Protection of cloud storage devices from anomalous encryption operations
According to examples, an apparatus includes a processor that determines that an encryption operation has been requested or executed through a cloud control plane capability with respect to a cloud storage device. The processor also determines that the requested or executed encryption operation with respect to the cloud storage device is anomalous and, based on a determination that the requested or executed encryption operation with respect to the cloud storage device is anomalous, outputs an alert and/or performs a remedial action. By identifying anomalous encryption operation requests or executions on cloud storage devices, the processor is able to determine that ransomware attacks are or have occurred on the cloud storage devices. In some examples, the processor takes remedial actions to mitigate harm posed by or prevent the ransomware attacks.
1 . An apparatus comprising:
a processor; and
a non-transitory memory on which is stored machine-readable instructions that when executed by the processor, cause the processor to:
determine that an encryption operation has been requested or executed through a cloud control plane capability with respect to a cloud storage device;
identify at least one element associated with the request or execution of the encryption operation;
determine whether a difference between the identified at least one element and a learned behavior corresponding to the at least one element exceeds a predefined threshold;
determine that the requested or executed encryption operation with respect to the cloud storage device is anomalous based on the determination that the difference exceeds the predefined threshold; and
based on a determination that the requested or executed encryption operation with respect to the cloud storage device is anomalous, at least one of:
output an alert; and
perform a remedial action.
2 . The apparatus of claim 1 , wherein the instructions cause the processor to:
determine whether the identified at least one element is anomalous with respect to the learned behavior associated with the request or execution of the encryption operation; and
determine that the request or execution of the encryption operation with respect to the cloud storage device is anomalous based on the determination that the identified at least one element is anomalous with respect to a learned behavior.
3 . The apparatus of claim 2 , wherein the instructions cause the processor to:
learn the behavior associated with the request or execution of the encryption operation through application of a machine learning operation on past behavior associated with requests and executions of encryption operations.
4 . The apparatus of claim 1 , wherein the requested encryption operation comprises a request to encrypt the cloud storage device using an encryption key, and wherein the instructions cause the processor to:
identify the at least one element as associated with the request to encrypt the cloud storage device;
determine that the at least one element associated with the request to encrypt the cloud storage device is anomalous; and
based on a determination that the at least one element associated with the request is anomalous, at least one of:
output the alert; and
prevent the cloud storage device from being encrypted responsive to the request to encrypt the cloud storage device to perform the remedial action.
5 . The apparatus of claim 1 , wherein the executed encryption operation comprises the cloud storage device being encrypted using an encryption key, and wherein the instructions cause the processor to:
identify the at least one element as associated with the encryption of the cloud storage device;
determine that the identified at least one element associated with the encryption of the cloud storage device is anomalous; and
based on the identified at least one element being determined to be anomalous, at least one of:
output the alert; and
prevent a decryption key corresponding to the encryption key from being deleted from a key storage device to perform the remedial action.
6 . The apparatus of claim 1 , wherein the requested encryption operation comprises a request to delete a decryption key from a key storage device, and wherein the instructions cause the processor to:
identify the at least one element as associated with the request to delete the decryption key from the key storage device;
determine that the at least one element associated with the request to delete the decryption key from the key storage device is anomalous; and
based on a determination that the at least one element associated with the request is anomalous, at least one of:
output the alert; and
prevent the decryption key from being deleted from the key storage device to perform the remedial action.
7 . The apparatus of claim 1 , wherein: the at least one element comprises a length of time between when the cloud storage device was encrypted using an encryption key associated with the decryption key and when the request to delete a decryption key was received; and the executed encryption operation comprises a request to delete the decryption key from a key storage device, and wherein the instructions cause the processor to:
identify the length of time between when the cloud storage device was encrypted using the encryption key associated with the decryption key and when the request to delete the decryption key was received;
determine that the identified length of time falls below a predefined time period; and
determine that the request to delete the decryption key from the key storage device is anomalous based on the identified length of time falling below the predefined time period.
8 . The apparatus of claim 1 , wherein the executed encryption operation comprises a deletion of a decryption key from a key storage device, and wherein the instructions cause the processor to:
identify at the least one element as associated with the deletion of the decryption key from the key storage device;
determine that the at least one element associated with the deletion of the decryption key from the key storage device is anomalous; and
based on a determination that the at least one element associated with the deletion of the decryption key is anomalous, at least one of:
output the alert; and
prevent another decryption key from being deleted from the key storage device to perform the remedial action.
9 . The apparatus of claim 1 , wherein the instructions cause the processor to:
output a notification to a requester of the encryption operation to provide additional authentication information: and
based on a determination that the additional authentication information fails to authenticate the requester, perform the remedial action.
