Asigra’s latest program defends public/non-profit organizations against cyber-attacks targeting backup data

Asigra announced a new program focused on defending the backup repositories and data of Canadian public and non-profit organizations against cyber-attacks. The purpose of the program is to ensure the recovery of data that otherwise may have become compromised as a result of malicious malware or ransomware Attack-Loops that prevent the recovery of mission-critical data and often put large volumes of personally identifiable information (PII) at risk.

Cyber-attacks on public/non-profit organizations have put citizen data at risk like never before as new variants of ransomware and other attacks continue to infiltrate and expose sensitive data to unknown and possibly criminal entities.

In a recent attack covered by the Toronto Star, medical test provider LifeLabs agreed to pay the ransom of attackers in order to retrieve millions of customer records. In a statement, the organization said, “The personal information of over 15 million customers was compromised, mostly in British Columbia and Ontario, including name, address, email, login, passwords, date of birth, health card number and lab test results.”

Like many organizations dealing with a cyber-attack, the last resort for recovery relies on a functioning disaster recovery or backup solution in place. Unfortunately, hackers have now designed ransomware and other malware to seek out secondary storage systems (aka: disaster recovery and backup data) in order to compromise a clean retrieval of the information. 

As a result, these organizations no longer have a way to reinstate their data, and therefore are faced with either relinquishing or paying a ransom which can be exceptionally high for public and non-profit entities.

As a Canadian company, Asigra is planning to help protect these organizations by partially donating a large percentage of its cybersecurity-enabled backup technology to Canada’s extensive list of public and non-profit organizations. Those establishments in the country that can issue a tax-deductible receipt may contact Asigra to receive the company's complete anti-ransomware/backup software suite with the cost covered in large part by a donation-in-kind.

Asigra’s cloud-based data recovery platform is unique in the industry for converging data protection and cybersecurity for effective malware/ransomware detection and prevention that ensures safe, secure and reliable data recovery. 

The advanced software includes initial zero-day Attack-Loop preventative technology using bi-directional cyber-threat detection, zero-day exploit protection, variable repository naming, and multi-factor authentication (MFA) for a full defensive suite against aggressive ransomware and other cyber-threats targeting backup data. This is complemented by FIPS 140-2 certification and military-grade data encryption to ensure enterprise-grade data security, making user data unreadable without the proper encryption key.

“The majority of cybersecurity analysts today agree that cyber-attacks are evolving from the perspective of what they target, how they impact organizations and the changing methods of attack,” said David Farajun, CEO, Asigra. “For the past year, we have seen an increasing number of cyberthreats begin to target the number one method of data recovery – the backup repository. As a specialist in this area, we have developed a very effective solution to fight against this and now offer the technology to public and non-profit organizations we share our data with.”

Commvault data protection software now fully tested and validated to support AWS Outposts

Commvault announced on Thursday that Commvault software has been tested and validated to support AWS Outposts, which is a new, fully-managed service that extends Amazon Web Services (AWS) infrastructure, services, APIs and tools to virtually any data center, co-location space, or on-premises facility for a truly consistent hybrid cloud experience.

Many customers need to keep certain workloads on-premises while managing other workloads in the cloud. Commvault has robust and expansive support for the ever-growing number of diverse workloads rapidly migrating to AWS from other platforms and delivers the same look, feel and performance for data protection and management on-premises as it does in the cloud. 

As a complement to AWS Outposts, Commvault’s software provides a true single solution, not just a single interface, which creates cost efficiencies, provides simplicity and reduces risk.

Commvault is an Advanced Technology Partner in the AWS Partner Network (APN) and holds AWS Storage Competency status. Working with the AWS engineering team allows Commvault to offer integrated cloud storage solutions and support, giving customers the ability to migrate, backup and store data in the cloud. The depth and breadth of Commvault’s software with the wide array of storage services available from AWS allows customers to rest assured that their data is secure and available in the cloud. 

