1. CryptoSpike Ransomware Protection & File System Auditing Robert Graf
CEO
2nd Sept. 2019

2. 1001110110101110100111111001 We care about your data! protect manage
analyze

4. Transparency on File System Access and Auditing
Worst Ransomware Strains
Who created, changed, copied, deleted… data when, where,…

5. Detailed Traceability
who?
when?
what?
how?
File deleted!
Comprehensive filter possibilities:
Recognise anomalies:
File Activity
SMB_DEL

6. Malware and Ransomware Threats
WannaCry
CryptoLocker
Petya
Worst Ransomware Strains

7. Ransomeware attack at Lukaskrankenhaus in Neuss

8. 3 days loss of data!!! The only option: 2.000 User
files being manipulated
Vol. 1
50 Mio. Files
Vol. 1
The only option:
Restoring the whole volume to Tuesday’s Snapshot
Ransomware Attack
Ransomware attack
Ransomware attack:
Filename & filetype have not changed
Last-access-dates have not changed
All files seem to be the same as before
How can GOOD files be separated from BAD files? Mo Tu We Th Fr
SnapShots
Data
3 days loss of data!!!

9. All other users continue to work WITHOUT data loss!
files being manipulated
Vol. 1
50 Mio. Files
Vol. 1
The Restore:
ONLY the changed (damaged) files will be restored!
single file restore
Active Blocking!
Anomaly detection and White- / Blacklists
Affected files are identified
Transactions are being logged
Detail overview of all users
Only affected contents being restored!
Data Mo Tu We Th Fr
SnapShots
All other users continue to work WITHOUT data loss!

10. CryptoSpike CryptoSpike Manager Blacklist CryptoSpike Portal Fpolicy
*.*locked
*.*kraken
*.*crypto
*.*cry
*.exx
Collect Blacklist form different Community Projects and Websites
License Mgmt
Add new Customers
Blacklist Updates
*.*locked
*.*kraken
*.*crypto
*.*cry
*.exx
*.*locked
*.*kraken
*.*crypto
*.*cry
*.exx
load
CryptoSpike
manage Blacklist
Pull from server
.pdf
.xls
.doc
.jpg
.giv
Whitelist
CryptoSpike Portal
Setup Wizard
Blocked Users
File History /Restore
Config. / Management
Pattern Learner
Fpolicy
Server
CryptoSpike concept
CryptoSpike
Server

11. Live-Demo

12. Access Blocking
Block Ransomware
As soon as ransomware is detected, access for effected user is blocked
Alert via and in portal
Infected files are displayed in detail and are ready to be restored

13. Easy Restore Choose files to be restored Click „Restore“ button
/RestoreFolder
Choose files to be restored
Click „Restore“ button
Select Snapshot
Choose restore location
Confirm „Restore“
Done!
One-button-restore

14. Transparency on Users File Access
User IOPS
User Actions
File Activity
Location / Path

15. Summary Easy Installation (.OVA / .VHDX)
Complete recording of all file activities
Transparency and traceability on file access (Auditing)
Real time Ransomware detection <0,5ms
Machine learning of access patterns
Detect anomalies
Immediate automatic blocking of affected user
Central Whitelist and Blacklist provide additional protection
One click Restore from NetApp SnapShots
Multitenant capabilities for Service Providers
Licensed per Storage Controller (ONTAP primary Systems)
CryptoSpike Benefits

16. Installation and Prerequisites
Download .OVA or VHD/VHDX File:
3 VM’s and 3 IP Addresses are needed to deploy Virtual Machine
CryptoSpike Server    
CryptoSpike FPolicy Server
CryptoSpike FPolicy Server 2
VM based on Linux Debian 9
Hardware Prerequisites:
1x CryptoSpike Server: 8 vCPU, 12 GB RAM and 100 GB Disk-Space
2x FPolicy Server: 4 vCPU, 8 GB RAM and GB Disk-Space
Check Network Connectivity:
Data LIF SVM <-to-> FPolicy Server (High performance, low latency)
FPolicy Server <-to-> CryptoSpike Server (Throughput ~ 40 MB/s)
CryptoSpike Server <-to-> ONTAP (Latency and Throughput is not critical)
One-button-restore

17. ...we go the extra mile...