Corruption-free Recovery Point Determination for Ransomware Attacks Against Storage Systems
A data protection system may perform a process including accessing a first compressibility metric indicating an amount of storage space saved if write traffic processed by a storage system is compressed and a second compressibility metric indicating an amount of storage space saved if write traffic processed by an additional storage system is compressed, the additional storage system configured to replicate data stored by the storage system; determining, based on the first and second compressibility metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and determining a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.
1 . A method comprising:
accessing, by a data protection system, a first compressibility metric indicating an amount of storage space saved if write traffic processed by a storage system is compressed and a second compressibility metric indicating an amount of storage space saved if write traffic processed by an additional storage system is compressed, the additional storage system configured to replicate data stored by the storage system;
determining, by the data protection system based on the first and second compressibility metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and
determining, by the data protection system, a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.
2 . The method of claim 1 , further comprising:
selecting, by the data protection system based on the corruption-free recovery point, a recovery dataset corresponding to the corruption-free recovery point; and
restoring, by the data protection system based on the selected recovery dataset, data stored by the storage system to an uncorrupted state.
3 . The method of claim 2 , wherein the recovery dataset comprises one or more of a recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat or a recovery dataset generated after the determining that the storage system is possibly being targeted by the security threat.
4 . The method of claim 3 , wherein the recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat comprises a provisional ransomware recovery structure that can only be deleted or modified in accordance with one or more ransomware recovery parameters.
5 . The method of claim 4 , wherein the one or more ransomware recovery parameters specify a number or type of authenticated entities that have to approve a deletion or modification of the provisional ransomware recovery structure before the provisional ransomware recovery structure can be deleted or modified.
6 . The method of claim 5 , wherein the one or more ransomware recovery parameters specify a retention duration before which the provisional ransomware recovery structure can be deleted or modified.
7 . The method of claim 2 , wherein the restoring is further based on a version of the data stored by the storage system that resides on a system other than the storage system.
8 . The method of claim 1 , further comprising:
receiving, by the data protection system, user input;
wherein the determining that the storage system is possibly being targeted by the security threat is further based on the user input.
9 . The method of claim 1 , further comprising presenting, by the data protection system, a visualization of at least one of the first compressibility metric or the second compressibility metric.
10 . The method of claim 9 , further comprising:
receiving, by the data protection system, user input based on the visualization;
wherein the determining of the corruption-free recovery point is further based on the user input.
11 . The method of claim 1 , wherein the data protection system is implemented by a controller within the storage system.
12 . The method of claim 1 , wherein the data protection system is implemented by a computing system communicatively coupled to the storage system by way of a network.
13 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
accessing a first compressibility metric indicating an amount of storage space saved if write traffic processed by a storage system is compressed and a second compressibility metric indicating an amount of storage space saved if write traffic processed by an additional storage system is compressed, the additional storage system configured to replicate data stored by the storage system;
determining, based on the first and second compressibility metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and
determining a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.
14 . The system of claim 13 , wherein the process further comprises:
selecting, based on the corruption-free recovery point, a recovery dataset corresponding to the corruption-free recovery point; and
restoring, based on the selected recovery dataset, data stored by the storage system to an uncorrupted state.
15 . The system of claim 14 , wherein the recovery dataset comprises one or more of a recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat or a recovery dataset generated after the determining that the storage system is possibly being targeted by the security threat.
16 . The system of claim 15 , wherein the recovery dataset generated prior to the determining that the storage system is possibly being targeted by the security threat comprises a provisional ransomware recovery structure that can only be deleted or modified in accordance with one or more ransomware recovery parameters.
17 . The system of claim 16 , wherein the one or more ransomware recovery parameters specify a number or type of authenticated entities that have to approve a deletion or modification of the provisional ransomware recovery structure before the provisional ransomware recovery structure can be deleted or modified.
18 . The system of claim 16 , wherein the one or more ransomware recovery parameters specify a retention duration before which the provisional ransomware recovery structure can be deleted or modified.
19 . The system of claim 14 , wherein the restoring is further based on a version of the data stored by the storage system that resides on a system other than the storage system.
20 . A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to perform a process comprising:
accessing a first compressibility metric indicating an amount of storage space saved if write traffic processed by a storage system is compressed and a second compressibility metric indicating an amount of storage space saved if write traffic processed by an additional storage system is compressed, the additional storage system configured to replicate data stored by the storage system;
determining, based on the first and second compressibility metrics, that the storage system is possibly being targeted by a security threat that causes a potential data corruption; and
determining a corruption-free recovery point for potential use by the storage system to recover from the potential data corruption.