Backup solution prevents, detects, and responds to ransomware attacks

Cohesity has introduced the Cohesity Anti-Ransomware Solution, a comprehensive series of new capabilities available for the latest version of Cohesity DataPlatform that directly combats ransomware attacks, one of the greatest enterprise security threats today. This solution offers the broadest set of capabilities of any modern-day backup vendor with a multi-layered approach that can prevent, detect, and if necessary respond to attacks – helping ensure business continuity while keeping cybercriminals in their place.

Thursday, 24th January 2019 Posted 5 years ago in by Phil Alsop

Ransomware attacks have become increasingly complex, targeted, and financially devastating for organizations around the world. Global losses from ransomware attacks are expected to reach $11.5 billion this year, according to estimates from the research firm Cybersecurity Ventures. Legacy backup infrastructure, which often functions as a data insurance policy, has become a prime target for attackers that exploit common weaknesses associated with these products. To counter sophisticated ransomware threats, organizations need to reconsider their backup strategy and deploy a solution that proactively prevents backup infrastructure from becoming a target, detects attacks in real time, and if necessary provides an immediate response to recover at scale, in order to avoid substantial downtime.

“Legacy backup solutions are ineffective against today’s ransomware attacks, which have become a top concern for almost every organization,” said Raj Rajamani, vice president of product management, Cohesity. “Real protection requires an integrated approach that combines proactive defense measures, intelligent monitoring, and the power to restore massive amounts of data immediately.”

Multi-Layer Protection Delivers Industry’s Strongest Defense Against Ransomware Attacks

Cohesity provides three layers of security that empower organizations to prevent, detect, and respond to ransomware attacks:

● Prevent: Cohesity's immutable file system, SpanFS, serves as the core defense against ransomware by keeping backup jobs in an immutable view. If an attacker tries to modify the backup, Cohesity DataPlatform will write the data to a new instance, keeping the original snapshot intact and preserved.

Customers also have access to additional protection with Cohesity DataLock, a new feature that allows security officers to “lock” a backup snapshot so that even someone with the highest level of access cannot modify or delete the backup. Cohesity also offers multi-factor authentication, another new feature that helps ensure that data is protected even when passwords are compromised.

● Detect: Because no barrier is 100 percent impenetrable, Cohesity is rolling out an entire new set of “detect” capabilities that uncover suspicious activities. Cohesity Helios, a SaaS-based secondary data and application management solution, provides anomaly detection that alerts the customer’s IT admin and Cohesity’s support team when the backup data changes or ingest rates fall outside the norm based on historical trends.

In addition to monitoring backup data change rates to detect potential ransomware attacks, with this announcement, Cohesity is also offering the industry’s only integrated detection and alerts for file-level anomalies within unstructured files and object data. This includes analyzing the frequency of files accessed and the number of files being modified, added, or deleted by a specific user or application to ensure a ransomware attack is quickly detected.

● Respond: In the event of a successful attack, quickly recovering any compromised data becomes the most vital function. Cohesity’s instant mass restore enables IT admins to recover not just files but hundreds of virtual machines instantly, at scale, to any point in time – a process that typically takes legacy or even modern backup solutions days, if not weeks. In these critical moments, backup solutions are only as good as how quickly they can recover the data – a quick recovery dramatically reduces the chances of downtime and lost revenue due to a ransomware attack.

Cohesity also provides the unique capability for customers to locate and delete infected files across their global data footprint, including in the public cloud. In addition, customers benefit from the platform’s ability to scale up to an infinite number of nodes without any detrimental impact on performance, which allows customers to store as many backups as they want right next to the production system for quick recovery.

These capabilities are now generally available to all customers using the latest version of Cohesity DataPlatform (Pegasus 6.1.1.).