Ransomware seems to be at the forefront of many discussions today, and for good reason: The ransomware gangs make a ton of money by causing massive problems to businesses that are in turn losing billions because of this – but most importantly, losing time.
So eventually, like for anything that’s a problem, people tried to find solutions.
The challenge becomes finding what solutions truly address the problem in a realistic way instead of being mostly marketing in order to show a vendor isn’t behind in this area.
Some of you may remember the awesome Chrysler ads with Ricardo Montalban talking about “rich Corinthian Leather”. There is no such thing, the leather came from New Jersey. Corinth in Greece was never known for its prowess in leather anything – but the name sounded cool and different, so marketing went with it, as is their idiom. I’ll explain how HPE’s Zerto ransomware detection & recovery is truly useful in both detecting modern ransomware and rapidly recovering with a tight RPO. I’ll also show which types of protection are more like Corinthian Leather 🙂
A good example of Corinthian Leather: “Immutable Snapshots”. Practically every serious storage system from the major vendors has this technology, which mostly means locking snaps so that even if ransomware has infected the backup system (and therefore has the permissions to delete snaps, which is the least of the many things ransomware will try and do), the storage system won’t allow the deletion to happen.
Techniques like locking snapshots are, at best, a supplemental form of defense. Some ransomware indeed tries to delete snaps before the hackers demand the ransom – but they have already been encrypting your data for months, so your snaps are also infected…
So if you can’t detect, with accuracy, when encryption started happening, you have no defense and no safe recovery point.
To summarize: Aside from prevention, what’s most useful if you have been infected is:
- Real-time detection but also…
- …the ability to detect modern kinds of ransomware that fool methods like standard Shannon entropy detection (for example, encryption that results in compressible data) but also…
- …the ability to very quickly recover, and with a minimal loss of data (tight RPO and RTO) – not in hours/days but seconds/minutes. Time is money and all that.
Let’s get started:
Continue reading “HPE Ransomware Detection and Recovery in Zerto 10: Sophistication that Works”
