Protecting data based on a sensitivity level for the data

A computer-implemented method according to an aspect includes determining a sensitivity level for an instance of data, comparing the sensitivity level to one or more policies, and conditionally performing a backup of the instance of data, based on the comparing.

BACKGROUND

The present invention relates to data security, and more specifically, this invention relates to protecting data from malicious activity.

Malware is a constant threat to data security. For example, ransomware is a type of malicious software that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them. This is increasingly becoming a major threat to the organizations, as losing access to critical data can lead to significant financial losses and also loss of reputation and credibility in the market for the organization.

However, current methods to address malware such as ransomware exhibit several deficiencies. For example, current anti-malware implementations perform backups of all data in a system without any filtering criteria, and are therefore time and resource-intensive, as well as slow to implement. There is therefore a need to enhance an effectiveness and efficiency of ransomware mitigation.

SUMMARY

A computer-implemented method according to an aspect includes determining a sensitivity level for an instance of data, comparing the sensitivity level to one or more policies, and conditionally performing a backup of the instance of data, based on the comparing.

In this way, data determined to be susceptible to one or more attacks may be preemptively backed up to a separate data storage location. This may minimize an impact of a malware attack involving the data, which may improve a functioning of computer devices that store and utilize the data. Additionally, instead of backing up all data at an equal rate, data having a higher level of sensitivity may be backed up at a higher frequency when compared to data having a lower level of sensitivity. This may increase an efficiency of backups being performed, and may reduce a utilization of resources (e.g., data bandwidth, processor utilization, etc.) during the performance of backups.

In one aspect, the sensitivity level is determined for the instance of data in response to a creation or modification of the instance of data.

According to one aspect, a computer program product for protecting data based on a sensitivity level for the data includes a computer readable storage medium having program instructions embodied therewith, where the computer readable storage medium is not a transitory signal per se, and where the program instructions are executable by a processor to cause the processor to perform a method including determining, by the processor, a sensitivity level for an instance of data, comparing, by the processor, the sensitivity level to one or more policies, and conditionally performing, by the processor, a backup of the instance of data, based on the comparing.

According to one aspect, a system includes a processor, and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, where the logic is configured to determine a sensitivity level for an instance of data, compare the sensitivity level to one or more policies, and conditionally perform a backup of the instance of data, based on the comparison.

According to one aspect, a computer-implemented method includes determining a sensitivity level for an instance of data, comparing the sensitivity level to one or more policies, and conditionally adjusting one or more access permissions for the instance of data, based on the comparing.

In this way, secure access permissions may be set for data determined to be susceptible to a malware attack. This may minimize an impact of a malware attack involving the data, which may improve a functioning of computer devices that store and utilize the data. Additionally, instead of updating access permissions for all stored data, only data having a higher level of sensitivity may have updated access permissions. This may increase an efficiency of access permission updating, and may reduce a utilization of resources (e.g., processor utilization, etc.) during the performance of access permission updating.

In one aspect, the access permissions are selected from a group consisting of password protection, data encryption, and required access credentials.

According to one aspect, a computer-implemented method includes identifying a creation or updating of an instance of data, analyzing the instance of data and metadata associated with the instance of data, determining a sensitivity level for the instance of data, based on the analyzing, comparing the sensitivity level for the instance of data to one or more policies, and conditionally performing a backup of the instance of data, based on the comparing.

DETAILED DESCRIPTION

The following description discloses several preferred aspects of systems, methods and computer program products for protecting data based on a sensitivity level for the data. Various aspects provide a method for determining a sensitivity level for data, and conditionally backing up the data or changing data permissions for the data based on a comparison of the sensitivity level to one or more policies.

The following description discloses several preferred aspects of systems, methods and computer program products for protecting data based on a sensitivity level for the data.

In one aspect, a computer-implemented method includes determining a sensitivity level for an instance of data, comparing the sensitivity level to one or more policies, and conditionally performing a backup of the instance of data, based on the comparing.

In this way, data determined to be susceptible to one or more attacks may be preemptively backed up to a separate data storage location. This may minimize an impact of a malware attack involving the data, which may improve a functioning of computer devices that store and utilize the data. Additionally, instead of backing up all data at an equal rate, data having a higher level of sensitivity may be backed up at a higher frequency when compared to data having a lower level of sensitivity. This may increase an efficiency of backups being performed, and may reduce a utilization of resources (e.g., data bandwidth, processor utilization, etc.) during the performance of backups.

