Protecting Data from Ransomware: Why a Traditional Backup Is No Longer Enough

According to the official IBM X-Force Threat Intelligence Index report, ransomware has remained the world’s top cyberthreat for several years in a row. Attackers are cunning: their malware can lurk undetected in a system for weeks or even months. All the while, it simply collects information about the network and infects all your daily and monthly backups. When the trap snaps shut, the virus initiates encryption and, in a matter of minutes, locks the company’s critical data.

If this happens, traditional system recovery from backups can take days. That’s why a modern approach to cybersecurity requires protection built directly into the hardware—at the level of the data storage system itself.

IBM’s Three Lines of Defense

The company offers the IBM Storage FlashSystem, which detects threats on its own and quickly restores data. This concept is based on three complementary technologies: FlashCore Modules, the Safeguarded Copy feature, and the IBM Storage Defender software.

1. Detect a virus in seconds: hardware-based detection from FCM

Typically, security software scans existing copies after a virus has already infiltrated the system. IBM FlashSystem arrays take a proactive approach:

• Artificial intelligence in every drive: IBM FlashCore Modules incorporate machine learning models. They analyze performance directly “on the fly.”
• Without slowing down the system: the drives check every write operation in real time and look for suspicious changes in the data structure (so-called entropy). Since the drives handle this themselves, the system’s main processor isn’t overloaded.
• Instant response: the system detects anomalies at the data-block level in less than a minute and immediately sends an alert, stopping the attack at the very beginning.

2. Safeguarded Copy — copies that cannot be deleted or modified

This feature automatically creates special protected data snapshots on the primary storage system; these are completely isolated from viruses thanks to the following criteria:

• Immutability: These copies cannot be encrypted, modified, or deleted. They are protected from both virus activity and human error. Deletion occurs strictly according to a preconfigured schedule.
• Logical Air-Gap: The protected copies are completely separated from the operational environment. Computers or servers running an operating system that has been attacked by a virus cannot physically access or modify these snapshots.
• Separation of Duties: A regular IT administrator does not have the permissions to delete such copies. Only a designated specialist—the security administrator—has this access. For added reliability, even the superuser’s privileges can be temporarily revoked during this process.
• No noticeable impact on speed: since these are low-impact copies, they can be taken very frequently (even hourly), and the technology itself has a much smaller impact on system performance than regular backups.

3. The Main Coordinator — IBM Storage Defender

The IBM Storage Defender application is the “brain” of the entire security system in the hybrid cloud. It collects security information from all sources, uses AI sensors to detect anomalies in Linux virtual machines, databases, and files, and automates the restoration of “clean” copies.

If another security system (such as IBM QRadar) detects an attack, Storage Defender can automatically instruct the system to take an unscheduled Safeguarded Copy snapshot to preserve the data in a secure state before encryption begins.

Guaranteed Recovery in 60 Seconds

To demonstrate the reliability of its hardware, IBM offers the IBM Ransomware Protection Guarantee: if your organization has modern IBM FlashSystem storage systems installed with connected IBM support and analytics services, the company guarantees that in the event of a cyberattack, your data will be restored from a Safeguarded Copy in 60 seconds or even faster.

What if something goes wrong? If the recovery takes longer than expected or the copy itself is corrupted, IBM will provide up to 40 hours of work from its top technical experts at no cost to help fully restore your business to normal operations. The data will be checked and cleaned in a special, completely isolated environment (clean room). Access to this area is blocked for any third-party programs or servers, so a virus will definitely not be able to interfere with the recovery operation.

Do you want to protect your business from cyber threats and set up guaranteed data recovery?

As a certified IBM Gold Partner, the Solidity team will help you implement these IBM security solutions in your company.