Skip to main content
NetApp Ransomware Resilience

Protect workloads with NetApp Ransomware Resilience protection strategies

Contributors amgrissino netapp-ahibbard
PDFs

After discovering workloads in NetApp Ransomware Resilience, it's essential to apply protection strategies to your workloads to configure a combination of ransomware detection, protection, and replication. Enable a ransomware protection strategy to detect ransomware attacks and ensure you have a protection baseline for recovery.

Required Console role
To perform this task, you need the Super admin or Ransomware Resilience admin role. Learn about Ransomware Resilience roles for NetApp Console.

Before you begin

If you intend to create a protection policy with suspicious user behavior detection, ensure you've performed the necessary setup for user activity monitoring.

Add a ransomware protection strategy

There are three approaches to adding a ransomware protection strategy:

  • Create a ransomware protection strategy if you have no snapshot or backup policies.

    The ransomware protection strategy includes:

    • Snapshot policy

    • Ransomware detection policy

    • Backup policy

  • Replace the existing snapshot or backup policies from Backup and Recovery protection with protection strategies managed by Ransomware Resilience.

    The ransomware protection strategy includes:

    • Snapshot policy

    • Ransomware detection policy

    • Backup policy

  • Create a detection policy for workloads with existing snapshot and backup policies managed in other NetApp products or services.

    The detection policy does not change the policies managed in other products.

    The detection policy enables Autonomous Ransomware Protection and FPolicy protection if they are already activated in other services. Learn more about Autonomous Ransomware Protection, Backup and Recovery, and ONTAP FPolicy.

Create a ransomware protection strategy (if you have no snapshot or backup policies)

If snapshot or backup policies do not exist on the workload, you can create a ransomware protection strategy, which can include the following policies that you create in Ransomware Resilience:

  • Snapshot policy

  • Backup policy

  • Ransomware detection policy

  • Secondary replication to ONTAP

Steps to create a ransomware protection strategy

  1. From the Ransomware Resilience menu, select Protection.

    Manage strategy page

  2. From the Protection page, select a workload then Protect.

  3. From the Ransomware protection strategies page, select Add.

    Add strategy page showing the snapshot section

  4. Enter a new strategy name. The strategy name cannot include spaces.

  5. Optionally, choose an existing protection strategy to use as the basis for the new strategy. In the Copy from existing Ransomware Resilience strategy, choose Select. Select the existing strategy then Copy.

  6. For each item, select the Down arrow.

  7. Choose the Detection policy settings:

    • Encryption detection: Enable Ransomware Resilience to detect encryption-based attacks.

    • Suspicious user behavior detection: Enable user behavior detection to transmit user activity events to Ransomware Resilience and detect suspicious events such as data breaches or data destruction.

    • Block file extensions: Enable Ransomware Resilience to block known suspicious file extensions.

      If you want to change the blocked file extensions, edit them in System Manager.

      Note You can choose any combination of the detection policies. The detection policy must include either encryption detection or suspicious user behavior detection.

  8. Set the Snapshot policy. To import snapshots settings from a predefined policy, choose the Select radio button then choose the policy from the dropdown. No other snapshot configurations are required if you import a policy.

    To configure your own settings, select Create then enter a Snapshot basename. The basename is the prefix appended to each snapshot.

  9. If you're configuring your own snapshot settings, you can enable Snapshot locking. If you enable snapshot locking, set a value for the Locking retention days (that is, how long the snapshots are locked for).

    Snapshot locking creates immutable storage by locking the snapshot copies on primary storage so that they cannot be modified or deleted for a certain period of time even if a ransomware attack manages its way to the backup storage destination. This enables quicker restore time. When a snapshot is locked, the volume expiration time is set to the expiration time of the snapshot copy.

    Snapshot copy locking is available with ONTAP 9.12.1 and later. To learn more about SnapLock, refer to ONTAP documentation for SnapLock.

    If you're configuring your own snapshot settings, set the snapshot schedule options. Choose whether to take snapshots at a frequency of minutes, hours, days, weeks, or months. For all options but daily, choose what time of day, week, or month to take the snapshots. Also, choose how many copies of each snapshot type to keep in the Retention field.

    Screenshot of the snapshot policy options.

  10. For on-premises workloads, you can optionally set a Replication policy to replicate the workload to ONTAP storage.

    To import a system-defined policy, choose the Select radio button then choose the predefined policy from the dropdown menu.

