How to Build Better Backups for Reduced Ransomware Risk

From the perspective of a hacker, the past 18 months have been nearly perfect. First, staff moved from uniform corporate networks to uneven in-home connections, while IT teams struggled to close security gaps. Now, many employees are headed back to the office part time, leading to the creation of an entirely new set of networking and connection challenges that put corporate assets at risk.

The result? Ransomware is on the rise. As noted by Computer Weekly, the first six months of 2021 saw a 93 percent increase in attacks compared with the same period in 2020. Hacker groups are also broadening their targets. From the spring attack on Colonial Pipeline to the more recent compromise at Howard University, the potential damage posed by ransomware has led to significant operational interruptions as organizations look minimize overall impact.

To effectively combat ransomware, businesses need a strategy that starts as close to their data as possible to deliver protection before, during and after an attack.

In other words, better ransomware defense begins with backups. 

Ransomware’s Four-Point Problem

Andrew Stone, CTO of industry-leading solution provider Pure Storage, notes that “ransomware is now a huge revenue-stream business.” This creates an increasingly active market that puts companies under pressure from both low-skilled attackers who have purchased Software as a Service ransomware packages in the hopes of making easy money and more sophisticated attackers looking to try out new tactics.

DISCOVER: Dive deeper into these new security tactics with Pure Storage.

For Stone, this creates a four-point problem: 

• Initial encryption. Data encryption prevents access to data, but it comes with the risk of total loss if the decryption tool provided doesn’t work.
• Data exfiltration. This is the most common ransomware worry: Attackers exfiltrate key information and threaten its release if they aren’t paid.
• Media services. Stone notes that in some cases, attackers will also threaten to reveal breaches to the media if payment isn’t forthcoming.
• It’s also possible that attackers will sell intellectual property or operational data to your competitors.

It’s worth noting, Stone says, that despite their role as extortion experts, most ransomware groups will try to honor the agreements they make with businesses. “A lot of them don’t want to violate the terms that they set forth. They don’t want to go against that because others won’t pay.”

Pure Storage Helps Before, During and After an Attack

For Stone, effective protection starts with position. “Putting protection close to the data is key,” he says. In practice, this means that storage isn’t just about backup. Instead, “it’s about protecting companies before, during and after an attack.”

Before an attack happens, “companies should focus on logging,” says Stone. “You need to log everything — don’t be strategic. If you only log the top 10 percent of your perceived risks, bad guys have a better chance of hitting the 90 percent.”

Pure Storage can help solve this challenge with FlashArray block storage and FlashBlade, the industry’s first fast file and object storage. These platforms let businesses build a scalable, pooled instance for both “hot” and “warm” data so these logs are usable. They offer a linearly extensible format with the capacity to search for specific events or to layer on analytics tools.

During an attack, Pure Storage can help with SafeMode, which prevents data from being deleted.

Click the banner below to dig deeper into cloud security guidance from CDW.