Blog

What is 360° Ransomware Protection?

by

IT professionals need to look for 360° Ransomware Protection of their backup infrastructure. Bad actors know that the backup infrastructure is critical in recovering from their ransomware attacks and avoiding paying the ransom. As a result, they target backup data and metadata to make recovery impossible or slow the process down.  

As we will discuss in our upcoming webinar “Three NEW Ransomware Exploits – How to Close the Backdoor” 360° Ransomware Protection shuts the backdoor that legacy backup storage solutions leave open. 

360° Ransomware Protection Requirements:

  • Improve Protection of production data by increasing backup frequency and improving recovery point objectives (RPO).
  • Improve Protection of protected data by providing instant immutability across all protocols. 
  • Improve Protection of Backup indexes and configuration files by hosting them on the backup storage target, storing them immutably while not impacting performance. 
  • Improve the Recovery Environment with standby storage to deliver on-demand production class performance on the backup storage target. 

Improve Protection of Production Data

Ransomware’s primary goal is still to encrypt your production data. The number one responsibility of any backup infrastructure is to ensure that production data is protected. Improving protection means enabling more frequent data capture events in the ransomware era. Using change block tracking (CBT) or block-level incremental (BLI) backup, organizations should be able to backup every hour instead of once per day. The problem is legacy backup storage solutions can’t keep pace with the dozens of backup jobs per hour this schedule would create. 

Increasing backup frequency using CBT or BLI backups creates another challenge. Backup software can only support so many of these jobs before they must consolidate them and synthetically create a new full backup. While full-synthetic backups eliminate the need to perform full backups over the network, they are very IO intensive. Legacy backup solutions can’t handle the IO demands of synthetic fulls, and most customers find that an over-the-network full backup is faster than the synthetic process. 

360° Ransomware Protection Improves RPO

The 360° Ransomware Protection capabilities of S1:Backup enable customers to take full advantage of CBT/BLI capabilities. They can execute backups every 30 minutes or less. The high-performance flash tier of S1:Backup can easily handle the dozens, even hundreds, of simultaneous data capture jobs this design can create. While an All-Flash Backup is not necessary, StorONE can provide a cost-effective, high-capacity flash tier sufficient to store an entire full backup + incremental jobs. When it is time to create a new synthetic full, StorONE’s ability to keep these most recent jobs on the flash tier means that the consolidation effort occurs in record time. 

Improve Protection of Protected Data

The copies of production data that the backup infrastructure stores are critical to a successful ransomware recovery. Protecting that data from being encrypted is now a new responsibility of backup storage targets. The backup storage target must provide immutability and it must provide some form of a physical or virtual air gap. 

ransomware protection

Most legacy backup storage targets don’t provide either of these capabilities. To compensate, many backup software vendors add another storage silo to their backup infrastructure to provide these capabilities. The addition of even more storage silos leads to further complexities and costs. First, additional jobs must be created to move the data from the primary backup storage target to the immutable storage target, which adds to operational overhead. Second, a data transfer needs to occur when moving data from the primary backup storage device back across the network to the immutable storage device, which takes time and may require additional networking. Third, most of these immutable systems force customers to learn a new storage protocol like S3/Object, again adding to operational costs. 

While storing protected data immutably is essential, the cost of that process can’t be so expensive that only a few organizations can afford it. The practice also can’t be so complicated that most organizations can’t consistently apply it. 

360° Ransomware Protection Provides Instant Immutability

S1:Backup’s 360° Ransomware Protection capabilities include making an immutable copy of every backup job less than 30 seconds after it completes, regardless of what protocol the backup infrastructure uses to transfer data. It does not require a separate storage silo or the scheduling and maintaining of additional backup jobs. The copies are capacity efficient and can be retained for months, creating a virtual airgap. S1:Backup’s immutability is simple, consistent, and transparent. S1:Backup can even alert you of a potential attack, so you can stop it early. 

Improve Protection of Backup Metadata

Recent attacks like the one that impacted Kronus, show that immutability by itself does not beat ransomware. Bad Actors also target backup metadata, the indexes, and configuration files that backup software creates. Without this data, the backup software does not know what production data it protected or where it stored it. Backup metadata is usually stored directly on the server that hosts the backup application, making it vulnerable to failures beyond ransomware. 

