Designing for Recovery: Infrastructure in the Age of Ransomware

Originally published by Nasuni.

Written by Joel Reich, Nasuni.

The menace of ransomware is driving increased security spending as organizations try to harden their systems against potential attacks, but ransomware is a new kind of threat. You can’t simply deploy tools to defend against the malware. You have to design your infrastructure for recovery.

I say this for two reasons. First, there’s an element of inevitability to ransomware. You can use the best security tools and software, educate your users, and institute best practices, but if you’re part of a large or global enterprise, hackers will find a way to get their malware through your perimeter. So, you need to design for recovery because you will, in all likelihood, suffer an attack.

The second reason is that recovery can be painful if you don’t plan ahead. Imagine ransomware strikes one of your locations, then spreads to a handful of other sites. Even if you have a solid backup strategy that allows you to restore previous, unencrypted versions of the impacted files, recovering that data can take days or weeks. The business downtime may prove more costly than the ransom.

To defend your organization against ransomware, and ensure that you’re not left holding the bag in the aftermath of a disaster, you need an overarching strategy and testable plan that allows you to rapidly detect and quickly recover from an attack.

Strategic Ransomware Recovery Planning

On one level, ransomware is a people problem. The malware often finds its way into organizations because someone clicks on the wrong link or downloads the wrong file. What we need to do is make people — IT and Security leaders — a valued part of the solution as well, by encouraging more high-level strategic thinking and planning around designing for recovery.

As you design your ransomware recovery strategy, you’ll want to ask:

• What tools do we already have at our disposal?
• Is our file infrastructure team aligned with InfoSec on ransomware?
• Have we mapped out the implications of multiple attack scenarios?
• Are employees sufficiently and consistently trained and educated?
• Do we have a detection and alert system in place?
• How quickly will we be able to quarantine the malware?
• What happens if the attack is distributed across multiple sites? Will that alter our recovery timeline?
• Will our RPOs be good enough for the business?
• Will we be able to provide a recovery timeline to business users?

These are just a few of the questions you’ll want to address. Ideally, you want to have a plan that you can test regularly, too, so you have a good sense of how it will perform, and what everyone on your team will need to do, in the event of a real attack. But my larger point here is that you need to engage in this kind of strategic planning, then search out new technologies or process improvements to eliminate or at least mitigate any weak points, to optimize your ransomware recovery.

Extending Ransomware Recovery to the Cloud

Shifting infrastructure to the cloud presents its own challenges. Let’s be honest. The cloud delivers some transformative capabilities, and it’s changing infrastructure as we know it, but the cloud isn’t perfectly secure. There’s still a bit of a wild west element to the space.

The cloud gives you an advantage relative to traditional data silos, but it also gives attackers a larger playing field. I’ve been hearing industry experts talk about how moving so much unstructured data to the cloud presents a bright, shiny target for hackers, especially if your permissions in the cloud are the same as your permissions in the enterprise. In short, the cloud itself doesn’t give you a free pass. You need to think about a number of factors including where your meta data is stored, does your solution make immutable copies of the data, and are you protecting data on its way to and from the cloud?

Adopting a Ransomware Mindset

I’ve been in the storage business for many years and worked through massive shifts in how we store and protect enterprise file data. This ransomware threat is different. It’s not going away, and if you want to protect your organization, you can’t simply rely on a set-it-and-forget-it approach to security. You need to adopt a ransomware mindset — and that starts with designing your infrastructure not just for resilience, but for recovery.