CryptoSpike Ransomware Protection & File System Auditing Robert Graf CEO rg@prolion.at +43 664 1314403 2nd Sept. 2019

1001110110101110100111111001 We care about your data! protect manage analyze

Transparency on File System Access and Auditing Worst Ransomware Strains Who created, changed, copied, deleted…. data when, where,…

Detailed Traceability who? when? what? how? File deleted! Comprehensive filter possibilities: Recognise anomalies: File Activity SMB_DEL

Malware and Ransomware Threats WannaCry CryptoLocker Petya Worst Ransomware Strains

Ransomeware attack at Lukaskrankenhaus in Neuss

3 days loss of data!!! The only option: 2.000 User 10.000 files being manipulated Vol. 1 50 Mio. Files Vol. 1 The only option: Restoring the whole volume to Tuesday’s Snapshot Ransomware Attack Ransomware attack Ransomware attack: Filename & filetype have not changed Last-access-dates have not changed All files seem to be the same as before How can GOOD files be separated from BAD files? Mo Tu We Th Fr SnapShots Data 3 days loss of data!!!

All other users continue to work WITHOUT data loss! 10.000 files being manipulated Vol. 1 50 Mio. Files Vol. 1 The Restore: ONLY the changed (damaged) files will be restored! single file restore Active Blocking! Anomaly detection and White- / Blacklists Affected files are identified Transactions are being logged Detail overview of all users Only affected contents being restored! Data Mo Tu We Th Fr SnapShots All other users continue to work WITHOUT data loss!

CryptoSpike CryptoSpike Manager Blacklist CryptoSpike Portal Fpolicy *.*locked *.*kraken *.*crypto *.*cry *.exx Collect Blacklist form different Community Projects and Websites License Mgmt Add new Customers Blacklist Updates *.*locked *.*kraken *.*crypto *.*cry *.exx *.*locked *.*kraken *.*crypto *.*cry *.exx load CryptoSpike manage Blacklist Pull from server .pdf .xls .doc .jpg .giv Whitelist CryptoSpike Portal Setup Wizard Blocked Users File History /Restore Config. / Management Pattern Learner Fpolicy Server CryptoSpike concept CryptoSpike Server

Live-Demo

Access Blocking Block Ransomware As soon as ransomware is detected, access for effected user is blocked Alert via email and in portal Infected files are displayed in detail and are ready to be restored

Easy Restore Choose files to be restored Click „Restore“ button /RestoreFolder Choose files to be restored Click „Restore“ button Select Snapshot Choose restore location Confirm „Restore“ Done! One-button-restore

Transparency on Users File Access User IOPS User Actions File Activity Location / Path

Summary Easy Installation (.OVA / .VHDX) Complete recording of all file activities Transparency and traceability on file access (Auditing) Real time Ransomware detection <0,5ms Machine learning of access patterns Detect anomalies Immediate automatic blocking of affected user Central Whitelist and Blacklist provide additional protection One click Restore from NetApp SnapShots Multitenant capabilities for Service Providers Licensed per Storage Controller (ONTAP primary Systems) CryptoSpike Benefits

Installation and Prerequisites Download .OVA or VHD/VHDX File: http://releases.prolion.at/CryptoSpike/ 3 VM’s and 3 IP Addresses are needed to deploy Virtual Machine CryptoSpike Server     CryptoSpike FPolicy Server CryptoSpike FPolicy Server 2 VM based on Linux Debian 9 Hardware Prerequisites: 1x CryptoSpike Server: 8 vCPU, 12 GB RAM and 100 GB Disk-Space 2x FPolicy Server: 4 vCPU, 8 GB RAM and 20 GB Disk-Space Check Network Connectivity: Data LIF SVM <-to-> FPolicy Server (High performance, low latency) FPolicy Server <-to-> CryptoSpike Server (Throughput ~ 40 MB/s) CryptoSpike Server <-to-> ONTAP (Latency and Throughput is not critical) One-button-restore

...we go the extra mile...