“Our tested and validated support for AWS Outposts allows our customers to leverage Commvault’s powerful cloud data protection and management capabilities on AWS,” said Karen Falcone, Vice President of Worldwide Cloud GTM, Commvault. “With the growth of cloud services and so many Commvault customers moving into AWS, we are helping organizations achieve the same level of data protection in the cloud as they did on-premises without the complexity and costs of installing and managing infrastructure.”

In October, Commvault announced product and experience enhancements to Commvault Activate, its data insights and governance solution that gives users greater visibility into their data, identifies opportunities for storage efficiencies and manages risk. Enhancements include the addition of file access controls for file storage optimization and new redaction functions with sensitive data governance. 

Trend Micro reveals that bug in Ryuk ransomware’s decryptor can lead to data loss in certain files

Ryuk’s decryptor tool — provided by the threat actors behind the ransomware to victims who have paid ransom demands — could actually cause data loss instead of reinstating file access to users. According to a blog post from Emsisoft, a bug with how the tool decrypts files could lead to incomplete recoveries, contrary to what the decryptor is actually meant to achieve.

While Ryuk has gained most of its notoriety due to who it targets and how much it tries to extort, the ransomware variant has actually seen a number of evolutions to its capabilities, which includes a revised encryption process. 

To make encryption faster and more efficient, Ryuk will only partially encrypt files that are larger than 57,000,000 bytes (approximately 54.4 megabytes) in 1,000,000 byte blocks — using a formula to compute how many of these blocks it will encrypt.

Traditionally, a file infected by Ryuk will contain a marker that shows whether it has already been previously encrypted with the Hermes ransomware, an earlier malware variant on which Ryuk was based. However, in addition to the Hermes marker, these partially encrypted files will also show a number beside the marker indicating how many of the 1,000,000 byte blocks were encrypted.

Due to a bug in how this number is calculated, the latest versions of Ryuk might accidentally truncate some files, removing a single byte of data from the file it was supposed to restore.

While a single byte might seem like a miniscule amount to get worried about (in most cases, the last byte is actually unused) — some types of files, such as those used in Oracle databases, store information in the last byte. This means that the removal of this single byte can actually result in an incomplete recovery, depending on the file type that was encrypted.

According to Trend Micro’s 2019 midyear security roundup, ransomware detections in the first half of the year increased by 77 percent compared to the second half of operations as threat actors seek to evolve their tools and methods. Ryuk is perhaps the most prevalent of the current ransomware families: It has earned the threat actors behind it millions of dollars from victims — typically, major organizations in both public and private sectors.

Given how widespread ransomware still is, it will benefit both organizations and individual users to regularly practice these recommendations to minimize the chances of a successful ransomware attack.

The simplest and perhaps most effective method to keep important files and data safe is to maintain regular backups — preferably using the 3-2-1 method of keeping three backup copies in at least two separate formats, with one copy offsite. IT administrators should ensure that systems, networks, servers, and applications are consistently updated and patched to prevent threat actors from taking advantage of vulnerable software and systems to deliver ransomware.

Organizations should cover all possible attack surfaces by implementing the principle of least privilege, where employees can only access parts of the system they need. Ransomware victims should also refrain from paying ransomware demands, as this encourages threat actors to continue with their campaigns. Furthermore, paying the ransom doesn’t even guarantee that the encrypted data will be restored, as seen in this scenario.

Organizations without dedicated security teams that want to bolster their security strategy can also look into taking advantage of services such as Trend Micro Managed XDR, which offers a wide scope of visibility and expert security analytics by integrating detection and response functions across networks, endpoints, emails, servers, and cloud workloads. 

The Managed XDR team is no stranger to Ryuk, and has extensive real-world experience investigating and analyzing the ransomware variant — as well as offering remediation advice — to customers.

Cohesity and HPE assist TEC Eurolab to maximize data security and resiliency, improve customer service

Cohesity announced Tuesday that TEC Eurolab has doubled its productivity and increased its revenues, after deploying a disruptive data management solution provided by Cohesity and HPE.

TEC Eurolab has seen major cost and efficiency benefits by using the joint Cohesity-HPE solution to enable intelligent file share services and enhance data security and resiliency. The solution, delivered by local systems integrator NETMIND, is now helping the company effectively serve customers across a multitude of sectors including aerospace and defense, automotive and motor racing, manufacturing, and biomedical industries.