In one aspect, the sensitivity level is determined for the instance of data in response to a creation or modification of the instance of data.

In another aspect, a computer program product for protecting data based on a sensitivity level for the data includes a computer readable storage medium having program instructions embodied therewith, where the computer readable storage medium is not a transitory signal per se, and where the program instructions are executable by a processor to cause the processor to perform a method including determining, by the processor, a sensitivity level for an instance of data, comparing, by the processor, the sensitivity level to one or more policies, and conditionally performing, by the processor, a backup of the instance of data, based on the comparing.

In one aspect, a system includes a processor, and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, where the logic is configured to determine a sensitivity level for an instance of data, compare the sensitivity level to one or more policies, and conditionally perform a backup of the instance of data, based on the comparison.

In one aspect, a computer-implemented method includes determining a sensitivity level for an instance of data, comparing the sensitivity level to one or more policies, and conditionally adjusting one or more access permissions for the instance of data, based on the comparing.

In this way, secure access permissions may be set for data determined to be susceptible to a malware attack. This may minimize an impact of a malware attack involving the data, which may improve a functioning of computer devices that store and utilize the data. Additionally, instead of updating access permissions for all stored data, only data having a higher level of sensitivity may have updated access permissions. This may increase an efficiency of access permission updating, and may reduce a utilization of resources (e.g., processor utilization, etc.) during the performance of access permission updating.

In one aspect, the access permissions are selected from a group consisting of password protection, data encryption, and required access credentials.

In one aspect, a computer-implemented method includes identifying a creation or updating of an instance of data, analyzing the instance of data and metadata associated with the instance of data, determining a sensitivity level for the instance of data, based on the analyzing, comparing the sensitivity level for the instance of data to one or more policies, and conditionally performing a backup of the instance of data, based on the comparing.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Hardware and software layer60includes hardware and software components. Examples of hardware components include: mainframes61; RISC (Reduced Instruction Set Computer) architecture based servers62; servers63; blade servers64; storage devices65; and networks and networking components66. In some aspects, software components include network application server software67and database software68.

Now referring toFIG. 4, a storage system400is shown according to one aspect. Note that some of the elements shown inFIG. 4may be implemented as hardware and/or software, according to various aspects. The storage system400may include a storage system manager412for communicating with a plurality of media on at least one higher storage tier402and at least one lower storage tier406. The higher storage tier(s)402preferably may include one or more random access and/or direct access media404, such as hard disks in hard disk drives (HDDs), nonvolatile memory (NVM), solid state memory in solid state drives (SSDs), flash memory, SSD arrays, flash memory arrays, etc., and/or others noted herein or known in the art. The lower storage tier(s)406may preferably include one or more lower performing storage media408, including sequential access media such as magnetic tape in tape drives and/or optical media, slower accessing HDDs, slower accessing SSDs, etc., and/or others noted herein or known in the art. One or more additional storage tiers416may include any combination of storage memory media as desired by a designer of the system400. Also, any of the higher storage tiers402and/or the lower storage tiers406may include some combination of storage devices and/or storage media.

The storage system manager412may communicate with the storage media404,408on the higher storage tier(s)402and lower storage tier(s)406through a network410, such as a storage area network (SAN), as shown inFIG. 4, or some other suitable network type. The storage system manager412may also communicate with one or more host systems (not shown) through a host interface414, which may or may not be a part of the storage system manager412. The storage system manager412and/or any other component of the storage system400may be implemented in hardware and/or software, and may make use of a processor (not shown) for executing commands of a type known in the art, such as a central processing unit (CPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc. Of course, any arrangement of a storage system may be used, as will be apparent to those of skill in the art upon reading the present description.

According to some aspects, the storage system (such as400) may include logic configured to receive a request to open a data set, logic configured to determine if the requested data set is stored to a lower storage tier406of a tiered data storage system400in multiple associated portions, logic configured to move each associated portion of the requested data set to a higher storage tier402of the tiered data storage system400, and logic configured to assemble the requested data set on the higher storage tier402of the tiered data storage system400from the associated portions.

