Counter Ransomware
Attacks with Cohesity
Key Benefits• Protect your data and businesswith a defense-in- deptharchitecture• Quickly identify potential attacks
with machine learning-based
anomaly detection and integratewith security operations• Reduce downtime with reliable andrapid recovery

Enterprise Strategy Group found that 79% of organizations havebeen struck by ransomware, 56% have paid the ransom and only
14% recovered all their data. And ransomware shows no signs ofabating. Cybersecurity Ventures expects global cybercrime costs
to reach $10.5 trillion USD annually by 2025 and that a businesswill fall victim to a ransomware attack every 2 seconds by 20311.
Even as awareness of digital extortion schemes is rising, moresophisticated and focused attacks increasingly target backup
data and infrastructure continuing to threaten enterprises
worldwide. For businesses that do become compromised, steep
financial loss is often compounded by customer distrust, and in
the case of healthcare, risk to human life.
Cohesity effectively counters ransomware attacks and helps your organization
avoid paying ransom. Cohesity’s comprehensive, data security and data
management solution features a multi-layered approach to protect backup
data against ransomware, detect and rapidly recover from an attack. Cohesity’s
unique immutable architecture ensures that your backup data cannot be
encrypted, modified or deleted. Using machine learning, it provides visibility
and continuously monitors for any anomalies in your data. And if the worst
happens, Cohesity helps to locate a clean copy of data across your global
footprint, including public clouds, to instantly recover and reduce downtime.
DetectProtect
Immutable backup
snapshots combinedwith DataLock(WORM), andZero-Trust principles
such as RBAC,
multi-factor
authentication, dataencryption, andQuorum prevent yourbackup data frombecoming a target

Machine-driven intelligenceestablishes patterns andautomatically detects andreports anomalies, and SOC
integrations enable
collaboration between IT
and security to defend theorganization

Recover
Maintain a vaulted data copythat is always available.
Simple search and instantrecovery to any point in time
gets you back in businessfast. Scan recover data forvulnerabilities and threats tosupport reliable recovery andinstantly recover hundreds ofvirtual machines (VMs),
databases, and ﬁles andobjects

Figure 1: Cohesity delivers comprehensive capabilities to protect, detect and recoverfrom a ransomware attack

1Solution Overview: Counter Ransomware Attacks with Cohesity

Cybersecurity Ventures: Top 6 Cybersecurity Predictions And Statistics For 2021 To 2025 (Dec. 30, 2021)

1

Protect• Role-based access control (RBAC) – To reduce the risk

Sophisticated ransomware such as Locky and Crypto recently
has been used to destroy shadow data copies and restore point
data, making enterprise backup infrastructure a prime cybercriminal target when it should be part of your organization’s
defense. Cohesity stops intruders by preventing your backup
from becoming an attack target.
Cohesity SpanFS™, a third-generation distributed filesystem—
uniquely offers multi-layered protection against a ransomware
attack. Among other things, Cohesity delivers the highest levelof protection against ransomware attacks because immutability
is at the foundation.

of unauthorized access to data and systems, Cohesity
enables your IT staff to grant each person a minimum levelof access to what is needed to do a particular job.
• Multi-factor authentication (MFA) – Should a criminal
actor get access to your system password, that individual
would not be able to access the Cohesity backup without
passing an additional layer of security in the form of MFAor multi-step verification. Cohesity supports a variety ofauthentication and authorization capabilities, including
strong Active Directory integration, MFA, access control
lists, mixed-mode role-based access control (RBAC), andcomprehensive system and product-level auditing.

• Immutable snapshots – All backup snapshots, by default,
are stored in an immutable state within Cohesity. Theoriginal snapshot (aka gold copy) is never mounted orexposed to any external system or application. The only way
to write new data or mount the backup for recovery in readwrite mode is to create a zero-cost clone of the original
backup, which is done automatically by the system.
• DataLock – WORM capability for backup enables the rolebased creation and application of a Datalock policy to selectedbackup snaps. The security officer role in your organization
can use this feature to store snaps in WORM format. The timebound setting enforcing spans cannot be deleted, even by theadministrator or security officer role, providing an extra layer ofprotection against ransomware attacks.

• Data encryption – Cohesity features software-based
FIPS-validated, AES-256 standard encryption for your datain flight and at rest. This cryptographic module validated
by the United States National Institute of Standards andTechnology (NIST) at the Federal Information Processing
Standards (FIPS) 140-2 Level 1 standard is trusted
worldwide.
• Quorum – To protect your data and systems from insiderthreats and stolen credentials, Cohesity requires any rootlevel or critical system change anyone in your organization
wants to make be authorized by more than one person.
Cohesity Helios, a next-gen data management platform, delivers
a unique combination of immutable backup snapshots, DataLockcapabilities, RBAC, MFA, plus Quorum (aka the four-eye rule), toprevent backup data from becoming part of a ransomware attack.

