Ransomware Defender
Ransomware Defender Product Specification
Use of this document
This document is the functional specification definition of the product's functionality.
Overview
The Ransomware product monitors audit data on Isilon/power scale clusters running OneFS 8.x and 9.0 and 9.1 software. This audit data is analyzed for user IO that appears to be similar to Ransomware attempting to read data and encrypt data. It does not detect any other type of malware other than Ransomware.
Terms
Eyeglass GUI - User monitoring, alarms and user interface to interact with product configuration and threats raised.
ECA VM’s - These are VM that process audit data and determine threats to production data.
Functional Specification Description
Dependencies
Read Audit data for supported OneFs releases
NFS mount of the cluster is used to read audit data
If the NFS mount to the ECA software is impacted by a network issue no audit data will be read and will impact analysis. This condition is monitored with the health check process called security guard. This must be used to monitor normal operations and validates if audit data is being read and processed.
Cluster API is reachable
NTP
Disk latency below published specifications for VM’s
AD is reachable via cluster API
VM disk latency is < product specification in documentation
RAM is allocated without oversubscription of the memory on the host running Ransomware Defender
Auditing must be enabled on any access zone that will be protected
Cluster must be licensed for Ransomware Defender
Only available in vmware OVA, Hyper-v
Patching
The product does not support hotfix patching and requires and complete upgrade of the software version or build number to apply any patch
Operating system patches are not provided and must be downloaded directly from online official open suse repositories
Compatibility
The product does not support forward compatibility with target devices and will require a software upgrade to support a forward version of a target device. This includes minor or build number changes of the target device.
Appliance Modifications
Modifying the operating system packages, removing or adding packages, changing the OS configuration and support of these changes is not covered by support and customers must support OS modifications and perform necessary testing. No support for customer modifications with the exception of applying open suse OS package patches that shipped with the original appliance or published procedure in documentation.
Operational Procedures
If documentation does not list a procedure, it is explicitly unsupported unless support provides a procedure.
Installation
This product is not customer installable and must be installed and configured by professional services for correct deployment and validation of the software integration with the cluster.
Use limitations
Combining this product with any other product is in violation of the specification & documentation unless it is found in documentation.
Analyze Audit data by:
NOTE: Even when used in accordance with documentation found here https://manuals.supernaeyeglass.com/project-eyeglass-administration-guides/HTML/eyeglass-ransomware-admin-guide.html this section still applies.
sampling audit events which by definition means building patterns based on windows of time, and the window limits the analysis of a pattern. Dual vector detectors are used to use audit data over larger windows to mitigate this.
Processing means reading sampled audit events into the threat detector module
Threat detectors look for patterns over a time period or window of time to determine if a threat has been detected.
Detector types
File extension is a list of 2400+ extensions that have been associated with Ransomware in the past, this is not guaranteed to to be an exhaustive list and new extensions will not be added in a timeline that this method of detection can be depended on as a primary detection vector.
Honeypot files - requires customers to configure files on shares or exports that allows monitoring of a “trip wire” file that is monitored for encryption IO events. If not configured by the customer this detection method will not function and reduces protection.
Behavior based detection - successive user operations that appear to be reading files in bulk, encrypting the data and then handling the source unencrypted file via deletes or rename operations.
Design Specification Limitations
It is expected that based on the above mathematical permutations that in some cases Ransomware behaviors may go unnoticed. This is expected in order to reduce false positives. This is a balance of processing time, sampling behaviours to provide increased detections at a reduced cost but exposes gaps in detection. To mitigate this all configuration options and detections should be used including the tripwire honeypot files. Multi vector detectors can be configured and should be set up by customers post installation.
False Positives are expected by design and may lead to excessive snapshots up to cluster limits before corrective action can be taken. A false positive may also lockout an application and is expected customers follow operating procedures to mitigate service account from lockout using ignore list or monitor lists.
Affected files list - the CSV list of files provided by the product is not an exhaustive list of affected files. Easy auditor or 3rd party audit products should be used to report on all file touched by an affected user. This is design intent to provide a list of some of the files that tripped the detector.
Detection variables and limitations
NOTE: Even when used in accordance with documentation found here https://manuals.supernaeyeglass.com/project-eyeglass-administration-guides/HTML/eyeglass-ransomware-admin-guide.html and this specification, the limitations in this section still apply.
The rate of the user behavior and the time window over which the sample is taken along with the sample of audit event used for analysis means a detection can be missed and this is expected that a behavior may be missed when analysing all permutations of time window and detectors and a sample of the source audit data.
User understands: Operational monitoring, and documentation procedures mitigate this customer risk by monitoring alarms, and verify security guard is operating normally along with configuration of the honeypot files within the file system. Various configuration options also reduce protection but simplifies operations customer choices affect the protection the product offers.
User understands: Combining all detection methods will mitigate missed detections but it will not eliminate the possibility a detection is missed. This means a variant of Ransomware may go undetected without detection or protection of the file system. Backups and snapshots are expected to exist or a cyber vault.
In addition, a cyber vault or Airgap as documented in the documentation and it offers additional mitigation but must be configured to achieve the highest level or data protection.
Customer configuration can be set up to alert only in monitor mode and snapshots can be disabled. This mode reduces protection and this is documented in documentation.
Monitor only mode will not attempt to disconnect a suspect user and thereby reduce the number of files impacted in an attack. This is a customer decision to enable enforcement mode to protect the file system.
Detection processing
Each user has individual learned detection settings if learning mode is used. This mode observes IO and customizes settings to remove 80% of the false positives.
