Encryption and tampering, caught early.
Automated tests on blocks, files and databases at every snapshot uncover latent tampering. Tabletop Testing integrates with CI/CD pipelines.
Cybersecurity · Delphix Anti-Ransomware
Ransomware encrypts your data. You're back up in minutes.
An attack gives no warning, so recovery has to be ready before it hits. With Perforce Delphix we protect your data in an immutable vault isolated from the network, check for threats continuously and, if an attack does come, bring your service back online in minutes.
- Protection
- Continuous detection
- Instant recovery
Approach and how it works
Detect, protect, restore, analyze: inside an isolated vault.
Production databases, on premise or in the cloud, are continuously copied into the Vault. From there Delphix validates them, checks them and, in an emergency, brings them back online.
Production
On premiseapplication + database
Cloudapplication + database
Delphix Vault · air gap
Continuous ingestionfull copy, then incrementals
Immutable Timeflowblocks never rewritten
Validation and detectionautomated tests on every snapshot
Isolated recovery environment
Private DBMS farmwhere the checks run
Tabletop testingautomated recovery drills
Air gap. When idle, the Vault's network interface can be switched off via API, truly isolating the data. The air gap can also be built with WORM object storage (write once, read many), which adds protection against tampering: written data can be neither modified nor deleted.
Backups nobody can rewrite.
After a full copy, "incremental forever" snapshots in an immutable Timeflow, with minimal impact on the source database. Policies for roles, retention and dataset locking.
The last healthy version, in minutes.
If an attack is detected, ingestion stops so that no corrupted data is collected, and Fast Recovery kicks in from a virtual database on the last healthy snapshot.
Understand what happened, and when.
The sequence of immutable snapshots reconstructs the timing, pattern and scope of the attack.
In the cloud too
Delphix Cloud Engines: the most cost-effective anti-ransomware architecture for cloud databases.
- Object storage to keep costs down, with space that grows when needed.
- Integration with IAM (role-based access) and private access keys.
- A caching tool to keep virtual database performance steady.
- Oracle
- SQL Server
- SAP HANA
- Db2
- Multi-cloud replication
Detection
Three levels of checks, on every snapshot.
Even partial encryption leaves traces. That's why the checks go all the way down from the data block to the individual table. On top of these come the checks of the detection add-on feature, on databases and filesystems.
Low-level attacks
Mass encryption is intercepted already during Delphix's ingestion and snapshot jobs.
- Blocks
- Ingestion
Tablespace attacks
Mass check queries on all objects of every tablespace, to uncover even partial encryption of datafiles.
- Tablespace
- Masking Engine
DML-level attacks
For each tablespace, "sentinel" tables with fixed data in a dedicated schema: their integrity is verified after every snapshot.
- Sentinel tables
- SQL queries
The flow, step by step.
Snapshot and replication
After every snapshot an automation pipeline (for example Jenkins) starts and monitors replication to the Vault. If the anomaly is in the datafile, an email goes out.
Test database
A virtual test database is created from the Vault for further integrity checks on the snapshot just replicated.
SQL checks
Checks on the sentinel tables of each tablespace, to uncover attacks on data integrity.
Mass checks
Using the Masking Engine, on every table of every tablespace, to spot even partial encryption.
Outcome
Corruption found? A recovery database is created on the last safe snapshot. Otherwise the snapshot is healthy.
Fast recovery
Restart, don't start over.
When an attack is detected, Delphix suspends ingestion so as not to collect corrupted data, and immediately starts Fast Recovery: the last valid version of the database is available in minutes.
The virtual database is activated in the recovery environment for minor events, or directly in production when the physical one is no longer usable.
- Minor events
- Fast Recovery «Light»For corruption or partial loss: a point-in-time virtual database, alongside the physical one, to recover even just schemas, tables or subsets.
- Major events
- Fast Recovery «Full»For a total outage: the physical database is replaced by a virtual database within minutes of detection.
- Meanwhile
- Service upThe virtual database serves the application while Delphix rebuilds the physical one in parallel.
- Key feature
- Virtual-to-PhysicalV2P cuts downtime by automatically recreating the physical database.
Add-on feature · Advanced detection
More detection, on top of Delphix Anti-Ransomware.
An add-on feature adds detection capabilities to the Delphix Anti-Ransomware solution. It delivers preventive detection and tracking of potential threats: integrated with Delphix Continuous Data, it checks changes in data and structures against a trusted baseline, keeps a history of every check and drastically cuts recovery times.
A "golden copy" as the reference.
Every check compares the current state with the reference copy of databases and filesystems.
Structure and data, with tailored thresholds.
Thresholds are configurable by environment type: strict for stable systems, looser where data changes often.
A validity log to restart fast.
You always know the last safe state to restore from.
Contact
Let's put your data out of harm's way.
A vault to design, checks to automate or a recovery plan to really put to the test: write to us and we'll put you in touch with the right professional.
- Emailinfo@cogitatech.it