Let Your Cloud Native Storage Save You from Ransomware!
summary
Claims an inline S3 gateway can detect ransomware by measuring entropy changes and quarantining uploads. Uses Ceph RGW Lua hooks running in-process, deployed on a Ceph cluster (demo without Rook), and compares entropy of the first ~4 MiB chunk to a stored prior value. If entropy rises above ~0.5% and ~20% of objects in a bucket look suspicious the bucket is flagged and new writes redirect to a quarantine bucket. Demo mostly recovers data; some files uploaded before flagging remain encrypted.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:26Agenda
- 5:49Entropy
- 15:34Bucket Notifications
- 17:43Why Lua
- 19:55Request Context
- 22:09Quarantine Bucket
- 28:12Quarantine Script
- 29:14Calculating the Entropy
- 29:35Detect the Ransomware
- 31:22Upload the Quarantine Code
related talks
18mSecuring S3 Backups Against Ransomware
30mAnti-ransomware strategies on the cloud
15mRansom Access Memories: Achieving Practical Ransomware Protection in Cloud with DeftPunk
35mDefeating Ransomware Attacks
50mProtegiendo sus datos en la nube de AWS ante un evento de ransomware
51mHow to secure your data and applications against ransomware
14mBehind the scenes w/ SentinelOne’s MDR: Detecting cloud ransomware
35mData Security and Storage Hardening in Rook and Ceph