ExaGrid’s Retention Time-Lock for Ransomware Recovery is in addition to the long term-retention of backup data and utilizes 3 distinct functions:
Immutable data deduplication objects.
Non-network-facing tier (tiered air gap).
Delayed delete requests.
When ransomware strikes, it is critical to have backups insulated from the malicious encryption/damage since they may be your last line of defense. ExaGrid helps insulate backups in the following ways...
Comprehensive access security...
ExaGrid shares can be accessed only from designated backup/media servers. While those servers may also be subject to rampant ransomware, the fewer servers that have access to your backups, the better.
SMB signing can be enabled for ExaGrid shares, requiring Windows account credentials to be authenticated and authorized before access is granted to an ExaGrid share, further reducing the chance of malicious access to backups.
Veeam Accelerated Data Mover shares require a separate Veeam password and are accessible only via SSH, which also reduces the chance of malicious access to Veeam backups.
All accounts used to manage the ExaGrid software are protected using non-default passwords. This includes the backup “admin” account, the special ExaGrid customer support account, and root access.
ExaGrid software is updated at least quarterly with the latest appropriate CVE fixes, reducing the ways ransomware can gain access to ExaGrid servers. Software may be updated more frequently as dictated by CVE severity.
Each ExaGrid server runs a proper firewall and a customized Linux distribution that opens just the ports and runs just the services necessary for receiving backups, web-based GUI, and ExaGrid-to-ExaGrid replication.
Communications between ExaGrid servers is secured using Kerberos authorization and authentication, protecting from a “man in the middle” attack from malicious users or software.
Invoke recover mode.
ExaGrid’s Retention Time-Lock clock is stopped with all deletes put on hold indefinitely until data recovery operation is complete.
The backup administrator can carry out the recovery using the ExaGrid GUI, but since this is not a common operation, we suggest contacting ExaGrid customer support.
Determine time of the event so you can plan the restore.
Determine which backup on the ExaGrid completed deduplication before the event.
Perform restore from that backup using the backup application (Veeam).
ExaGrid advantages are:
Long term-retention is not impacted and retention time-lock is in addition to the retention policy.
Immutable deduplication objects cannot be modified, changed or deleted (outside of the retention policy).
Manage a single system instead of multiple systems for both backup storage and ransomware recovery.
Unique second Retention Tier that is only visible to ExaGrid software, not to the network – (tiered air gap).
Data is not deleted as delete requests are delayed and therefore ready to recover after a ransomware attack.
Daily, weekly, monthly, yearly, and other purges still occur, but are simply delayed, to keep storage costs in line with the retention periods.
Requires up to an additional 2% to 10% of repository storage.
Storage does not grow forever and stays within the backup retention period set to keep storage costs down.
All retention data is preserved and is not deleted.
Useful links...
ExaGrid-specific information for Veeam KB2660 - by ExaGrid
ExaGrid releases software Version 6.0 with Retention Time-Lock for Ransomware Recovery feature - by HelpNetSecurity
7 Practical tips to prevent ransomware attacks on backup storage - by CenterGrid
ExaGrid and Veeam - Protecting backup data from Ransomware - by Mike Tonks
ExaGrid Time-Lock – Who’s (still) afraid of ransomware? - by ElasticSky
ExaGrid Concludes 2020 with 7 Industry Award Wins and New Ransomware Recovery Solution - by FinancialPost
ExaGrid Concludes 2020 with 7 Industry Award Wins and New Ransomware Recovery Solution - by BusinessWire
Retention Time-Lock for Ransomware Recovery - by ExaGrid
Deduplication Appliance Best Practices - by Veeam
