{"id":530229,"date":"2024-10-24T09:00:00","date_gmt":"2024-10-24T13:00:00","guid":{"rendered":"https:\/\/www.commvault.com\/?p=530229"},"modified":"2024-10-24T12:21:20","modified_gmt":"2024-10-24T16:21:20","slug":"answering-your-ransomware-questions","status":"publish","type":"post","link":"https:\/\/www.commvault.com\/blogs\/answering-your-ransomware-questions","title":{"rendered":"Answering Your Ransomware Questions"},"content":{"rendered":"\n
When it comes to\u00a0ransomware<\/a>, it\u2019s a matter of when, not if, an organization will be impacted. Effective cyber recovery requires a focus on protecting your assets and data, intelligence to understand when threats are present and what data is affected, and the ability to restore extremely large amounts of data as quickly as possible. Here are some commons questions about how to prepare for ransomware.<\/p>\n\n\n\n Corporations should perform these essential steps to protect their employees and equipment from ransomware and malicious behaviors:<\/p>\n\n\n\n Commvault Cloud<\/a>\u00a0offers capabilities\u00a0including role-based access control, auditing, integration with customer-owned authentication technologies\u00a0like SAML, and encryption of all intra-service communications and data during transmission to securely handle customer data.<\/p>\n\n\n\n Additionally, all backup data is compressed, deduplicated, and encrypted by default from the source, on the\u00a0network, and at rest. Compression and deduplication also obfuscate data, providing additional security if the backup\u00a0storage is compromised. Learn more about the\u00a0A-to-Z aspects of cyber resilience against ransomware<\/a>.<\/p>\n\n\n\n Companies should educate their employees on the risks of ransomware and what to watch for in unsolicited emails and texts. Online training can be very effective to highlight examples.<\/p>\n\n\n\n From a personal level, learn what to look for and use precautions:<\/p>\n\n\n\n These are just the basics, and it\u2019s important for each of us to do our part to protect ourselves and our organizations from being affected by an attack.<\/p>\n\n\n\n To identify ransomware proactively, you should implement threat detection tools as part of your environment\u2019s defenses. Commvault turns the tables on attackers, applying advanced forensics and generative AI to accelerate threat detection and response. We start with our Zero-Trust Architecture, with key features such as multi-factor authentication, multi-person authorization, SAML, privilege access management, and role-based access controls. Commvault\u00ae Cloud includes intelligent monitoring and risk identification to deceive and flag threats early in the attack lifecycle, along with cyber deception for early warning into ransomware and malicious intent. Gain insights into trends and user behaviors to detect anomalies before they spread.<\/p>\n\n\n\n With endpoint protection, businesses can implement comprehensive data backup and recovery protection for data at the edge. But it\u2019s important to obtain insights throughout your SaaS and hybrid cloud environments. Without protection for SaaS data, applications, and endpoints, the risk of data loss or attacks such as corruption, accidental deletion, and malicious attack is substantial.<\/p>\n\n\n\n Be prepared to block ransomware with early detection and rapid response initiatives. Commvault provides intuitive tools and advanced insights so you can spot risks in real-time and limit exposure to ongoing cyberthreats. With our hardened, multi-layered approach to ransomware readiness, you\u2019ll have robust controls to help prevent threats and enable data to be recoverable from a cyberattack. Using immutable, air-gapped data copies, advanced anomaly detection, and built-in encryption, Commvault Cloud gives you the tools to safeguard critical data across apps, endpoints, and hybrid cloud environments.<\/p>\n\n\n\n Isolate the issue to prevent it from spreading any further and begin forensic analysis as quickly as possible. Ideally, you want to set up a clean and safe location to assess the situation and minimize the impact to the organization.<\/p>\n\n\n\n Commvault Cloud\u00ae Cleanroom\u2122 Recovery<\/a>\u00a0offers a cost-effective and flexible way to create a secure, isolated environment to recover your organization\u2019s data and applications when a breach occurs. Cleanroom Recovery can be used to conduct forensic analysis of known infected systems and identify the root cause of an attack. It also can help reduce downtime and accelerate recovery with a streamlined process for testing, analyzing, and restoring both data and applications to get back to a production-capable environment.<\/p>\n\n\n\n One\u00a0analysis<\/a>\u00a0found that\u00a024 days<\/strong>\u00a0was the average reported time to recover from a cyberattack in the United States in 2022. Recovering from a cyberattack typically requires forensic investigation and remediation to be completed first, which can delay the actual recovery of data and restoration of normal business activity. It\u2019s important to verify that data is free from infection before it is released back into the production environment.<\/p>\n\n\n\n Cyber readiness requires a broader outlook on system and data recoverability across all your infrastructure and processes. The ability to respond and recover quickly depends on being prepared with an incident response plan and the appropriate platform that incorporates data protection, threat detection and prevention, and isolated environments for safe restoration. This shift is essential in today\u2019s threat landscape, emphasizing recovery as well as protection and integrity.