While most backup applications can recreate this data from manually scanning the files that store production copies, the process can take weeks to complete in some cases. Until the process is complete, you can’t recover data. 

360° Ransomware Protection Protects Backup Metadata

The 360° Ransomware Protection built-in to StorONE’s S1:Backup also protects backup metadata. It does this not by forcing you to create a separate task to copy the metadata. Instead, the performance of S1:Backup enables you to directly host backup metadata on our solution and apply the same immutable policies to it that you apply to protected data. If the ransomware attack gets to your backup metadata, you are less than 30 seconds away from a known good copy. Most customers will find that operations like searching for a file version will execute faster, making the backup application more responsive. Only StorONE’s S1:Backup can host backup metadata on the same system as the protected data and provide instant immutability to both. 

Improve Recovery Performance

The first three steps provide a quality data capture infrastructure and data resiliency, but a ransomware attack brings new recovery challenges. There is more pressure to recover quickly after a ransomware attack because your data center is physically intact, the lights are blinking, and users can’t figure out why it is taking you so long! There is the added pressure of paying the ransom, which may seem like the easy way out. 

Another challenge is you need time to disinfect your production storage properly. As the attack on Kronus proves, it can take months to disinfect your environment correctly and confirm which data sets were infected. This challenge conflicts directly with the need to recover quickly. 

360° Ransomware Protection Provides Sterile Standby Storage

For years, backup software solutions could instantiate virtual machines and applications on the backup storage target. The problem is the performance of these targets is disappointing in the production use case. In addition, the protocols supported are minimal, usually just one. Finally, they don’t have the high availability that organizations require of production systems. 

StorONE’s S1:Backup is the first backup solution to provide these instantiated VMs and applications with performance similar to production. For a prolonged outage, as Kronus experienced, a native restoration provides even better performance. It also provides full protocol support and complete enterprise-class availability.

Wrapping it Up

360° Degree Ransomware protection enhances your current backup software application to provide a complete ransomware protection and recovery environment. It enables you to recover from an attack quickly without the expense of buying new software and the overhead of learning how to use it. Each element of the strategy is critical to closing the circle. If your current backup storage target can’t improve RPO, protect protected data from the backup metadata, and provide a sterile standby storage area, then you are exposed to a potential attack and should check out our webinar.

Ransomware’s Backdoor

by

As IT professionals look to shore up their defenses against ransomware, they must understand ransomware’s backdoor. Ransomware’s frontal attack is well known. A compromised system or clicking the wrong email link can deposit a ransomware trigger file. That trigger file replicates itself and, then as quickly as possible, starts encrypting production data. At that point, most IT professionals turn to their backup software and start recovering data. The problem is that while this attack is going on, or increasingly before the frontal assault begins, ransomware is using the back door which your backup storage vendors have left open, making recovery much more difficult. Ransomware uses the Backdoor to:

• Encrypt Backup Data

• Encrypt Backup Metadata

• Slow down attempts to recover data

If the Ransomware attack is successful at any of these three backdoor entry points, you may be forced to pay the ransom even though you have a solid backup strategy. It is time to close the back door! In our upcoming webinar, “Three NEW Ransomware Exploits – How to Close the Backdoor,” we will detail these new exploits and provide ways that you can prepare for them and beat them. 

Ransomware Backdoor # 1: Encrypting Backup Data

The first ransomware backdoor exploit is backup data, the copy of production data that the backup architecture is storing. Even unsophisticated ransomware attacks may see success in this effort by accidentally stumbling upon the backup mount point. However, ransomware is increasingly targeting the backup storage repositories first, then moving on to encrypt production data. If the attacker can encrypt your backups and production data, you will likely have to pay the ransom.  

ransomware backdoor

The answer is to make sure that all your backups are stored immutably. Most immutable solutions can’t perform well enough to be the first backup ingest point, and they can’t be deemed suitable for recovery. Organizations are forced to implement yet another storage system and learn another protocol. And as we discussed in our blog, “Does Immutability Beat Ransomware,” you need more than immutability to beat ransomware. 

