Answering Your Ransomware Questions

When it comes to ransomware, it’s a matter of when, not if, an organization will be impacted. Effective cyber recovery requires a focus on protecting your assets and data, intelligence to understand when threats are present and what data is affected, and the ability to restore extremely large amounts of data as quickly as possible. Here are some commons questions about how to prepare for ransomware.

What are some best practices to implement ransomware prevention? 

Corporations should perform these essential steps to protect their employees and equipment from ransomware and malicious behaviors:

• Install regular software updates and patches, on both individual computers and IT equipment.
• Perform regular backups of all data, following the 3-2-1 approach:
  • Make 3 copies of the data,
  • On 2 different media types,
  • And 1 of those copies should be offsite and immutable, so it can’t be modified or deleted.
•  Limit user access to systems to reduce the risk of accidental or intentional modifications.

Commvault Cloud offers capabilities including role-based access control, auditing, integration with customer-owned authentication technologies like SAML, and encryption of all intra-service communications and data during transmission to securely handle customer data.

Additionally, all backup data is compressed, deduplicated, and encrypted by default from the source, on the network, and at rest. Compression and deduplication also obfuscate data, providing additional security if the backup storage is compromised. Learn more about the A-to-Z aspects of cyber resilience against ransomware.

What are some everyday prevention measures for IT to deliver to our employees to prevent attacks? 

Companies should educate their employees on the risks of ransomware and what to watch for in unsolicited emails and texts. Online training can be very effective to highlight examples.

From a personal level, learn what to look for and use precautions:

• Use multi-factor authentication to verify your identity at login.
• Apply appropriate email and endpoint security to screen out malware or phishing attempts.
• Carefully review links by hovering over them without clicking to confirm the URL is safe.

These are just the basics, and it’s important for each of us to do our part to protect ourselves and our organizations from being affected by an attack.

How can we proactively detect ransomware incidents within our organization? 

To identify ransomware proactively, you should implement threat detection tools as part of your environment’s defenses. Commvault turns the tables on attackers, applying advanced forensics and generative AI to accelerate threat detection and response. We start with our Zero-Trust Architecture, with key features such as multi-factor authentication, multi-person authorization, SAML, privilege access management, and role-based access controls. Commvault® Cloud includes intelligent monitoring and risk identification to deceive and flag threats early in the attack lifecycle, along with cyber deception for early warning into ransomware and malicious intent. Gain insights into trends and user behaviors to detect anomalies before they spread.

Can we detect ransomware attacks beyond the endpoint? 

With endpoint protection, businesses can implement comprehensive data backup and recovery protection for data at the edge. But it’s important to obtain insights throughout your SaaS and hybrid cloud environments. Without protection for SaaS data, applications, and endpoints, the risk of data loss or attacks such as corruption, accidental deletion, and malicious attack is substantial.

Be prepared to block ransomware with early detection and rapid response initiatives. Commvault provides intuitive tools and advanced insights so you can spot risks in real-time and limit exposure to ongoing cyberthreats. With our hardened, multi-layered approach to ransomware readiness, you’ll have robust controls to help prevent threats and enable data to be recoverable from a cyberattack. Using immutable, air-gapped data copies, advanced anomaly detection, and built-in encryption, Commvault Cloud gives you the tools to safeguard critical data across apps, endpoints, and hybrid cloud environments.

What do I do if I believe my system has been infected by ransomware? 

Isolate the issue to prevent it from spreading any further and begin forensic analysis as quickly as possible. Ideally, you want to set up a clean and safe location to assess the situation and minimize the impact to the organization.

Commvault Cloud® Cleanroom™ Recovery offers a cost-effective and flexible way to create a secure, isolated environment to recover your organization’s data and applications when a breach occurs. Cleanroom Recovery can be used to conduct forensic analysis of known infected systems and identify the root cause of an attack. It also can help reduce downtime and accelerate recovery with a streamlined process for testing, analyzing, and restoring both data and applications to get back to a production-capable environment.

How long does the recovery process take? 