    To make your own replication settings, select Create then enter a Replication policy basename, which is the prefix appended to all snapshots. Set the Replication schedules. Toggle the frequencies you want to enable (hourly, daily, weekly, or monthly) and set the retention value (the number of replicated snapshots to keep) for each schedule you enable.

  11. Optionally, set a Backup policy. To import an existing, choose the Select radio button then choose the predefined policy from the dropdown menu.

    To create your own policy, select Create and enter a Backup policy basename. Set the Backup schedules by toggling the different frequencies (hourly, daily, weekly, and monthly) then setting the retention count for each.

    Tip To enable backup locking on secondary storage, configure your backup destinations using the Settings option. For details, see Configure settings.

  12. Select Add.

Add a detection policy to workloads with existing snapshot and backup policies managed by Backup and Recovery

Ransomware Resilience enables you to assign either a detection policy or a protection policy to workloads with existing snapshot and backup protection managed in other NetApp products or services. Backup and Recovery uses policies that govern snapshots, replication to secondary storage, or backups to object storage.

Add a detection policy to workloads with existing backup or snapshot policies

If you have existing snapshot or backup policies with Backup and Recovery, you can add a policy to detect ransomware attacks. To manage protection and detection with Ransomware Resilience, see Protect with Ransomware Resilience.

Steps

  1. From the Ransomware Resilience menu, select Protection.

    Manage strategy page

  2. From the Protection page, select a workload then select Protect.

  3. Ransomware Resilience detects if there are existing active Backup and Recovery policies.

  4. To leave your existing Backup and Recovery in place and only apply a detection policy, leave the Replace existing policies box unchecked.

  5. Select the detection settings you want:

    • Encryption detection

    • Suspicious user behavior detection

    • Block suspicious file extensions

  6. Select Next.

  7. If you selected Suspicious user behavior detection as a detection setting, select the user activity agent or or create one.

    The user activity agent hosts the new data collectors. Ransomware Resilience creates the data collector automatically to transmit user activity events to Ransomware Resilience to detect anomalous user behavior.

  8. Select Next.

  9. Review your choices. Select Create to activate detection.

  10. On the Protection page, review the Detection status to confirm detection is Active.

Replace existing backup or snapshot policies with a ransomware protection strategy

You can replace your existing backup or snapshot policies with a ransomware protection strategy. This approach removes your externally managed protection and configures detection and protection in Ransomware Resilience.

Steps

  1. From the Ransomware Resilience menu, select Protection.

    Manage strategy page

  2. From the Protection page, select a workload then select Protect.

  3. Ransomware Resilience detects if there are existing active Backup and Recovery policies. To replace the existing policies, select the Replace existing policies box. When you select the box, Ransomware Resilience replaces the list of detection policies with detection policies.

  4. Choose a protection policy. If no protection policy exists, select Add to create a new policy. For information about creating a policy, see Create a protection policy. Select Next.

  5. If your strategy includes replication, select the Destination system and Destination storage VM. Select Next.

  6. Select a backup destination or create a new one. Select Next.

    1. If your protection strategy includes user behavior detection, select a User activity agent in your environment to host the new data collectors. Ransomware Resilience creates the data collector automatically to transmit user activity events to Ransomware Resilience to detect anomalous user behavior.

  7. Review the new protection strategy then select Protect to apply it.

  8. On the Protection page, review the Detection status to confirm detection is Active.

Assign a different policy

You can replace the existing policy with a different one.

Steps

  1. From the Ransomware Resilience menu, select Protection.

  2. From the Protection page, on the workload row, select Edit protection.

  3. If the workload has an existing Backup and Recovery policy that you want to maintain, uncheck Replace existing policies. To replace the existing policies, check Replace existing policies.

  4. In the Policies page, select the down arrow for the policy you want to assign to review the details.

  5. Select the policy you want to assign.

  6. Select Protect to complete the change.

Delete a ransomware protection strategy

You can delete a protection strategy that is not currently associated with any workloads.

Steps

  1. From the Ransomware Resilience menu, select Protection.

  2. From the Protection page, select Manage protection strategies.

  3. In the Manage strategies page, select the Actions Actions button option for the strategy you want to delete.

  4. From the Actions menu, select Delete policy.

Next steps