Ransomware Backdoor # 2: Encrypt Backup Metadata

Another ransomware backdoor exploits encrypting the data that the backup-server software needs to operate, its indexes, and configuration files. Without access to these files, you can’t recover data, regardless of where you store it or whichever media format you choose. The good news is you may be able to rebuild this information; the problem is that rebuilding an index requires manually rescanning every single backup job (if they are not corrupted), which can take hours, if not days. 

Ransomware Exploit # 3: Slow Down the Recovery Process

The final ransomware backdoor is for the malware to slow down your recovery efforts. If it takes you days or weeks to recover, you may be tempted to pay the ransom. Encrypting backup metadata is an example of slowing down the recovery effort. Ransomware tries to replicate itself repeatedly, changing its file name to make it hard to detect. As a result, even after you have identified the attack and the source file, there may be dozens of copies of that file scattered throughout your data center’s storage environment. When you restore data into this infected environment, the ransomware works to encrypt the data a second time rapidly. 

Close The Backdoor with 360° Ransomware Protection

Closing the backdoor that Bad Actors are using to exploit your environment is critical to surviving the attack and not paying the ransom. It would be best if you built a wall of protection around your data to make sure that your recovery efforts are not only successful but happen quickly. StorONE’s S1:Backup provides 360° Ransomware Protection that closes the back door and reinforces the “front door.” S1:Backup’s 360° Ransomware Protection provides

• The total value out of block-level backup technologies to backup more frequently, lowering the recovery point objective. 

• The complete immutability of every backup job across any storage protocol, protecting data from a ransomware attack. 

• The performance backup software vendors need to host backup metadata from storage. Once actively used on S1:Backup, all backup metadata is also stored immutably. Most customers also see improved backup application operations like searching for file versions.   

• A Sterile Recovery Target that delivers production-class performance and features at backup storage prices. S1:Backup will dynamically reallocate its flash tier during recovery to deliver needed performance for these applications or data sets. IT can run S1:Backup as production for weeks while they take the time to complete the necessary forensic work to root out the ransomware trigger files. 

Learn More

Response Time vs. Return to Operations

by

Standby storage solves the response time vs. return to operations problem many organizations face during a severe outage. Most production storage systems will have 24x7x4 support contracts associated with them. The problem is that these contracts only guarantee a response time, not “return to operations” time. In other words, the vendor is there quickly to admire your problem but makes no assurances about fixing the problem.

Organizations need to focus on return to operations and account for a potential outage in the storage infrastructure. In most cases, IT needs to recover data because of user error and the backup infrastructure is there for those circumstances. This infrastructure is also there for major disasters, which wipe out the entire data center. Where backup infrastructure historically falls short is the “in-between” disasters where a storage hardware failure or a bug in the storage software causes an outage. “In-between” disasters often cause some of the worst return to operations results the organization will face. While less frequent than user errors, they are far more frequent than a site-wide disaster, yet most organizations don’t have a strategy for protecting and recovering from “in-between” disasters.

A Real Response Time vs. Return to Operations Story

I recently spoke with an IT director who relayed a situation they went through about three months prior. They were upgrading their all-flash array, and following the best practice, they upgraded the system one controller at a time. Even though the vendor assured the customer that the upgrade was non-disruptive and they could do it anytime they wanted, the IT Director decided to do the upgrade during the weekend. This organization was part of a large hospital district. Even their slow time was mission-critical.

They deployed the software on one controller, confirmed it was working, and then deployed it on the next controller. About 10 minutes after the upgrade was complete, the system began to experience load. Both controllers crashed, and they were completely down. Most of the production environment ran on this system, so the impact was severe.

response time vs. return to operations

The organization called the vendor’s support line, and within four hours, a technician was on-site. As is typical today, the technician was not an employee of the storage vendor and didn’t even visually recognize the system they were there to fix. Their first action was to call for support. Working with remote support took the storage vendor another 18 hours to resolve the situation so that the organization could bring applications back online. During the 24 hours, they could not onboard or discharge patients. They couldn’t even fill prescriptions. The outage made local news coverage. It is important to note that the vendor fulfilled the obligation of their support contract, but the customer was still down for well over 24 hours.

