Understanding Zero Day Recovery - Your last defence against ransomware attacks
- 1. Zero Day RecoveryTM Your last line of defence against ransomware and cyber attack © Copyright Tectrade Computers 2019
- 2. 2 Data is the DNA of any business, and at Tectrade we make it our mission to protect it. TheTectrade data platform uses the world’s best people and industry leading technologies to provide the very best in data protection and recovery. © Copyright Tectrade Computers 2019
- 3. By 2019, despite increasing effectiveness of countermeasures, successful ransomware attacks will double in frequency year over year, up from 2 to 3 million in 2016. Cyber Security Protection Perimeter Security Endpoint Security Application Security Data Security Focus of nearly all cyber security vendors: Protection or Defence against cyber threats not recovery from attack. Cyber Defence Cyber Recovery © Copyright Tectrade Computers 2019
- 4. What is Zero Day Recovery? Cyber Defence Cyber Recovery Very few vendors talk about cyber recovery but cyber recovery is essential to full cyber protection. Hacker discovers vulnerability Exploit created to leverage vulnerability Attack is launched Public/Vendor awareness Vendor builds signature Vendor distributes signature IT admin installs signature to protect against attack Day Zero Attack DefendedWindow of Vulnerability The window of vulnerability is where business are most at risk. Providing fast recovery and backup allows them to defeat a zero day/ransomware attack using cyber recovery. This is most important when looking at Zero day and Ransomware attacks which are extremely difficult to defend against. Example of Zero-Day Attack © Copyright Tectrade Computers 2019
- 5. How serious is the issue? 50 percent chance of employees suffering productivity loss 30 percent chance that the business will shut down temporarily 20 percent chance of corporate revenue loss • There are ever increasing amounts of new code and a robust underworld economy that will be stoking the market for zero day and ransomware attacks • It is expected that zero day exploits will rise from one per week in 2015 to one per day by 20211 Ransomware and Zero day attacks are increasing • Servers involved in processing retail transactions can no longer do so, resulting in delayed or lost sales • Hospitals whose systems become inaccessible can see lives put at risk, such as NHS patients whose cancer treatments were delayed as a result of a May 2017 attack. • Manufacturing operations can be temporarily shut down such as Renault factories in France and Slovenia in May 2017. © Copyright Tectrade Computers 2019
- 6. What are the key problems? Downtime, revenue loss, and reputation damage due to attack Inability to recover from attack quickly Cost and pain of designing and building to recover fast IT and security teams working in silos with backup not considered part of the solution to cyber attack © Copyright Tectrade Computers 2019
- 7. Policy Technology Enhanced service and operational model Discover & justify Define & Design Deliver Operate Optimize Volume Cost Value Risk © Copyright Tectrade Computers 2019
- 8. Tectrade’s Zero-Day Recovery service enables you to rely on and trust your data platform to recover applications and data quickly after an attack We become your last line of defence. What if you could confidently and quickly roll back to an uncompromised version of your data? © Copyright Tectrade Computers 2019
- 9. Plan • Decide your policy, clean, rebuild, or restore? • Identify critical workloads and data • Identify Dependencies in workloads • Create a zero day recovery catalogue Build • Deploy a technology platforms to automate failover, or backup and recovery activity • Create an out of band data recovery vault (‘air-gap’) • Build a ‘clean room’ for Gold images Continuously Test • Conduct regular restore testing, ideally automated • Test the integrity of your recovery data Monitor and detect • Monitor your environment for unexpected behaviours using cybersecurity tooling • Monitor and manage your data protection environment to ensure RPO objectives are met Recover • Perform Forensics and Damage Assessment • Restore applications direct from recovery vault • Review status and reset Creating a Zero-Day Recovery architecture © Copyright Tectrade Computers 2019