Now referring toFIG. 5, a flowchart of a method500is shown according to one aspect. The method500may be performed in accordance with the present invention in any of the environments depicted inFIGS. 1-4 and 9-10, among others, in various aspects. Of course, more or less operations than those specifically described inFIG. 5may be included in method500, as would be understood by one of skill in the art upon reading the present descriptions.

As shown inFIG. 5, method500may initiate with operation502, where a sensitivity level is determined for an instance of data. In one aspect, the instance of data may include a file, an object, etc. For example, the instance of data may include textual data, video data, image data, audio data, etc. In another aspect, the sensitivity level may be determined for the instance of data in response to the creation or modification (e.g., editing, etc.) of the instance of data.

For example, data access may be monitored within a system, and the creation or modification of the instance of data may be identified as a result of the monitoring. In another example, the instance of data may be created or modified within a computing system such as a single computing device, a clustered computing system, a cloud-based computing environment, etc.

Additionally, in one aspect, the sensitivity level for the instance of data may be determined utilizing metadata associated with the instance of data. For example, metadata may be stored with the instance of data during the creation or modification of the instance of data. In another example, the metadata may include one or more of a name of the instance of data, an owner of the instance of data, a file size of the instance of data, a platform in which the instance of data is utilized, a last update time for the instance of data, a time of creation of the instance of data, a heat value for the data, etc. In yet another example, all or a portion of the metadata may be user-defined.

Further, in one aspect, the sensitivity level for the instance of data may be determined by analyzing the instance of data. For example, the analysis of the instance of data may include one or more of parsing text within the instance of data, performing image analysis within the instance of data, performing optical character recognition (OCR) for the instance of data, converting the instance of data to another format (e.g., from a PDF to text, etc.), comparing the instance of data to another instance of data, identifying one or more objects within the instance of data, etc. In another example, the analysis of the instance of data may result in additional metadata for the instance of data. For instance, the additional metadata may include one or more topics associated with the instance of data, one or more keywords found within the instance of data, one or more objects identified within the instance of data, etc.

Further still, in one aspect, the sensitivity level for the instance of data may be determined utilizing the metadata associated with the instance of data, as well as the additional metadata determined for the instance of data resulting from the analysis of the instance of data. For example, the metadata associated with the instance of data, as well as the additional metadata determined for the instance of data resulting from the analysis of the instance of data, may be compared to predetermined metadata.

Also, in one example, the sensitivity level may be determined for the instance of data based on a predetermined number of matches between the predetermined metadata and the metadata associated with the instance of data, as well as the additional metadata determined for the instance of data resulting from the analysis of the instance of data. For instance, a first number of matching metadata may result in a first sensitivity level. In another instance, a second number of matching metadata greater than the first number may result in a second sensitivity level greater than the first sensitivity level.

In addition, in one aspect, a weight and/or value may be assigned to the instance of data for each instance of metadata associated with the instance of data (e.g., the metadata associated with the instance of data, as well as the additional metadata determined for the instance of data resulting from the analysis of the instance of data). In another aspect, the assigned weights and/or values may be summed for the instance of data, and a predetermined sensitivity level corresponding to the summed weight and/or value may be determined.

Furthermore, in one aspect, the sensitivity level for the instance of data may indicate a malware sensitivity of the instance of data, and may be indicate a risk of the instance of data being susceptible to one or more instances of malware (e.g., ransomware, etc.). For example, a predetermined malware threat may be associated with predetermined threat metadata. In another example, if the metadata associated with the instance of data, as well as the additional metadata determined for the instance of data resulting from the analysis of the instance of data matches all or a predetermined percentage of the predetermined threat metadata, the instance of data may be determined to be susceptible to the predetermined malware threat, and may be assigned a predetermined sensitivity level.

Further still, in one aspect, the sensitivity level may include an integer value or any other numerical or textual value. For example, the sensitivity level may include a level within a predetermined scale (e.g., integers from one to ten, etc.). In another aspect, the sensitivity level may be stored in association with the instance of data (e.g., within a database, etc.).

