JEROME MCFARLAND: Hello, everyone,
and thank you for joining us.
In this session we'll be discussing
the impact of ransomware, and how organizations
can better prepare to mitigate the impact of ransomware
via cyber resilience.
We'll first share some insights on the growing
ransomware threat, as gleaned from Google Cloud's
unique vantage point.
Then we'll share our views on how to think about and approach
cyber resilience, including some specific guidance
on how Google Cloud can help.
And finally, to wrap things up, we'll
suggest some simple ways to get started on your cyber
resilience journey.
And my name is Jerome McFarland.
I'm a Google Cloud Solutions manager,
focused on topics relating to infrastructure modernization.
In today's session, I'm very pleased to be joined
by Vicente Diaz, a security engineer from Google's
VirusTotal team.
Now with introductions out of the way,
I'll pass the mic to Vicente.
VICENTE DIAZ: Thanks, Jerome.
VirusTotal is the world's largest cross-source threat
intelligence platform.
This provides us with a unique visibility
that we use to analyze how ransomware attacks have
been evolving during the last two years.
All this data is available in our "Ransomware
in a Global Context" report.
And today we will discuss some of the main findings.
We analyze how ransomware attacks
evolved for the last two years.
For this period, we observed more than 130 active ransomware
families.
We also observe attackers distribute their malware
in waves.
Some of them do aggressively in terms of the number of samples
created.
More interestingly, in addition to the most notorious attacks,
we found a constant baseline of 100 active ransomware families.
Attackers use different strategies
for spreading their malware.
Many of them systematically create a big amount
of fresh new samples before spreading,
which difficults detection.
Attackers also use other malware families
to get into their victims before deploying ransomware.
This includes remote access trojans, rats, and botnets.
Unfortunately, in some locations we
underestimate the presence of such malware
without considering this might be the first stage
of a critical attack.
Social engineering is probably the main distribution vector.
Generally speaking, attackers do not
seem to need a high level of sophistication
in their toolset.
There's a low percentage of artifacts
used in ransomware attacks incorporating
any kind of exploit.
And when they do, the exploit is usually
exploiting some vulnerabilities.
However, we can think of some of these attacks
as a job of a well-oiled team, where attackers routinely
use APD like methodologies and tools against their victims.
Google Cloud has great products and solutions
that can leverage such signals to help prevent
successful ransomware attacks.
Unfortunately, it's impossible to guarantee that everything
will get detected.
So you also need effective ways to recover
in the event of a successful attack.
And Google Cloud can help with that as well.
I will now hand off to Jerome so he can tell you more.
JEROME MCFARLAND: Thanks, Vicente.
To enable rapid recovery from a ransomware attack,
we strongly advise taking a forward looking, strategic
approach.
And in Google Cloud, we've developed an end
to end framework for delivering cybersecurity and resilience,
as shown here.
This framework is aligned with the five functions defined
by the NIST cybersecurity framework.
And it helps our customers proactively apply GCP products
and services to meet their security and resilience goals.
Google Cloud offers a robust portfolio of security offerings
that can help customers stop a malicious attack
from occurring.
These technologies are focused on prevention.
However, in today's session, we'll
focus on technology supporting accelerated recovery
from an attack that was triggered successfully.
Now, by design, ransomware attacks
create chaotic, stressful situations,
with victims often left scrambling to react and find
a clear path forward.
And as a result, the time required to recover
is often measured in days, which can
be a catastrophe for business operations.
Now, in such situations being reactive
is not a path to successful.
Successful recovery demands a proactive, context aware
approach.
And the context aware part is critical.
It's very important to note that reliance on traditional backup
and disaster recovery products may not be sufficient when
faced with a ransomware attack.
An attack initiated by an intelligent bad actor
is very different from an outage caused by human error
or by a natural disaster.
Recovering quickly from an intentional attack
requires an intentional approach.
The good news is that we're here to help.
At Google Cloud we're committed to protecting your business
and helping you to achieve resilience
against malicious attack.
We feel that we're uniquely equipped
with the technology and infrastructure to support
that mission, helping you to accelerate
your time to recovery, and thereby
minimize the disruptions to your business.
With GCP integrated solutions, you
can gain confidence in your ability to recover from attack.
And you'll also gain the ability to test those recovery
capabilities in advance of an attack,
thereby demonstrating effective, predictable recovery,
and reducing your overall cyber risk.
Now, to do so, preparation is crucial.
And an effective solution will address three key core
requirements.
The first two relate to pre-attack preparation.
And the last relates to a recovery scenario.
And the first area is the ability
to capture point in time copies of mission critical data.
And you'd think of these conceptually as time stamped
backups.
And, of course, when capturing these copies,
you'll want to do it efficiently from both a time and a storage
perspective.
And a good solution will also need
to provide sufficient coverage to address your key application
stacks and environments.
The second core requirement is the ability
to protect the data you've captured by securing it
in a safe location, and with sufficient isolation
from your production infrastructure.
