Volume dependencies in a storage system
An example method for monitoring volume dependencies for security threats comprises: detecting a request to perform an operation with respect to a volume included in a plurality of volumes included in a storage system; determining, based on a dependency mapping that specifies dependencies between the plurality of volumes, that performance of the operation would affect a dependency between the volume and one or more other volumes included in the plurality of volumes; and determining, based on the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes, that the request is possibly associated with a security threat against data stored by the storage system.
1. A method comprising:
detecting, by one or more computer processors, a request to perform an operation with respect to a volume included in a plurality of volumes included in a storage system;
determining, by the one or more computer processors based on a dependency mapping that specifies dependencies between the plurality of volumes, that performance of the operation would affect a dependency between the volume and one or more other volumes included in the plurality of volumes;
determining, by the one or more computer processors based on the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes, that the request is possibly associated with a security threat against data stored on the volume by the storage system, wherein the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes is further based on an absence of a corresponding request to perform a corresponding operation with respect to the one or more other volumes; and
performing, by the one or more computer processors based on the determining that the request is possibly associated with a security threat, a remedial action with respect to at least one of the volume or a source of the request.
2. The method of claim 1 , wherein the operation comprises at least one of a deletion of the volume, an encryption of the volume, a renaming of the volume, or a moving of the volume.
3. The method of claim 1 , further comprising determining the dependency mapping between the plurality of volumes.
4. The method of claim 3 , wherein the determining the dependency mapping comprises receiving an input indicating that the one or more other volumes depend on the volume.
5. The method of claim 3 , wherein the determining the dependency mapping comprises determining an endpoint of an interaction between the volume and the one or more other volumes.
6. The method of claim 3 , wherein the determining the dependency mapping comprises determining that the one or more volumes depend on the volume based on a type of application associated with at least one of the volume and the one or more other volumes.
7. The method of claim 1 , wherein the dependency mapping comprises an immutable object of a container system.
8. A system comprising:
one or more memories storing computer-executable instructions; and one or more processors to execute the computer-executable instructions to:
detect a request to perform an operation with respect to a volume included in a plurality of volumes included in a storage system;
determine, based on a dependency mapping that specifies dependencies between the plurality of volumes, that performance of the operation would affect a dependency between the volume and one or more other volumes included in the plurality of volumes;
determine, based on the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes, that the request is possibly associated with a security threat against data stored on the volume by the storage system, wherein the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes is further based on an absence of a corresponding request to perform a corresponding operation with respect to the one or more other volumes; and
perform, based on the determining that the request is possibly associated with a security threat, a remedial action with respect to at least one of the volume or a source of the request.
9. The system of claim 8 , wherein the operation comprises at least one of a deletion of the volume, an encryption of the volume, a renaming of the volume, or a moving of the volume.
10. The system of claim 8 , wherein the one or more processors are further configured to execute the computer-executable instructions to determine the dependency mapping between the plurality of volumes.
11. The system of claim 10 , wherein the determining the dependency mapping comprises determining an endpoint of an interaction between the volume and the one or more other volumes.
12. The system of claim 10 , wherein the determining the dependency mapping comprises determining that the one or more volumes depend on the volume based on a type of application associated with at least one of the volume and the one or more other volumes.
13. A non-transitory, computer-readable medium storing computer instructions that, when executed, direct one or more processors of one or more computing devices to:
detect a request to perform an operation with respect to a volume included in a plurality of volumes included in a storage system;
determine, based on a dependency mapping that specifies dependencies between the plurality of volumes, that performance of the operation would affect a dependency between the volume and one or more other volumes included in the plurality of volumes;
determine, based on the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes, that the request is possibly associated with a security threat against data stored on the volume by the storage system, wherein the determining that the performance of the operation would affect the dependency between the volume and the one or more other volumes is further based on an absence of a corresponding request to perform a corresponding operation with respect to the one or more other volumes; and
perform, based on the determining that the request is possibly associated with a security threat, a remedial action with respect to at least one of the volume or a source of the request.
14. The computer-readable medium of claim 13 , wherein the instructions further direct the one or more processors to determine the dependency mapping between the plurality of volumes.