Also, in one aspect, the sensitivity level may be determined for the instance of data in response to the creation or modification of the instance of data. In another aspect, the instance of data may be added to a queue in response to the creation or modification of the instance of data, and the sensitivity level may be determined for the instance of data in response to retrieval of the instance of data from the queue.

Additionally, method500may proceed with operation504, where the sensitivity level is compared to one or more policies. In one aspect, each of the one or more policies may be predetermined. In another aspect, each of the one or more policies may indicate a schedule by which data is to be backed up, as well as a corresponding sensitivity level for the data and/or a backup location for the data.

For example, a policy may indicate that data having a first sensitivity level is to be backed up according to a first frequency, data having a second sensitivity level is to be backed up according to a second frequency different from the first frequency, etc. In another example, the frequency by which the data is backed up may include an associated timeline (e.g., hourly, daily, weekly, etc.). In yet another example, a policy may indicate that data having a predetermined sensitivity level is to be immediately backed up. In still another example, a policy may indicate that data having a first sensitivity level is to be backed up to a first location, data having a second sensitivity level is to be backed up according to a second location different from the first location, etc.

Further, in one aspect, the one or more policies may be stored (e.g., in a database, etc.). In another aspect, the sensitivity level may be compared to the one or more policies in response to the creation or modification of the instance of data. In yet another aspect, the instance of data may be added to a queue in response to the creation or modification of the instance of data, and the sensitivity level may be compared to the one or more policies after the sensitivity level is determined in response to retrieval of the instance of data from the queue.

Further still, in one aspect, the sensitivity level may be stored in a local database with the instance of data (or a pointer to a storage location of the instance of data), and the sensitivity level may be retrieved from the local database and compared to the one or more policies according to a predetermined schedule (e.g., where comparisons are performed periodically, etc.). In another aspect, results of the comparing may include an indication as to whether the instance of data is to be backed up, as well as a time and/or date that the instance of data is to be backed up and/or a frequency by which the instance of data is to be backed up (e.g., according to a schedule indicated by one or more policies, etc.).

Also, method500may proceed with operation506, where a backup of the instance of data is conditionally performed, based on the comparing. In one aspect, results of the comparing may indicate that the instance of data is to be immediately backed up. For example, the instance of data may then be immediately backed up in response to the indication.

In addition, in one aspect, results of the comparing may indicate that the instance of data is to be backed up according to a predetermined schedule. For example, the instance of data may then be flagged as being associated with the predetermined schedule. In another example, a backup application may be notified when the predetermined schedule indicates that a backup of associated data is to be performed. In yet another example, in response to the notification, all data flagged as being associated with the predetermined schedule may be identified and may be backed up.

Furthermore, in one aspect, results of the comparing may also indicate a location where the instance of data is to be backed up. For example, the instance of data may be backed up to the indicated location. In another aspect, performing the backup of the instance of data may include sending a copy of the instance of data to a storage area for storage.

For example, the storage area may include a storage area within the system where the instance of data was created. In another example, the storage area may include a storage area separate from the system where the instance of data was created. In yet another example, the storage area may include one or more databases. In still another example, the storage area may include cloud-based storage, tape storage, disk storage, flash storage, etc. In another aspect, the instance of data may be automatically backed up in response to a determination that the sensitivity level is above a predetermined threshold.

In this way, data determined to be susceptible to a malware attack may be preemptively backed up to a separate data storage location. This may minimize an impact of a malware attack involving the data, which may improve a functioning of computer devices that store and utilize the data. Additionally, instead of backing up all data at an equal rate, data having a higher level of sensitivity may be backed up at a higher frequency when compared to data having a lower level of sensitivity. This may increase an efficiency of backups being performed, and may reduce a utilization of resources (e.g., data bandwidth, processor utilization, etc.) during the performance of backups.

Further, by optimizing backup frequencies for data based on sensitivity level for the data, an amount of data stored during backups may be reduced. This may optimize storage usage during the backup process.

Now referring toFIG. 6, a flowchart of a method600for adjusting access permissions for data based on a sensitivity level for the data is shown according to one aspect. The method600may be performed in accordance with the present invention in any of the environments depicted inFIGS. 1-4 and 9-10, among others, in various aspects. Of course, more or less operations than those specifically described inFIG. 6may be included in method600, as would be understood by one of skill in the art upon reading the present descriptions.

