I. Ransomware has become a major global cyber threat

Ransomware is essentially a malware attack that encrypts and steals important data, rendering computers or specific files unusable or unreadable; only if the victim pays the ransom is it possible to obtain the key to restore the computer or decrypt the encrypted files. In recent years, the number of ransomware attacks has doubled, and they are extremely stealthy, with many variants and rapid changes, and more diverse targets. Ordinary anti-virus software generally cannot quickly identify and kill them, and it has become the most popular topic of network threats.
Six major trends in ransomware attacks:

II. Solution Architecture

Dual anti-ransomware from primary storage domain to backup domain
In order to avoid ransomware, in addition to network layer security protection solutions, professional storage also needs to have anti-ransomware capabilities. Huawei storage provides a high-security protection solution from primary storage to backup to ensure the safe operation of enterprises.
▪ Anti-ransomware for primary storage: When data enters production storage, through the storage's own security snapshot/WORM and other capabilities, a clean area is established inside the device to ensure that data is protected from tampering and deletion. A separate physically isolated area can also be established, and the data is copied to the isolated area through Air Gap automatic shutdown control to form a more secure protection effect.

▪ Anti-ransomware backup: In addition to the anti-ransomware capabilities of the primary storage itself, we also provide anti-ransomware capabilities on the backup storage. The encryption, security snapshot/WORM, etc. of the backup storage ensure the cleanliness of the data inside the storage. By establishing an isolation zone, data security is guaranteed, so that we can quickly restore secure data when we are attacked by ransomware, ensuring the normal operation of the enterprise.

III. Solution Value

The storage anti-ransomware solution covers the application scenarios of SAN storage, NAS storage and backup storage. Through key technologies such as storage encryption, Air Gap, and security snapshot/WORM, it can realize data anti-tampering, data security detection, and data security recovery.

End-to-end data encryption
● NFS, CIFS/SMB protocols, support protocol layer encryption.
● Production and backup data support encrypted storage.
● AIR GAP replication supports encrypted transmission.
● Data and backup copies are remotely replicated with encrypted transmission.

AIR GAP replication
By setting the AIR GAP replication SLA, copies are automatically and periodically copied from production/backup storage to the isolated environment for storage. During non-replication periods, the replication link is disconnected and the copy is in an "offline state", reducing the possibility of being attacked.

Data anti-tampering and anti-deletion
● The WORM file system can set a protection period for production/backup data to prevent any modification and deletion operations on the data during the protection period.
● Security snapshot: On the basis of the read-only snapshot, snapshot anti-deletion is implemented, and a protection period can be set. Snapshots cannot be deleted and data cannot be modified during the protection period.

Ransomware detection
● Establish a baseline model based on historical data to determine whether the change characteristic value of the copy metadata is abnormal.
● For abnormal copies, compare the snapshot copy data before and after to calculate the file size change, entropy, similarity, etc.
● Use a machine learning model to determine whether the file change is caused by ransomware encryption, and mark it as ransomware encryption.