Prevention against Ransomware costs - Arcserve UDP Tamas.Jung@Arcserve.com Principal consultant - EE Copyright © 2017 Arcserve. All rights reserved.

Copyright © 2017 Arcserve. All rights reserved. What is Ransomware? Ransomware is malware for data kidnapping in which the attacker encrypts the victim's data and demands payment for the decryption key. Ransomware spreads through e-mail attachments, infected programs and compromised websites. A ransomware malware program may also be called a cryptovirus, cryptotrojan or cryptoworm. The net result: no data access, sometimes data loss… The Alternative: Pay up or Ignore (but now you need to restore your systems/data) Copyright © 2017 Arcserve. All rights reserved.

Ransomware is a Costly Reality This Just In... A poll of IT managers at 300 UK businesses sponsored by Trend Micro found that 44 % of UK businesses have been infected by ransomware in the last two years The average ransom demanded is $722 - although the payment is usually requested in Bitcoin 20 % of organizations reported ransom demands of $1338 Organizations affected by ransomware estimate they spent 33 hours on average fixing the issues caused by the ransomware infection For hose companies who refused to give into hackers' ransom demands, 60% said they were able to retrieve data from back up files Copyright © 2017 Arcserve. All rights reserved.

Ransomware in Backup and SLA terms Recovery point objectives Recovery time objectives Copyright © 2017 Arcserve. All rights reserved.

Arcserve’s Backup and Recovery Solution: UDP REMOTE OFFICE / BRANCH OFFICE PRIMARY SITE REPLICATION UDP APPLIANCE GLOBAL DEDUPLICATION PHYSICAL SYSTEM BACKUP VMWARE & HYPER-V BACKUP HARDWARE SNAPSHOT BACKUP BMR INSTANT VM VIRTUAL STANDBY HIGH AVAILABILITY P2V MIGRATION FREE WORKSTATION PROTECTION REMOTE OFFICE PROTECTION TAPE BACKUP PUBLIC / PRIVATE / ARCSERVE CLOUD DR SITE / MSP DATACENTER WAN OPTIMIZED REPLICATION AUTOMATED DR TESTING BACKUP TO CLOUD HIGH AVAILABILITY TO CLOUD FILE COPY & FILE ARCHIVE TO CLOUD REMOTE VIRTUAL STANDBY JUMPSTART DATA SEEDING MULTI-TENANT STORAGE NDMP BACKUP FILE ARCHIVING GLOBAL DASHBOARD CENTRALIZED MANAGEMENT ROLE BASED ADMINISTRATION Copyright © 2017 Arcserve. All rights reserved.

Customer 1 – A Publishing Business….Somewhere 2 3 4 Customer X supports a few hundred users at this publishing business The corruption came in as an attachment titled Pictures.zip with a spoofed email address – who doesn’t have “click-happy” end-users? Photos.zip was the infected file sent via email. It was a “bart” type virus Customer X does a 7AM snapshot of his environment and keeps a near line copy of the Recovery Points as a precaution. Best backup practices paid off!! Result Using Arcserve was key to his ability to thwart the attack and recover the affected systems and their data It took him 28 hours to determine the source, repair and reverse the damage but there was no publicly visible indication that an attack had taken place His ability to contain the attack and mitigate the damage earned him a letter of praise from his CEO Copyright © 2017 Arcserve. All rights reserved.

Customer 2: Medical/Healthcare…Somewhere Else.. 1 2 3 4 Customer was hit with multiple successive attacks, a common recent occurrence in their industry Avoiding operational impacts (regardless of the interruption cause) is a fundamental SLA which has a direct impact on communities and individuals In addition, avoiding negative publicity is very critical to this line of business In this customers’s case, the 5th Ransomware attack was particularly aggressive and took over local admin accounts on workstations and servers and encrypted files dozens of servers. Having a Bad day? Result Customer was able to recover all the servers with Arcserve UDP  Without Arcserve backups, they would be paying many $1000’s to recover, In this customer’s experience, their attacks seem to be more focused on “traditional” types of flat files – PDFs DOCs XLSs, etc.  Copyright © 2017 Arcserve. All rights reserved.

Protect the Source Machine Best Practices Protect the Source Machine Take precautions to prevent infection in the first place, such as training users to not click on links within emails, downloading attachments from unknown sources and updating software on a timely basis. Perform regular backups, which may include rethinking your service level agreements to ensure critical business data is backed up more frequently. Follow the 3-2-1 strategy for backup: one of the copies should be offline, and at least one of the copies should be offsite. Make sure your chosen backup solution includes virtual standby for critical systems so that you can get back on your feet very quickly. Copyright © 2017 Arcserve. All rights reserved.

Best Practices and Conclusion Protect the Protector: The Backup Data Replicate data to offsite / cloud If your backup server gets infected or if your backup data is on a shared network share that is accessible from an infected machine, ransomware can encrypt backup data as well. It sounds obvious, but it’s important to remember! Periodically, copy recovery points to offline media, such as USB disks. Consider leveraging tape as a backup medium for critical data (yes tape!). This oldie but goodie comes in handy to send periodic recovery points offline. Copyright © 2017 Arcserve. All rights reserved.

Questions Tamas.Jung@Arcserve.com Principal consultant – EE Borivoje Božinović b.bozinovic@energodata.rs Hardware & Sotware sales executive , Energodata Copyright © 2017 Arcserve. All rights reserved.