@denbesten I agree, you need to know the original backup data is secure and has not been compromised. A journal type system, will take a copy, from the original, but as you state if the original has been compromised, then it is no longer safe in terms of integrity and availability. Another approach is to ensure that you can detect and prevent these attacks occurring to the original storage system, and that you have a secondary system which has an independent secure backup (i.e. it is encrypted) system, which can be trusted, so that recovery can be obtained without impact to the organisation. But as you know, there is no point, recovering to the same systems that were compromised, if you can no longer trust them.
In the previous links I provided, it uses:
The FCM4 technology in new FlashSystem arrays is designed to capture and summarize detailed statistics about every I/O in real time. FlashSystem uses machine learning models to distinguish ransomware and malware from normal behavior, positioning organisations to take action and keep operating in the event of an attack.
It also provides the following: The FlashSystem Cyber Recovery Guarantee is designed for anyone who purchases a new Flashsystem Array with Storage expert care and Storage Insights Pro. With this package, IBM guarantees recovery of a SafeGuarded Copy (immutable snapshot) restore point within 60 seconds or less.
This is the type of technology which is now available these days, and like the IP protection from various Vendors on AI LLM Models, having to establish trust, integrity is big business these days. There is an old metaphor "Practice what you preach", which can be used for protecting storage systems against cyberattacks too.
Regards
Caute_Cautim
