Recovery: The Ultimate Line of Defense Against Ransomware
Ransomware is not only the most prevalent threat to downtime and data loss, but the frequency and severity of attacks continue to increase. Every organization, from the board level to the most basic of system users, needs to be actively defending against ransomware. There are many lines of defense, some of which your organization already has. Let’s explore how ransomware recovery from Zerto, a Hewlett Packard Enterprise company, can be your ultimate line of defense against ransomware.
Awareness and Education
Being aware of the threat of ransomware is your first line of defense. Criminals make ransomware attacks; therefore, there are no rules governing how they may infiltrate and attack your systems. Every device user in your organization is a target for attackers to obtain credentials, infiltrate, and spread malware within your system. Every user needs to be educated on security best practices to avoid common mistakes like navigating to malicious websites or clicking on suspicious attachments in phishing emails.
Cyberattacks like ransomware are becoming more sophisticated in targeting systems and users. With even one user becoming compromised, attackers can use that user account to attack other users within internal systems, spreading the malware more easily once they control what others view as a trusted user. The more credentials that get compromised, the more access attackers may have to critical data and applications. Awareness and knowledge can help stop attacks before they even happen.
Detection and Prevention
Likely your organization already has some anti-malware tools scanning incoming files, emails, and other types of communication to detect and prevent malicious files from entering your system. This is another crucial line of defense, along with security measures like next-generation firewalls to lower your attack surface area. These are essential tools to keep malware out of your system and are particularly good at spotting known threats. For unknown threats, some types of anomaly detection solutions try to detect the unknown, particularly changes in files that may indicate that a ransomware attack is underway.
Detection and prevention are important to have in place, but they will not always protect you from the human factor that is the most vulnerable part of your defense. Even with training and knowledge of cyberattacks, users can still make an error compromising their credentials and account, thus compromising your data and systems. It is not a matter of if an attack will happen, but when and how often. Detection and prevention may not stop all attacks, but they can mitigate the risk, frequency, and severity of attacks.
Backups and Snapshots
Backups and snapshots are the tried and true defense against disaster if you are willing to tolerate downtime and data loss. Backups and snapshots play an important role in ransomware defense because they are the last line of defense if all else fails. But ransomware attackers know their victims may recover from a backup or snapshot rather than pay a ransom, so they often target backup/snapshot systems as part of the attack, either deleting or encrypting the backups/snapshots. Luckily, many solutions now have options to protect backups and snapshots with immutability.
The problem with relying on backups and snapshots is the frequency of when they are taken, which is often many hours apart, and this leads to significant data loss if you must recover your critical data. The recovery time can also be an issue moving the data back onto production storage so users and applications can access it. This is why backups and snapshots should only be a last line of defense against ransomware.
The Ultimate Line of Defense: Recovery with Zerto
Your organization will inevitably get hit by a ransomware attack. Attackers want you to experience enough downtime and data loss to justify paying the ransom. Disrupting your operations costs you more than the lost hours and data. It can cost you reputational damage to your brand, lost customers, litigation, or fines. Zerto helps you prevent the downtime and data loss attackers count on to make you pay.
Zerto protects you from ransomware in three primary ways:
- Recovering to a data point seconds before the attack
- Bringing applications and data back online within minutes
- De-risking recovery with non-disruptive testing
With continuous data protection technology, Zerto is protecting data and applications in real-time, near-synchronously, to our recovery journal. Zerto creates recovery checkpoints every few seconds, coordinating across multiple VMs to create consistent checkpoints for applications. Zerto continuous data protection can be used over any distance, between sites, different hypervisors, and to various supported cloud platforms.
When a ransomware attack strikes, whether it affects a group of files, a group of VMs, an entire site, or multiple sites, Zerto orchestration and automation can recover the data and applications at any scale you need within minutes. Zerto protection across multiple platforms and the ability to protect to more than one platform simultaneously adds added protection against attacks that target specific platforms or have only compromised credentials on specific platforms.
Zerto nearly eliminates data loss by allowing recovery to a point seconds before data was encrypted by ransomware. The continuous data protection journal Zerto uses contains hundreds or thousands of checkpoints to enable you to choose the precise point in time you want to recover from where you know the data is in a good state.
Despite practically eliminating the downtime and data loss that organizations would experience using backup/snapshots only, Zerto offers an even more compelling feature for ransomware protection: non-disruptive testing. For ransomware attacks, Zerto’s non-disruptive testing serves two roles. First, it assures recovery will work when needed by regularly testing recovery without disrupting production applications. It does this by recovering in an isolated network for testing while producing an automated recovery test report. Secondly, this recovery into an isolated network is ideal for ransomware recovery so that recovered data can be checked for existing malware or other compromised elements before recovering it to production.
On top of all these features, Zerto also offers immutable data copies from the journal. So, even in the catastrophic event that all of your Zerto systems are compromised by an attack, the immutable data copies can be used to quickly recover with near-zero data loss by reinstalling Zerto. All of these features combined mean that you can recover your organization’s applications and data as quickly as possible with the least data loss and with assured, tested recovery.
Ransomware will continue to be a threat for the foreseeable future. Still, with a well-planned defense, including Zerto as the ultimate line of defense, your organization can be back up and running quickly without needing to pay a ransom. Don’t be fooled by other solutions based on traditional backup schedules leading to hours of data loss and even longer recovery times.
Get hands on with Zerto for ransomware recovery with our free on-demand labs or try Zerto in your own environment with our Get out of Ransomware Jail offer to protect 10 VMs.
David Paquette 
