How Storage Systems Can Detect Ransomware Early
· 10:57 · Watch on YouTube ↗
Summary
The video explains how storage systems can detect ransomware through changes such as rising data entropy, reduced compressibility and mass file operations, and recommends resilient backups and coordinated response planning.
Key points
- The video recommends keeping software patched, training users to avoid unknown attachments and using endpoint protection as part of ransomware defense.
- Storage systems may detect ransomware early by monitoring data access and writes for deviations from established behavior.
- Potential signals include increased data entropy, reduced compressibility or deduplication, bursts of mass overwrites and mass file renames; combining signals against a baseline may help reduce false alarms.
- Backups should be recent, redundant, recoverable and immutable, and organizations should test recovery.
- The video advises planning and testing a fast, coordinated response, including isolating affected systems and restoring critical data from a clean recovery point.
- Connecting storage alerts to SIEM and SOAR systems can provide broader context and help automate mitigation and recovery actions.
Article Details
- Topics
- [00:22] Ransomware threat and organizational impact
- [01:13] General ransomware prevention measures
- [02:13] Storage as an early indicator of data encryption
- [03:01] The four backup qualities: recent, redundant, recoverable and immutable
- [04:14] Storage monitoring and data-change signals, including entropy and compressibility
- [07:18] Combining activity signals with baselines to detect anomalies
- [08:31] Coordinated response and integrating storage alerts with SIEM and SOAR