Limiting the ability of ransomware to spread within a data center
In a data center, a storage array detects a ransomware attack based on suspicious data or IO activity associated with a storage object. The storage array identifies all host servers authorized to access the storage object and generates notifications that prompt the identified host servers, or possibly all connected host servers, to shut down paths to the storage array. The storage array identifies one of the host servers as the likely source of the ransomware attack based on characteristics of IOs sent to access the storage object. The storage array generates a notification to prompt that host server to shut down all paths to all storage arrays.
1 . A method comprising:
detecting a ransomware attack in a first storage array;
identifying a first host server as a source of the ransomware attack;
prompting the first host server to shut down all paths to a second storage array responsive to identification of the first host server as the source of the ransomware attack;
responsive to identification of the first host server as the source of the ransomware attack, prompting other host servers running test environments to isolate from the ransomware attack by abruptly terminating paths to the first storage array; and,
responsive to identification of the first host server as the source of the ransomware attack, prompting other host servers running production environments to delay isolating from the ransomware attack by implementing delayed path termination in which new Input-Outputs (IOs) are halted, pending writes are destaged and replicated, and host application instances are terminated.
2 . The method of claim 1 further comprising prompting all host servers with paths to the first storage array to shut down those paths.
3 . The method of claim 1 further comprising detecting the ransomware attack based on data or input-output activity associated with a storage object.
4 . The method of claim 3 further comprising identifying all host servers authorized to access the storage object.
5 . The method of claim 4 further comprising creating notifications to prompt multi-path software running on the identified host servers to shut down paths to the first storage array.
6 . The method of claim 5 further comprising identifying the first host server as the source of the ransomware attack based on characteristics of input-output commands sent by the first host server to access the storage object.
7 . The method of claim 6 further comprising creating a notification to prompt multi-path software running on the first host server to shut down all paths to all storage arrays.
8 . A non-transitory computer-readable storage medium storing instructions that are executed by a computer to perform a method comprising:
detecting a ransomware attack in a first storage array;
identifying a first host server as a source of the ransomware attack;
prompting the first host server to shut down all paths to a second storage array responsive to identification of the first host server as the source of the ransomware attack;
responsive to identification of the first host server as the source of the ransomware attack, prompting other host servers running test environments to isolate from the ransomware attack by abruptly terminating paths to the first storage array; and
responsive to identification of the first host server as the source of the ransomware attack, prompting other host servers running production environments to delay isolating from the ransomware attack by implement delayed path termination in which new Input-Outputs (IOs) are halted, pending writes are destaged and replicated, and host application instances are terminated.
9 . The non-transitory computer-readable storage medium of claim 8 in which the method further comprises prompting all host servers with paths to the first storage array to shut down those paths.
10 . The non-transitory computer-readable storage medium of claim 8 in which the method further comprises detecting the ransomware attack based on data or input-output activity associated with a storage object.
11 . The non-transitory computer-readable storage medium of claim 10 in which the method further comprises identifying all host servers authorized to access the storage object.
12 . The non-transitory computer-readable storage medium of claim 11 in which the method further comprises creating notifications to prompt multi-path software running on the identified host servers to shut down paths to the first storage array.
13 . The non-transitory computer-readable storage medium of claim 12 in which the method further comprises identifying the first host server as the source of the ransomware attack based on characteristics of input-output commands sent by the first host server to access the storage object.
14 . The non-transitory computer-readable storage medium of claim 13 in which the method further comprises creating a notification to prompt multi-path software running on the first host server to shut down all paths to all storage arrays.
15 . An apparatus comprising:
a storage node comprising non-volatile storage and at least one compute node configured to detect a ransomware attack, identify a first host server as a source of the ransomware attack, and responsive to identification of the first host server as the source of the ransomware attack:
prompt the first host server to shut down all paths to a second storage array;
prompt other host servers running test environments to isolate from the ransomware attack by abruptly terminating shut down paths to the first storage array; and
prompt other host servers running production environments to delay isolating from the ransomware attack by implementing delayed path termination in which new Input-Outputs (IOs) IOs are halted, pending writes are destaged and replicated, and host application instances are terminated.
16 . The apparatus of claim 15 further comprising the compute node being configured to detect the ransomware attack based on data or input-output activity associated with a storage object.
17 . The apparatus of claim 16 further comprising the compute node being configured to identify all host servers authorized to access the storage object.
18 . The apparatus of claim 17 further comprising the compute node being configured to create notifications to prompt multi-path software running on the identified host servers to shut down paths to the first storage array.
19 . The apparatus of claim 18 further comprising the compute node being configured to identify the first host server as the source of the ransomware attack based on characteristics of input-output commands sent by the first host server to access the storage object.
20 . The apparatus of claim 19 further comprising the compute node being configured to create a notification to prompt multi-path software running on the first host server to shut down all paths to all storage arrays.