The News: Nutanix improved its cyber resilience with new ransomware detection and recovery features in Nutanix Unified Storage and its Data Lens security as a service (SaaS) security application. You can read the press release on the Nutanix website.
Nutanix Adds Ransomware Protection Inside Its Unified Storage for HCI
Analyst Take: Data Lens provides file analytics and reporting, anomaly detection, audit trails, and ransomware protection for Nutanix Files. It is designed to proactively assess and mitigate security for unstructured data and compliance risks. Its new capabilities include:
- Ransomware Detection and Blocking Within 20 Minutes: Proactive detection combined with automated response helps quickly block attacks and minimizes ransomware’s impact.
- Ransomware 1-Click Recovery: Nutanix Data Lens and Nutanix Unified Storage will identify the last known good snapshot and automatically recover the share from the snapshot. Customers will have the option of automated or manual recovery to quickly restore normal operations.
- Permission Visibility and Risk Visualization: Data Lens identifies the root cause of access control risks and monitors a risk score to track vulnerabilities within data and user groups.
Nutanix already had ways to deal with ransomware, such as immutable snapshots of virtual machines, but had a gap for protecting shared storage. With its new capabilities, Data Lens recommends the last good snapshot for a restore point and provides customers with a list of every affected file – those files that were created or modified after the ransomware attack. It uses signature-based detection techniques and behavioral pattern detection such as client IP, user account details, file activity, and other behavioral detection markers, to provide security and visibility against threats. The goal of the added cyber resilience is to not only make ransomware detection faster but also easier for Nutanix Cloud Platform HCI customers to manage.
Nutanix also added object storage support to Data Lens. Data Lens now includes data lifecycle management, auditing, and reporting features for Nutanix Objects Storage.
Looking Ahead
The onslaught of ransomware attacks has made cyber resilience a board-level concern, and C-level leadership recognizes the direct correlation between data resilience and recoverability, with their overall ability to minimize the potential fallout (downtime and data loss) from cyberattacks. The Enterprise Cloud Index global research study conducted by Nutanix found that 93% of organizations said they need to be better prepared for ransomware attacks.
With this in mind, primary data storage, data protection, and data management vendors alike are responding with tools to empower IT to be more proactive when it comes to identifying and stopping attacks, and to minimize recovery point objectives (RPOs) and recovery time objectives (RTOs). Nutanix is no exception.
Ransomware detection is an area that has arguably the most amount of “muddiness.” Vendors of all shapes and sizes are messaging their approach, from endpoint detection tools all the way through tools for uncovering malicious activity within “colder,” last-line-of-defense data vault environments. Based on The Futurum Group’s conversation with Nutanix, the vision is clear. Focus on detecting ransomware attacks in-progress, within production storage environments, and minimize their blast radius. That is, stop them from further spreading (say, into the backup environment) and provide the ability to quickly identify and recover from the snapshot that is as close as possible to the point of infection to minimize data loss while helping the business to get back up and running as quickly as possible.
The Futurum Group is expecting to see much more inclusion of permission visibility and risk visualization features over the next 12-18 months. When it comes to making SecOps teams more proactive, these features could not be more key. Especially as we move to multicloud environments and as we consider the sheer scale at which enterprises operate, permissions structures are extremely complex and are a key vulnerability that malicious actors are looking to exploit.
Disclosure: The Futurum Group is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of The Futurum Group as a whole.
Other Insights from The Futurum Group:
Cisco Discontinues HyperFlex to Focus on Nutanix-Based HCI
VMware Ups Cyber-Resiliency With NSX+, Ransomware Recovery
Rubrik’s AI-Powered Cyber Recovery Minimizes Data Loss
Author Information
Dave focuses on the rapidly evolving integrated infrastructure and cloud storage markets.
Krista Case brings over 15 years of experience providing research and advisory services and creating thought leadership content. Her vantage point spans technology and vendor portfolio developments; customer buying behavior trends; and vendor ecosystems, go-to-market positioning, and business models. Her work has appeared in major publications including eWeek, TechTarget and The Register.
