3 ms·
Can one detect a ransomware infection early by watching copy-on-write snapshots on a file server?
by akeck 6y ago
Can one detect a ransomware infection early by watching copy-on-write snapshots on a file server?
- gpm 6y agoYou can, the company I work for makes a product that does exactly that. It's very much a last line of defense way of detecting attacks because it means the attackers are already in and already have access to whatever workload is being protected. https://www.rubrik.com/en/products/polaris-overview/polaris-radar https://www.rubrik.com/en/products/polaris-overview/polaris-... Disclaimer: I'm just an engineer (not a sales person/pr/...) and all my comments on HN including this one are entirely my own views/not the companies views.
- AnIdiotOnTheNet 6y agoThere are various strategies. One way that is fairly common is to have canary files that, when modified, trigger alerts and other automated action (locking out the account that did the modification, for instance).
- bpoyner 6y agoVeeam One can alert you to possible ransomware if there is simultaneous high write rate and high CPU usage on a VM.
- freeopinion 6y agoNot all ransoms are about denying the owner use of their data. Some ransoms are about publishing copies of the data.