1. Prevention against Ransomware costs - Arcserve UDP
Principal consultant - EE
Copyright © 2017 Arcserve. All rights reserved.

2. Copyright © 2017 Arcserve. All rights reserved.
What is Ransomware?
Ransomware is malware for data kidnapping in which the attacker encrypts the victim's data and demands payment for the decryption key.
Ransomware spreads through attachments, infected programs and compromised websites. A ransomware malware program may also be called a cryptovirus, cryptotrojan or cryptoworm.
The net result: no data access, sometimes data loss…
The Alternative: Pay up or Ignore (but now you need to restore your systems/data)
Copyright © 2017 Arcserve. All rights reserved.

3. Ransomware is a Costly Reality
This Just In...
A poll of IT managers at 300 UK businesses sponsored by Trend Micro found that 44 % of UK businesses have been infected by ransomware in the last two years
The average ransom demanded is $722 - although the payment is usually requested in Bitcoin
20 % of organizations reported ransom demands of $1338
Organizations affected by ransomware estimate they spent 33 hours on average fixing the issues caused by the ransomware infection
For hose companies who refused to give into hackers' ransom demands, 60% said they were able to retrieve data from back up files
Copyright © 2017 Arcserve. All rights reserved.

4. Ransomware in Backup and SLA terms
Recovery point objectives
Recovery time objectives
Copyright © 2017 Arcserve. All rights reserved.

5. Arcserve’s Backup and Recovery Solution: UDP
REMOTE OFFICE / BRANCH OFFICE
PRIMARY SITE
REPLICATION
UDP APPLIANCE
GLOBAL
DEDUPLICATION
PHYSICAL SYSTEM BACKUP
VMWARE & HYPER-V BACKUP
HARDWARE SNAPSHOT BACKUP
BMR
INSTANT VM
VIRTUAL STANDBY
HIGH AVAILABILITY
P2V MIGRATION
FREE WORKSTATION PROTECTION
REMOTE OFFICE PROTECTION
TAPE
BACKUP
PUBLIC / PRIVATE / ARCSERVE CLOUD
DR SITE / MSP DATACENTER
WAN OPTIMIZED REPLICATION
AUTOMATED DR TESTING
BACKUP TO CLOUD HIGH AVAILABILITY TO CLOUD
FILE COPY & FILE ARCHIVE TO CLOUD
REMOTE VIRTUAL STANDBY
JUMPSTART DATA SEEDING
MULTI-TENANT STORAGE
NDMP BACKUP FILE ARCHIVING
GLOBAL DASHBOARD
CENTRALIZED MANAGEMENT
ROLE BASED ADMINISTRATION
Copyright © 2017 Arcserve. All rights reserved.

6. Customer 1 – A Publishing Business….Somewhere2 3 4
Customer X supports a few hundred users at this publishing business
The corruption came in as an attachment titled Pictures.zip with a spoofed address – who doesn’t have “click-happy” end-users?
Photos.zip was the infected file sent via . It was a “bart” type virus
Customer X does a 7AM snapshot of his environment and keeps a near line copy of the Recovery Points as a precaution. Best backup practices paid off!!
Result
Using Arcserve was key to his ability to thwart the attack and recover the affected systems and their data
It took him 28 hours to determine the source, repair and reverse the damage but there was no publicly visible indication that an attack had taken place
His ability to contain the attack and mitigate the damage earned him a letter of praise from his CEO
Copyright © 2017 Arcserve. All rights reserved.

7. Customer 2: Medical/Healthcare…Somewhere Else..1 2 3 4
Customer was hit with multiple successive attacks, a common recent occurrence in their industry
Avoiding operational impacts (regardless of the interruption cause) is a fundamental SLA which has a direct impact on communities and individuals
In addition, avoiding negative publicity is very critical to this line of business
In this customers’s case, the 5th Ransomware attack was particularly aggressive and took over local admin accounts on workstations and servers and encrypted files dozens of servers. Having a Bad day?
Result
Customer was able to recover all the servers with Arcserve UDP 
Without Arcserve backups, they would be paying many $1000’s to recover,
In this customer’s experience, their attacks seem to be more focused on “traditional” types of flat files – PDFs DOCs XLSs, etc. 
Copyright © 2017 Arcserve. All rights reserved.

8. Protect the Source Machine
Best Practices
Protect the Source Machine
Take precautions to prevent infection in the first place, such as training users to not click on links within s, downloading attachments from unknown sources and updating software on a timely basis.
Perform regular backups, which may include rethinking your service level agreements to ensure critical business data is backed up more frequently.
Follow the strategy for backup: one of the copies should be offline, and at least one of the copies should be offsite.
Make sure your chosen backup solution includes virtual standby for critical systems so that you can get back on your feet very quickly.
Copyright © 2017 Arcserve. All rights reserved.

9. Best Practices and Conclusion
Protect the Protector: The Backup Data
Replicate data to offsite / cloud
If your backup server gets infected or if your backup data is on a shared network share that is accessible from an infected machine, ransomware can encrypt backup data as well. It sounds obvious, but it’s important to remember!
Periodically, copy recovery points to offline media, such as USB disks. Consider leveraging tape as a backup medium for critical data (yes tape!). This oldie but goodie comes in handy to send periodic recovery points offline.
Copyright © 2017 Arcserve. All rights reserved.

10. Questions Tamas.Jung@Arcserve.com Principal consultant – EE
Borivoje Božinović
Hardware & Sotware sales executive , Energodata
Copyright © 2017 Arcserve. All rights reserved.