When looking to make sure they don’t get caught in a similar situation in the future, the organization began researching purchasing two of the same all-flash array and replicating between them. Dual systems were beyond what the organization could afford and didn’t protect them from their other, potentially more significant concern, a ransomware attack.

Standby Storage as an Answer to Response Time vs. Return to Operations

StorONE’s S1:Backup is the only backup storage solution on the market that can fulfill the critical role of standby storage. Standby storage means it can “stand-in” for production storage when it is down due to a hardware or software fault, or if and when a ransomware attack compromises it. A standby storage solution needs to deliver production-class performance and data availability at backup storage prices. 

Standby Storage has several advantages over buying two production storage systems from the same vendor:

•    Significantly less expensive than buying duplicate systems

•    ONE “stand-in” for all production systems (VMware, databases, NAS, etc.)

•    Different Controllers – won’t be impacted by a faulty software upgrade by the production storage vendor

•    Resolves the issues relating to backup – faster, frequent protection, faster recoveries, and complete ransomware protection

The Advantages of Standby Storage

StorONE’s S1:Backup’s standby storage capability provides several advantages over the other alternative, buying two of every production storage system. First, while providing similar performance and availability, it is significantly less expensive than your typical production storage systems.

Second, the data center probably has multiple storage systems; one for virtualized environments, one for NAS, and one for databases. Most organizations have at least six different production storage systems from six vendors. Instead of buying six duplicate systems, S1:Backup’s standby feature can act as a stand-in for all your production workloads. It also is different software, which means a faulty controller software upgrade does not impact the StorONE virtual controller technology.

Third, while addressing the need for a standby storage solution, S1:Backup’s core mission is improving your backup infrastructure. S1:Backup can reduce recovery point objectives (RPO) and recovery time objectives (RTO) without replacing your backup-server software while also providing 100% protection from a ransomware attack.

And finally, S1:Backup is backup with a future. Unlike every other backup storage solution on the market, it can expand to support other use cases like archive, virtualized workloads, databases, and even analytics workloads. Using the same StorONE software and hardware controllers, it can support these additional workloads.

Join us for our live webinar, “Beat Ransomware With Standby Storage,” this Thursday at 11:00 AM ET / 8:00 AM PT to learn more about standby storage and ransomware protection. All attendees will receive an advanced copy of our latest whitepaper, “What is Standby Storage?”

response time vs. return to operations
Sign Up

Does Immutability Beat Ransomware

by

While many backup storage vendors now count on it almost exclusively, does immutability beat ransomware? The short answer is no. Making backup data immutable is not enough to beat ransomware. It is an important level of defense, but it is just one level of many required defenses. 

Beating ransomware requires:

1.    Immutability of the entire backup environment, not just the backup data

2.    Rapid Recovery to eliminate the temptation to pay the ransom

3.    A sterile environment that is 100% immune to the ransomware attack

4.    Protection of the backup storage environment from intrusion

Requirement 1: An Immutable Backup Environment

Storing the backup data in an immutable form is critical to recovery from ransomware. Still, suppose the backup metadata (indexes and configuration files) get encrypted. In that case, the time to rebuild the configuration and recreate the indexes (if possible) will significantly delay the start of the recovery process. Most backup storage vendors avoid offering immutability for the backup software metadata because their solutions can’t meet the performance demands of the backup software. And the customer is left to fend for themselves to protect and secure the backup metadata.

StorONE’s S1:Backup is built on our Enterprise Storage Platform. We protect your backup data and your backup software’s metadata. We can deliver the performance the backup software metadata requires. Thanks to its volume isolation technology, we can ensure that the performance of updating metadata will not impact the ingesting of actual backup data. 

