The Ransomware Protection Score panel provides a simple way to see how resilient your data is to a ransomware attack. It is an aggregation of all the actions that are recommended to be taken in order to improve your data security posture and cyber resiliency. This panel works in conjunction with the Recommended Actions panel. There are two parts to the Ransomware Protection Score panel:

In this example page, there are seven recommended actions for the "Protect" category. The first recommendation is relevant for 258 files.

This panel supports working environments and data sources that have been added to BlueXP classification.

Note that recommendations are applicable per data source. So if the same recommendation is relevant to 3 data sources, it will be counted as 3 recommendations.

You can click the to expand each Recommended Action, as shown below.

To see the detailed list of data that has been identified as having a recommended action, click the Investigate button and you’ll be redirected to the BlueXP classification Investigation page with the list of all the files that meet the criteria for the recommended action.

Then you can decide whether you want to apply the recommended action on all those files, or on just some of them.

After you fix the recommended action, the next refresh of the Ransomware Protection Score panel (every 5 minutes) will adjust the number for the score. You can also click the Re-Scan button to update the page now.

The Cyber Resilience Map is the main area in the dashboard. It enables you to see all your working environments and data sources in a visual manner and be able to view relevant cyber-resilience information.

The map consists of three parts:

These are the currently tracked alerts and suggested remediations.

Ransomware incidents detected on your managed systems will appear as alerts in the Ransomware incidents panel. This includes encryption events, suspicious file extensions, ransomware activity, and malicious activity. The panel will display the type of incident and whether any automatic actions have been run to try to resolve the issue. For example, a volume Snapshot copy could be been generated and sent to the cloud.

Current support is for on-premises ONTAP clusters that are running Autonomous Ransomware Protection (ARP). ARP uses workload analysis in NAS (NFS and SMB) environments to proactively detect and warn about abnormal activity that might indicate a ransomware attack. Learn more about ONTAP Autonomous Ransomware Protection.

You can click the to expand an incident to view the number of encrypted files identified in the suspect volume, the types of file extensions, and the time the attack occurred.

You can click the Recover button if you want to attempt to recover from the ransomware attack. This brings you to the BlueXP ransomware protection Recovery dashboard where you can replace the volume with an older Snapshot copy that has not been affected by ransomware. See how to use the Recovery dashboard.

The Encrypted Files panel shows the top 4 data sources with the highest percentage of files that are encrypted, over time. These are typically items that have been password protected. It does this by comparing the encryption rates over the past 7 days to see which data sources have a greater than 20% increase. An increase of this amount could mean that ransomware is already attacked your system.

Click a line for one of the data sources to view the filtered results in the BlueXP classification Investigation page so that you can investigate further.

The Top Data Repositories by Sensitivity Level panel lists up to the top four data repositories (working environments and data sources) that contain the most sensitive items. The bar chart for each working environment is divided into:

You can hover over each section to see the total number of items in each category.

Click each area to view the filtered results in the BlueXP classification Investigation page so that you can investigate further.

The Domain Administrative Group control panel shows the most recent users who have been added into your domain administrator groups so that you can see if all the users should be allowed in those groups. You must have integrated a global Active Directory into BlueXP classification for this panel to be active.

The default administrative admin groups include “Administrators”, “Domain Admins”, “Enterprise Admins”, “Enterprise Key Admins”, and “Key Admins”.

The Open Permissions panel shows the percentage for each type of permission that exist for all files that are being scanned. The chart is provided from BlueXP classification and it shows the following types of permissions:

You can hover over each section to see the percentage and total number of files in each category.

Click each area to view the filtered results in the BlueXP classification Investigation page so that you can investigate further.

The Storage system vulnerabilities panel shows the total number of high, medium, and low security vulnerabilities that the BlueXP digital advisor tool has found on each of your ONTAP clusters. High vulnerabilities should be looked at immediately to make sure your systems are not open for attack.

Note that you can view the BlueXP digital advisor directly by selecting Health > Digital advisor from the BlueXP menu.

Click the type of vulnerability (High, Medium, Low) you want to view for one of your clusters and you are redirected to the Security Vulnerabilities page in BlueXP digital advisor. (More about this page can be found in the BlueXP digital advisor documentation.) You can view the vulnerabilities and then follow the recommended action to resolve the issue. Oftentimes the resolution is to upgrade your ONTAP software with a point release, or full release, that resolves the vulnerability.

The Harden your ONTAP environment panel provides the status of certain settings in your ONTAP systems that track how secure your deployment is according to the NetApp Security Hardening Guide for ONTAP Systems and to the ONTAP anti-ransomware feature that proactively detects and warns about abnormal activity.

You can review the recommendations and then decide how you want to address the potential issues. You can follow the steps to change the settings on your clusters, defer the changes to another time, or ignore the suggestion.

This panel supports on-prem ONTAP, Cloud Volumes ONTAP, and Amazon FSx for NetApp ONTAP systems at this time.

The settings that are being tracked include:

The Business critical data permissions analysis panel shows the permissions status of data that is critical for your business. That way you can quickly assess how well you are protecting your business critical data.

This panel shows data based on the policies you have selected in the Business Critical Data Configuration page. It shows data from the two business critical policies which have the most total files. Click the link to view or define additional policies. Learn more about configuring and selecting business critical data policies.

The graph shows permission analysis of all the data that meets the criteria from your policies. It lists the number of items that are:

Hover over each bar in the charts to view the number of results in each category. Click a bar and the BlueXP classification Investigation page is displayed so you can investigate further about which items have open permissions and whether you should make any adjustments to file permissions.

The Backup Status panel shows how different categories of data are being protected using BlueXP backup and recovery. This identifies how comprehensively your most important categories of data are backed up in case you need to recover because of a ransomware attack. This data is a visual representation of how many items of a specific category in a working environment are backed up.

Only on-prem ONTAP and Cloud Volumes ONTAP working environments that are already being backed up using BlueXP backup and recovery and scanned using BlueXP classification will appear in this panel.

Initially this panel shows data based on default categories that we have selected. But you can select the categories of data that you want to track; for example, codes files, contracts, etc. See the full list of categories that are available from BlueXP classification for your working environments. Then select up to 4 categories.

After the data is populated, hover over each square in the charts to view the number of files that are backed up out of all files in the same category in the working environment. A green square means 85% or greater of your files are being backed up. A yellow square means between 40% and 85% of your files are being backed up. And a red square means 40% or fewer files are being backed up.

You can click the Backup button at the end of the row to go to the BlueXP backup and recovery interface to enable backup on more volumes in each working environment.

You can use NetApp SnapLock technology on your ONTAP volumes to retain files in unmodified form for regulatory and governance purposes. You can commit files and Snapshot copies to "write once, read many" (WORM) storage, and set retention periods for this WORM-protected data. Learn more about SnapLock.

The Critical data immutability panel shows the number of items in your working environments that are being protected from modification and deletion on WORM storage by using ONTAP SnapLock technology. This allows you to view how much of your data has an immutable copy so you can better understand your backup and recovery plans against ransomware.

This panel shows data based on the policies you have selected in the Business Critical Data Configuration page. Click the link to view or define additional policies. Learn more about configuring and selecting business critical data policies.

The panel shows the following information for the data that matches the selected policies:

BlueXP classification policies that include the following filters are not available in the dropdown for selected policies because they rule out important search areas:

So when creating the policies to view your critical business data in the Critical data immutability panel, make sure you keep this in mind.