Transcript for "They Want What You Can't Rebuild: Breaking Ransomware Leverage on Unstructured Data": Hello, and welcome to today's session on unstructured data titled, they want what you can't rebuild, breaking ransomware leverage. My name is Ranga, and, I'm a product manager at Rubrik. On a daily basis, I talk to organizations who are looking at protecting and securing their unstructured datasets to achieve cyber resilience, typically at or approaching petabyte scale. And internally, I work with a team of tenured builders who focused on this problem for ten plus years. And a large portion of the team joined Rubrik about five years ago, via an acquisition of a company called Igneous Systems. With that, let's get started. Since we'll talk a little bit about features as well in this session, you see a safe harbor statement. We went through the introduction. As for the rest of the agenda, we'll start with what is unstructured data, why it matters, and why now. We'll then jump into the customer journey about how people can get prepared, the questions they should ask, the things they should do, and how do they know that they've actually achieved cyber resilience or are well on their journey. And we'll close with the path forward at Rubrik and touch upon the Rubrik offering for unstructured data. Let's get started. What is unstructured data? The way I think about unstructured data is that any data that does not fit in a table or does not have structure or a schema is unstructured. Think of a song or a video or a photo. And in the enterprise context, maybe think of a scan that they take at a hospital. It's called a DICOM report, for instance. All of this pile and object are examples of unstructured data, and then it can be anywhere, on prem or in the cloud. And there, you see the four quadrants, like you do on the screen. And the common thing across all of this is that it is massive. And, different applications put it in different places, and this means it's just hard to know what is where, and it's hard to control. So it results in data sprawl. Furthermore, I alluded to the DICOM data. A scan may have a patient ID, in in in the health care context. And so sensitive data is mixed in with this tool that compounds this problem. Because of the size of the data and because of the sprawl and lack of visibility, data can just be stuck in the wrong place and become very hard to move and, you know, safeguard. All of this means that this data is an easy target for somebody else because organizations may not know, which means somebody else can know or could know and attack it. Stepping back a little bit, why now? As of last year, 92% of the data that is generated in the enterprise is unstructured, and a lot of it is sensitive too. And this thing is not going away. It's here to stay. It's gonna grow fast over the next five years. And with the advent of, GenAI, as people look at new use cases and what they can do, they have to start from a position where they trust that data. Trust that data to say we can run some use cases on it. Trust that data to say you can make it available to other teams in the organization. So how do we go about doing that? Unfortunately, a lot of the infrastructure that is available today was not built for the scale, terabyte scale. It's either very expensive or it simply doesn't work or it requires cobbling together a lot of tools. So this does not scale with business needs. And because all of this infrastructure is working against, the organization, in the event of a cyber incident, this also means that it's hard to recover and recover quickly simply because it's hard to find out where the impact is. It's hard to move data. It's just hard to restore operations. So this is gonna take time. Let's now jump to the second part of the agenda, which is the customer journey. And I wanna point out, like, four questions that typically come up. Let's say, legal comes and asks you to find all files that contain personal identifiable information across the file and object or NAS estate. NAS being network attached storage. Can you do it? And how quickly can you do it? If ransomware encrypts your files tonight, how long would it take for you to identify a clean restore point in your backup? This is not whether you have a backup. This is about whether you trusted enough to restore from it. Have you run this scenario actually as a simulation to find which backup predates the infection and is clean? And you can actually granularly restore just what was impacted and then verify that all the way up to the application is working fine. Do you have the same level of protection as your databases and virtual machines or whatever is golden in your organization for your unstructured data as well. If you see yourself pausing for any of these questions, that is the gap that ransomware is going to exploit. And the gap almost almost always, comes down to the same thing. Having a backup is not the same as knowing which backup is going. So if we go through this slide to think about what it means to prove that you can recover, you have an environment which is approaching petabyte scale, if not petabyte scale. You have backups. But the moment that really hits home here typically is when people start asking, can we prove that we can recover