Ransomware is one of the most pervasive threats facing IT organizations today, encrypting enterprise data and preventing user access.

Being prepared for ransomware isn't just about detection, it's also about having the right tools in place to ensure data resilience. That's the direction that IBM is taking with its storage portfolio, which this week released the IBM Storage Defender as a generally available service.

IBM Storage Defender was first announced in preview back in March as a multi-tier service to help enterprises protect and defend data against threats such as ransomware. The service integrates data protection from IBM partner Cohesity, alongside the IBM Storage Protect backup technology.

"IBM Storage Defender is designed to leverage sensors across primary and secondary workloads to detect threats and anomalies from backup metadata, array snapshots and other relevant threat indicators," Sam Werner, VP, IBM Storage Product Management, told SDxCentral. "This allows clients to cut through data silos and get a clear action plan on what it takes to strengthen their data resilience.”

A best practice for decades in many IT operations has been to have regular snapshot backups of data. In the modern hybrid cloud world, simply having a snapshot isn't quite enough to have the data resiliency needed to be able to rapidly recover from a potential attack.

"It’s now standard for organizations to deploy applications across multiple clouds and on-premises workloads," Werner said. "To mitigate data breaches and data leaks, it’s important to understand where and how data flows across the entire enterprise and through various cloud providers."

He explained that in the event of a cyberattack, natural disaster, or just human error, the first thing an organization needs to establish is what data they need access to in order to orchestrate data recovery and get a minimally viable enterprise back to operational status.

For decades, the common practice for data resilience has consisted of systems of snapshots. Data is backed up to an archive at set intervals, and when things go wrong with the local copy, administrators can simply go back and pull from the most recent clean data to replace any corrupted files.

"As attacks have become more sophisticated, malicious code can infect not only the working data, but the snapshots as well," Werner warned.

Modern data resiliency with the technologies that IBM is providing can help reduce the extent of damage attackers can inflict on data backups, making recovery quicker and easier. For example, Werner noted that the best backup systems employ immutable snapshots to preserve data against threats. This involves the creation of a permanent, unalterable copy within a storage array that no machine or individual can directly access. Machine learning can also be used to check the copy of the immutable snapshot and validate that there is no corruption.

Werner said that IBM Storage Defender works across on-premises and cloud environments to give clients a complete view into where their data is saved and what is their overall security posture.

On-premises, the basic idea is to also go beyond what IBM has already been doing with its hardware-based capabilities. For example, the IBM Storage FlashSystem already has inline corruption detection. Werner said that in combination with the ransomware scanning and detection capabilities in Defender, IBM can greatly reduce the time to detection and, in turn, reduce recovery times.

The service also has a cloud-based management platform that can work across enterprise workloads, virtual machines and containerized cloud-native applications.

Werner noted that IBM Storage Defender helps enterprises detect sophisticated threats earlier and orchestrate data recovery safely to help get an enterprise running much sooner by coordinating with existing security operations (SecOps) workflows.

"IBM Storage Defender incorporates SIEM [security information and event management], SOAR [security orchestration automation response] and XDR [extended detection and response] integrations to ensure the solution operates within existing enterprise SecOps workflows," Werner said. "Our team at IBM Storage is currently working with IBM Security to add an additional data layer to XDR, and to drive new integrations with the security recovery platform and their threat intel in the near future."