The Cohesity-HPE joint solution for TEC Eurolab offers zero data loss and improved security, compliance and data integrity; 50 percent reduction in data retrieval time compared to previous solution; 100 percent improved production output across the Tomographic Center; 30 percent operating expense savings in reduced personnel time spent on data management; 20 percent capital expenses savings due to reduced burden on workstations; and offers quick and easy file search and recovery across multiple workstations with a single UI.

Founded in 1990, TEC Eurolab is a private corporation based in the province of Modena, Italy. TEC Eurolab is a prominent center of technical expertise and laboratory testing with the mission of improving the reliability of chemical, mechanical, and structural properties of products for its global customers, and providing specialised support and knowledge of materials, processes, and industry standards.

“The center can now double the number of analyses it performs each week and is able to deliver results to our customers faster with no performance bottlenecks,” said Marco Moscatti, board member and production director, TEC Eurolab.

Industrial tomography scanners deal with large, high-resolution 3D images, resulting in the center’s data growth of 50 percent per year. However, it has been challenged by legacy technology that couldn’t keep up with the increasing data volumes. The existing environment failed to efficiently and reliably process massive volumes of data.

The Tomographic Center used numerous workstations for file acquisition, 3D reconstruction and analysis. These workstations were processing many copies of the same data separately, slowing down operations and causing data loss, legal risks, and missed service level agreements. 

TEC Eurolab had a number of requirements, including a secure, central data store to ensure data integrity and predictable recovery, efficient file sharing, secure and reliable target storage for backup, non-disruptive scalability, and a seamless integration with its existing HPE environment.

Outstanding performance results from a pilot test driven by the software-defined data center specialist NETMIND led TEC Eurolab to choose Cohesity DataPlatform software on certified HPE Apollo r2200 Gen 10 servers as their preferred file share and scale-out target storage for backups.

With the new solution in place, data from all three types of workstations is written to the Cohesity cluster that acts as a central repository for acquisition, 3D reconstruction, and analysis data. All data resides on a Cohesity file share, powered by Cohesity SmartFiles —  intelligent file services built into the Cohesity DataPlatform — resulting in more efficient file sharing and faster recovery, all from a central management user interface (UI).

Additionally, with robust security and data resiliency provided by Cohesity DataPlatform, TEC Eurolab greatly reduced the risk of data being lost or compromised, and enhanced its ability to meet regulatory compliance.

“We have reduced staff operational time by 30 percent and significantly improved data resiliency with Cohesity. Best of all, we have doubled our production capacity and are able to meet customer SLAs without compromising security and compliance, which contributed in part to an increase in Tomographic Center revenues. We are now looking to further maximize these benefits across the organization by expanding Cohesity to other use cases such as integrated backup, recovery, and analytics,” said Moscatti.

“With the Cohesity-HPE joint solution, TEC Eurolab is getting the best of both worlds,” said Giovanni Golinelli, pre-sales manager and systems and storage architect, NETMIND. “They are now able to adhere to their customers’ strict security needs and industry regulatory requirements. They have an enterprise-grade solution that combines the security-first approach of Cohesity software with built-in silicon-level firmware protection, encryption, and breach detection of HPE Apollo Gen 10 servers.”

TEC Eurolab is already considering Cohesity for additional use cases across the organization. In the next phase of deployment, TEC Eurolab is considering Cohesity for integrated backup and recovery of all data across the organization as well as using Cohesity MarketPlace apps for anti-virus, in-place analytics, and vulnerability assessment. 

The combination of self-monitoring infrastructure with HPE InfoSight for servers and unified visibility from Cohesity Helios, global SaaS-based management for data and applications, will allow the company to gain predictive insights from their data and further optimize operations.

“We see a lot of potential at TEC Eurolab for further expansion of the joint solution from Cohesity and HPE. TEC Eurolab has already realized tremendous efficiency in their operations by using Cohesity for file shares and as a scale-out backup target and will elevate it to the next level by using Cohesity for integrated backup and recovery,” adds Giovanni Golinelli, Pre-Sales Manager, Systems and Storage Architect at NETMIND. “Future native integration of Cohesity with HPE primary storage portfolio including HPE Nimble Storage and HPE SimpliVity will help accelerate this and make Cohesity their data management platform of choice.”

