Ransomware protection

The ability to deliver ransomware protection has become increasingly difficult as ransomware attacks have moved beyond the desktop/laptop vector. Ransomware attacks today play out across the entire IT infrastructure, targeting all forms of data and requiring a more robust response. In addition to solutions for preventing attacks, organizations need response and data recovery plans that can quickly bring information back online. 

Recovery after an attack requires a clean copy of data that’s uninfected by ransomware. To ensure the integrity, confidentiality and availability of critical data in the event of a ransomware or other cyber attack, more companies today are seeking technology that can support data isolation strategies. This approach to data protection involves maintaining a copy of important data production and backup networks, and isolating it via an operational air gap. This type of approach to ransomware protection can help to avoid tampering, destruction and corruption of data and speed successful recovery after an attack.

PowerProtect Cyber Recovery delivers superior ransomware protection by providing physical and logical isolation of critical data within a dedicated vault. PowerProtect Cyber Recovery also leverages machine learning and intelligent analytics within the vault to identify suspicious activity and enable recovery of known good data in order to quickly resume business operations.

PowerProtect Cyber Recovery ensures ransomware protection through five essential steps.

• Data representing critical applications is synced through the air gap, which is unlocked by the management server into the vault, and replicated into the vault target storage. The air gap is then re-locked
• A copy of that data is made. Vault retention is configurable but most keep about a month's worth of copies
• The data is retention locked to further protect it from accidental or intentional deletion or ransomware for example
• The data is optionally analyzed by our analytics engine, CyberSense (more on that later). 
• Recovering data from the vault in the event of a ransomware or cyber attack or simply for recovery testing procedures is critical and there are a number of ways recovery can be performed.

Monitoring and reporting is also provided from within the vault and can be shared outside of the vault environment in a variety of secure methods which we will discuss in more detail.

PowerProtect Cyber Recovery is built on several key technologies.

• Cyber Recovery vault. The PowerProtect Cyber Recovery vault isolates critical data away from the attack surface and physically and logically separating it in a protected part of the data center or in a cloud or Multicloud environment. The vault is further isolated and protected with an operational air gap avoiding management interfaces that could be compromised. Synchronization of data between production systems is automated and controlled from the Cyber Recovery vault – the vault preserves the original integrity of the data via immutable copies protected by retention lock.
• CyberSense. When a ransomware attack penetrates the data center, CyberSense helps to find data corruption. This innovative technology uses machine learning to analyze more than 100 content-based statistics, identifying signs of potential ransomware or other corruption with up to 99.5% confidence.

Automated recovery. PowerProtect Cyber Recovery automates restore and recovery procedures to bring systems back online quickly after an attack.

To improve ransomware protection, Dell Advisory and Implementation Services can help to accelerate cyber resiliency planning, develop of a cyber resilience strategy and deploy ransomware protection or Cyber Recovery solutions. Advisory Services focus on providing recommendations for integrating and optimizing recovery within a data environment. Implementation Services help to integrate PowerProtect Cyber Recovery into a data protection environment while tailoring the solution to the exact needs of your organization. 

Our services include:

• Creating a minimum viable company in the cyber recovery vault that can be trusted to ensure recovery of essential business functions after a ransomware attack.
• Providing recommendations on recovery strategy and integration points with plans for organization-wide incident response.
• Helping to integrate a recovery solution that recognizes the full range of threat vectors and that is aligned with the NIST Cybersecurity Framework.
• Developing and testing recovery plans and procedures. 

What is ransomware?

Ransomware is a form of malicious software, or malware. When downloaded to a computer or server, ransomware can block access to data and files on the device until a ransom is paid. Ransomware programs often use encryption to prevent victims from accessing their data, providing an encryption key only after a ransom has been received.

What’s the best ransomware protection?

Combating ransomware effectively involves at least two layers of protection. Organizations need technology that prevents ransomware attacks by blocking threats and educating employees about best practices for cyber security. And organizations need solutions that can speed the recovery of data backups after a successful attack while ensuring that the backup copy of data is uninfected by ransomware.