<\/p>\n\n\n\n To reduce the amount of time it takes to\u00a0recover from ransomware<\/a>, you\u2019ll need to define your cyber resilience strategy. When you establish a thorough recovery plan, regularly test to verify that the plan works, and have confidence that you can successfully deploy it when needed, you\u2019ll be able to respond to an attack and recover from it much faster.<\/p>\n\n\n\n Commvault\u2019s\u00a0Cloudburst Recovery<\/a>\u00a0capability can help you improve business continuity by using infrastructure-as-code to automate rapid and frictionless recovery of data, enabling mass recovery from cloud storage at scale with the highest speed possible. Through the breadth of the Commvault Cloud offerings, you can leverage unlimited scale, sophisticated layered security, and simple management to keep your organization protected now and in the future.<\/p>\n\n\n\n Earlier this year,\u00a0Commvault collaborated with GigaOm<\/a>\u00a0to conduct a survey on cyber recovery readiness and resilience with 1,000 security and IT leaders.\u00a0This collaborative study offers a worldwide view into the challenges of cyber readiness postures and identifies effective strategies that you can use to enhance your recovery readiness plans.<\/p>\n\n\n\n To make things more actionable, we identified these 5 practices and capabilities that have an outsized impact on resilience. We call them the cyber readiness maturity markers, and as you can expect, the more you have, the more mature and prepared you are to respond to a ransomware incident.<\/p>\n\n\n\n First, early warning security tools are technologies and systems designed to detect potential cyber threats before they can cause significant harm. These tools aim to identify risks at the earliest possible stage, allowing organizations to respond proactively rather than reactively. Examples include intrusion detection systems, deception technology, intrusion prevention systems, security information and event management, user and entity behavior analytics, and endpoint detection and response.<\/p>\n\n\n\n Second, it\u2019s important to maintain an isolated, pre-configured, or dynamic recovery environment (such as a cleanroom) that remains unaffected by cyber incidents at the primary site. This secondary site can be quickly activated for continuous business and data integrity in a cyberattack or major failure. It enhances cyber resiliency by providing a secure failover option, minimizing downtime and complexities of failover.<\/p>\n\n\n\n Third, you should maintain a separate, air gapped (that is, immutable and indelible) copy of your data \u2013 secured behind a third party\u2019s infrastructure. The data remains unchanged and protected from cyber threats, including ransomware and malicious insider actions. It enhances data integrity and availability, providing a reliable recovery option in case of data corruption or loss.<\/p>\n\n\n\n Fourth, this is a crucial capability for a structured and efficient response to cyber incidents. Tested runbooks provide step-by-step instructions for handling various types of incidents, reducing confusion and response time. Clearly defined roles and processes are critical so that every team member knows their responsibilities, promoting coordinated efforts. This preparedness speeds up recovery and helps maintain operational continuity during and after cyber events.<\/p>\n\n\n\n And last, but not least, establish metrics and tests that demonstrate your organization\u2019s ability to recover from cyber incidents and assess associated risks. These measures, such as regular recovery drills and risk assessments, provide insight into the effectiveness of your recovery plans and identify potential vulnerabilities. They are essential for cyber resiliency.<\/p>\n\n\n\n This is how you can be ready to recover from ransomware. Being ready for recovery means your teams have the confidence and the ability to quickly recover all data and applications across your environment, including physical servers, virtual machines, and your various cloud platforms. If you\u2019re interested in seeing the full Cyber Recovery Readiness Report, you can\u00a0download the PDF<\/a>.<\/p>\n\n\n\nWhat are some best practices to implement ransomware prevention?\u00a0<\/h4>\n\n\n\n
\n
\n
What are some everyday prevention measures for IT to deliver to our employees to prevent attacks?\u00a0<\/h4>\n\n\n\n
\n
How can we proactively detect ransomware incidents within our organization?\u00a0<\/h4>\n\n\n\n
Can we detect ransomware attacks beyond the endpoint?\u00a0<\/h4>\n\n\n\n
What do I do if I believe my system has been infected by ransomware?\u00a0<\/h4>\n\n\n\n
How long does the recovery process take?\u00a0<\/h4>\n\n\n\n
How do I best evaluate my current ransomware prevention strategy?\u00a0<\/h4>\n\n\n\n
Let\u2019s step through each of these:<\/h5>\n\n\n\n
Security tools to enable early warning about risk, including insider risk.<\/h6>\n\n\n\n
A known-clean dark site or secondary system in place.<\/h6>\n\n\n\n
An isolated environment to store an immutable copy of the data.<\/h6>\n\n\n\n
Defined runbooks, roles, and processes for incident response.<\/h6>\n\n\n\n
Specific measures to show cyber recovery readiness and risk.<\/h6>\n\n\n\n
Are you ready to build your cyber recovery plan?\u00a0<\/h4>\n\n\n\n