How indelible cloud storage could solve the ransomware problem

The Big Story

Pay now, don't pay later

Ransomware is one of the most potent and puzzling threats facing businesses operating on the internet in 2021. Difficult to trace and paralyzing when successful, ransomware attacks tend to have the most profound effects on the businesses and organizations least equipped to handle the situation.

• Ransomware works when attackers gain access to that sensitive data through any number of security vulnerabilities or supply-chain attacks and encrypt it using their own keys.
• Few businesses can function without access to their data., and hackers often target backup systems first to make life even harder.

But what if data was stored in a different way, so that it couldn't be overwritten with outside encryption technology? That's what Rubrik, a cloud data-management startup that just raised "in the low tens of millions" according to Bloomberg, thinks could be a solution to the ransomware scourge.

• Rubrik's cloud data-storage and management technology offers immutable storage, which means that data can't be changed by any external force after it has been written to the storage service.
• This is not a new idea: Businesses with strict regulatory requirements around data storage have been locking tape drives in secure "air-gapped" vaults for decades, and all the major cloud providers offer immutable storage options.
• But immutable storage has tended to be more expensive than regular storage options for most data types, and it's also more difficult to retrieve and use in day-to-day work.
• Rubrik introduced new immutable storage services in May pitched directly at businesses worried about ransomware, focusing not just on immutability but on making the recovery process easier.

This technology has seen increasing traction in recent years and Rubrik is now valued at $4 billion after investment from Microsoft and others. Assuming ransomware continues to spread unchecked, there's an enormous opportunity for companies like Rubrik, Druva and Veeam (among others) to make their immutable cloud storage services easier and cheaper to use.

• Untold amounts of data vulnerable to ransomware attacks are stored on old-fashioned network-attached storage devices that can be compromised once malware has entered a corporate network.
• The aforementioned data-storage companies offer their storage as a service, allowing their customers to get rid of that aging hardware in favor of cloud storage devices they don't have to maintain.
• And those services run on the Big Three cloud providers, giving businesses that are interested in storage-protection options an easier on-ramp to the cloud.

But immutable storage is just part of a broader move toward "zero trust" security postures, which are table stakes for forward-thinking companies in Silicon Valley but less understood basically everywhere else.

• Developed by Google in response to a China-backed hack of its network that stole some of its source code, the idea behind zero-trust security is pretty simple: Networks will be breached, and therefore even credentialed users inside those networks simply cannot be trusted.
• Several companies are working together to help the U.S. government adopt zero-trust principles after the Biden administration ordered cybersecurity improvements following the devastating SolarWinds supply-chain attack earlier this year.
• Immutable storage services generally require multifactor authentication procedures to access the administrative records, and offer easily restored snapshots of clean data stored at preset intervals.

Each passing day in 2021 is a reminder that some of the world's biggest systemic problems have moved past the point of prevention, and into a period of mitigation.

• So long as ransomware remains a profitable undertaking, it will be next to impossible for governments and large tech companies to prevent it; it's hard to imagine that software will ever be 100% secure.
• Immutable storage services offer those companies a lifeline where they no longer have to choose between paying the ransom and staying in business, or hoping their partners and law enforcement can bail them out.
• This isn't academic: Scripps Healthcare was down for weeks in the middle of the pandemic after it was hit with a ransomware attack, and this week it said it lost nearly $107 million stemming from lost revenue and expenses responding to the attack.

In the immortal words of Intel's Andy Grove, only the paranoid survive.

— Tom Krazit

A MESSAGE FROM TRELLO

After a year and a half of living and working through a pandemic, it's no surprise that employees are sending out stress signals at record rates. According to a 2021 study by Indeed, 52% of employees today say they feel burnt out. Crisis management is one thing, but how do you permanently lower the temperature so your teams can recover sustainably?

Learn more

This Week On Protocol

Arm inside: Intel's latest addition to its IPU lineup of chips designed for cloud data centers comes with an interesting twist: 16 Arm Neoverse cores. I talked to Intel's Guido Appenzeller about its new Mount Evans chip, which aims to help cloud providers with overhead tasks that need to be kept separate from customer workloads.

