SafeMode – Protection Against Ransonware Attack

 Why and what is FlashArray SafeMode

Enabling FlashArray SafeMode on Purestorage storages ensures a quick turnaround in case your data is encrypted by a ransomware attack. It is to ensure that the image of the client company will not be tarnished. That reputation will be maintained. That the financial values ​​assigned to the company will not be affected nor will they lose market value.

It consists of a very simple strategy to enable FlashArray SafeMode. But first I will explain what FlashArray SafeMode is: Purestorage's highly reliable solution incorporated into the operating system code, so to speak, Purity. Licensing is not required, nor any kind of subscription or additional costs. Attributes already well explored by Purestorage in its products. Because the entire line of Storages solutions are delivered to the customer with the features enabled.

Returning to FlashArray SafeMode, the feature works in a simple and robust way. Once enabled, FlashArray SafeMode will protect volumes, snapshots, file directories, pods (ActiveCluster), protection groups (I'll talk about it in another post) and etc. Imagine a scenario in which a small inattention could cause an involuntary deletion of a volume and that was only noticed after 24 hours?. Tragic!. By default, in Purestorage, when an object is deleted (volume for example) it will go to a waiting area, called Eradication, which has a timer of 24 hours or more. After this period, the data will be permanently deleted. This feature is very good for use by storage administrators, due to involuntary deletion. Now imagine that a hacker exploits a vulnerability and gains access to storage and encrypts the entire environment.

With FlashArray SafeMode this won't be a long-term problem, but a matter of minutes as the data replicated to Purestorage's secure environment is immutable. FlashArray SafeMode does not allow the Storage Administrator to cause the deletion of an object protected by SafeMode.

The only method to eradicate it is with a conference call to support, with two named people and their respective PINs. If an attacker somehow acquired administrator credentials, he would be unable to eradicate objects. Immutability of snapshots prevents snapshots from being changed and FlashArray SafeMode prevents malicious eradication by the hacker.

Enabling FlashArray SafeMode

1. 1.       Contact Purestorage Support and request activation.
2. 2.       Once the request has been analyzed, a videoconference will be required for activation.
3. 3.       The Purestorage Account manager will compose the conference.
4. 4.       The customer must nominate up to 5 people who are not the storage administrators.
5. 5.       During the videoconference, a 6-digit PIN will be sent to trusted people.
6. 6.       After that Purestorage support will enable FlashArray SafeMode.

Simple, fast, secure and proactive.

FlashArray SafeMode is, and should be, part of meetings with the security team of any company, even if it only has cloud storage, as Purestorage is in the market place of the main global cloud players.