Despite 76% of companies paying ransomware criminals, a third did not recover. This shows that paying the ransom is not a recovery strategy, because bad actors have resorted to using ransomware as a service.

The backup repository has been the main target of ransomware, because getting rid of the life preserver enables criminals to sell survivability as a product. Through Veeam Disaster Recovery Orchestrator, the ransomware challenge is tackled using an immutable repository, testing the backup, and automating the recovery process, according to Jason Buffington (pictured), vice president of solutions strategy at Veeam Software Corp.

“Ninety-four percent of the time, one of the first intrusions is to attempt to get rid of the backup repository … so if you don’t have a survivable repository, you have no options,” Buffington stated. “We provide air gaping, whether you are cloud-based … now you have at least a repository, which is not affectable. For us, that’s Veeam Disaster Recovery Orchestrator, a product that orchestrates all the stuff that Veeam users know and love about our backend recovery engine.”

Buffington spoke with theCUBE industry analysts Dave Vellante and David Nicholson at VeeamON during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed Veeam’s “2022 Ransomware Trends Report” and how the Veeam Disaster Recovery Orchestrator tackles the ransomware challenge. (* Disclosure below.)

Veeam Sandbox tests the ability to recover

Since 84% of companies do not test their ability to recover from backups, Buffington believes attaining an immutable repository becomes farfetched, but the Veeam Sandbox fills the void.

“Several years ago, Veeam created the Sandbox, what we call a data lab,” he said. “We create a whole framework for you with a proxy that goes in; you can stand up whatever you want. If a file exists, you can ping it, ODBC SQL, and map the exchange. So automating test restores every night, not just the backup log work.”

The rate of ransomware infections is higher, because they take a longer gestation period, according to Buffington.

“On average, about one in four organizations say they have not been hit, but since we know that ransomware has a gestation of around 200 days from first intrusions, so when you have that attack, 25% may be wrong … that’s 25% in the best case,” he explained.

The engine behind automated recovery is the orchestrator, Buffington added.

“The magic is a product that we call Orchestrator … so it actually takes all of those steps, and you actually define each step along the way,” he said. “You define the IP addresses, the paths, and where it’s going to go. It then runs the job in test mode every night, every week, so if there’s a problem with any step along the way, it gives you the report and fixes those things before you need it.”

With ransomware targeting the heart of the enterprise, immutability at all levels is fundamental.

“That’s why Veeam is so important around cloud and disk and tape,” Buffington said.

When it comes to the issue of ransomware, Buffington believes the closer you get to the problem, the worse it becomes.

“When you look at the … security professional and the backup admin, who are responsible for prevention or mediation, they saw a much higher rate of infection than the CISOs and the IT pros,” he pointed out. “I think the meta point there is: The closer you are to the problem, the worse this is.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the VeeamON event:

(* Disclosure: TheCUBE is a paid media partner for the VeeamON event. Neither Veeam Software Corp., the sponsor for theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE