Designing for Recovery: Infrastructure in the Age of Ransomware

The menace of ransomware is driving increased security spending as organizations try to harden their systems against potential attacks, but ransomware is a new kind of threat. You can’t simply deploy tools to defend against the malware. You have to design your infrastructure for ransomware recovery.

I say this for two reasons. First, there’s an element of inevitability to ransomware. You can use the best security tools and software, educate your users, and institute best practices, but if you’re part of a large or global enterprise, hackers will find a way to get their malware through your perimeter. So, you need to design for recovery because you will, in all likelihood, suffer an attack.

The second reason is that ransomware recovery can be painful if you don’t plan ahead. Imagine ransomware strikes one of your locations, then spreads to a handful of other sites. Even if you have a solid backup strategy that allows you to restore previous, unencrypted versions of the impacted files, recovering that data can take days or weeks. The business downtime may prove more costly than the ransom.

To defend your organization against ransomware, and ensure that you’re not left holding the bag in the aftermath of a disaster, you need an overarching strategy and testable plan that allows you to rapidly detect and quickly recover from an attack.

Strategic Ransomware Recovery Planning

On one level, ransomware is a people problem. The malware often finds its way into organizations because someone clicks on the wrong link or downloads the wrong file. What we need to do is make people — IT and Security leaders — a valued part of the solution as well, by encouraging more high-level strategic thinking and planning around designing for recovery.

As you design your ransomware recovery strategy, you’ll want to ask:

• What tools do we already have at our disposal?
• Is our file infrastructure team aligned with InfoSec on ransomware?
• Have we mapped out the implications of multiple attack scenarios?
• Are employees sufficiently and consistently trained and educated?
• Do we have a detection and alert system in place?
• How quickly will we be able to quarantine the malware?
• What happens if the attack is distributed across multiple sites? Will that alter our recovery timeline?
• Will our RPOs be good enough for the business?
• Will we be able to provide a recovery timeline to business users?

These are just a few of the questions you’ll want to address. Ideally, you want to have a plan that you can test regularly, too, so you have a good sense of how it will perform, and what everyone on your team will need to do, in the event of a real attack. But my larger point here is that you need to engage in this kind of strategic planning, then search out new technologies or process improvements to eliminate or at least mitigate any weak points, to optimize your ransomware recovery.

Extending Ransomware Recovery to the Cloud

Shifting infrastructure to the cloud presents its own challenges. Let’s be honest. The cloud delivers some transformative capabilities, and it’s changing infrastructure as we know it, but the cloud isn’t perfectly secure. There’s still a bit of a wild west element to the space.

The cloud gives you an advantage relative to traditional data silos, but it also gives attackers a larger playing field. I’ve been hearing industry experts talk about how moving so much unstructured data to the cloud presents a bright, shiny target for hackers, especially if your permissions in the cloud are the same as your permissions in the enterprise. In short, the cloud itself doesn’t give you a free pass. You need to think about a number of factors including where your meta data is stored, does your solution make immutable copies of the data, and are you protecting data on its way to and from the cloud?

Ransomware Protection & Recovery with Nasuni

One of the things I like about the Nasuni approach is that the platform does a lot of this work for you by offering infrastructure that performs at local speed but with the cloud holding the “gold copies” of your data. Nasuni continuously snapshots data to the cloud and maintains a complete versioned history of every file in object storage. Data is stored as immutable objects, so when local files are impacted by an attack, you can quickly point back to previous, clean versions in the cloud. Since Nasuni doesn’t require mass movement of data, the platform is capable of restoring millions of files in minutes.

Earlier this year, Nasuni released a Ransomware Protection add-on service that monitors internal activity for suspicious files and behaviors. The system is designed to shorten the overall time to recovery down to just minutes whenever possible. It starts by automatically alerting administrators once a pattern emerges. IT can then dive deeper and quarantine users, machines, and locations as needed to stop the spread of the malware. It reports out files that are impacted and shows administrators the last clean snapshot for those files. Last but not least, it provides a detailed report of the attack that administrators and their infosec partners can analyze as part of the ransomware learning curve.

These features align with a design-for-recovery strategy, yet the technology also frees up time for IT to engage in the kind of strategic ransomware planning that’s needed these days, and if you think you don’t have the manpower to devote someone to ransomware defense, think again. Nasuni customers are able to discontinue dedicating personnel to backup processes and licenses because the solution takes care of data protection automatically. This turns into a major cost-saving benefit, but it also means they don’t need to dedicate individuals and teams to managing those backups. The IT expert who’d been overseeing tapes can be re-tasked with strategic ransomware defense planning.

Adopting a Ransomware Mindset

I’ve been in the storage business for many years and worked through massive shifts in how we store and protect enterprise file data. This ransomware threat is different. It’s not going away, and if you want to protect your organization, you can’t simply rely on a set-it-and-forget-it approach to security. You need to adopt a ransomware mindset — and that starts with designing your infrastructure not just for resilience, but for recovery.