Ransomware Recovering from · The Data Infrastructure Software Company • Update / patch your...

Recovering from Ransomware

Don’t pay the Ransom!A better solution to get back your data

Today’s Presenter

Sushant RaoSenior Director of Product MarketingDataCore Software

Threat potential of

Ransomware

• Ransomware is a type of malicious software that carries out the cryptoviral extortion attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it

Most recent example is WannaCry in mid of May 2017 – thousands of companies in all industries were affected in more than 150 countries

According to CNN, $209 million were paid to ransomware criminals in just three months (Q1/16)

Ransomware – What is it?

Source: https://en.wikipedia.org/wiki/Ransomware, https://de.wikipedia.org/wiki/WannaCry

Extent of Wannacry Ransomware

Source: https://intel.malwaretech.com/botnet/wcrypt /

• Services and applications with security holes• SMB file sharing (Wannacry started this way)

• Browser• Silverlight, Flash or Java Exploits

• Emails (comparable to Phishing: simulation of serious senders)• Government, Amazon, FBI, Police, PayPal, etc.

• Phone call• ”Microsoft is calling …“

• Dropbox• Downloads of files, e.g. application papers

Threat Vectors

• Local disks of affected system

• Active UNC (Uniform Naming Convention) paths• Home Shares

• Group Shares

• Inactive UNC paths• Temporary drives with password in cache

Threat potential

(choose one)

• Yes (been attacked before)

• No (haven’t been attacked, so far)

Question 1: Has your business/organization been affected by

Ransomware?

Typical Protection Measures

• Update / patch your computers and servers• If possible, turn on automatic updates

• Educate users to not open attachments / download files• Easier said than done!

• Backup your data!• Recover your data in case of an attack

3 Steps to Protect from Ransomware

• Pay the requested amount?• No guarantee that this will lead to recovery of data

• Is there “honor among thieves”?

• Restore data from backup• Recovery Point Objective (RPO)?

• Calculated data-loss

• Where is my Backup?

• Is my backup affected?

• Restore time?

What can be done after you’ve been attacked?

The principles of RPO/RTO

t (time)

Downtime

Rectification work

Lost timeRPO

DecisionAlert Recovery-time RTO

t (time)

Downtime

Rectification work

Lost timeRPO

t (time)

Downtime

Rectification work

Lost timeRPO

t (time)

Downtime

Rectification work

Lost timeRPO

t (time)

Downtime

Rectification work

Lost timeRPO

t (time)

Downtime

Rectification work

Lost timeRPO

Continuous Data Protection:A better way to recover data

• Access to any data state within a 14 day time-window

• Journalizes any I/O of protected disks

• No application implementation necessary

• Agent-less

• Just turn-it-on and recover

• Consistency checkpoints could be set (optional)

Continuous Data Protection (CDP)

ProductionArrayCDP Array

Data Written @ 2:41:30 pmData Written @ 2:41:32 pmData Written @ 2:41:35 pmBad data Written @ 2:41:36 pm

CDPContinuous Data Protection (CDP)

Where CDP makes the difference!

Backup

Snapshot

Backup

Snapshot

• Film (constantly report any change ) and recover

DataCore CDP• Extreme improvement of RPO and RTO

Return to previous consistency

Free choice ofrollback time

7am 8am 9am 10am 11amTime-stampedupdates

Optional marked checkpoints

11:09 am

10:22 am

• Independence of backup-windows

• Shortening of restore-time and less data-loss

• Optimization of RPO and RTO – close to zero

• Forensic analysis and troubleshooting

Benefits of CDP CDP

• Changes in typical behavior of CDP

• Retention time shrinks abruptly

• Log increases suddenly

Recognition of attack

• Rollback of CDP protected disk• After receiving the alert immediately switch-off all

affected servers!• Identify exact time before the attack occurred• Gradually approach the right time by checking multiple

rollback-points• Identify non-encrypted data• Restore non-encrypted data or ”instant“ promotion of

rollback-point to replace original disk

Defense

• CDP is not:

• A replacement for backup

• Creating a media change

• A replication tool

• Replacing “good common sense”

Please keep in mind…

• Ransomware is no myth, everyone can be affected

• Ransomware attacks local and server-data

• Never pay – this would be the invite for the next attack!