As shown inFIG. 6, method600may initiate with operation602, where a sensitivity level is determined for an instance of data. In one aspect, the sensitivity level may be determined for the instance of data in a manner similar to that described in operation502ofFIG. 5.

Additionally, method600may proceed with operation604, where the sensitivity level is compared to one or more policies. In one aspect, each of the one or more policies may be predetermined. In another aspect, each of the one or more policies may indicate access permissions to be set for the instance of data, as well as a corresponding sensitivity level for the data. For example, a policy may indicate that a first set of access permissions are to be set for data having a first sensitivity level, a second set of access permissions different for the first set of access permissions are to be set for data having a second sensitivity level, etc. In another example, the access permissions may include one or more of password protection, data encryption, required access credentials, etc.

Further, in one aspect, the one or more policies may be stored (e.g., in a database, etc.). In another aspect, the sensitivity level may be compared to the one or more policies in response to the creation or modification of the instance of data. In yet another aspect, the instance of data may be added to a queue in response to the creation or modification of the instance of data, and the sensitivity level may be compared to the one or more policies after the sensitivity level is determined in response to retrieval of the instance of data from the queue. In still another aspect, results of the comparing may include an indication as to the access permissions to be set for the instance of data.

Further still, method600may proceed with operation606, where one or more access permissions for the instance of data are conditionally adjusted, based on the comparing. In one aspect, results of the comparing may indicate that predetermined access permissions are to be set for the instance of data. In another aspect, the predetermined access permissions may be set for the instance of data in response to the indication.

In this way, secure access permissions may be set for data determined to be susceptible to a malware attack. This may minimize an impact of a malware attack involving the data, which may improve a functioning of computer devices that store and utilize the data. Additionally, instead of updating access permissions for all stored data, only data having a higher level of sensitivity may have updated access permissions. This may increase an efficiency of access permission updating, and may reduce a utilization of resources (e.g., processor utilization, etc.) during the performance of access permission updating.

Now referring toFIG. 7, a flowchart of a method700for conditionally backing up data based on a sensitivity level for the data is shown according to one aspect. The method700may be performed in accordance with the present invention in any of the environments depicted inFIGS. 1-4 and 9-10, among others, in various aspects. Of course, more or less operations than those specifically described inFIG. 7may be included in method700, as would be understood by one of skill in the art upon reading the present descriptions.

As shown inFIG. 7, method700may initiate with operation702, where a creation or updating of an instance of data is identified. In one aspect, monitoring may be performed within a system, and the creation or updating of the instance of data may be identified in response to the monitoring.

Additionally, method700may proceed with operation704, where the instance of data and metadata associated with the instance of data are analyzed. In one aspect, the metadata associated with the instance of data may be stored with the instance of data during the creation or modification of the instance of data. In another aspect, the analysis of the instance of data may include one or more of parsing text within the instance of data, performing image analysis within the instance of data, performing optical character recognition (OCR) for the instance of data, converting the instance of data to another format (e.g., from a PDF to text, etc.), comparing the instance of data to another instance of data, identifying one or more objects within the instance of data, etc. In yet another aspect, the analysis of the instance of data may result in additional metadata for the instance of data.

Further, method700may proceed with operation706, where a sensitivity level is determined for the instance of data, based on the analyzing. In one aspect, the sensitivity level may be determined for the instance of data in a manner similar to that described in operation502ofFIG. 5.

Further still, method700may proceed with operation708, where the sensitivity level for the instance of data is compared to one or more policies. In one aspect, the comparing may be performed periodically (e.g., according to a schedule, etc.). For example, the sensitivity level for the instance of data may be stored in association with the instance of data. In another example, periodically, each stored sensitivity level may be compared to the one or more policies.

Also, in one aspect, the comparing may be performed in response to the creation or updating of the instance of data. For example, the comparing may be performed immediately after the sensitivity level is determined. In another example, the sensitivity level may not be stored in association with the instance of data (e.g., at a local storage area such as a database, etc.). In yet another example, the sensitivity level be stored in association with the instance of data when the instance of data is backed up. For instance, the sensitivity level may be stored with the instance of data at the backup location.