Requirement 2: Rapid Recovery

Immutability protects your backup data while it is at rest, but at some point, you need to activate that data and restore it. One of the challenges when executing a ransomware recovery is that, unlike other disasters, there is another recovery option — pay the ransom. Paying the ransom rewards the attacker, exacerbating the problem. There is also no guarantee that they will give you the keys to your data. To remove even the temptation of paying the ransom, IT must recover data back into production quickly. Most modern backup software has an instant recovery feature which is the ability to instantiate a virtual machine (VM) or an application directly on the backup storage target. This feature should enable rapid return to operations, but most backup storage targets use hard drives exclusively and can’t deliver production VMs and applications’ performance. All-Flash backup storage targets sidestep the issue but make you pay dearly for it.

StorONE’s S1:Backup efficiently uses a small number of flash drives to speed up the ingestion rate, collapse consolidation windows, and ensure that instant recoveries are instant. The solution will dynamically reprovision some of the flash SSDs for recoveries. The patented algorithms that StorONE invented enable S1:Backup to deliver hundreds of thousands of IOPS from this small quantity of drives.

Requirement 3: A Sterile Recovery Environment

After targeting the backup environment, ransomware will then attack production data, encrypting it so you can’t access it. If you’ve ensured backup data immutability and somehow secured your backup metadata, you now have to restore into a production storage environment that is still infected. Even if your backup software product has instant recovery, you have to move that instantly recovered environment to production storage quickly. The pressure to recover quickly doesn’t provide you the time to make sure that you’ve removed all occurrences of the ransomware trigger file. There is a high likelihood that your recovery effort will be in vain since the remaining trigger files will soon re-encrypt the recovered data.

Immutability Beat Ransomware

StorONE’s S1:Backup delivers a sterile, production-class environment to which you can safely recover VMs or applications. You can either promote instantly recovered instances or directly restore your workloads to StorONE volumes. The S1:Backup then employs the full power of the StorONE Enterprise Storage Platform to deliver a highly available, high-performance environment with maximum data protection. StorONE will continue to store an immutable copy of data as it changes, protecting these recovered applications from any remaining ransomware trigger files. With S1:Backup, you get the benefit of time! The time to go through your environment and remove all remaining remnants of the attack before moving these applications back to their production storage systems.

Creating a Sterile Recovery Environment requires a backup storage solution you can elevate to Standby-Storage. To learn more about Standby-Storage, register for our webinar “Beat Ransomware with Standby Storage.”

Requirement 4: Intrusion Prevention

A final level of protection ensures that a bad actor or even a rouge employee can’t compromise the backup infrastructure. This type of attack is likely what made the Kronos recovery so difficult. Their IT team counted on their backups as they should, but they couldn’t access them when they went to use them.

StorONE’s S1:Backup provides two-factor authentication, making an outside infiltration more difficult. For the ultimate security, organizations can set immutable data to only be mutable after the retention period has passed, making even a rogue attack ineffective.

Conclusion

Ransomware isn’t the only threat to the data center. We still have to worry about natural disasters and other artificial problems, but preparing for a ransomware attack and making sure you can recover from it also prepares you to recover from any other challenge. Developing a Ransomware Protection and Recovery Plan is a worthy exercise, and every organization should go through it. If you’d like help architecting a plan, feel free to reach out to us, and we can guide you through the process with no obligation to buy StorONE.

Ransomware-proof Your Backups

by

The recent attack on Kronos proves that organizations need to ransomware-proof their backups. Kronos is a Human Resources and Workforce automation software provider. The company admits to becoming aware of a cyber-attack on December 11th and, as of January 12th, is not yet claiming complete restoration of their customer’s data.

Legacy Backup Storage: Exposed and Fragmented

While there are few details of the attack, available information suggests that the attacker started with infiltration of their backup software and then planted a ransomware trigger file to encrypt data throughout the organization. The organization could not access its backups to recover from the attack on the rest of the environment. The result is, at this point, a month-long recovery process.

IT should take three lessons away from this attack:

  1. Backup Data must be protected from cyber-attack
  2. Backup metadata must also be protected from cyber-attack
  3. You need a “clean” recovery target to act as standby storage after a cyber-attack

These lessons are new and should be considered enhancements to the steps we outlined in our white paper “A Three-Step Ransomware Recovery Guide.”