A good solution will also store and protect your data
in a way that maximizes its resistance
to unauthorized tampering.
The third and final core requirement
is the ability to quickly restore your business
after an attack has occurred by recovering to a known good data
state, which, of course, also involves
having mechanisms to identify a good state to return to.
To facilitate rapid recovery in the aftermath of an attack,
a good solution will allow your organization
to test its efficacy in preparation,
and to test on demand, and as often as desired
to achieve and maintain confidence.
With these key requirements in mind,
we're pleased to offer our customers a proactive path
forward by implementing ransomware recovery
on Google Cloud.
With Google Cloud technologies you
can deliver broad protection for your mission critical workloads
by capturing application consistent point in time data
states for key environments and applications,
such as VMware VMs, SQL server databases, MySQL,
HANA databases, and more.
In addition, by storing these immutable data copies
on Google Cloud, you can keep them physically separate
from your production infrastructure,
thereby reducing their susceptibility to easy attack.
And, of course, at the end of the day speed is key.
The goal is to get your business back online as
quickly as possible.
However, as we've mentioned before,
ransomware attacks can't be treated the same
as a traditional outage.
When ransomware infections occur,
they're often present for days, weeks, or even months
before being triggered.
And as a result, some of the stored data copies
may also be infected.
Therefore, once your security teams
identify tools to scan for the malware,
they'll need to use those tools to validate your stored data
copies before using those copies as the source for recovery.
With traditional backup and recovery products,
accessing the stored backups can be a very time consuming
process, with each copy needing to first
be moved to hot storage and transformed to an application
readable format.
Needing to perform this move and transform process sequentially
before each backup inspection can extend a recovery process
for days.
With the Google Cloud solution, however, your security teams
can obtain instant access to multiple point in time data
states in parallel without needing
to move them, and also without needing to transform them
because we can store the data in its native application
accessible format.
And in this way, you can implement a solution
with an expected recovery time measured in hours, not days.
And finally, our solution is also
designed to be cost effective, as its core is delivered
as a pay as you go service via Google Cloud Marketplace.
The Google Cloud ransomware recovery solution as depicted
here builds on Actifio, our unique first party backup
and recovery solution to deliver the functionality
required to deliver fast cloud integrated ransomware recovery.
Actifio can quickly capture application consistent point
in time data states using its efficient incremental forever
technology, which drastically minimizes the amount of data
transferred and stored.
When using incremental forever data capture,
Actifio only takes a single full copy of the data.
And from then forward, it efficiently captures and stores
only the changed blocks, while still maintaining
the capability to fully access and restore
application consistent data corresponding to any
of the captured points in time.
Now, these efficiently captured point in time copies
are stored in cost effective cold storage on Google Cloud.
Now, for on premises production environments,
this creates physical separation between the production
infrastructure and the recovery data,
thereby making it less susceptible to attack.
Now, in steady state, the associated deployment
is very lightweight.
You'll simply send data periodically
to our cloud based storage.
Then after a successful attack occurs,
you can dynamically and rapidly spin up scalable cloud
infrastructure to access the stored data states
and perform your validation.
This allows you to minimize your steady state costs.
And it also allows you to perform cost effective,
on demand preemptive testing, with
the required infrastructure only deployed
when it's actually needed.
Now, it's also worth noting that to augment Actifio's
native capabilities, this solution
also provides guidance, best practices,
and scripting templates crafted specifically
to support the ransomware recovery use case.
For example, scripted identity access management controls
can provide an additional layer of protection
by authorizing and de-authorizing access
to the cloud storage in alignment
with a scheduled backup window.
And crucially, Actifio supports parallel
direct access to multiple point in time data states
without requiring transformation or movement of the data.
This allows your security team to scan and rapidly identify
uninfected recovery candidates, supporting recoveries
in hours, not days.
But we're not stopping there.
Looking ahead, we're continuing to evolve and integrate
the best of Google Cloud's technologies and services
to help our customers improve and validate
their cyber preparedness.
And these efforts have multidisciplinary scope,
spanning storage, security, AI ML, and more.
Be sure to stay tuned for what we have in store.
Now, some final thoughts to close out our session.
We're here to help you accelerate
your time to recovery from a ransomware attack.
In turn, that can reduce your cyber risk
and provide you with validated confidence
in your ability to maintain business continuity.
We welcome you to partner with us
in your journey to achieving end to end cybersecurity
and resilience.
Now, finally, as I mentioned earlier,
Google Cloud has a variety of products and services
to support that end to end journey.
Our specialists will be happy to help
you learn more about any or all of the associated solutions.
So let's get started.
To learn more about ransomware recovery,
cyber resilience, and security with Google Cloud,
please contact your Google Cloud sales representative.
And to learn more about Google Cloud solutions
and best practices for achieving cybersecurity and resilience,
we invite you to check out these articles on cloud.google.com.
And with that, we'll close the session.
I'd like to thank my co-presenter Vicente
for joining me today.
And, of course, a big thank you to everyone watching.
We truly appreciate your time and attention.