Nutanix Adds Ransomware Protections to Help Secure Customers' IT Environments

Nutanix, Inc. announced additional ransomware protections in its cloud platform.

These include threat monitoring and detection, as well as more granular data replication and robust access controls all natively built into the Nutanix stack. These new capabilities build on the company’s data services for network security, files and objects storage, virtualization, and BC to help enterprises prevent, detect and recover vs. ransomware attacks across multiple cloud environments. At a time when attacks are becoming even more common due to the rise of remote work, these capabilities make it to implement security and BC best practices at the infrastructure level, rather than rely on a complex matrix of bolt-on security products.

A recent Gartner report⁽¹⁾ shared that: “In 2020, in particular, there have been swift changes to threats with increased remote work and targeted malware campaigns that take advantage of worldwide events, such as Covid-19. Ransomware has evolved beyond the commodity, widespread attacks intended to infect a single endpoint to include more advanced techniques, such as fileless malware and data exfiltration […]. These new strains of ransomware make prevention and planning more important than ever to prevent ransomware attacks.”

Organizations, especially those with large remote user populations or hybrid work environments, cannot rely on a single action or tool to protect themselves. They need to ensure their IT infrastructure allows them to best respond to these incidents.

Detect and recover from network and data threats
The company’s cloud platform now delivers anomaly detection based on ML and IP reputation services with the firm‘s security networking operations and monitoring solution, Flow Security Central, a feature with Nutanix Flow. It helps identify known attack vectors, including potential ransomware, at the network level before reaching the application and data layers. Specifically, it monitors networks for anomalies, malicious behavior, as well as common network attacks that propagate by searching for additional vulnerable targets. It also monitors endpoints to identify traffic coming from disreputable locations, something especially helpful for defending VDI deployments that are prime targets for initial ransomware infection and spread.

Closer to the application layer, the firm’s cloud platform also includes native ransomware detection for file storage services within Nutanix Files. File analytics, which is a feature included with Files, detects abnormal and suspicious access patterns and identifies known ransomware signatures to block data access in real-time. To help ensure snapshots are available when needed, File analytics identifies file shares where replication and snapshots have not been configured appropriately and alerts IT administrators to this potential risk. Files also provides immutable snapshots preventing tampering and deletion which are common attack vectors in ransomware payloads to hinder recovery attempts. Recovery is accelerated via native snapshot capabilities when enabled on file shares. With these capabilities natively integrated into Files, IT professionals can not only detect but also quickly recover from ransomware attacks using native tools.

Protect data and applications
To further protect application data from ransomware attacks, the firm’s cloud platform includes features within the object storage solution, Nutanix Objects. Objects includes more granular permissions to access object data for primary and secondary storage. Specifically, Objects offers the ability to configure WORM policies for individual files and objects selected by an IT team to help guard vs. unauthorized deletion or encryption of data, thwarting many common ransomware attacks. These WORM protections can be automated by simply classifying data under a ‘legal hold’ to prevent tampering or malicious destruction. Additionally, Objects’ locking features were reviewed and attested to by Cohasset Associates as meeting the non-rewritable, and non-erasable storage requirements for electronic records as specified under the relevant SEC, FINRA, and CFTC regulations.

Objects also provides data access permissions at a granular bucket level so IT administrators can better secure multi-tenant environments. Lastly, the company’s platform now delivers support for Windows Credential Guard for VMs and virtual desktops running on the AHV hypervisor. Credential Guard adds OS protection from malware using credential theft attacks on Microsoft OS environments, a common vector used by ransomware to gain administrative privileges.

Ensure BC
While detection and prevention are both key aspects of an effective strategy to protect vs. malware and ransomware, all companies should have a plan to ensure BC in the event of an attack. Nutanix Mine, the company’s secondary storage solution, provides direct backup to Objects when using Mine in conjunction with solutions from partner HYCU Inc. This means all ransomware protection natively available in Objects, such as immutability and WORM, will also be applied to this secondary storage solution. Additionally, the company has obtained interoperability qualifications, including Veeam Object Immutability as well as certifications with other backup vendors, to extend ransomware protections to secondary storage.

“CIOs and CISOs know that there is no one solution that provides 100% protection vs. ransomware or other types of malware attacks, and the current remote and hybrid work models widen an enterprise’s attack surface,” said Rajiv Mirani, CTO. “Enterprises need a defense in depth approach to security, starting with their IT infrastructure. However, the right security tools need to also be simple and seamless to implement. Nutanix delivers a strengthened cloud platform out of the box, with an even richer set of ransomware protections available.“

All these features are available to customers.

Click to enlarge