In addition, method700may proceed with operation710, where a backup of the instance of data is conditionally performed, based on the comparing. In one aspect, the backup of the instance of data may be conditionally performed in a manner similar to that described in operation506ofFIG. 5.

Now referring toFIG. 8, a flowchart of a method800for dynamically securing data based on metadata associated with a data threat is shown according to one aspect. The method800may be performed in accordance with the present invention in any of the environments depicted inFIGS. 1-4 and 9-10, among others, in various aspects. Of course, more or less operations than those specifically described inFIG. 8may be included in method800, as would be understood by one of skill in the art upon reading the present descriptions.

As shown inFIG. 8, method800may initiate with operation802, where metadata associated with a data threat is determined. In one aspect, the metadata associated with the data threat may be extracted from one or more data sources. In another aspect, the one or more data sources may include one or more news sources, one or more blog posts, one or more social media posts, etc. In yet another aspect, the one or more data sources may be parsed in order to identify the metadata associated with the data threat.

For example, one or more articles, links, or other textual, audio, and/or visual data provided by the one or more data sources may be parsed and/or analyzed in order to determine the metadata associated with the data threat. In another aspect, the metadata associated with the data threat may include an identification of the data threat, one or more types of data susceptible to and/or negatively affected by the data threat, one or more locations where the data threat has occurred, etc. In yet another aspect, the data threat may include one or more instance of malware (e.g., a malware attack, etc.).

Additionally, method800may proceed with operation804, where the metadata associated with the data threat is compared to metadata associated with a stored instance of data. In one aspect, the metadata associated with the stored instance of data may include metadata stored with the instance of data during the creation or modification of the instance of data. For example, the metadata associated with the stored instance of data may include one or more of a name of the instance of data, an owner of the instance of data, a file size of the instance of data, a platform in which the instance of data is utilized, a last update time for the instance of data, etc.

Further, in one aspect, the metadata associated with the stored instance of data may include additional metadata determined by analyzing the instance of data. For example, the analysis of the instance of data may include one or more of parsing text within the instance of data, performing image analysis within the instance of data, performing optical character recognition (OCR) for the instance of data, converting the instance of data to another format (e.g., from a PDF to text, etc.), comparing the instance of data to another instance of data, identifying one or more objects within the instance of data, etc. In another example, the additional metadata may include one or more topics associated with the instance of data, one or more keywords found within the instance of data, one or more objects identified within the instance of data, etc.

Further still, in one aspect, the metadata associated with the data threat may be compared to the metadata associated with the stored instance of data in order to determine whether the stored instance of data is susceptible to the data threat.

Also, method800may proceed with operation806, where one or more security aspects of the stored instance of data are conditionally adjusted, based on the comparing. In one aspect, one or more security aspects of the stored instance of data may be adjusted in response to determining a predetermined amount of matching metadata between the metadata associated with the data threat and the metadata associated with the stored instance of data. In another aspect, one or more security aspects of the stored instance of data may be adjusted in response to determining that the metadata associated with the data threat is associated with the metadata associated with the stored instance of data.

Additionally, in one aspect, one or more security aspects of the stored instance of data may be adjusted in response to determining that the stored instance of data is susceptible to the data threat, based on the comparing. In another aspect, conditionally adjusting the one or more security aspects may include changing a sensitivity level for the stored instance of data. In yet another aspect, conditionally adjusting the one or more security aspects may include immediately backing up the stored instance of data. In still another aspect, conditionally adjusting the one or more security aspects may include adjusting one or more data permissions for the stored instance of data.

In this way, data susceptible to a data threat may be identified and protected in response to the dissemination of information associated with the data threat.

FIG. 9illustrates an exemplary policy-based sensitive data backup environment900, according to one exemplary aspect. In one aspect, the environment900may be implemented within a single system, within one or more nodes of a multi-node cluster, a cloud computing environment, etc.

Additionally, in one aspect, a data monitoring module902identifies the creation or modification of an instance of data. For example, the data monitoring module902may monitor actions performed on data, and may identify the creation or modification of the instance of data as a result of such monitoring. In another aspect, the identified creation or modification of the instance of data may be sent as an event from the data monitoring module902to a data analysis and management module904. In yet another aspect, metadata associated with the instance of data (e.g., name, owner, file size, etc.) may also be sent from the data monitoring module902to a data analysis and management module904.