Ransomware-Proof Backup Data

The first lesson is that backup data itself must be immutable so that a ransomware attack can’t encrypt the same data you intend to use for recovery. The problem is, backup data does need to change, especially if you are using block-level incremental (BLI) or change-block tracking (CBT) backup techniques. The answer is to use immutable snapshots, capturing every version of every backup job and securing from a potential breach while not impacting backup ingest performance. StorONE’s S1:Backup provides complete immutability of every backup job across all protocols, and media types with infinite retention, without impacting performance.

Ransomware-Proof Backup Metadata

Ransomware-proof Your Backups
S1:Backup: Ransomware-Proof, Consolidated Backup, AND Recovery Storage

Backup-server software is a robust, IO demanding application. It also creates a lot of metadata (data about the protected data). Backup software stores this metadata in a series of index or database files. It enables the backup administrator to interface with the backup devices, scan for a specific version of files, and manage data retention. The performance demands of the backup software mean that IT needs to store metadata separately from the backup storage target, typically on production storage or on an array dedicated to the backup server software, further fragmenting the storage infrastructure.

If this data is somehow compromised, recovery may be impossible or, at a minimum, very time-consuming. The Kronos attack is proof that bad actors are targeting backup data in parallel to their attack on the rest of your environment. Protecting backup metadata is critical to recovery.

Again, the answer is storing this data in an immutable state, but, even more so than the backup storage target, this data needs to change, and it needs to be on storage that is very responsive to high-IO demands. Most production storage systems don’t provide immutability. Except for StorONE’s S1:Backup, most backup storage targets can’t meet backup software metadata’s IO demands.

S1:Backup solution is built on the StorONE Enterprise Storage Platform. That means that while it is priced competitively against typical backup storage targets, it also provides the performance and availability the backup application requires from a volume to store its metadata. That volume can also leverage our immutable snapshot technology to protect the backup software’s metadata from attack.

Ransomware-Proof Standby Storage

Another challenge that IT faces when recovering from a ransomware attack is deciding if it is safe to recover to production storage. IT needs to ensure that the ransomware trigger file and its replicants are removed from the environment. If one copy goes unnoticed, the organization may be in the same situation a few hours after recovery is complete.

In a perfect world, you’d have an exact copy of your current storage system, powered off and disconnected from the network. Few, if any, organizations can afford this level of redundancy and protection. Also, even this extreme level of redundancy won’t protect from the new system being compromised if the ransomware isn’t entirely eradicated.

StorONE’s S1:Backup solution is also Standby Storage, which means that it leverages our Enterprise Storage Platform to deliver production class performance, availability, data protection, and data integrity. The system is not sitting idle, waiting for a ransomware attack. It is working as backup storage and storing production backup metadata. All data is immutably protected via our snapshot technology.

IT can leverage the backup-server software’s instant recovery features during a ransomware recovery or recover directly to volumes on the S1:Backup infrastructure. IT can assure the organization that these volumes are “clean.” IT can also leverage the same immutable snapshot technology to protect and quickly recover these new production volumes if they miss one of the malware replicants.

To learn more about how StorONE’s S1:Backup and Standby storage can ensure complete and rapid ransomware recovery, register for our live webinar on January 27th at 11:00 am ET. We will send you an advanced copy of our latest white paper, “What is Standby Storage?”

Sign Up

A Cure for Ransomware Overload

by

The recent Log4j vulnerability is triggering a whole new round of “Get Ready for Ransomware” webinars and blogs, to the point that IT needs a cure for ransomware overload. While being ready for ransomware is critical, focusing on it exclusively is as dangerous as ignoring it. IT professionals will need to recover from ransomware at some point. They will also need to recover from a natural disaster, hardware failure, or accidental (or deliberate) user deletion of data. To meet these challenges, you probably don’t need to overhaul your data protection strategy, but you will need to enhance it.

Getting Back to Basics

Anytime you feel overwhelmed, the best thing to do is get back to the basics. Almost all data protection and disaster recovery strategies are based on the 3-2-1 data protection rule—three copies of data on two separate storage systems and one copy off-site. While the threats facing the modern data center and the increasing expectations for recovery require enhancing the 3-2-1 rule, it is an excellent tool for recentering your focus.

