DATASHEET

Cohesity FortKnox
on Microsoft Azure
Cyber Vaulting and Recovery as a Service

Data powering business operations is more valuable than ever. Itis also more vulnerable than ever to cybersecurity threats, power
outages and natural disasters. This reality has forced organizations
to rethink their approaches to the 3-2-1 strategy of backing up data—
three copies of data, on two different media, with one of them in anoff-site environment. Although a traditional air gap model wheredata is stored on magnetic tapes and moved off-site for data isolation
ensures data security in the face of increasing ransomware attacks,
it impedes rapid recovery which prevents teams from achieving
stringent service-level agreements (SLAs). To stay competitive while
protecting data, enterprises are embracing a modern 3-2-1 strategy
that includes a virtual air gap with physical separation and network
isolation and provides both secure and highly available data.

HighAir Gap(Offsite Tape)

VirtualAir Gap

Physical
Separation
and Network
Isolation

Local
Backup
LowSlow

Speed of Recovery

FastFigure 1: Modern data isolation via virtual air gap balances security and agility

Modern Air Gap for the Cloud Era
Cohesity FortKnox powers a modern 3-2-1 strategy for the cloud era

operational isolation. FortKnox dramatically simplifies operations andthat effectively balances organizations’ security and agility priorities.

lowers costs, eliminating the complexity and resource requirements

A SaaS cyber vaulting and recovery solution, FortKnox improves cyberof internally managed isolation solutions. FortKnox is a cloud service

resiliency with an immutable copy of data in a Cohesity-managed

empowering organizations to prepare for and recover quickly andcloud vault via a virtual air gap. Organizations relying on FortKnox

confidently from attacks with granular recovery back to the source orgain an additional layer of security against ransomware and otheran alternate location, including the public cloud. Currently, FortKnox

cybersecurity threats through physical separation, and network andsupports data vaulting on Microsoft Azure.

DATASHEET | Cohesity FortKnox

Cohesity
managedCustomermanaged

FortKnox
Dynamic Connection /“Virtual Air Gap”

Cohesity Data Cloud
Backup copy

Primary Location

Vaulted copy

Data Recovery

Data Center/Edge/Cloud

Data Recovery

CustomermanagedCohesity Data Cloud
Alernate Location
Data Center/Edge/Cloud

Figure 2: Cohesity FortKnox boosts cyber resilience with data recovery back to the source or to an alternate location

Key Benefits
Managing data vaults on-premises or in the cloud can be complicatedand costly for internal teams, particularly as they encounter skills
gaps and ever-more destructive ransomware that deletes backups
and steals data. FortKnox overcomes these obstacles with a newdata isolation technique that improves data resiliency amid risingor the associated cloud storage or egress costs, as they are coveredin the FortKnox subscription. When teams need to safely deposit
data to the cloud vault or recover it quickly, Cohesity establishes atemporary and highly secure network connection that limits accessto the isolated data by cybercriminals and unauthorized insiders

ransomware attacks.

while supporting business SLAs. Teams can leverage FortKnox data

Additional Protection Layer Safeguards Data andReputations

does FortKnox minimize enterprise attack surfaces, it also reduces

FortKnox is an integral part of the multilayered cyber resilientarchitecture built on the notion of least privilege and segregation ofduties with granular Zero Trust security principles. It keeps bad actors
at bay with advanced access controls and early threat detection
capabilities. FortKnox stores an immutable copy of data in a Cohesitymanaged cloud vault via a configurable transfer window or virtual
air gap and that copy of data is further protected with safeguards.
These include role-based access (RBAC), encryption, multi-factor
authentication (MFA), a WORM lock policy, and a quorum rule that
requires at least two employees to approve any critical actions,protecting data from unauthorized access or tampering. FortKnox
allows for the management of global data vaults through a single
UI and also automatically scans for cybercrimes by monitoring
anomalous snapshots.

