Cohesity NetBackup

NetBackup provides ML-based user behavior analytics to ensure security at all times—not just at login. It utilizes self-defending intelligence to monitor user behavior, and it enhances your cyber resilience posture with the following capabilities:

• An ML-based adaptive risk engine that proactively monitors user behavior to guard against internal and external threats and prevent irreversible data destruction
• Inline entropy analysis for rapid detection of encryption events during a backup, and more holistic anomaly detection
• Adaptive multi-factor authentication (MFA) that identifies high-risk user actions and subject them to additional authentication
• Adaptive multi-person authorization (MPA) that defends against insider threats by monitoring changes to security and other settings
• A blast radius analysis that performs searches for malware and other potential indicators of compromise (IOCs) in a highly efficient way that scales across the entire enterprise environment.
• A security risk meter that allows users to set a baseline for their security configuration and track any changes from that selected baseline.
• Version 11.1 of NetBackup adds the following new capabilities:    
  • A new Freeze Mode acts like a digital “red stop button,” allowing administrators to instantly lockdown the environment during a cyber event – halting restores, changes, or expirations.
  • A new Maintenance Mode enables safer upgrades in a temporary, time-bound state that auto-reverts to lockdown.
  • YARA rule-based scanning allows security teams to import external threat feeds and detect malware patterns, using the same tools that security researchers employ worldwide.
  • A new Stop-on-Infection workflow halts scans at the first detected threat, flags the image, and moves to the next recovery point

AI-Driven Anomaly Detection and Automated Malware Scanning

NetBackup augments its artificial intelligence-driven anomaly detection capabilities with automated malware acanning. During backup operations, backups are checked for anomalies in near real-time. If anomalies are suspected, malware scanning is automatically initiated to determine if backups contain malware. If a malware scan is positive, data protection, replication, and expiry can be automatically paused for infected targets to contain the spread and prevent expiration of backups with uninfected data.

NetBackup utilizes an adaptive risk engine to perform built-in user behavior analytics that monitor and learn from user actions as they happen. Once sufficient training data is obtained, high-risk operations will trigger alerts and additional security checks in order to slow down a cyberattacker and prevent irreversible destruction of data.

NetBackup can automatically pause data protection activities for a protected asset when a malware scan detects an infection in a backup image. Malware scanning is also used to identify the last known good backup before restoring. The ability to identify and recover the most recent malware-free backup is crucial for fast recovery of critical business operations. When recovering, it is imperative to ensure any infected files are not included in the restoration.

The ability to exclude these files, preventing the possibility of reinfection, enables the most current backups to be recovered, getting business back to the closest point prior to the attack (see Figure 2). Malware scanning can also be performed inline during recovery, if desired.

Inline entropy analysis is part of NetBackup’s anomaly detection capabilities, which computes entropy levels as the backups occur. This patented technology can be performed with no measurable impact to backup performance, and internal testing has shown a 100% success rate in ransomware detection, with an extremely low false positive rate (<0.1%). Based on this data and other heuristics, recommended recovery points are then highlighted that provide the best optimization of RPO and RTO while also ensuring a clean, malware-free restore.