Curing Ransomware Overload with More Frequent Copies

The first part of the 3-2-1 rule deals with copies of data. First, you need at least three copies of production data. Most of those copies should be created by your backup software application. The enhancement required to protect against ransomware is that your backup storage target should store that data so an external force can’t alter it. It should be immutable.

Another enhancement to the 3-2-1 rule, caused by ransomware and increased recovery expectations, is that you need to execute backups more frequently than in the past. Instead of once a night, the goal should be to capture data multiple times a day and even multiple times an hour for active data sets. Most backup-server software solutions can capture block-level changes to data, making the network requirements for more frequent backups less demanding.

Cure ransomware overload and fix your DR storage problem
S1:Backup Flash-First Backup Improves RPO

However, the challenge with more frequent but smaller backup jobs is the IO demand on the legacy backup storage system may be more than it can sustain. Modern backup storage must have a flash front end that can sustain the IO demands of hundreds of simultaneous backup jobs with just a handful of flash drives. The increase in frequency not only helps you lower the impact of a ransomware attack it also improves your ability to recover, with minimal data loss, from a variety of failures.

Curing Ransomware Overload with Standby Storage

The second part of the 3-2-1 rule deals with the number of storage systems used in the protection process. The problem is the rule is not very particular on the capabilities of the target storage device. The primary focus is low cost. Since data protection is, in essence, an insurance policy, the policy can’t cost more than what you are insuring. In other words, your backup storage target can’t cost anything close to the cost of your production storage system.

However, the problem with only focusing on low cost is that you end up with a backup storage target that doesn’t add much value to your recovery effort. Modern backup-server software can recover and host data directly on the backup storage target. Still, if the performance of that legacy target is so bad that it is unusable, then there isn’t any value in the feature.

Modern backup storage targets need to provide production class performance and even go so far as to provide standby storage capabilities. If you have a modern backup storage target in a ransomware attack, you have a known clean storage system with clean data instantly available. Suppose the backup storage solution can provide this performance, plus high availability, media failure protection, and other enterprise features. In that case, it can elevate your “insurance policy” to a business continuance strategy protecting you not only from ransomware but also storage system failure.

You can learn more about elevating your backup infrastructure to a business continuance strategy by watching the replay of our webinar “The Four Steps to Elevate Backup into Business Continuance“

Protecting the Off-site Copy

The final aspect of the 3-2-1 rule is “one copy off-site.” Most backup-server software can replicate data to another storage device, and if they can’t, solutions like StorONE’s S1:Backup have the capability. In either case, it is even more valuable if the backup storage target at the disaster recovery (DR) site has standby storage capabilities. Imagine needing only one storage system in your DR site that can receive backup and replication jobs and also become production storage in the event of a disaster.

Keeping Backup Storage Cost-Effective

A cure for ransomware overload is to make sure your backup storage is cost-effective for years to come. While rapid recovery from a ransomware attack or another type of failure is critical, the backup infrastructure must remain affordable. Some vendors are suggesting that an all-flash backup device is the only viable ransomware recovery strategy, but considering the 10X price advantage of hard disk drives, all-flash backup isn’t practical. Modern backup storage targets need to balance rapid recovery with affordable long-term data protection.

Cure Ransomware Overload and get ready for the future
S1:Backup Can Mix Drives on the Same Volume

Affordability can be built into the rapid recovery effort by maximizing the performance of each flash drive used, thus reducing the total number of flash drives required. It can also be built into the hard disk tier using high-density 18/20TB HDDs with a meager cost per GB. However, backup storage targets need to address challenges associated with recovery from drive failure, and weeks of recovery are unacceptable. RAID rebuild times are more relevant than ever, and modern drive failure protection algorithms like StorONE’s vRAID can recover these high-density drives in less than three hours.

Conclusion

If you are focusing on just ransomware right now, you may need a cure for ransomware overload. Take a step back and apply the 3-2-1 backup strategy. All you need to do is add a few enhancements to the way you store backup data, and you’ve not only solved your ransomware overload but also protected yourself against many other types of disasters.

Learn More About the Hidden Cost of Dedupe

  • This field is for validation purposes and should be left unchanged.