10 . A method comprising:
determining, by a processor, that an encryption operation with respect to an encryption of a cloud storage device has been requested or executed;
identifying, by the processor, at least one element associated with the request or execution of the encryption operation;
determining whether a difference between the at least one element and learned behavior corresponding to the at least one element exceeds a predefined threshold
determining, by the processor, whether the at least one element associated with the requested or executed encryption operation is anomalous based on the determination that the difference exceeds the predefined threshold; and
based on a determination that the requested or executed encryption operation with respect to the cloud storage device is anomalous, at least one of:
outputting, by the processor, an alert; and
performing, by the processor, a remedial action.
11 . The method of claim 10 , wherein the requested encryption operation comprises a request to encrypt the cloud storage device using an encryption key, and wherein the method further comprises:
determining that the at least one element associated with the request to encrypt the cloud storage device is anomalous; and
based on a determination that the at least one element associated with the request is anomalous, at least one of:
outputting the alert; and
preventing the cloud storage device from being encrypted responsive to the request to encrypt the cloud storage device to perform the remedial action.
12 . The method of claim 10 , wherein the executed encryption operation comprises the cloud storage device being encrypted using an encryption key, and wherein the method further comprises:
determining that the identified at least one element associated with the encryption of the cloud storage device is anomalous; and
based on the identified at least one element being determined to be anomalous, at least one of:
outputting the alert; and
preventing a decryption key corresponding to the encryption key from being deleted from a key storage device to perform the remedial action.
13 . The method of claim 10 , wherein the requested encryption operation comprises a request to delete a decryption key from a key storage device, and wherein the method further comprises:
determining that at least one element associated with the request to delete the decryption key from the key storage device is anomalous; and
based on a determination that the at least one element associated with the request is anomalous, at least one of:
outputting the alert; and
preventing the decryption key from being deleted from the key storage device to perform the remedial action.
14 . The method of claim 10 , wherein: the at least one element comprises a length of time between when the cloud storage device was encrypted using an encryption key associated with the decryption key and when the request to delete a decryption key was received; the executed encryption operation comprises a request to delete the decryption key from a key storage device, and wherein the method further comprises:
identifying the length of time between when the cloud storage device was encrypted using an encryption key associated with the decryption key and when the request to delete the decryption key was received;
determining whether the identified length of time falls below a predefined time period;
determining that the request to delete the decryption key from the key storage device is anomalous based on the identified length of time falling below the predefined time period; and
at least one of:
outputting the alert; and
preventing the decryption key from being deleted from the key storage device to perform the remedial action.
15 . The method of claim 10 , wherein the executed encryption operation comprises a deletion of a decryption key from a key storage device, and wherein the method further comprises:
determining that the at least one element associated with the deletion of the decryption key from the key storage device is anomalous; and
based on a determination that the at least one element associated with the deletion of the decryption key is anomalous, at least one of:
outputting the alert; and
preventing another decryption key from being deleted from the key storage device to perform the remedial action.
16 . A non-transitory computer-readable medium on which is stored a plurality of instructions that when executed by a processor, cause the processor to:
determine that an encryption operation with respect to an encryption of a cloud storage device has been requested through or executed by a cloud control plane capability available from a cloud service provider;
identify at least one element associated with the request or execution of the encryption operation;
determine that the at least one element associated with the requested or executed encryption operation is anomalous based on a difference between the at least one element and a learned behavior corresponding to the at least one element exceeding a predefined threshold; and
based on a determination that the requested or executed encryption operation with respect to the cloud storage device is anomalous, at least one of:
output an alert; and
perform a remedial action.
17 . The non-transitory computer-readable medium of claim 16 , wherein the requested encryption operation comprises a request to encrypt the cloud storage device using an encryption key, and wherein the instructions cause the processor to:
determine that the at least one element associated with the request to encrypt the cloud storage device is anomalous; and
based on a determination that the at least one element associated with the request is anomalous, at least one of:
output the alert; and
prevent the cloud storage device from being encrypted responsive to the request to encrypt the cloud storage device to perform the remedial action.
18 . The non-transitory computer-readable medium of claim 16 , wherein the requested encryption operation comprises a request to delete a decryption key from a key storage device, and wherein the instructions cause the processor to:
determine that at least one element associated with the request to delete the decryption key from the key storage device is anomalous; and
based on a determination that the at least one element associated with the request is anomalous, at least one of:
output the alert; and
prevent the decryption key from being deleted from the key storage device to perform the remedial action.
19 . The non-transitory computer-readable medium of claim 16 , wherein the executed encryption operation comprises a deletion of a decryption key from a key storage device, and wherein the instructions cause the processor to:
determine that the at least one element associated with the deletion of the decryption key from the key storage device is anomalous; and
based on a determination that the at least one element associated with the deletion of the decryption key is anomalous, at least one of:
output the alert; and
prevent another decryption key from being deleted from the key storage device to perform the remedial action.