without paying in the event of an incident? And and and really to think about whether people achieve cyber resilience, how confident do they feel before the incident about their posture, right, becomes the determinant. So some best practices here on what organizations can build and what they need to know. Start with seeing the data. Start with visibility. Get to know what is where. There are many people generating these unstructured datasets across different buckets and different storage systems. So have a way to see that. Get everybody in the room. This is not a one person problem. People generating the data are not the ones tasked with protecting it, are not the ones tasked with filing cyber incidents. So you'll need to get your application owners, IT security and compliance teams in the room, to have that visibility and start ranking what is important to you. Do a tabletop exercise. This is not optional if you wanna prepare for cyber resilience. So test your recovery and simulate it. Finally, the speed at which you recover and restore your business systems depends on what you restore first. Not everything can come first given the scale, but at the same time, knowing what data matters most to you makes a difference. Now let's start talking about how these things can be delivered, by highlighting some of these things in the rubric offering. Let's start with data management. We spoke about the lack of control. Rubrik's offering for unstructured data operates at petabyte scale for many, many customers, hundreds of customers. It doesn't lock you into any storage system. So if you create a backup on one system, you can restore that in another system. You can also use the offering to understand what's in the data and about the data. So you start getting control over, understanding what's in the data and also doing something about it. I mean, oftentimes, the joke goes that the solution for unstructured data is to just bring more storage. But here, if you have the visibility, then you can go and actually delete stuff or move it into a lower tier storage and handle the problem that way too. But it all starts with knowing what's in the data. The second thing I wanna highlight is cyber. So the whole offering is built on Rubrik's zero trust architecture. What that means specifically here is there are offerings to detect threats in your system, and infections that are latent. Also, all the backups are immutable and logically aircraft, which means they cannot be written anymore. They can be read multiple times. Finally, as organizations start thinking about what more they can do with their data, the offering allows movement of data visibility and becomes a foundation for analytics, to understand how this data came to be as well using lineage and then granularly providing access to the people who need it through governance. We recently announced an offering in this space called Rubrik Annapurna, so stay tuned in the coming weeks for more information on this or feel free to get in touch with us. Double clicking into the Rubrik for unstructured data offering, I wanna talk about four pillars. Let's start with data discovery, which is all about understanding your data. And you can do that primarily in two ways. One, you can automatically discover what data was last accessed or last modified and make decisions based on that. So for instance, if you have data that was not accessed for the last six months, you may want to tear that off to cold storage or maybe even delete it after notifying teams. He can also understand not just activity on the data, but what's in the data as well on a continuous basis using sensitive data discovery. So these are the two things that make up the data discovery followed up the offering. As for data observability, when on a continuous basis, customers have the ability to scan their backup environment for known, threats or indicators of compromise and bring up alerts. And at the time of a restore, there is the turbo threat hunt capability that scans through tens of thousands of snapshots all in a matter of minutes, if not seconds, to get you the same visibility so that you know before you restore that you're restoring from a safe restore point or a clean backup. Data resilience comes from the bread and butter of the offering, really, which is when it lands data in the target storage, it lands it in an immutable way and in a logically high gap way. This means that the backup data cannot be encrypted because it cannot be modified or deleted by attackers. And data remediation. So in the event that you need to do a restore, you can do this granularly. You can do this from the theme restore point, and you can restore to any system of your choice. So the combination of all of this is what gets you to rapid threat free recovery, especially when you need it the most. A bit more about the offering itself, we have customers one customer, protecting more than 60,000,000,000 files. So this is this this technology really scales. So if you're wondering how you're gonna protect, one, two, five, ten plus terabytes of data, I can tell you that it will work for you and that you should get in touch with us. Overall, we have more than a trillion files, protected and similar scale of data under management. To highlight some