{"id":6679,"date":"2021-01-27T17:07:58","date_gmt":"2021-01-27T20:07:58","guid":{"rendered":"https:\/\/addvalue.com.br\/novo\/?p=6679"},"modified":"2021-01-27T17:08:37","modified_gmt":"2021-01-27T20:08:37","slug":"ransomware-protection","status":"publish","type":"post","link":"https:\/\/addvalue.com.br\/novo\/artigos\/ransomware-protection\/","title":{"rendered":"Ransomware Protection with Commvault\u2019s Modernized Air Gap"},"content":{"rendered":"
<\/header>\n
\n

Cyber threats are continuously evolving at an accelerated pace.\u00a0Ransomware is often the leading antagonist, leaving organizations crippled and at the mercy of cybercriminals.\u00a0Commvault helps organizations protect and recover data to resume business operations quickly. However, as threats evolve, even backup and recovery platforms are at risk to ransomware.\u00a0This has led to next-generation security controls such as immutability and multi-factor authentication to mitigate against these invasive threats. What about traditional air gap solutions? Is air gapping a viable solution against ransomware threats? In some cases, air gapping by itself may not be enough protection against threats; conversely, immutability and multi-factor authentication (MFA) may not be enough protection either. However, layering immutability, MFA, and Commvault\u2019s modernized air gap controls provide a highly effective solution at mitigating threats.\u00a0Let\u2019s dive into this further.<\/p>\n

Understanding the basics of ransomware<\/strong><\/h4>\n

First, let\u2019s understand how ransomware works at a high level. I like to think of ransomware as a symptom<\/strong> but not necessarily the catalyst<\/strong>. Most of the common ransomware strains we see today started as an Advanced Persistent Threat (APT) introduced into the environment through a targeted socially engineered phishing<\/a> attack.\u00a0For example, you may get an email from what appears to be a legitimate source (such as a work organization or bank) that tricks you into downloading a malicious application that introduces the APT. The APT keeps itself hidden in the environment crawling around doing reconnaissance, such as looking for user accounts and data to steal, as well as locating resources to infect.\u00a0APT\u2019s use \u201coff the shelf\u201d tools built into many operating systems to remain hidden, help collect data, and spread ransomware.\u00a0They take advantage of exposed and exploitable protocols to move around the environment. APT\u2019s have also been known to take down backup applications and data, as you can see from the Ryuk<\/a> ransomware breakdown.\u00a0Threats that move and spread around in the network are called lateral moving threats. As soon as the APT has done its work, the ransomware is released like a time-bomb.<\/p>\n

This is key to understanding how air gapping provides an effective layer of security.\u00a0The assumption is ransomware will infect your environment if there is any exposure to public networks such as the internet. This is especially true during the COVID pandemic<\/a> wherein organizations adopted \u201cwork from home\u201d policies, allowing end-users to connect into the work environments, creating more exposure and entry points for threats. However, backup storage targets that are air-gapped within the organization are shielded from lateral moving threats.<\/p>\n

What is traditional air gapping?<\/strong><\/h4>\n

We established that air gapping has value.\u00a0When you think of air gapping, you might immediately think of tape backups or the classic \u201cgovernment\u201d dark site.\u00a0Both solutions offer protection against lateral movement of threats since tapes are removed from the library, and dark sites are isolated and have no persistent connections to public networks.\u00a0However, both solutions are slow and ineffective for modern environments that need accessibility and rapid recovery.\u00a0Organizations are looking for air gap principles applied to modern storage,\u00a0 including cloud targets, to limit lateral moving threats while providing a seamless recovery experience when needed.<\/p>\n

Commvault\u2019s modernized air gap<\/strong><\/h4>\n

Commvault\u2019s approach to air gapping allows organizations to maintain efficient recovery point and recovery time objectives while reducing the impact of lateral moving threats.<\/p>\n

The most accessible air gap solution offered by Commvault is Metallic\u2122 Cloud Storage Service (MCSS).\u00a0With MCSS, there are no\u00a0persistent connections to the storage since all data resides in Metallic Cloud and is only accessed via authenticated API calls.\u00a0Direct access to cloud storage is not possible as credentials are not exposed. The storage is secure, scalable, and accessible.\u00a0When ransomware infects the environment, it will not spread to the cloud storage since it is virtually air-gapped, reducing lateral threats. MCSS is built into Commvault data protection solutions and preconfigured. It is as simple as applying a license and selecting the storage; there is no additional infrastructure or settings required.<\/p>\n

For organizations that cannot use the cloud, they can air gap using Commvault\u2019s Network Topologies and built-in intelligence for managing persistent connections to storage.\u00a0This on-premises solution segments and compartmentalizes storage; all incoming communication to the storage is blocked, and data pulled into the isolated storage.\u00a0Communication is air-gapped by controlling power management automatically for virtual gateways or data movers.\u00a0This solution requires minimal infrastructure; however, it can be applied to Commvault HyperScale\u2122 and just about any storage.<\/p>\n

To protect the backup content, Commvault\u2019s machine learning framework detects anomalous activity and changes to the content. Events and notifications are automatically triggered so customers can respond proactively. Removing threats from content is as simple as browsing your content and selecting the threat to erase. Check out this youtube video demonstration<\/a>, Avoid ransomware reinfection with Commvault<\/em>, to see how this works. This ensures backup data is clean and ready for recovery.<\/p>\n

Putting the security pieces together for maximum ransomware protection<\/strong><\/h4>\n

At this point, you might be thinking, why bother with an air gap solution when I have immutable storage locked down with MFA controls? There is no doubt that immutability and MFA are an integral part of the layered solution; however, they do not address lateral moving threats.<\/p>\n

Let\u2019s use the analogy of a combination safe.\u00a0If your offline bitcoin wallet is stored in a safe, is it safer sitting in plain sight for an intruder to easily see, or would it be better if the safe is secured<\/strong> and hidden<\/strong> in your house?\u00a0 Even though your safe is locked and secured, why would you expose it to additional risk? You don\u2019t need the combination to get into the safe; you need a way to exploit the safe.\u00a0It makes logical sense that the most secure<\/strong>option would be to keep your bitcoin wallet in a lockbox stored at a remote secured facility such as a bank \u2013 where it is air-gapped and un-reachable. Now you have eliminated the possible exposure to an intruder altogether.<\/p>\n

The same applies to backups; your storage should be immutable and protected with MFA controls. As soon as you segment, isolate, and air gap, you are further reducing the risk to ensure the ultimate protection.<\/p>\n

Fighting ransomware with Commvault\u2019s layered security approach<\/strong><\/h4>\n

Taking a layered approach to securing backup data provides the best overall protection against threats such as ransomware. Commvault\u2019s modernized approach to air gapping is not only simple, but it also provides the maximum level of security needed to protect against lateral moving threats so customers can be assured their data is recovery ready.<\/p>\n

source: https:\/\/www.commvault.com\/blogs\/ransomware-protection-with-commvaults-modernized-air-gap?hsamp_network=linkedin&hsamp=aSkEnY-rLpGIO<\/div>\n
\n
\n
Posted<\/span>