ESX Virtualization

VMware ESXi, vSphere, VMware Backup, Hyper-V... how-to, videos....

Zerto 10 announced with a Real-Time Ransomware Detection and Air Gap Vault with immutability

By | Last Updated:

Shares

Zerto 10 launch event was excellent. Having a Kevin Mitnick as one of the presenters really helps indeed, but Zerto 10 looks pretty solid. With features announced in this release, we won't look at ransomware the same way as we did before. If you have a spare hour, watch the recording here, you won't regret. Now, to the content and to the news about what has been announced that Zerto 10 will bring to fight ransomware and other new features.

The fact that the IT is in war against ransomware isn't new. What changes is that IT has better and better tools to fight it to win battles. Usually, the battle is over when ransomware encrypts your servers, endpoints, and also backups. The first “weapon” we've seen over the couple of years was an immutability of backups. So every vendor now has a possibility to have backups stored within an immutable repository. This is good, but with that, there is also the duration during which you'll need to restore your whole system.

Zerto since several years is now part of HP Enterprise, and that's where Zerto might get an advantage over traditional, software-only data protection vendors.

Zerto has been within the industry for over a 10 years and there are some top challenges that Zerto hears:

  • Threads evolution
  • Slow speed of recovery
  • Low ration of data recovery if you pay the ransom
  • Staying with compliance with GDPR, SOX, HIPAA, ….

Zerto Encryption Analyzer

As we know, Zerto is known as a product that is able to tap into a virtual machine’s IO stream causing no overhead or performance problems compared to traditional hypervisor snapshots and use that data to captures and copies the IOs from VMs, to the remote site where a journal system keeps those data.

Zerto 10 adds a new component that will be able to detect encryption within the IOs. Usually where there is an encryption, there might be a ransomware attack happening, right? And that's exactly the Zerto's new feature all about – detect encryption at the early stage! When most, if not all, of your data is already encrypted and you're looking to recover, that's already too late….

The detection is done at the block level so where a possibly encrypted block is detected, it happens in the very early stage.

The detection system is actually sitting within the Zerto VRA appliance (the appliance that is responsible for moving the data at the block level), so all you have to do is activate a single check box, which activates the inline detection that collects the encryption metrics data. Those data can be then sent via a new API to ZVM, or to other systems.

Just to note, this feature has no additional cost.

As being said, you can leverage external systems, via new API and hook it to other anti-malware security systems that are external to Zerto. Here is an example at Github

New Vault architecture with immutability and Encrypted periodic replication via Physical air gap direct connect RCIP (Remote copy over IP)

The architecture of Immutable Vault with which has been announced, has an ongoing encrypted periodic replication with a physical air gap with direct connection via RCIP. The physical connections between the storage systems used with Remote Copy over IP (RCIP) are through an IP-capable network. Each link between a pair of storage systems is a logical link between a controller node on one storage system and a controller node on the other storage system in the configuration. These links use an Ethernet port from each of the nodes in the storage systems. HPE Alletra systems are part of the architecture.

Another feature of Zerto's software, in conjunction with HP, as it is now an HP company, is that they're have a Vault architecture that has a encrypted periodic replication where physical direct connect air gap is maintained. The architecture is on the bellow screenshot from the presentation. All snapshots in the vault are immutable, all Zerto components needed for recovery are stored in the vault.

So if you lose the Production and replication targets, because they're encrypted by a ransomware, you still have a vault that you know that is immutable, disconnected from the network, and clean. So you just need to chose the restore point that has been identified as “clean” before the ransomware started to spread out, an start your production from those immutable copies.

The vault does not have an exposed management port and does not have any single point of compromise. The Resilience Automation Server (RAS) inside the vault is a lightweight VM that works with native HPE switch and array services to control the RCIP on the HPE Alletra. It uses randomization to reduce traffic predictability.

The vault will allow you to recover all the components from a clean restore point (Zerto Virtual Manager, journals and replicas) so you'll be able to rebuild a clean Zerto deployment inside the vault, even if, the outside world has been destroyed by ransomware.

Screenshot from the presentation video.

Hardened Linux Appliance instead of Windows system for Zerto

Another new feature of the Zerto 10 is the new hardened Linux Zerto Virtual Manager Appliance to which Zerto moves to. It is a stripped down Linux with hardened kernel, with minimum services actives, with a reduced attack surface, including an MFA and RBAC.

You don't have to worry about how do you migrate, because Zerto provides a tool that migrates everything, not only the settings, VPGs, Recovery plans etc….. The migration, apparently, is very fast, it takes about 5 min.

The upgrades and updates will be much easier than dealing with Microsoft's MSIs. The UI stays the same so no changes for admins from the usage perspective, no need to learn anything new.

Zerto 10 and Enhanced and Expanded Microsoft Azure Integration at Scale

At azure, the challenge is often a cost, when operating a large infrastructures. Zerto 10 has optimized their footprint in Azure on their components, but also lower the number of API calls so overall, for large scale protection workloads in Azure, the Zerto infrastructure is more “lighter” in terms of resources, but also those API calls.

There is also a new support for multi-disk consistency API leveraging new Azure API co-developed with Microsoft. This will allows applications using multiple disks to have a single consistency point.

Zerto for Microsoft Azure will be available in the Azure Marketplace in July.

Zerto is used in Azure now have the same scalability as on-prem. Migration to and from Azure, DR to and from Azure, all those moves are seamless.

Final Words

Zerto Virtual Replication is able to provide very aggressive RPOs with its journaling technology and continuous replication architecture without putting more pressure on production environment which may be the case with traditional backup systems using VDDK and snapshots.

Zerto is able to replicate your virtual environment across your servers and storage platforms. Zerto provides a robust and easy-to-use migration and disaster recovery solution. Zerto has the ability to thoroughly test your BC/DR plans while maintaining the online state of the production environment.

Zerto is:

  • RPOs of seconds
  • No impact to production because it does not use snapshots like traditional backup programs.
  • Simple workflow for rapid RTOs on day-to-day recovery scenarios.
  • Failover, failback and testing are all automated

Links: Zerto website

Zerto 10 Launch Event (recorded)

Press Release:

The Zerto 10 product will be GA and available for downland, in a couple of weeks.

More about Zerto on ESX Virtualization

 

More posts from ESX Virtualization:

Stay tuned through RSS, and social media channels (Twitter, FB, YouTube)

Shares
5/5 - (1 vote)

About Vladan SEGET

This website is maintained by Vladan SEGET. Vladan is as an Independent consultant, professional blogger, vExpert x16, Veeam Vanguard x9, VCAP-DCA/DCD, ESX Virtualization site has started as a simple bookmarking site, but quickly found a large following of readers and subscribers.

Connect on: Facebook. Feel free to network via Twitter @vladan.

x