of the recent launches, this offering also becomes available not just in a SaaS play, but for sovereign and dark sites. We are the Rubrik Security Cloud private environment. We enhanced our cyber resilience capabilities by bringing in threat monitoring and turbo threat threat hunting about six months ago, which I spoke about in the earlier slides. Our goal, as part of this offering is to cover as much as the file and object storage systems as possible at any given point in time. So we find ourselves adding native API native protection capabilities where we use the filer API to run the protection job. So in the recent past, we've added support for both, like, vast IBM storage scale and other enterprise offerings and also cloud offerings like AWS, FSXN, or Azure Files. And finally, all of this is available with the rest of the Rubrik product portfolio via the Rubrik Security Cloud. Three things you can do after this meeting. See your data. Get people in the room. Start seeing the data. Right? Like run discover, run sensitive data discovery that'll allow you to do exactly that. And then bring in the different teams within your organization to understand what you need to do about that data and understand what is priority. You need to rank it. So that's how you identify what to restore first in that simulation or in case you need it in reality as well. And finally, secure it. Secure it through a product like Rubrik for unstructured data. Because if it's not immutable and it's not logically arrogant, it's really not recoverable because it's already under attack or attacked and compromised. Now I'm going to show you a demo. What you're looking at here is the Rubrik Security Cloud landing page or dashboard. You can see that you can go to unstructured data over here and get a view of your entire unstructured dataset, file and object, both on prem and in the cloud. You can navigate to specific product panes and add your systems. And once you do that, you can see that they're automatically discovered over here, and you see all your file shares and what is protected and so on and so forth, because this is already done. But essentially to add a system, what one needs to do is to just share the type of the system and here are all the supported sources and the IP or the host name. We also support data in the cloud, and you can do that by going to cloud, an s three or Azure blob, and the flow would be similar. And then you can start understanding what's in the data, right, or about the data. So I wanna show you that flow before I touch upon the protection flow. So we do that. Go here. There is a discover pane. And what this is showing me is what data was last modified in thirty days, what data was modified in thirty to a hundred eighty days, and so on and so forth. I can toggle this to last accessed as well, and I can immediately get this visibility, not just at the aggregate level, but down to a filer or an object within it. A share and an object within it. Let me see if I can go into a folder here. Yep. Alright. So you can drill down and go all the way down to a share and an object. I can also change these parameters to look at this at different time stamps or time ranges if I want it. Back to the listing page where we looked at the inventory. So you'll also see other ways to navigate if you need to, and you'll see tiles here which you can pin and then navigate to the specific product within the portfolio. And to protect, we need to set up something called an SLA domain or a service level agreement on TrueBrick. So I can create an SLA domain and choose MAS CloudDirect. I select whether I want additional platform security features to prevent accidental changes to how long a backup is retained, retained, for instance. That's retention lock. I set up how often I wanna take backups, how often I wanna retain them, and then I select what I wanna back up and where I wanna back it up. Right? So there is a way to add a target as well. And once I'm done with all of that, I can hit next, and it would be protected on a schedule. The protected data would be visible under a task monitoring screen where I can filter I just this, and I can look at what failed, what completed, and so on. There are other ways to do monitoring as well via events where you can get the raw fire hose of events. You can also get alerted via webhooks into any third party tool of your choice where you want to consume alerts from all tools. And you can also get reports for visibility on what is working and how things are working. What I would recommend starting with is the object capacity report. Yeah. So if you see object capacity over here Yeah. You can use this object capacity report or an object capacity over time report to see usage over time. There is also a licensing dashboard that tells you what you've consumed. I wanna see if I can find it. Yep. You can go to licenses and usage, and you can see your, license and your meter across all products, including your unstructured product. And threat analytics is available here from where you set up your sensitive data discovery policies or to run threat monitoring on a cadence to check against known indicators of compromise or to run turbo threat hunts. And that was the demo. I will be live during the session as well