Default settings are used for any user without custom settings
Once a security event is detected:
Send alarm about new security event
Lookup user AD groups from cache
Resolve SMB share access
Store files in security events to CSV file
Update SMB shares with deny read permission for the user involved
Generate snapshots on smb shares
Update log for event with timestamps throughout processing logic
Done
Detection processing scenarios that alters processing logic
These lists alter processing based on above logic
Whitelist by path, user or ip will ignore and detection that matches the filters
Monitor mode path, user, or ip will skip lockout step for any detections that match the filters.
Snapshot mode
Enabled will trigger snapshots, disabled will not snapshot
Critical mode
Disabled means no immediate real time lockout will occur and only timed lockout
File extension processing
File extensions can be enabled (enforced), disabled (ignored) or monitor mode which disables lockout logic as per above.
Flag as false positive and learning mode
Monitor detections and peak values seen (highest rate) and increase detectors to bump up by .3 relative to the defaults. This process is manually triggered or automated with learning mode.
The outcome of the analysis is visible in the GUI and can be deleted by admins to relearn. Manual detector CLI also exists to customize by hand.
File banned list available as versioned file that allows customers to switch between versions. Ie. current version and switch to new version.
Custom file extensions are supported allowing customers to add any extensions to the list
Event data is stored as a CSV for each user and provides a sample of the affected files in the database.
CSV includes file, path, detector, date and time, user ID, file extension
Airgap Function
This function automates syncing data using synciq between Isilon or powerscale clusters on a closed private network for the purpose of maintaining an offline copy of data. This helps ensure best practices for data protection.
2 different product options are available with outside the vault network automation of and inside the vault with a different license required for inside the vault automation.
Licenses
Airgap Enterprise
License required for vault agent VM deployment inside the vault
Enterprise airgap operates inside the vault on the vault cluster management network secured and closed network. The cluster IP interfaces are added or deleted to allow synciq to reach the vault cluster
Management
During airgap sync operations alarms are retrieved from the vault cluster from an ssh session on the production protected cluster and requires the PAPI to be reachable to collect alarms using a vault minimum permissions user that is allowed to collect alarms. These alarms are proxied to users through Eyeglass email or syslog alarm subsystem.
Enterprise vault agent VM will push logs during airgap sync operations to Eyeglass VM using SSH and API to store logs on eyeglass for support purposes
Scheduled airgap maintenance can be requested from eyeglass on an interval of eery 2 hours (enterprise airgap) or on demand with basic airgap. This uses a heart beat process that checks for maintenance requests created using a CLI command on eyeglass. Maintenance activities would include debugging or software upgrades
Reporting
Both versions offer reporting that tracks synciq replication using the reports to summarize success or failures and includes other metrics such as throughput, sync duration, quantity of data replicated. This report is scheduled daily and reports are visible in the airgap Icon management interface.
Monitoring
Both versions offer monitoring of airgap job steps from the airgap management interface showing previous executions and access to reports that summarize replication status
Proxy alarms from the vault hardware are viewable in the alarm icon interface
Smart Airgap
This feature checks threat level determined by Ransomware Defender or Easy Auditor , if an active threat is raised in either product any scheduled sync to the vault is paused to keep the vault cluster offline. The administrator must clear the active alarms before normal sync operations will continue
Configuration
Adding the static route, and service user to get alarms from the vault cluster and the schedule of data sync to the vault cluster
Enterprise version also requires control of the schedules and must be enabled for Enterprise version
Data Security
The solution adds significant protection to maintain an offline copy of data. The solution requires that operational step are followed and all devices used in the airgap , including switches, routers, firewalls,, vault cluster are patched regularly for security related patches, including the OS on all eyeglass VM's.
The solution reduces the potential of the data in the vault from being compromised but does not eliminate all possible attacks or threats to the data inn the vault. Physical threat or insider threats or other threat risk is not reduced to zero percent possibility. The solution reduces this potential if all operational guidelines are followed. No guarantee or warranty is made about the threat reduction to zero or the possibility of comprising the vault data.
Installation Knowledge Transfer post installation
The product installation process informs customers of the decisions they own to determine the protection and activation of protection features.
The default product installation requires customer action to enter enforcement.
Operational Expectations for all deployments
Ransomware Defender is a component of an overall security solution that must include the following best practices in order to correctly deploy a security solution. The operational steps below are expected to be followed for correctly using and integrating Ransomware Defender into a security solution.
A data security plan should include multiple layers of security including endpoint protection and a backup system to recover data. Ransomware Defender is not intended to replace other security solutions or backups of your data.
Backup data should be stored off line so that it is not connected to the network. An offline backup is a requirement in all scenarios.
Network monitoring tools, SIEM tools with logging and monitoring of all key components and high risk systems, including the storage environment.
The specification and operational management of this product Requires:
May not detect or prevent any or all malicious code or that use of the licensed program and related updates or upgrades will keep company’s network or computer systems free from viruses or other malicious or unwanted content or safe from intrusions or other security breaches
Product usage assumes endpoint protection Anti-virus software is in place on all operating systems, devices, computers.
All computers with operating systems are patched regularly
All CVE's are acted upon with patches and remediation applied to all devices within the IT infrastructure.
All firewalls, security devices are running current versions and configured correctly to protect networks
The compute infrastructure is maintained and provides minimum product requirements for cpu, memory, disk latency.
The end users and IT are trained to respond to a Ransomware attack and have a run book to respond to an incident.
End users are trained regularly for phishing attacks and social attacks intended to compromise computers with Malware/Ransomware
All product alerts are acted on in a timely manner to ensure processing of audit data is protecting the file system.
Security guard product is monitored daily for proper product functionality
Honeypot feature is implemented fully to offer maximum security level of protection.