Close this search box.

Thinking Strategically About Ransomware Recovery

The author

Sponsored Post: Joel Reich, Board Member, Nasuni

The menace of ransomware is driving increased security spending, as organizations try to harden their systems against potential attacks. But ransomware is a new kind of threat. You can’t simply deploy tools to defend against the malware—you have to design your infrastructure for recovery.

There are two reasons for this. First, there’s an element of inevitability to ransomware. You can use the best security tools and software, educate your users, and institute best practices, but if you’re part of a large or global enterprise, hackers will find a way to get their malware through your perimeter. So, you need to design for recovery because you will, in all likelihood, suffer an attack.

The second reason is that recovery can be painful if you don’t plan ahead. Imagine ransomware strikes one of your locations, then spreads to a handful of other sites. Even if you have a solid backup strategy that allows you to restore previous, unencrypted versions of the impacted files, recovering that data can take days or weeks. The business downtime may prove more costlier than the ransom.

To defend your organization against ransomware, and ensure that you’re not left holding the bag in the aftermath of a disaster, you need an overarching strategy and testable plan that allows you to rapidly detect and quickly recover from an attack.

On one level, ransomware is a people problem. The malware often finds its way into organizations because someone clicks on the wrong link or downloads the wrong file. What we need to do is make people—IT and security leaders—a valued part of the solution as well, by encouraging more high-level strategic thinking and planning around designing for recovery.

As you design your ransomware recovery strategy, there are a number of important questions to ask:

  • What tools do we already have at our disposal?
  • Is our file infrastructure team aligned with InfoSec on ransomware?
  • Have we mapped out the implications of multiple attack scenarios?
  • Are employees sufficiently and consistently trained and educated?
  • Do we have a detection and alert system in place?
  • How quickly will we be able to quarantine the malware?
  • What happens if the attack is distributed across multiple sites? Will that alter our recovery timeline?
  • Will our RPOs be good enough for the business?
  • Will we be able to provide a recovery timeline to business users?

These are just a few of the questions to address. Ideally, you want a plan you can test regularly, to provide a sense of how it will perform, and what everyone on your team will need to do, in the event of a real attack.

The larger point is that you need to engage in this kind of strategic planning, then search out new technologies or process improvements to eliminate or at least mitigate any weak points, to optimize your ransomware recovery.

Extending Ransomware Recovery to the Cloud

Shifting infrastructure to the cloud presents its own challenges. The cloud delivers some transformative capabilities, and it’s changing infrastructure as we know it, but the cloud isn’t perfectly secure. There’s still a bit of a “Wild West” element to the space.

The cloud gives you an advantage relative to traditional data silos, but it also gives attackers a larger playing field. Industry experts talk about how moving so much unstructured data to the cloud presents a bright, shiny target for hackers, especially if your permissions in the cloud are the same as your permissions in the enterprise.

In short, the cloud itself doesn’t give you a free pass. You need to think about a number of factors, including where your metadata is stored, if your solution makes immutable copies of the data, and whether you’re protecting data on its way to and from the cloud.

Ransomware Protection & Recovery with Nasuni

The Nasuni approach to this challenge is comprehensive. Its platform does a lot of this work for you by offering infrastructure that performs at local speeds, but with the cloud holding the “gold copies” of your data. 

Nasuni continuously snapshots data to the cloud and maintains a complete versioned history of every file in object storage. Data is stored as immutable objects, so when local files are impacted by an attack, you can quickly point back to previous, clean versions in the cloud. Since Nasuni doesn’t require mass movement of data, the platform is capable of restoring millions of files in minutes.

Earlier this year, Nasuni released a Ransomware Protection add-on service that monitors internal activity for suspicious files and behaviors. The system is designed to shorten the overall time to recovery down to just minutes whenever possible. It starts by automatically alerting administrators once a pattern emerges.

IT can then dive deeper and quarantine users, machines, and locations as needed to stop the spread of the malware. It reports out files that are impacted and shows administrators the last clean snapshot for those files. 

Last but not least, it provides a detailed report of the attack that administrators and their infosec partners can analyze as part of the ransomware learning curve.

These features align with a design-for-recovery strategy, but the technology also frees up time for IT to engage in the kind of strategic ransomware planning necessary these days.

Ransomware protection can feel overwhelming, but if you think you don’t have the manpower to devote someone to ransomware defense, think again. Nasuni customers are able to discontinue dedicating personnel to backup processes and licenses, because the solution takes care of data protection automatically. 

This turns into a major cost-saving benefit, but it also means they don’t need to dedicate individuals and teams to managing those backups. The IT expert who’d been overseeing tapes can be re-tasked with strategic ransomware defense planning.

Adopting a Ransomware Mindset

The years have seen massive shifts in how we store and protect enterprise file data, and still, this ransomware threat is different. It’s not going away, and if you want to protect your organization, you can’t simply rely on a set-it-and-forget-it approach to security. You need to adopt a ransomware mindset, and that starts with designing your infrastructure not just for resilience, but for recovery.

This Article Is Sponsored by Nasuni

Sign Up For Our Newsletter

Don’t worry, we hate spam too!

Get The Latest On Ransomware Right In Your Inbox

Sign Up To Receive Our Monthly Ransomware Newsletter
Don’t worry, we hate spam too

Is This Your Business?
Get In Touch

Contact Us To Sponsor Your Business Listing & Learn More About The Benfits.

Before You Go!
Sign up to stay up to date with everything ransomware

Sign Up To Receive Our Monthly Ransomware Newsletter
Don’t worry, we hate spam too

JUST RELEASED: The 2024 State of Ransomware Survey is in.


Share via
Copy link
Powered by Social Snap