Figure 2: With Cohesity Helios, organizations detect ransomware intrusions

Solution Overview: Counter Ransomware Attacks with Cohesity2Detect

RecoverAs cyber criminals continue to strengthen and modify their

Cybersecurity threats, internal and external, do happen, and fast.

approaches, Cohesity makes it easier for your organization

That’s why recovery has to be predictable and rapid. Cohesity

to detect intrusions with a global, enterprise SaaS-based

speeds the process of getting back your ransomed enterprisemanagement solution. Cohesity customers have a single

data and applications—at scale. In addition to the immutabledashboard to see, manage, and take action fast on their data andbackups, Cohesity offers multiple policy-based methods to isolate

applications globally. In the fight against ransomware, Cohesity

your mission-critical data and have the last good copy secured.

Helios machine learning (ML) provides insights humans may missTo meet your unique recovery and security requirements, you

because it automatically and continuously monitors and notifies

can isolate your data into the Cohesity-managed cloud vault—

you when an anomaly is detected.

Cohesity FortKnox, replicate it to another immutable cluster, orThe cutting-edge ML algorithms proactively assess your IT

tape it out to offsite storage, like Iron Mountain.

needs and automate infrastructure resources regularly. If yourCohesity Helios’ machine-drive assistance helps accelerateorganization’s data change rate, including data ingest is out of

the recovery by recommending a clean copy of data to restore.

the normal range—based on daily change rates on logical data,

Alternately, you can leverage the platform’s global search

stored data after global deduplication, or historical data ingest—

capabilities to quickly locate and access the data acrossCohesity Helios’ machine-driven anomaly detection sends aenvironments.

notification to your IT administrators. Instantly, IT is informedthat data changes do not match normal patterns. Plus with themonitoring of user activity organizations can identify when data
usage indicates unauthorized data access and use that could
lead to data exfiltration.

To ensure a clean restore and avoid re-injecting a software
vulnerability or exposure into your production environment,
Cohesity’s CyberScan provides deep visibility into the healthand recoverability status of protected snapshots. CyberScan
shows each snapshot’s vulnerability index and actionable

Because Helios machine-driven learning establishes patterns

recommendations to address software vulnerabilities. This helps

and automatically scans for data ingest/change rate anomalies,

you to cleanly and predictably recover from a ransomware attack.

it flags a potential ransomware attack. Should an anomaly

And organizations can scan snapshots for threats that could

be detected, the platform simultaneously alerts both yourreinfect systems after their restoration. Leveraging ML driven

enterprise IT team and Cohesity’s support team, expediting

threat intelligence, snapshots can be scanned for the latest

remediation.

indicators of compromise (IOCs) that threat actors leverage

Besides monitoring backup data change rate to detect apotential ransomware attack, Cohesity gathers log data forfile-level anomalies within unstructured files and object data.
Organizations can review the frequency of files accessed,
number of files being modified, added or deleted by a specificto gain access to systems, escalate privileges and exfiltrateand encrypt data. To support privacy and industry regulations,organizations need to understand data exposure. Leveraging
data classification, organizations can quickly access private andsensitive data that may have been exfiltrated.

user or an application, and more to ensure a ransomware attack

With the combination of fully hydrated snapshots withis quickly detected.

Cohesity’s proprietary SnapTree’s B+Tree architecture, MegaFile,and instant mount, you can dramatically reduce your downtime
by restoring hundreds of virtual machines (VMs), files, objects,
and large databases instantly.

Solution Overview: Counter Ransomware Attacks with Cohesity3Counter Ransomware Attacks
with Cohesity

Dataﬁle reconstruction using Conventional Snapshot images

S0Backup is your first and last line of defense against sophisticated

Aand crippling ransomware attacks. Cohesity’s comprehensiveB

anti-ransomware solution protects, detects and most

S1
C0

S2
C1

S3
C2

Sn
C3

Cn

Unboundedaccumulated
traverses (n)to reconstruct
A, B, Cn

Dataﬁle reconstruction using Cohesity SnapTree images

importantly, rapidly recovers what you need to reduce downtime

S0and ensure business continuity.

AB

C0

S1

S2

S3

SnC1C2C3CnAlways ﬁxedtraverses(2 in this example)
to reconstruct
A, B, CnTime

Figure 3: Cohesity patented SnapTree technology delivers unlimited snaps with nooverhead, supporting instant recovery at scale

To learn more, visit www.cohesity.com/solutions/ransomware© 2024 Cohesity, Inc. All rights reserved.
Cohesity, the Cohesity logo, SnapTree, SpanFS, DataPlatform, DataProtect, Helios, and other Cohesity marks are trademarks or registered trademarks of Cohesity, Inc. in the US
and/or internationally. Other company and product names may be trademarks of the respective companies with which they are associated. This material (a) is intended to provide
you information about Cohesity and our business and products; (b) was believed to be true and accurate at the time it was written, but is subject to change without notice; and (c)is provided on an “AS IS” basis. Cohesity disclaims all express or implied conditions, representations, warranties of any kind.
COHESITY.com | 1-855-926-4374 | 300 Park Ave., Suite 1700, San Jose, CA 95110

Solution Overview: Counter Ransomware Attacks with Cohesity

3000015-010-EN 3-20244