Remote control: The spread of the delta variant of COVID-19 is wreaking havoc on back-to-work plans around the U.S., which means we might be in for an even longer period of remote work than we thought just a month ago. Protocol's Amber Burton talked to GitLab's Darren Murph about his role as "head of remote" and how companies can prepare for the scattered life.

Green daze: The boom in cloud services over the past decade has been accompanied by a boom in data centers, full of servers, storage devices and all manner of electronic control switches and routers. Protocol's Janko Roettgers took a look at how the consumer electronics industry is trying — with limited success — to get better about reducing its environmental impact, which at some point enterprise tech will also need to consider.

Five Questions With...

Ayman Sayed, CEO, BMC

What was your first tech job?

From childhood, I was always tinkering with electronics and fixing things where I could – or just taking them apart to put them back together. I like to joke that my first tech job was to challenge the electronics makers of household items – radios, telephones, televisions – let's call it Quality Control.

If Protocol gave you $1 billion to start a new enterprise tech company from scratch today, what would you do?

That is a very generous offer! I'd love to see an incubation lab that can help both enterprise vendors and customers come together to solve big, hairy global challenges around food and water issues, education and healthcare. With partners in the not-for-profit sector to help deploy and monitor success, we can create an ecosystem that brings together technology experts and charitable organizations to focus on finding ways to leverage quantum computing, blockchain and AI for the good of the world.

What's your favorite pastime that doesn't involve a screen?

I have been an angler for many years, and a big fan of oenology – or the science of wine. Luckily, I am fortunate to live in a place where I can pursue both my passions. Fly fishing is a mix of artistry and science that requires patience, trust and diligence. Oenology is much the same; it's artistry with agricultural science, requires an immense amount of patience in the maturation of fruit, trust in the harvest qualities and diligence to refine a varietal to just the right balance.

How can enterprise tech improve its current status around diversity, equity and inclusion?

Every organization has a responsibility to help the communities where we live and operate. The tech sector can do so much. We can create greater economic equality with access to education, we can engage with the communities where we operate to help create equitable opportunities for employment and advancement and most importantly support innovation through the inclusion of diverse views and perspectives.

Which enterprise tech legend motivates you the most?

Overall inspiration really comes from the pioneers of modern electrical and computer engineering who have been the drivers for how we use technology today. Hedy Lamarr's persistence and drive to deliver frequency-hopping technology and Ada Lovelace's dedication and patience in creating computer programs that the great minds of her time couldn't fathom are incredible traits and accomplishments to admire. These women exercised a conviction and diligence that continue to inspire me in my own ongoing evolution as a technology leader.

Around the Enterprise

• Databricks is close to raising $1.5 billion or more, according to Bloomberg. That would value the fast-growing data analytics company at $38 billion.
• Nvidia reported revenue of $6.5 billion, up 68% compared to last year with data-center revenue up 35%. It also warned that its proposed acquisition of Arm is going to take longer than expected after regulatory scrutiny.
• The chip shortage could last another two years, according to Ampere CEO Renée James, although it probably hasn't had much impact on the company's low-volume but quite-interesting Arm server chips.
• GlobalFoundries filed confidentially for an IPO and, according to Reuters, never received a reported takeover bid from Intel earlier this year.
• Microsoft has a strong relationship with partners, and according to new research from The Channel Company its Azure cloud marketplace drives the most partner revenue.
• Salesforce and Slack announced new integrations between their two services in the first product reveal since Salesforce's $27 billion acquisition of Slack closed.
• Should AWS be a little more human? Ben Kehoe, chief robotics research scientist at iRobot and an influential user of AWS's Lambda serverless technology, thinks so, and wrote an interesting proposal about why that would be good for its customer base.
• Palantir bought $51 million in gold bars that it is keeping in "a secure location in the northeastern U.S." as a hedge against a "black swan event," an interesting move for a surveillance and data-mining contractor.