Which is a more devastating impact from a ransomware attack: the encryption of just about everything brining production to a halt, or the theft and publication of terabytes of sensitive data? Regardless of which answer you choose, today’s ransomware attacks zero in on your accessing most important, critical, sensitive, and valuable data. New storage protection concepts like cyberstorage offer organizations an ability to prevent the success of ransomware attacks, but not everyone has cyberstorage today… or do they?

1. The Role of Cyberstorage in Stopping
Modern Ransomware Attacks
Nick Cavalancia
4-time Microsoft Cloud and Datacenter MVP, CEO of Conversational Geek
1
1

2. The current state of ransomware attacks
2
of ransomware
attacks include
exfiltration
and extortion
96%
have
lateral
movement
70%
include
compromising
credentials
40%
include
encryption,
reconfiguration,
data destruction
90%

3. The Ransomware Attack Chain
3
Intrusion
Kill Chain
Horizontal Kill Chain
Entry, Authentication,
Control, Persistence,
Stealth Lateral Movement
Ransomware Kill Chain

4. Defining cyberstorage – present and future
4

5. What makes up cyberstorage
from Gartner’s perspective?
“Cyberstorage protects storage system data against
ransomware attacks through early detection and blocking
of attacks
5
, and aids in recovery through analytics to
pinpoint when an attack started. The solutions can be
pure software, a dedicated appliance or fully integrated
with the data storage solution.”

6. What makes up cyberstorage
from Gartner’s perspective?
● Prioritize active protection of unstructured data
storage systems on the grounds that limiting or
blocking an attack is better than recovering from one
● Storage should have ransomware detection, blocking,
and recovery as part of their roadmap.
● Do not treat cyberstorage products as an alternative to
backup, immutable vaults, network monitoring or
disaster recovery
6
Prevent
Protect
Layer

7. Building your ransomware
“cyberstorage” strategy
7
Intrusion
Kill Chain
Horizontal Kill Chain Ransomware Kill Chain
Prevent Protect Layer

8. Building your ransomware
“cyberstorage” strategy
8
Intrusion
Kill Chain
Horizontal Kill Chain Ransomware Kill Chain
Prevent Protect Layer

9. Building your ransomware
“cyberstorage” strategy
● Involves using what you have in place today
● More about a focus based on actual threat actor actions
● That is, until you adopt a mature-enough cyberstorage solution
9

10. Manage. Support. Protect.