- 10. How does Zero Day Recovery work? Time Return to service Tectrade’s Zero day recovery platform continuously generates immutable restore points as defined by client policy (RPO) Tectrade implement and deploy the highly secured Helix Protect appliance with an immutable recovery vault Client conducts digital analysis to identify compromised machines. Confirms a point in time to restore to. Continuous monitoring, testing, and management ensures viability of restore points Client or Tectrade restores image or data quickly from the vault, aligned to Policy Incident / Detection © Copyright Tectrade Computers 2019
- 11. Fast Recovery Near instant recovery Recovers a workload in 1-2 hours Stand alone secured backup and recovery platform Recovers workloads in minutes Technology integrated into your environment built around a snapshot architecture ZDR combines both models to meet your recovery needs
- 12. ZDR Architecture – The right solution for your business Immutable snapshot technology creates instant recovery points for immediate re-deployment © Copyright Tectrade Computers 2019
- 13. Benefits of Tectrade Zero Day Recovery The ability to recover critical systems quickly after a zero day or ransomware attack No ransom ever needs to be paid Cost effective managed service ensures recoveries are always available Visibility of estate allows prioritisation of critical systems Works in hybrid environments including cloud Managed service option – Takes the worry of Zero day and ransomware attacks away 155+ Customers managed 20+ Years experience Over 132PB of data protected 2m+ systems monitored daily © Copyright Tectrade Computers 2019
- 14. With over 23 years experience at the cutting edge of data management, we have a host of certifications in proven enterprise-class solutions and a customer list that spans industries and continents. Our creds/expertise summary With international operations and over 35 technical specialists, Tectrade has helped hundreds of clients to gain comprehensive control of their data and manage it effectively as their organisation grows. 155+ Customers managed 20+ Years experience Over 132PB of data protected 2m+ systems monitored daily UK & US Strong Financials ISO, PCI, CRB Qualifications & Certificates Work with all leading vendors Over 59 people 69% technical © Copyright Tectrade Computers 2019
- 15. Tectrade UK 1st Floor, River Court Old Mill Lane Godalming Surrey GU7 1EZ Tectrade US 379 West Broadway New York, 10012 www.tectrade.com Thank you © Copyright Tectrade Computers 2019
- 16. Healthcare Zero Day Recovery © Copyright Tectrade Computers 2019
- 17. How serious is the issue for healthcare? 50 percent chance of healthcare employees suffering productivity loss 30 percent chance that the healthcare services will shut down temporarily 20 percent chance of revenue loss and adverse affect on patient care In 2015, 3 of the 7 largest cyber breaches occurred in the healthcare sector. The Anthem incident was the largest cyber security breach in the healthcare industry in 2015. Hospitals whose systems become inaccessible can see lives put at risk, such as NHS patients whose cancer treatments were delayed as a result of a May 2017 attack. Ransomware attacks are growing and the prime target is healthcare organisations due to: • A heavy reliance on critical administrative and clinical systems affecting the whole care delivery process • Patient suffering if these fail - far different from a business that loses revenue • Faced with the choice of “ransom for data” most healthcare professional often pay attackers • Healthcare is also traditionally behind in adoption of data security solutions and upgrades to their IT estate mostly due to inadequate funding and focus Ransomware and Zero day attacks are increasing© Copyright Tectrade Computers 2019
- 18. Saving lives with backup and recovery Zero Day Recovery - Piece of mind for healthcare organisations against data loss and attack with cost effective back up and recovery Electronic Health Record Recovery Healthcare Clinics Administration System Recovery HIPPA Compliance & Enterprise Data Recovery © Copyright Tectrade Computers 2019
- 19. Finance & Insurance Zero Day Recovery © Copyright Tectrade Computers 2019
- 20. How serious is the issue for finance and insurance? 50 percent chance of finance & insurance employees suffering productivity loss 30 percent chance that the financial and insurance services will shut down temporarily 20 percent chance of revenue loss and adverse affect on customer perception Financial services and insurance sector was attacked more than any other industry over the last 12 months. Ransomware attacks are growing in financial service and insurance sector due to: • Breadth of information stored about customers makes them prime targets • Online systems for banking and insurance transactions if taken offline due to ransomware can render an organisation unable to operate • Faced with the choice of “ransom for data” most financial and insurance professionals often pay attackers • Large amount of data in disparate systems makes recovery of data difficult. Ransomware and Zero day attacks are increasing © Copyright Tectrade Computers 2019
