Ransomware Recovering from · The Data Infrastructure Software Company • Update / patch your...

Copyright © 2017 DataCore Software Corp. – All Rights Reserved. The Data Infrastructure Software CompanyThe Data Infrastructure Software Company

Recovering from Ransomware

Don’t pay the Ransom!A better solution to get back your data

Copyright © 2017 DataCore Software Corp. – All Rights Reserved. The Data Infrastructure Software Company

Today’s Presenter

2

Sushant RaoSenior Director of Product MarketingDataCore Software

Copyright © 2017 DataCore Software Corp. – All Rights Reserved. The Data Infrastructure Software Company 3

Threat potential of

Ransomware


• Ransomware is a type of malicious software that carries out the cryptoviral extortion attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it

Most recent example is WannaCry in mid of May 2017 – thousands of companies in all industries were affected in more than 150 countries

According to CNN, $209 million were paid to ransomware criminals in just three months (Q1/16)

4

Ransomware – What is it?

Source: https://en.wikipedia.org/wiki/Ransomware, https://de.wikipedia.org/wiki/WannaCry

https://en.wikipedia.org/wiki/Ransomware

https://en.wikipedia.org/wiki/Ransomware

https://de.wikipedia.org/wiki/WannaCry

https://de.wikipedia.org/wiki/WannaCry


Extent of Wannacry Ransomware

Source: https://intel.malwaretech.com/botnet/wcrypt /


• Services and applications with security holes• SMB file sharing (Wannacry started this way)

• Browser• Silverlight, Flash or Java Exploits

• Emails (comparable to Phishing: simulation of serious senders)• Government, Amazon, FBI, Police, PayPal, etc.

• Phone call• ”Microsoft is calling …“

• Dropbox• Downloads of files, e.g. application papers

6

Threat Vectors


• Local disks of affected system

• Active UNC (Uniform Naming Convention) paths• Home Shares

• Group Shares

• Inactive UNC paths• Temporary drives with password in cache

7

Threat potential


(choose one)

• Yes (been attacked before)

• No (haven’t been attacked, so far)

8

Question 1: Has your business/organization been affected by

Ransomware?


Typical Protection Measures

9


• Update / patch your computers and servers• If possible, turn on automatic updates

• Educate users to not open attachments / download files• Easier said than done!

• Backup your data!• Recover your data in case of an attack

10

3 Steps to Protect from Ransomware


• Pay the requested amount?• No guarantee that this will lead to recovery of data

• Is there “honor among thieves”?

• Restore data from backup• Recovery Point Objective (RPO)?

• Calculated data-loss

• Where is my Backup?

• Is my backup affected?

• Restore time?

11

What can be done after you’ve been attacked?


The principles of RPO/RTO

t (time)

Las

t Bac

kup

Att

ack

Downtime

Rec

ogni

tion

ofat

tack

Star

t R

ecov

ery

Rectification work

Stan

dard

op

erat

ion

Lost timeRPO

DecisionAlert Recovery-time RTO

?



t (time)

Las

t Bac

kup

Att

ack

Downtime

Rec

ogni

tion

ofat

tack

Star

t R

ecov

ery

Rectification work

Stan

dard

op

erat

ion

Lost timeRPO


?


Continuous Data Protection:A better way to recover data

18


• Access to any data state within a 14 day time-window

• Journalizes any I/O of protected disks

• No application implementation necessary

• Agent-less

• Just turn-it-on and recover

• Consistency checkpoints could be set (optional)

Continuous Data Protection (CDP)


Hosts

ProductionArrayCDP Array

Data Written @ 2:41:30 pmData Written @ 2:41:32 pmData Written @ 2:41:35 pmBad data Written @ 2:41:36 pm

CDPContinuous Data Protection (CDP)


Where CDP makes the difference!

Backup

CDP



Backup

Snapshot

CDP



Backup

Snapshot

CDP

• Film (constantly report any change ) and recover

CDP


DataCore CDP• Extreme improvement of RPO and RTO

CDP

CDP


Return to previous consistency

6am

Free choice ofrollback time

7am 8am 9am 10am 11amTime-stampedupdates

Optional marked checkpoints

CDP

11:09 am

10:22 am

Host

CDP


• Independence of backup-windows

• Shortening of restore-time and less data-loss

• Optimization of RPO and RTO – close to zero

• Forensic analysis and troubleshooting

26

Benefits of CDP CDP


• Changes in typical behavior of CDP

• Retention time shrinks abruptly

• Log increases suddenly

27

Recognition of attack


• Rollback of CDP protected disk• After receiving the alert immediately switch-off all

affected servers!• Identify exact time before the attack occurred• Gradually approach the right time by checking multiple

rollback-points• Identify non-encrypted data• Restore non-encrypted data or ”instant“ promotion of

rollback-point to replace original disk

28

Defense


• CDP is not:

• A replacement for backup

• Creating a media change

• A replication tool

• Replacing “good common sense”

29

Please keep in mind…


• Ransomware is no myth, everyone can be affected

• Ransomware attacks local and server-data

• Never pay – this would be the invite for the next attack!

• Promote awareness among your users

• Be prepared – define the appropriate measures upfront: “what to do, when the problem occurs“

30

Summary


(choose one)

• Backup only

• CDP only

• Backup + CDP

31

Question 2: What is the best way to protect your data?


Introduction to DataCore

32


30,000+ DEPLOYMENTS WORLDWIDE

10,000+ Customers 10th Gen Product

Companies in all Industries & Sizes

Software-defined Storage & Hyper-converged

Technology: Storage Virtualization & Parallel I/O

Main Offices• Australia• France• Germany• Japan• UK• USA

Proven. Globally.

33


One platform for any storage


One platform for any deployment

Traditional Converged Hyper-Converged Hybrid-Converged Cloud

Integrate, manage, and enhance existing

storage

Leverage internal storage, reduce complexity and

maintain compute segregation

Consolidate all functions for smallest footprint and highest

performance

Consolidate all functions for smallest footprint and highest performance while

serving storage externally

Extend services to Microsoft Azure,

Amazon AWS, or any other public or private cloud-based platform

Apps Apps

V V V V

Apps

V V V

Apps

V

DataCore


DataCore Benefits

Improved performance by 3X or more

IMPROVE PERFORMANCE

Reduced storage-related downtime by50% of more

REDUCE DOWNTIME

Reduced storage-related spending by25% or more

INCREASE UTILIZATION

In the first year, positive ROI

SAVE MONEY

36


• Patch / update your computers and servers

• Educate your users on how to be safe

• Evaluate CDP in addition to backups of your data• Schedule a 15-minute live demo with one of our Solution Architects

http://info.datacore.com/LiveDemo

• Try DataCore CDP in your environment• Protect your data in case of an attack

37

Next Steps



Ransomware Recovering from · The Data Infrastructure Software Company • Update / patch your...

Documents

Transcript of Ransomware Recovering from · The Data Infrastructure Software Company • Update / patch your...