• Promote awareness among your users

• Be prepared – define the appropriate measures upfront: “what to do, when the problem occurs“

Summary

(choose one)

• Backup only

• CDP only

• Backup + CDP

Question 2: What is the best way to protect your data?

Introduction to DataCore

30,000+ DEPLOYMENTS WORLDWIDE

10,000+ Customers 10th Gen Product

Companies in all Industries & Sizes

Software-defined Storage & Hyper-converged

Technology: Storage Virtualization & Parallel I/O

Main Offices• Australia• France• Germany• Japan• UK• USA

Proven. Globally.

One platform for any storage

One platform for any deployment

Traditional Converged Hyper-Converged Hybrid-Converged Cloud

Integrate, manage, and enhance existing

storage

Leverage internal storage, reduce complexity and

maintain compute segregation

Consolidate all functions for smallest footprint and highest

performance

Consolidate all functions for smallest footprint and highest performance while

serving storage externally

Extend services to Microsoft Azure,

Amazon AWS, or any other public or private cloud-based platform

Apps Apps

V V V V

DataCore

DataCore Benefits

Improved performance by 3X or more

IMPROVE PERFORMANCE

Reduced storage-related downtime by50% of more

REDUCE DOWNTIME

Reduced storage-related spending by25% or more

INCREASE UTILIZATION

In the first year, positive ROI

SAVE MONEY

• Patch / update your computers and servers

• Educate your users on how to be safe

• Evaluate CDP in addition to backups of your data• Schedule a 15-minute live demo with one of our Solution Architects

http://info.datacore.com/LiveDemo

• Try DataCore CDP in your environment• Protect your data in case of an attack

Next Steps

Thank You

info@datacore.comwww.datacore.com

Ransomware Recovering from · The Data Infrastructure Software Company • Update / patch your...

Documents

Transcript of Ransomware Recovering from · The Data Infrastructure Software Company • Update / patch your...

Conti Ransomware

Ransomware infographicITU - itu.int · ransomware detections were flagged as crypto-ransomware. a 27% increase since it was discovered. A ransomware variant seen in Russia that zipped

Recovering from a Ransomware Attack - NYMISSA · RMI •Current state of cyber recovery. •A cyber-recovery solution architecture. •Technologies available today… not futures.

Ransomware: Wannacry

MAPPING THE RANSOMWARE LANDSCAPE - Bitpipedocs.media.bitpipe.com/io_13x/io_137963/item_1550281/Mapping T… · 2 RANSOMWARE GUIDE: MAPPIN THE RANSOMWARE LANSCAPE SCOPE OF THE THREAT

Hive Ransomware

Understanding Ransomware: Impact, Evolution and Defensive ...€¦ · 14/07/2014 · 3 Evolution of Ransomware 3.1 Historic Examples of Ransomware Ransomware trojans appeared as

LockBit Ransomware

Ransomware Handbook

Ransomware- success stories Triangle InfoSeCon · Ransomware Ransomware WannaCry,Petya,CryptoLocker,and TeslaCrypt are some of the more notable examples of such ransomware. In general,

Ransomware: The Known and Unknown€¦ · Can I get ransomware from removable devices? Can I get ransomware from social media? Can a hacker infect me with ransomware through other

Ransomware and tips to prevent ransomware attacks

Recovering Your Customers From Ransomware Without Paying Ransom

Lessons Learned: Recovering from Ransomware · 2020. 7. 7. · Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website.” In 2019 one

NIST SPECIAL PUBLICATION 1800-11B Data Integrity · NIST SPECIAL PUBLICATION 1800-11B Data Integrity . Recovering from Ransomware and Other Destructive Events . ... 36 (IT) enterprise

Cisco Ransomware Overview (with video) · Cisco Ransomware Defense Solutions. Ransomware is a Massive Market Size of the ransomware market –$1B and growing $1B $209M in Q1 CY2016

Thermostat Ransomware

RANSOMWARE PROTECTION€¦ · RANSOMWARE PROTECTION UIDE . ... Exploitation Exploit Mitigations Application Behavior Payload Execution ... PREVENTION AGAINST RANSOMWARE.

Easy way to uninstall PadCrypt ransomware: Remove PadCrypt ransomware

Cybercrime Tactics & Techniques: Q2 2019 Ransomware ......Ransomware shifts to business targets » Consumer ransomware drops -12% YoY & -25% QoQ » Business focused ransomware increase