to take any questions. So look forward to meeting you there. Right. Hey, folks. I'll take the first question. The question is, do we have to protect our entire NAS landscape to identify PII information, or can Rubrik simply scan data and provide the info? We're talking about tens of petabytes. Right now, scan works, only if you back up the data. So you will have to protect your data to scan. That is the case today. I'm, given there are another questions, maybe I can kick off this conversation as well. Feel free to leave your response in the chat if you can. What percent of your NAS estate are you protecting today? Less than 5%, five to 10%, 10 to 25%, greater than 25%, or any other way you wanna say it is fine too. Just trying to get a sense for where, folks on the bridge are at with their protection. 90%. That's good. And is that on a is that on a petabyte plus, base as well, Tim, or is that, like, a small smallish portal? Okay. Got 200 tablet. Got it. Right. Let us know how the how the restore goes. Are you are you already using a CD, Tim? Okay. Makes sense. What's your which which, data management operation is underserved today for you on Nasivi? Is it protection, restore, something else, searching, perhaps something else? Where do you where do you see pain? Alright. Cool. Yeah. So I can, talk a little bit about that then. So as of right now Alright. NASCD does support all of, NAS protection workflows via RFC. This is something that, is available if you're starting afresh today. Given you're an existing customer, we are building a bridge or a way for you to migrate over to RSC as well so that you can leverage the full platform for all of its, platform security capabilities, enterprise capabilities, like, you know, on the security front, retention lock, you know, quarter mark to say, hey. At least two people need to sign off on a certain operation and so on. Enterprise features like, you know, getting getting webhooks in addition to email notifications, getting alerted in a tool of your choice, monitoring flows, events, all of that the same way you get, for other workloads on Rubrik, reports. All of that is just gonna be available through a single pane. So we'll build that bridge, and then you can use that bridge to move over. And when you do, you don't have to redo your backups. Your backups stay where they are, and they they just continue, as if nothing happened. So, essentially, what think of it as us changing the front door or the interfaces, the UI and the API sets to manage your backups. But your backups are where they are, and it it they just continue, from where you continue from where you were at before we move to RSC. Awesome. Any I'm I'm trying to see if there are any other questions. I don't see any anything else, but maybe, Tim, we can keep talking in the meantime. If you have any other questions, feel free to ask. Alright. Maybe I can ask a different one. When you think about unstructured data, what are the top three things you're trying to get done? K. What should be the first step? There's a question. What should be the first step when addressing open access sensitive files reported at large capacity? Alright. So let's try to break this down. There's open access and sensitive files that somebody reported for a large set of files, if I would understand this question. The first step is to understand what the definition of sensitivity is, and the next step is to go and, I would think, get the data owners in the room for these file sets and have a conversation with them on what this means to your business and suitably identify next steps. Right? So it goes back to what we covered in the webinar. You've seen something at this point, and then you get the people in the room so that you can begin to understand what that means for you and the business. And from there, hopefully, the right next steps just, are a consequence from that point on. Does that make sense? And if you're looking for something else, feel free to feel free to share more information. Tell me a bit more about the question. Okay. K. The focus is creating an IRE clean room to use in a cyber event. Alright. What does an IRE or an isolated recovery environment mean for you, Tim? Can you drop some bullets here to say to share what an IRD is for you. I'm assuming everyone can read the chat, but I repeat the question. Regarding what we're trying to get done, we're stable, and the focus is on IRD and clean room to use inside of it. So I'm just trying to start with understanding how the clean room is set up and what operations team wants to run and go from there and maybe answer the question. K. Alright. So Tim says it's not constantly synced, physically isolated to restore after an event or to be able to run native food production there for a while. Got it. How do you how do you run fire drills on this team? Essentially, you you're running your backups right now, and you're preparing for a certain eventuality when you set up a clean room. But how do you know that that is going to be available for you? Alright. We're just now planning. Okay. So I can talk a little bit about how we think about this, and without getting into too much of the specifics, if that helps. So what we hear from, customers and what what we've learned is an IRE is something