As-a-Service Consumption Dramatically Simplifies
Operations and Lowers Costs
In a pay-as-you-grow service that keeps costs down, FortKnox
empowers organizations to simply connect, vault, and recover data.
No need to worry about deploying and maintaining “DIY” data vaults

vaulting and recovery with customizable protection policies. Not only
the likelihood of a data breach.
Cohesity also provides customers greater flexibility to address varied
RTO and budget requirements by providing a choice of FortKnox
storage tier options—a warm storage tier for immediate data
recoveries, suitable for ransomware protection use cases, as well asa more cost-effective cold storage tier with RTOs of up to 12 hours,
suitable for compliance use cases.

Rapid Recovery Saves Time and Improves BusinessContinuity
FortKnox delivers fast, granular recovery of data back to thesource or an alternate location, enabling enterprises to be moreagile. Preferred recovery sites may be onsite, a public cloud (e.g.,Amazon Web Services, Microsoft Azure, Google Cloud Platform), oran edge location. Since FortKnox prevents vaulted data from being
modified, organizations with compromised or lost production data
can be confident knowing that they can easily identify and recover
an untainted copy of data. In contrast to legacy backup and air gap
solutions, FortKnox simplifies the recovery of specific files and objects
quickly—without having to restore whole data volumes.

DATASHEET | Cohesity FortKnoxSpecifications• Configurable transfer window, outside of which vault is locked from writing into/read access
Virtual Air Gap• Vaulted data copy isolated from customer environment with physical separation, network andmanagement isolation, aka virtual air gap• Isolation from customer’s own cloud instance

Immutability• DataLock (WORM) using Immutable storage for Azure Blob
• Read-only snapshots prevents intentional or unintentional modifications or deletions of vault data
• Data-at-rest and data-In-flight Encryption

Data Security• Flexible Cohesity or customer-managed KMS• Quorum controlled recoveries to minimize data exfiltration vectors• Multi-factor authentication• Granular role-based access control

Access Control• Quorum for critical actions including recoveries• Short-lived token based authentication to access vault• Authenticated API call-based access over HTTPS• Access limited to authorized Cohesity clusters only

Ransomware Detection
Rapid Recovery• Machine learning-based anomaly detection and reporting• Machine driven recommendation of clean snapshot for faster incident response• Quick, granular recovery back to source or alternate location to meet stringent SLAs
• SaaS solution that’s as simple as connect, vault, and recover

As a Service Consumption• Data vaulting and recovery with customizable protection policies• Pay as you go consumption model based on back-end TB (BETB) usage• No additional cloud storage or egress costs

Public Cloud Availability

Flexible Storage Classes

Single Pane of Management• Supports data vaulting to Microsoft Azure (Warm Vault only; Cold Vault coming soon)• Warm Storage Tier for recovery that starts immediately upon customer initiation, and a minimum 30day retention period.
• Cold Storage Tier for recovery that starts 4 hours after customer initiation, and a minimum retention
period of 90 days or longer.
• View and manage global data vaults with centralized dashboard• Simplified administration with SLA-based policies

Simplify and modernize data isolation and recovery with Cohesity FortKnox.
Visit the free trial to get access to FortKnox.

© 2023 Cohesity, Inc. All rights reserved.
Cohesity, the Cohesity logo, SnapTree, SpanFS, DataPlatform, DataProtect, Helios, the Helios logo, DataGovern, SiteContinuity, and other Cohesity marks are trademarks or registered trademarks of Cohesity, Inc. in
the US and/or internationally. Other company and product names may be trademarks of the respective companies with which they are associated. This material (a) is intended to provide you information about Cohesityand our business and products; (b) was believed to be true and accurate at the time it was written, but is subject to change without notice; and (c) is provided on an “AS IS” basis. Cohesity disclaims all express or implied
conditions, representations, warranties of any kind.

Cohesity.com | 1-855-926-4374 | 300 Park Ave., Suite 1700, San Jose, CA 95110

1000044-007-EN 8-2023