Veritas tested and validated for AWS Outposts; will help customers overcome challenges of on-premises and cloud environments

Veritas Technologies announced this week that it has the capabilities to support AWS Outposts, and has tested it and found that it can help to deliver positive customer outcomes at scale through re-architecting complex workloads to run on AWS.

AWS Outposts are fully managed and configurable compute and storage racks built with Amazon Web Services (AWS)-designed hardware that allow customers to run compute and storage on-premises, while seamlessly connecting to AWS’s broad array of services in the cloud. 

AWS and Veritas customers may have certain workloads that need to remain on-premises for several years, such as applications that are latency sensitive and need to be near on-premises assets. These customers want to be able to run AWS compute and storage on-premises, while easily and seamlessly integrating these workloads with the rest of their applications on AWS. 

Until now, customers lacked the same APIs, tools, hardware, and functionality across on-premises and cloud to deliver a truly consistent hybrid experience. 

AWS Outposts solves these challenges by delivering racks of AWS compute and storage—the same hardware used in AWS public region datacenters—to customers, bringing AWS services, infrastructure, and operating models on-premises. With AWS Outposts, Veritas can help AWS customers overcome the challenges that exist with managing and supporting infrastructures in both on-premises and cloud environments and deliver positive outcomes at scale.

Veritas worked closely with the AWS Outposts team to be one of the first AWS Partner Network (APN) members to successfully test and validate its solution with AWS Outposts. This included the deployment of a NetBackup Amazon Machine Image (AMI) to AWS Outposts and the backup and recovery of workloads for mission critical applications between AWS Outposts and Amazon Simple Storage Service (Amazon S3). 

Validating Veritas NetBackup on AWS Outposts provides the enterprise scale data protection that Veritas is known for to newly extended on-premises environments.

University of Lausanne adopts Cohesity data management platform to boost time and cost savings, backup flexibility, scalability

Cohesity announced this week implementation of a comprehensive data backup solution for the University of Lausanne, located in Switzerland. Working in tandem with local partner Infoniqa, the solution deployed by the university is significantly faster and more automated and scalable than systems previously used. 

A complete backup of the Microsoft Exchange database now only takes eight hours instead of 29 and the incremental backup can be completed in just under two hours instead of the previous 7.5 hours.

With the new solution, the University of Lausanne is realizing simple, fast backup and disaster recovery on a single platform; easier management through integration with VMware and Avamar; significant time and cost savings in data backup and recovery; and compliance according to DSGVO by encryption of critical data.

With over 15,000 students, 5,000 employees, and two million documents, the university manages around 22 PB of logical data. For this purpose, a second backup solution was set up at the Neuchâtel site. 

As the licences for the existing system expired, the university was looking for a state-of-the-art solution that would meet a number of key requirements: secure critical data in encrypted form, high scalability, efficient recovery of mass data, compatibility with EMC NetWorker and the option of a hybrid cloud solution.

“Cohesity and Infoniqa take a modern and holistic approach to data management,” explains Michel Ruffieux, storage backup manager, University of Lausanne. “It was the only solution that met our requirement to secure critical data in encrypted form using a multi-tenant solution with private keys managed on a KMS server using the KMIP protocol.”

Cohesity and Infoniqa were able to combine the old and new backup systems at the University of Lausanne to cover the entire virtualized environment. Infoniqa enabled the platform to be deployed according to the customer’s requirements. Cohesity supplied four appliances, and additional servers can be added to this space-saving cluster in the future. This appliance group can also be used for storage with the same cluster concept.

With the Cohesity’s SnapTree technology, the university can now access the data in a maximum of three steps. Login takes less than five minutes and full flash recovery takes 11.5 hours. In addition, a web interface facilitates the recovery of a Windows or Linux virtual machine with granular files. This approach to using, managing and backing up secondary and primary data is one of Cohesity’s strengths.