that is, yes, typically isolated, and it is used to recover from some kind of disaster. Typically, one where customers may lose access to their primary, data center or systems at least for a for a while. Right? So there is some active business discontinuity. And in that event, they wanna use their backups to bring up an environment that, can bring back their applications. High low. Now as much as this is a tail event, Customers need to know that this option is available for them should they need it. So they need to do that by running fire drills. Like, just think of how the fire alarm goes off in the office and all of us step out, and then they tell us it's a fire drill and then we go back in. Similarly, how do we run this kind of fire drill to restore to the IRE when the primary systems are actually not impacted, just to make sure that this option is available. That's how we think about it, and what we're building to is going to allow customers to largely accomplish that where you can generally just pause your work, leave your table to bring it back to the fire alarm analogy, run the IRE drill, and then go back to your desk and start working like nothing happened. So that's what we're, that's that's how we're looking at building capabilities, to to address this use case. Periodic orchestrate recovery once yeah. Periodic orchestrated recovery is what I refer to as the fire drill. The way, to just share one more level of detail, the way NCD will accomplish this is by providing the ability for customers, users, to specify what ABM can and cannot do. So we can now come in and tell that stateless VM or what you see as clusters to perform only backup jobs or only the activity jobs, and you can connect to specific, restore targets of your choice in terms of connectivity, and then you can pause the rest of the jobs or the rest of the VMs and issue a restore task, and it'll just run on your IRVM. And that way, you'll get your IRRE. Pausing is analogous to people just leaving their desks, and you un pause and then that basically means they come back to their desk after the IRD exercise is over and the rest of the, like, the new job start running now on on the on the unpause VMs. So you'll have the ability to essentially run targeted restors and do pause VMs. These are the building blocks that will allow customers to accomplish this, use case around periodically running like a retool and a re as part of filing. Okay. So is that, access to the IRE a challenge from in terms of, like, getting your application back up and running? Is that what you're alluding to or just the data? Or probably even both? Yeah. I would assume it's it's hard to connect, or just have the IRRI talk to every application, and that's by design. But I see I see the challenge there too. Right? Like, and and you bring up a good point. Like, full recovery all the way back to the application is not just about having the data, but, actually, all the connectivity required to run the application. And in this case, that has to be wired up, after the data is available in the IRU host. Alright. Can we get one more on what what else is, like, a top job people are trying to get done with with their NASS state unstructured data. We have approximately five minutes left, so I will take one or two more questions. K. So Tim says part of the it's part of the financial institution. And so we're concerned to have connectivity across branches. Yeah. I can imagine. We're we're happy to, continue the conversation on IRE team. Feel free to maybe get in touch via support or something, and we can chat more about your use case too, in case in case you'd like to. Okay. Rubrik is available. 9.6. Any considerations for NCD? Okay. So for what? Is this for the control plane? Is this for the data? Like, what is this? For what? It's for clusters. Okay. So, essentially, you're talking about a copy of the backup data. Right? So this will work slightly differently in unstructured datasets, and I'll explain why. So first of all, like, the Ruby for unstructured data, the NCI offering does not use CDM to write the back ups. The reason for that is it is more cost effective at petabyte scale to write directly to your target. Typically, people use some low cost, objects or type of target either on prem or in, like, a deep, archive type tier in the cloud. Now when they do that, accessing the data after it's written is going to incur large data retrieval fees from the storage vendor. And so any solution will pass down these kind of data retrieval fees to the customer. Instead, what we recommend is creating multiple backup copies as part of the backup policy. So the product already has the ability to have one backup chain or one backup policy or isolate domain in RSC right to multiple targets. So you can do that to get multiple copies of your data. So if you have, like, one region failure or one target that's fading, you can always recover from the other target. Does that check the box for how you think about for your data, Tim? Yep. Okay. Cool. Alright. I will hang around for another ten, fifteen seconds to see if I have another question coming up. Else, we will call it a wrap. Thank you, Tim, for your questions. Alright. Thanks everyone for your time today, and we'll be in touch. Have a good one.