One analysis found that 24 days was the average reported time to recover from a cyberattack in the United States in 2022. Recovering from a cyberattack typically requires forensic investigation and remediation to be completed first, which can delay the actual recovery of data and restoration of normal business activity. It’s important to verify that data is free from infection before it is released back into the production environment.

Cyber readiness requires a broader outlook on system and data recoverability across all your infrastructure and processes. The ability to respond and recover quickly depends on being prepared with an incident response plan and the appropriate platform that incorporates data protection, threat detection and prevention, and isolated environments for safe restoration. This shift is essential in today’s threat landscape, emphasizing recovery as well as protection and integrity.

To reduce the amount of time it takes to recover from ransomware, you’ll need to define your cyber resilience strategy. When you establish a thorough recovery plan, regularly test to verify that the plan works, and have confidence that you can successfully deploy it when needed, you’ll be able to respond to an attack and recover from it much faster.

Commvault’s Cloudburst Recovery capability can help you improve business continuity by using infrastructure-as-code to automate rapid and frictionless recovery of data, enabling mass recovery from cloud storage at scale with the highest speed possible. Through the breadth of the Commvault Cloud offerings, you can leverage unlimited scale, sophisticated layered security, and simple management to keep your organization protected now and in the future.

How do I best evaluate my current ransomware prevention strategy? 

Earlier this year, Commvault collaborated with GigaOm to conduct a survey on cyber recovery readiness and resilience with 1,000 security and IT leaders. This collaborative study offers a worldwide view into the challenges of cyber readiness postures and identifies effective strategies that you can use to enhance your recovery readiness plans.

To make things more actionable, we identified these 5 practices and capabilities that have an outsized impact on resilience. We call them the cyber readiness maturity markers, and as you can expect, the more you have, the more mature and prepared you are to respond to a ransomware incident.

Let’s step through each of these:

Security tools to enable early warning about risk, including insider risk.

First, early warning security tools are technologies and systems designed to detect potential cyber threats before they can cause significant harm. These tools aim to identify risks at the earliest possible stage, allowing organizations to respond proactively rather than reactively. Examples include intrusion detection systems, deception technology, intrusion prevention systems, security information and event management, user and entity behavior analytics, and endpoint detection and response.

A known-clean dark site or secondary system in place.

Second, it’s important to maintain an isolated, pre-configured, or dynamic recovery environment (such as a cleanroom) that remains unaffected by cyber incidents at the primary site. This secondary site can be quickly activated for continuous business and data integrity in a cyberattack or major failure. It enhances cyber resiliency by providing a secure failover option, minimizing downtime and complexities of failover.

An isolated environment to store an immutable copy of the data.

Third, you should maintain a separate, air gapped (that is, immutable and indelible) copy of your data – secured behind a third party’s infrastructure. The data remains unchanged and protected from cyber threats, including ransomware and malicious insider actions. It enhances data integrity and availability, providing a reliable recovery option in case of data corruption or loss.

Defined runbooks, roles, and processes for incident response.

Fourth, this is a crucial capability for a structured and efficient response to cyber incidents. Tested runbooks provide step-by-step instructions for handling various types of incidents, reducing confusion and response time. Clearly defined roles and processes are critical so that every team member knows their responsibilities, promoting coordinated efforts. This preparedness speeds up recovery and helps maintain operational continuity during and after cyber events.

Specific measures to show cyber recovery readiness and risk.

And last, but not least, establish metrics and tests that demonstrate your organization’s ability to recover from cyber incidents and assess associated risks. These measures, such as regular recovery drills and risk assessments, provide insight into the effectiveness of your recovery plans and identify potential vulnerabilities. They are essential for cyber resiliency.

Are you ready to build your cyber recovery plan? 

This is how you can be ready to recover from ransomware. Being ready for recovery means your teams have the confidence and the ability to quickly recover all data and applications across your environment, including physical servers, virtual machines, and your various cloud platforms. If you’re interested in seeing the full Cyber Recovery Readiness Report, you can download the PDF.

Ready to learn more about the Commvault Cloud platform? Request a demo to see it in action and discover how you can respond to ransomware.