshotting are crucial for ransomware recovery features in mission-critical storage.

Originally appeared as a free-to-download analyst’s opinion: Primary storage cyber protection solutions to thwart ransomware from Omdia's Cloud Storage subscription service. Omdia is an Informa property.