Further, in one aspect, the data analysis and management module904may store the event and any associated metadata received from the data monitoring module902. For example, the data analysis and management module904may store the event and metadata in a key value store of the data analysis and management module904. In another aspect, the data analysis and management module904may analyze the instance of data to determine additional metadata (e.g., topics, keywords, etc.) for the instance of data. In one aspect, this analysis may be performed utilizing one or more neural networks.

Further still, in one aspect, the data analysis and management module904may determine a sensitivity level for the instance of data, based at least in part on the associated metadata and the additional metadata. The data analysis and management module904may then store the sensitivity level for the instance of data with the instance of data (e.g., as sensitivity metadata, etc.).

Also, in one aspect, a policy engine906may retrieve the sensitivity level for the instance of data from the data analysis and management module904, and may compare the retrieved sensitivity level to one or more data backup policies. In one aspect, the policy engine906may retrieve and compare a plurality of sensitivity levels according to a predetermined schedule. In another aspect, the policy engine906may retrieve and compare the sensitivity level in response to receiving an identification of the creation or modification of the instance of data from the data monitoring module902.

In addition, in one aspect, results of comparing the retrieved sensitivity level to one or more data backup policies may include data backup information for the instance of data (e.g., an indication as to whether the instance of data is to be backed up, as well as a time and/or date that the instance of data is to be backed up and/or a frequency by which the instance of data is to be backed up, etc.). This data backup information may be sent from the policy engine906to a data backup module908. The data backup module908may then back up the instance of data according to the received data backup information.

Furthermore, in one aspect, the policy engine906may receive an immediate notification from the data analysis and management module904in response to a determination by the data analysis and management module904that the instance of data has a sensitivity level above a predetermined threshold.

FIG. 10illustrates an exemplary threat-responsive data backup environment1000, according to one exemplary aspect. In one aspect, the environment1000may be implemented within a single system, within one or more nodes of a multi-node cluster, a cloud computing environment, etc.

Additionally, in one aspect, a data threat monitoring module1002monitors one or more data sources. In another aspect, as a result of the monitoring, the data threat monitoring module1002identifies an existing data threat, and extracts threat metadata associated with the threat. In yet another aspect, the data threat monitoring module1002sends the threat metadata to a data analysis and management module1004.

Further, in one aspect, the data analysis and management module1004compares the threat metadata to stored metadata associated with a stored instance of data. The comparison may be performed in a manner similar to that described in operation804ofFIG. 8. In response to determining that the stored instance of data is susceptible to the data threat, an identification of the instance of data is sent from the data analysis and management module1004to a security module1006.

Further still, in one aspect, the data analysis and management module1004may update a sensitivity level for the instance of data, in response to determining that the stored instance of data is susceptible to the data threat. In another aspect, the update sensitivity level and/or an indication of one or more security actions (e.g., backing up the instance of data, changing data permissions for the instance of data, etc.) may be sent from the data analysis and management module1004to the security module1006with the identification of the instance of data.

Further still, in one aspect, the security module1006may implement one or more security actions for the instance of data. For example, the security module1006may implement one or more security actions received from the data analysis and management module1004. In another aspect, the security module may compare the sensitivity level for the instance of data to one or more thresholds, and may perform one or more security actions in response to determining that the sensitivity level for the instance of data exceeds one or more thresholds. In yet another aspect, the security module1006may automatically implement one or more security actions in response to receiving the identification of the instance of data from the data analysis and management module1004.

There have been guidelines and techniques to mitigate and/or minimize the impact of ransomware attacks on enterprise critical data. For example, use of regular backups of the data can minimize the data losses caused by ransomware attacks.

But, there are practical challenges applying these techniques. For example, it is practically challenging to take backups of the whole data, when an organization is generating large quantities of data every day. Also, in some cases ransomware attackers know that nightly backups are taken, so data access may be locked at the end of the day to maximize the impact of an attack. However, an increase the backup frequency may lead to more cost to the backup solution.

In another example, regularly checking and fixing data permissions may be difficult, as practically scanning large quantities of data at regular intervals and checking for appropriate permissions is challenging.

