Security

Review: Ransomware Investigation Platform Fortifies Defenses in Depth

This recovery tool keeps watch over protected networks and speeds recovery following a ransomware attack.

Twitter

John Breeden II is an award-winning reviewer and public speaker with 20 years of experience covering technology.

Ransomware is one of the most dangerous cyberthreats operating today. Many organizations are specifically targeted, either because criminals assume they can ask for a lot of money or because of a higher possibility for payment. Among those targeted groups, healthcare organizations are near the top of the list.

Companies such as Rubrik are pioneering defenses against ransomware. A combination of frontline protections and immutable backup systems that are safe from external state changes create a defense in depth, which monitors for anomalies in data and helps to quickly recover should an attack land successfully.

In healthcare, any downtime is unacceptable. If a hospital can recover all of its corrupted data, but it takes weeks to do so, that is still a large disruption. To compensate, Rubrik created the Ransomware Investigation platform, which is designed to keep administrators apprised of the state of their storage and backup deployments, and to restore more quickly everything that has been corrupted should an attack make it past other defenses.

Click the banner for access to exclusive HealthTech content and a customized experience.

Ransomware Investigation Powered by Machine Learning

The Ransomware Investigation platform is extremely advanced and intelligent, using machine learning to watch over an organization’s data and storage. Over time, it creates a baseline of behavior that is unique to every organization. Thereafter, it can analyze elements such as file properties, change rate, content type and entropy changes to files.

If it spots an anomaly, it will alert users about any indications of an attack getting through to other defenses. All of that processing is conducted within the cloud, so there is no impact on the local network.

DIVE DEEPER: Discover why layered security is essential to health systems' incident response planning.

A Quick Response to Ransomware Attacks

Restoration in response to a limited attack can take time. But with Ransomware Investigation, once an attack is confirmed, it can show administrators exactly what files have been compromised and how the attack was able to penetrate other defenses. This allows administrators to shore up their security and enables targeted restoration.

Instead of restoring everything — potentially, terabytes of information — only the files that were corrupted need to be replaced. That can cut down the time required to return to full operations from days or weeks to just a few hours.

Ransomware Investigation is a powerful tool that acts as a force multiplier for other defenses. That’s great news in healthcare, where protection is paramount for supporting patient care.

SPECIFICATIONS

PRODUCT TYPE: Ransomware recovery platform
DEPLOYMENT TYPE: Core components operate within the cloud
THREATS MITIGATED: Ransomware, or anything else that corrupts or erases data
KEY FEATURES: Anomaly detection and automated recovery
ADDITIONAL CAPABILITY: Can be used for post-breach analysis to see what went wrong

Saving Time and Lives in Healthcare With a Ransomware Investigation Platform

One of the key features of Rubrik’s Ransomware Investigation platform is the ability to tactically restore data corrupted during an attack.

Having data backed up, especially in an immutable format like Rubrik offers, is a perfect last line of defense against ransomware. That way, even if an attacker breaches a security perimeter and encrypts files, victims have an option to restore everything instead of paying a ransom to get their data back.

The problem with that strategy is that backup and restore processes can take a long time. Depending on the technology used and the transport protocols involved (for instance, if the backup or restore process must run through the internet) it might take days to restore 100 gigabytes of data, and weeks or more for a couple terabytes’ worth of files.

That is one reason why Rubrik Ransomware Investigation is such a powerful tool. It allows for targeted restoration of corrupted data while ignoring everything else.

To see how this might affect operations, the platform was put to the test with 20GB of backup data. That is admittedly a small network, and a restoration process running at an average of 5 megabytes per second is pretty good. But it showed on average how much time can be saved by using the Ransomware Investigation tool.

In the first test, several systems on the test network were corrupted with simulated ransomware. Without knowing what data was affected, the test involved restoring the entire backup pool. That process took one hour and 10 minutes. Had this been a backup restoring data over the internet or from the cloud, it probably would have taken about two days.

In the second scenario, the same systems were corrupted, but Ransomware Investigation was used to pinpoint the affected data. Armed with that information, the test was able to restore the affected data and systems in under two minutes — 97 percent faster than the first backup.

On a larger network, Rubrik Ransomware Investigation would have enabled us to restore affected data in hours instead of days or even weeks. That speedy response would not only protect lives in healthcare, but also keep hospitals running without taking a major financial hit following a ransomware attack.