SNIA Developer Conference September 15-17, 2025 | Santa Clara, CA
Fighting Ransomware Using Intelligent Storage
Abstract
Ransomware is an acknowledged threat, and protecting your data must be a security-in-depth exercise. We discusses how Intelligent Storage can detect and recover from an attack while maintaining administrative isolation from compromised servers. While this method is only a single layer of a defence-in-depth infrastructure, it can be implemented invisibly on existing workloads and storage which can gather the proper sets of metrics.
Learning Objectives
- Understand the value baseline measurements of metrics for your workloads.
- Identify patterns of anomalies in metrics which indicate probably infections.
- Utilize metrics to infection zero-day for restorations and the process to validate that restore.
Related Sessions
DOTS - A Simple, Visual, Method for Preserving Digital Infomation
DOTS is the only digital storage designed to be read with a camera employing standard image processing techniques. Data is recorded visually on patented phase-change metal alloy tape at a microscopic density that rivals the capacity of current magnetic tapes. DOTS can record any digital file format, visible text, and imagery on the same media. Using a visual method to represent the data ensures, as long as cameras and imaging devices are available, the information will always be recoverable, and backwardly compatible to the 1st generation. DOTS™ is Write-Once Read Many (WORM) storage, tamper-proof, cannot be erased, and supports external compression and data encryption, making it a secure and robust archive technology. It is non-magnetic, chemically inert, immune to electromagnetic fields (including EMP), and can be stored in normal office environments or extremes ranging from -9º to 66º C (16º to 150º F) With visual technologies such as photographic prints or negatives and paper text documents, one can look directly at the medium to access the information. With all magnetic media, complex optical, biologic, or holographic storage, a machine and software are required to read and translate the data into a human-observable and comprehensible form. If the machine or software is obsolete or lost, the data is likely to be lost as well. It is critical that the method employed to protect the data must be unencumbered by complicated technology. DOTS is designed to ensure both those preservation and comprehension demands can be met. The presentation will not only explain how DOTS works, but also explain that taking advantage of DOTS visual characteristics, we have come up with a patented method for preserving digital images and sound that ensure they will always be readable for hundreds of years without any file format or operating system dependencies.
A Quintuple Parity Error Correcting Code - A Game Changer in Data Protection
We describe a replacement for RAID 6, based on a new linear, systematic code, which detects and corrects any combination of E errors (unknown location) and Z erasures (known location) provided that Z+2E≤4. The code is at the core of a RAID technology called PentaRAID, for which the two co-inventors were awarded a US utility patent. The problem that we address is that of weak data protection of RAID 6 systems. The known vulnerability is that RAID 6 may recover from not more than 2 failed disks in a RAID, if we know which disks failed. If we do not know which disks are the source of errors, we are protected from only 1 disk failure. Moreover, if 1 disk fails, the failed data needs to be recovered, and with hard disks reaching 40TB, the recovery process lasts for weeks (degraded mode). While in degraded mode, the second disk failure results in a system with no error detection and correction. In addition, Undetected Disk Errors (UDE) can only be detected but not corrected event with one failed disk. The natural solution is to increase redundancy from 2 to more disks. There is very little payoff from using 3 disks. It turns out that a practical solution is possible with 5 redundant disks, and this solution is employed in PentaRAID. The payoff is immense, as the RAID extends Mean Time to Data Loss (MTDL) from days to far beyond the age of the universe (100 quadrillion years) under typical assumptions in regard to disk error rates. The new RAID can tolerate a loss of 2 drives at unknown locations (thus seemingly operating normally but generating UDE), and up to 4 disks at known locations, e.g. due to power failure (typically detected by the disk controller). In addition, the recovery process involves a fixed, small number of Galois field operations per error, and therefore has virtually fixed computational cost per error, independent of the number of disks in the array. Parity calculation has also constant time per byte of data, if distributed computation is utilized. In short, the computational complexity is on the par with that of RAID 6. Notably, the solution does not require Chien search commonly used in Reed-Solomon coding, which makes it possible to utilize large Galois fields. The application of the new technology will dramatically increase data durability with significant reduction of the number of hard disks necessary to maintain data integrity, and will simplify the logistics of operating RAID in degraded mode and recovery from disk failures.
“Streaming Replication” of Object Storage System Data to achieve Disaster Recovery.
Object Storage is increasingly getting used on premises for a variety of use cases some of which consist of primary and critical applications. Such use cases and applications require enterprise grade Data protection and disaster recovery capabilities. Replication of S3 compatible Scale Out Object Storage presents unique challenges that are unlike found in traditional block or file storage. Replication of object storage system is done at individual bucket and object level and it not only has to deal with data replication but also object specific constructs like metadata and tags. Streaming replication provides a near synchronous and eventually consistent approach to replicate object storage data.
Hardening OpenZFS to Further Mitigate Ransomware
While the Open Source cross-platform OpenZFS file system and volume manager provides advanced block-level features including checksumming, snapshotting, and replication to mitigate ransomware at the POSIX level, the evolving nature of ransomware dictates that no technology should rest on its laurels. This developer and administrator-focused talk will explore strategies for hardening OpenZFS and its supported operating systems towards a goal of total storage immutability without authorization. Achieving this goal will require operating system-level mitigations with a focus on multi-factor authentication (MFA) and authorization.
Fighting Ransomware Using Intelligent Storage
Ransomware is an acknowledged threat, and protecting your data must be a security-in-depth exercise. We discusses how Intelligent Storage can detect and recover from an attack while maintaining administrative isolation from compromised servers. While this method is only a single layer of a defence-in-depth infrastructure, it can be implemented invisibly on existing workloads and storage which can gather the proper sets of metrics.
LTO Technology and Two-dimensional Erasure-coded Long-term archival storage with RAIL Architecture
This is a two-part detailed technology presentation on LTO, erasure codes, and archival storage. In the first part, we will cover core LTO technology by reviewing areal density roadmaps, physical and logical LTO formats, and data durability for long-term archival applications including environmental requirements. In the second part, we will discuss new two-dimensional erasure-coded tape for durable and available long-term data storage where random access is used. Tape has recently reemerged as the lowest cost medium for different levels of cold data in archival data storage. The old cliche about tape being dead is no longer the case. Instead, the new feeling is that tape has found a new home in hyperscaler data centers. This is due to three key factors: total cost of ownership (TCO), roadmap, and durability—a must for the new zettabyte era of cold data storage. In this era, the consensus among analysts is that data is growing at approximately 40 to 50 percent per year. IDC estimates that by 2025 there will be 7 trillion gigabytes of cold archive data to manage. This which is why tape has reemerged as the unprecedented cold storage medium of choice. However, these massive scaling predictions have resurfaced some of the old challenges with new requirements as areal densities increase—such as typical tape and drive errors, human interactions, and environmental conditions. When we consider the fact that systems (due to low TCO) may operate in an open environment using cartridge to drive ratios around 100:1 with complicated robotics libraries, the need for a different data protection policy with adaptive drive and media management other than legacy copy systems becomes important. In this presentation we will introduce a new erasure-coded tape architecture using Redundant Array of Independent Libraries (RAIL) to solve this complex problem by offering lowest the TCO cold storage system with high data durability and availability.