- 21. Reduce Risk. Recover Fast. Zero Day Recovery - Piece of mind for finance & insurance organisations against data loss and attack with cost effective back up and recovery Financial Records Recovery Customer online system recovery Enterprise Data Recovery © Copyright Tectrade Computers 2019
- 22. Retail Zero Day Recovery © Copyright Tectrade Computers 2019
- 23. How serious is the issue for retail? 50 percent chance of retail employees suffering productivity loss 30 percent chance that the retail services will shut down temporarily 20 percent chance of revenue loss and adverse affect on customer service In 2017 ransomware attacks on retail organisations have doubled and they are increasingly focussed on business critical systems with bigger ransom demands. Ransomware attacks are growing and one of their prime targets is retail organisations due to: • A heavy reliance on online shopping platforms and point of sale payment systems that could be held to ransom • Customer trust and investor confidence lost if ransomware hits • Faced with the choice of “ransom for data” most retailers often pay attackers • Retail is tipped by cyber watchers to be the next target of a large scale ransomware attack Ransomware and Zero day attacks are increasing© Copyright Tectrade Computers 2019
- 24. Recover Instantly. No Ransom Required. Zero Day Recovery - Piece of mind for retails organisations against data loss and attack with cost effective back up and recovery Customer account details and payment information Online commerce systems Enterprise Data Recovery © Copyright Tectrade Computers 2019
- 25. Manufacturing Zero Day Recovery © Copyright Tectrade Computers 2019
- 26. How serious is the issue for manufacturing? 50 percent chance of manufacturing employees suffering productivity loss 30 percent chance that the manufacturing production will shut down temporarily 20 percent chance of revenue loss Just over a third of all documented attacks in the second quarter of 2017 targeted the manufacturing industry, with manufacturers appearing in the top three targets in five of six geographic regions throughout 2016. Ransomware attacks are growing and the prime target is healthcare organisations due to: • Legacy systems that operate production that are open to exploits commonly used in ransomware attacks • Downtime in production that affects productivity and profitability such as Renault factories in France and Slovenia in May 2017. • Faced with the choice of “ransom for data” most manufacturing organisations often pay attackers • Manufacturing is also traditionally behind in adoption of data security solutions Ransomware and Zero day attacks are increasing© Copyright Tectrade Computers 2019
- 27. Ransomware Defeated. Zero Day Recovery - Piece of mind for manufacturing organisations against data loss and attack with cost effective back up and recovery Production data and operational blueprint recovery Live Production System Recovery Enterprise Data Recovery © Copyright Tectrade Computers 2019
- 28. With over 23 years experience at the cutting edge of data management, we have a host of certifications in proven enterprise-class solutions and a customer list that spans industries and continents. Our creds/expertise summary With international operations and over 35 technical specialists, Tectrade has helped hundreds of clients to gain comprehensive control of their data and manage it effectively as their organisation grows. 155+ Customers managed 20+ Years experience Over 132PB of data protected 2m+ systems monitored daily UK & US Strong Financials ISO, PCI, CRB Qualifications & Certificates Work with all leading vendors Over 59 people 69% technical © Copyright Tectrade Computers 2019
- 29. Tectrade UK 1st Floor, River Court Old Mill Lane Godalming Surrey GU7 1EZ Tectrade US 379 West Broadway New York, 10012 www.tectrade.com Thank you © Copyright Tectrade Computers 2019
Editor's Notes
- #3: Right now, organisations are facing extraordinary data challenges. Much of the world’s data is currently trapped in old architectures – architectures that are failing to handle the pace of data growth, and preventing organisations from using data to develop revolutionary new products, services and ways of working. Getting a handle on your data is not just important – it's business critical.