As a solution, business critical data may be identified based on cognitive techniques and data-insights, and based on that information, enhanced and optimized techniques for data-aware mitigation for ransomware attacks may be performed.

A data analysis and management platform may implement techniques to mitigate or minimize the impact of ransomware attack. For example, the data analysis and management platform may provide a real-time view of the data across multiple data-islands in a typical customer data center, based on the system and custom metadata for this data. It also provides techniques to enrich the metadata with data deep inspection, using carious cognitive techniques. Thus, based on the data content and custom/enriched metadata we can identify critical data for the organization when the data is created or updated.

If data is determined to be sensitive based on the system definition or user defined sensitivity criteria, the data analysis and management platform can set a frequency of the data backup policy, for the particular data. Setting more frequent backups on data marked with a tag (e.g., a “Sensitive:True” tag, etc.) may minimize business critical data loss in case of a ransomware attack as the most recent copy of critical data may be available on a backup system. In another example, an air gap copy of the critical data may be made based on the data content and custom tags (e.g. sensitive), where an air gap copy entails making a copy on tape, exporting it from a tape library or putting it in a virtual tape vault and updating the state (e.g. file/tape/export info) in the data analysis and management platform.

Also, a live backup may be triggered for highly sensitive data, based on live events.

Additionally, a news consumer may periodically query a news discovery service, and may parse most recent news articles reporting about ransomware attacks and may filter out specific industries or type of data or locations where these attacks are happening using concept extraction and filtering.

Then based on these live triggers, the news consumer may determine potential candidates for similar ransomware attacks based on the live news feeds and may trigger backups of such sensitive documents.

In addition to the enhanced data backup techniques mentioned above, an efficient method is provided to check and toggle data access privileges and set more restrictive permissions for a select set of sensitive files/directories based on data-aware policies, so that these files cannot be modified or erased by other users, including intruders trying to execute a ransomware attack. A ransomware remediation dashboard may also be provided that shows all air-gapped copies of data, based on data classification and tagging such as sensitive, and the location of the latest backup along with associated ransomware remediation data protection policies.

In one aspect, a method for backing up business critical data includes inputting real time data and metadata from across a plurality of data storage systems into a centralized system, performing deep data inspection on the metadata, using cognitive techniques, identifying critical data, and for critically sensitive data based upon the policy, adjusting the backup frequency of said critically sensitive data.

In one aspect, an air gap copy of the critical data may be made based on the data content and custom tags (e.g. indicating the data as sensitive), where an air gap copy entails making a copy on tape, exporting it from the tape library or putting it in a virtual tape vault and updating the state (e.g. file/tape/export info) in the centralized system.

In another aspect, live backups may be triggered for highly sensitive data, based on live events. In yet another aspect, ransomware news events may be monitored to find potential candidates for similar ransomware attacks based on live news feeds, and trigger backups of such sensitive documents.

In another aspect, data access privileges may be checked and adjusted, and more restrictive permissions may be set for a select set of sensitive files/directories based on data-aware policies, so that these files cannot be modified or erased by other users, including intruders trying to execute a ransomware attack.

In another aspect, a ransomware remediation dashboard may show all of the air gapped copies of data, based on data classification and tagging such as “sensitive,” and the location of the latest backup along with the associated ransomware remediation data protection policies.

In this way, data to be backed up at higher frequencies may be classified. Additionally, metadata may be captured from source storage devices (e.g., bulk load+live indexing) and inserted into the data analysis and management platform for analysis. Further, source data to be encrypted according to a line of business may be tagged. Further still, deep data analytics may be performed on the source data to gain further insights.

Also, additional tags may be added to the data, based on deep data insights, that depict the level of sensitivity for the data. In addition, advanced queries may be performed to the data analysis and management platform leveraging a corpus of information to drive candidates for backups at varying frequency levels based on data sensitivity levels. In this way, many files may be queried in a short amount of time, which may eliminate a need to scan for encryption.

Further, data may be backed up with an appropriate frequency based on the sensitivity level of the data. Further still, air-gap copies of data may be created utilizing a tape/virtual tape vault. Also, live notifications may be received about an outbreak of ransomware attack in certain industries, and defensive action may be taken immediately based on one or more policies to protect sensitive data with an elevated backup frequency or adjusted data permissions.