Cyber resilience

In addition to defenses that prevent cyber attacks, organizations seeking to improve cyber resilience need an effective data recovery framework. The most effective approach today involves three key components.

• Data Isolation is critical. The vault is ideally operated in a physically restricted area, such as a cage or locked room, that helps to guard against an insider threat. When the air gap is in a "locked" state – no data can flow – there is no access to any part of the solution. When unlocked, which is done to update or "sync" data, the operation is controlled from the secure, vaulted side, not from production. And during this phase the vault maintains a very secure profile. Only network traffic representing replication data is allowed and there is never access to other vault components or to the management plane of the storage or solution. So bad actors can't wait for the vault to unlock and then just drive in. 
• Data Immutability is next. Using PowerProtect DD’s Compliance Mode Retention Lock capability, data is prevented from deletion or change for a set time period, usually two weeks to a month (customer configurable). The lock cannot be overridden, even by an administrator with full privileges. Unique to PowerProtect DD are enhancements that further secure the lock from an attack on the clock (or NTP server), which might otherwise allow a bad actor to create an early expiration of the lock. Those who do not want or require such a strong control, or want operational flexibility, can configure governance retention lock (which is also the available mode on our PowerProtect DD Virtual Edition (DDVE)). 

PowerProtect Cyber Recovery’s Data Intelligence is based on the analytics engine – CyberSense – described in more detail in a later slide. But at a high level, CyberSense evaluates the full content of files and not just metadata or operating system information. This gives it more insight into whether the data has been improperly corrupted or modified. Machine learning ensures that the analytics stay ahead of changes in tactics

PowerProtect Cyber Recovery enables cyber resilience by protecting and isolating critical data from ransomware and other cyber threats. This Dell solution uses machine learning to identify suspicious activity and enable recovery of known good data and to resume normal business operations quickly and with confidence.

PowerProtect Cyber Recovery protects data and provides recovery across on-premises and multiple cloud environments including Dell Technologies Cloud and other leading service providers such as AWS, Microsoft Azure and Google Cloud Platform.

PowerProtect Cyber Recovery provides a secure digital vault that is logically and physically isolated from the production and backup networks with an operational air gap. To provide the best chance for recovery if production and primary backups have been compromised or infected, data in the vault is protected in an immutable format with retention locks. This Dell solution promotes cyber resilience by ensuring that a clean copy of data free from corruption can be recovered after a cyber or ransomware attack.

PowerProtect Cyber Recovery is built to be the last line of data protection defense against cyber attacks.

• The vault operates in 4 basic steps:
• Data representing critical applications is synced through the air gap, which is unlocked by the management server into the vault and replicated into the vault target storage. The air gap is then re-locked
• A copy of that data is made. Vault retention is configurable, but most keep about a month's worth of copies
• The data is retention locked to provide ransomware protection and against other risks such as accidental or intentional deletion or encryption for example.
• The data is optionally analyzed by our analytics engine, CyberSense (more on that later). 
• Recovering data from the vault in the event of a ransomware or cyber attack or simply for recovery testing procedures is critical and there are a number of ways recovery can be performed.
• Monitoring and reporting is also provided from within the vault and can be shared outside of the vault environment in a variety of secure methods which we will discuss in more detail.
• ransomware protectionRecovery workflows are fully automated to enable fast resumption of business operations.

PowerProtect Cyber Recovery is the first solution to fully integrate CyberSense, an optional capability that fully indexes and analyzes vaulted data within the security of the vault to help detect indicators of compromise and attack. CyberSense proactively identifies attacks in motion with accuracy that’s been shown to be greater than 99%. CyberSense constantly monitors data integrity to detect mass deletions, encryption and more than 100 types of changes in files and database that are often associated with an attack. CyberSense automatically generates alerts when signs of corruption are found and identifies the last good copy of data for recovery. With Cyber Sense, organizations can more easily identify threats, diagnose attack vectors and protect business-critical content to enhance cyber resilience.

What is cyber resilience?

Cyber resilience is an organization’s ability to prevent, respond to and recover from cyber attacks. Cyber resilience requires security teams to move beyond strict threat prevention and to incorporate technologies that can mitigate the damage from sophisticated cyber threats like ransomware and insider attacks and recover data quickly after an attack.

How do companies achieve cyber resilience?

Cyber resilience requires a multilayered approach to cyber security. In addition to advanced threat protection and security training for employees, a strong cyber recovery strategy can promote cyber resilience by protecting backup systems from corruption and enabling fast recovery of business-critical systems, applications and operations after an attack.