- #4: A recent survey by cyber-edge.com found that only 51% payments of a ransom resulted in data recovery. https://cyber-edge.com/wp-content/uploads/2018/03/CyberEdge-2018-CDR.pdf
- #5: A recent survey by cyber-edge.com found that only 51% payments of a ransom resulted in data recovery. https://cyber-edge.com/wp-content/uploads/2018/03/CyberEdge-2018-CDR.pdf
- #6: Just over a third of all documented attacks in the second quarter targeted the manufacturing industry, with manufacturers appearing in the top three targets in five of six geographic regions throughout 2016. Manufacturing (34%) was followed by finance (25%) and health care (13%) as the most targeted sectors.
- #7: The impact of ransomware on small to mid-sized businesses can be crippling Ransom demands are not the small business killer, downtime is. Most small to midsized businesses impacted by ransomware experienced hours of downtime For many, the source of ransomware cannot be identified Ransomware infections often spread to other endpoints once they take hold Current technology solutions do not seem to be solving the problem There are ever increasing amounts of new code and a robust underworld economy that will be stoking the market It is expected that zero day exploits will rise from one per week in 2015 to one per day by 20211 Servers involved in processing retail transactions can no longer do so, resulting in delayed or lost sales Hospitals whose systems become inaccessible can see lives put at risk, such as NHS patients whose cancer treatments were delayed as a result of a May 2017 attack. Manufacturing operations can be temporarily shut down Renault factories in France and Slovenia in May 2017.
- #8: Risk How much downtime (cost) can we withstand? What impact to my business (revenue) would be disastrous? What is our risk profile? Value Which are our most valuable applications or data? Which applications are business critical to sustaining our business? Cost What is a reasonable cost to mitigate risks to valuable apps? How do I procure? OPEX or CAPEX? How much does it cost to recover today? Volume How much of our data and application estate must be protected to the highest level? How do I want to recover infected workloads? How many cyber incidents occur?
- #9: Typically recovery from a cyber attack requires manually disinfecting or re-building their machine. This is time consuming, and with Zero-day attacks, disinfection is almost impossible. The ZDR service provides confidence and trust in your recovery points.
- #11: It is our play to capture a chunk of the cyber-security spend in clients and diversifies our offering away from IT operations by targeting new people. The proposition is called Zero Day recovery. Zero-day recovery is based upon the idea that a security breach is matter of when, not if, and that the breach is likely to be achieved using unknown or unpatched vulnerabilities in an organisation. It focuses on the process of recovering from a breach by using Helix Protect to restore data in hours. This compares to days required for the traditional disinfection or rebuild process. There are three differences between our current data protection go to market and Zero Day Recovery: We have created marketing and positioning language to focus on the recovery from cyber-attack instead of our traditional focus on infrastructure, application, or user failure. We’ve added cyber monitoring tools into the portfolio to help clients spot attacks in progress and to perform post discovery forensic work to find the attack vector. The rate and expected speed of recoveries (restores) particularly of VM images is likely to be higher than our current client expectation. The Zero Day recovery story will sit alongside our traditional data protection messaging but will represent our big bet to win new clients at an accelerated rate. Alex will expand on this at the kick off.
- #12: Note, clients wanting instant access to data can mount their images using SPP or SPVE to get data, but their performance will only be as good as the performance of the DP storage. Therefore, if they are looking to build out a fast recovery to business as usual, then a true snapshot architecture is needed.
- #13: Three tier architecture, designed to provide fast recoveries with insurance against data loss using data protection technologies.
- #19: Electronic Health Records Healthcare Clinics Enterprise Data Reasons: Clinicians need fast access to patient data at all times, Big Data and bring your own device impacts are real and growing, The budget isn’t growing as fast as protected health information
- #22: Electronic Health Records Healthcare Clinics Enterprise Data
- #25: Electronic Health Records Healthcare Clinics Enterprise Data
- #28: Production data and operational blueprints Live production systems Enterprise Data