As part of the 56th edition of the
IT Press Tour event held in California this week, VMblog had the opportunity to meet with Jim McGann, VP of Strategic Partnerships at
Index Engines. The company provided us with an in-depth look at their flagship solution, CyberSense, an AI-powered data integrity and recovery platform designed to help organizations recover smarter from ransomware attacks.
The Persistent Ransomware Challenge
Despite increased cybersecurity measures, ransomware persists as a major threat due to system vulnerabilities, social engineering tactics, weak access controls, lack of security awareness, and insufficient backup and recovery plans. The impacts can be devastating - from costly downtime and recovery efforts to permanent data loss and reputational damage.
According to McGann, notable ransomware incidents in 2023 alone included UK logistics firm KNP Logistics having to terminate 700 employees, a 20% sales decline at Clorox due to operational disruptions, a 6-month outage for infrastructure recovery at The British Library, and estimated costs of $110 million for MGM Resorts after a crippling attack.
The Complexities of Ransomware Recovery
Recovering from a ransomware attack is an intricate and time-consuming process. McGann explained, "It typically involves detecting the attack, scanning for malware, engaging insurance providers and recovery specialists, restoring data from backups, verifying data integrity, and eventually resuming operations."
According to
IBM research, the average ransomware breach costs $5.13 million, with companies remaining down for an average of 22 days. Relying solely on traditional backup solutions presents challenges as they often lack the ability to pinpoint ransomware-induced data corruption accurately.
Why Data Integrity is Critical
Index Engines emphasizes the importance of data integrity as a cornerstone of cyber resilience and the ability to recover from ransomware without significant data loss. Their CyberSense solution goes beyond backup by employing AI-powered forensic analysis to inspect data content directly, detecting corruption patterns indicative of ransomware with a high degree of accuracy.
Key benefits of CyberSense's data integrity approach include:
- Efficient Detection: Direct scanning of backups/snapshots without re-hydration saves time and compute resources while preventing malware spread.
- Faster Recovery: Identifying the last known good data copy enables immediate restoration, eliminating the need for lengthy full restores.
- Data Loss Minimization: Detailed listings of corrupted files allow for curated recovery, avoiding mass restores that overwrite clean data.
- Future Risk Mitigation: Comprehensive forensic analysis pinpoints the blast radius and provides telemetry data to proactively stop future attacks.
AI-Powered Content Analysis
At the core of CyberSense is its AI-powered content analysis engine that inspects file contents, database structures, and core infrastructure using hundreds of data points. This deep inspection can detect even the most advanced ransomware variants that maintain original metadata, use slow encryption rates, base64 encoding, or partial/intermittent encryption patterns.
The AI model leverages machine learning trained on millions of ransomware samples, continually updated with anonymized customer data. It combines header-based analyses with deep content inspection to achieve unmatched accuracy.
CyberSense's Workflow
The CyberSense platform streamlines the entire ransomware detection and recovery process through an intuitive workflow:
- Analytics Engine: Over 200 metadata and content analytics identify corruption patterns indicative of ransomware, analyzed by the AI model.
- Alert Generation: Alerts are triggered for detected corruption, integrated into SIEM/SOAR systems.
- Investigation: A centralized dashboard provides visualizations and forensic details on the attack timeline, affected systems, and corrupted data.
- Recovery: Detailed reports highlight the last known good data copies, enabling rapid, curated restoration while minimizing data loss.
- Feedback Loop: Telemetry data exports to SIEM/SOAR support threat hunting and behavioral analytics to proactively thwart similar attacks.
Version 8.6 Enhancements
In 2Q24, Index Engines' CyberSense v8.6 release introduced advanced backup monitoring capabilities through customizable thresholds. This proactive feature monitors file changes, additions/deletions, entropy shifts, and other indicators of potential malicious activity - enabling early detection of insider threats or stealth ransomware.
The update also includes usability improvements like consolidated alert views, host monitoring dashboards, and centralized backup job statuses for streamlined analysis across the entire IT estate.
Proven Operational Impact
McGann told VMblog that existing CyberSense customers have reported significant operational benefits, including an 80% reduction in recovery time and 75% less downtime following ransomware incidents. The deep forensic insights, curated recovery processes, and security telemetry integration enabled by the solution empower organizations to minimize data loss while strengthening their overall cyber resilience posture.
Wrap Up
In today's escalating ransomware landscape, relying solely on backup is insufficient. Index Engines' CyberSense platform introduces a smarter approach - harnessing AI to validate data integrity directly, enabling faster, more precise recovery while minimizing downtime and permanent data loss.
As demonstrated at the IT Press Tour, CyberSense stands out as a pioneering solution that addresses the critical need for intelligent ransomware recovery backed by unparalleled detection accuracy and forensic-level insights.
##