1 of 57

Anomalies

Good or bad?

Daniel.Olkowski@dell.com

1

Internal Use - Confidential

2 of 57

Agenda

Anomalies
Detecting anomalies
Examples
Demo
Licensing
Materials

2

Internal Use - Confidential

3 of 57

Anomalies

CYBER ANOMALY THREAT DETECTION

3

Internal Use - Confidential

4 of 57

What is important?

Cyber Anomaly �Threat Detection

The most important things to customers

Being sure that we can survive any attack
Detect incident as early as possible

Cyber war is real war

4

Internal Use - Confidential

5 of 57

Anomalies

Cyber Anomaly �Threat Detection

Anomalies are the first thing that shall warn us
This is why we measure blood and other things
To check if our body is healthy, „in norm”
We have ready to use tool to check if our backup system behavior is fine
Data Protection Advisor

5

Internal Use - Confidential

6 of 57

Anomalies

Cyber Anomaly �Threat Detection

IT owners can protect critical data from cyberattacks by creating simple rules getting immediate alerts via

email
call local script
send SNMP trap
create Windows Event Log Entry

Or any combination of the above

6

Internal Use - Confidential

7 of 57

Anomalies

Cyber Anomaly �Threat Detection

Proactive approach to anomaly detection is a form of information security management that focuses on anticipating and preventing potential threats by analyzing data protection activities
It is a strategy that includes the following:

Identifying potential threats – analyzing data
Preventing attacks before they happen – anomaly in data
Detecting attacks as soon as possible – anomaly in data
Responding to attacks in an appropriate way – info from data

Tool: Data Protection Advisor
DPA enables organizations to more effectively design and efficiently implement a cyber resilience strategy.

7

Internal Use - Confidential

8 of 57

Anomalies

Cyber Anomaly �Threat Detection

DPA is available for any backup software
Good subject for consultancy

Even consultancy rather than implementation
Implementation is simple
Knowledge what to use is more tough
Good subject for Residence
Appreciated in Poland

8

Internal Use - Confidential

9 of 57

Detecting anomalies

CYBER ANOMALY THREAT DETECTION

9

Internal Use - Confidential

10 of 57

Data Protection Advisor

Monitor selected appliance and systems with suitable set of rules

Detect anomalous behavior as soon as it happens via Alerts

Data Protection Advisor Analysis Engine is stateful

Easy to configure and setup default and new rules

11 of 57

What is DPA?

Data Protection Advisor

Data Protection Advisor Analysis Engine is a stateful engine that continuously monitors backup appliances activities and detects anomalies based on customer defined rules.
IT owners can protect critical data from cyber attacks by creating simple rules getting immediate alerts via email, call local script, send SNMP trap, Event Log Entry.
Data Protection Advisor Analysis Engine provides a preemptive method of detecting the anomaly and send alerts immediately which is more effective than reporting as reports are sent at scheduled interval and has to be managed by an operator.
In case of cyber attack, we want me to be informed of the attack as soon as the threat is detected.

11

Internal Use - Confidential

12 of 57

Data Protection Advisor

Cyber Anomaly �Threat Detection

Data Protection Advisor Analysis Engine provides a pre-emptive method of detecting anomalies based on predefined rules and send alerts immediately.
This is more effective than reporting, as reports are sent at scheduled intervals and an operator must manage them.
In case of a cyberattack, we want to be informed of the attack as soon as we detect the threat.

12

Internal Use - Confidential

13 of 57

Introduction

Rules

Rules is the logic used to detect an anomaly and/or breach

Analysis Policy

Collection of one or more rules assigned to an object or group.

Alerts

Alert tab will show the alert and can also trigger a variety of external alerts if defined/configured

Dell Data Protection Advisor Analysis Engine

Analysis Engine

Detects state changes in the data defined in the Rules that have been assigned and triggers alerts

What is the Analysis Engine and what are rules, policies and alerts?

An analysis rule template is a set of instructions that defines the rules logic. When a rule template is added to an analysis policy, the Analysis Engine carries out certain operations and then displays the resulting events in the Alerts section of the web console.

An Analysis Policy contains multiple rules that apply to different object types. The Analysis Engine only runs the rules that are applicable to a given object. For example, if the object is a switch, then the Analysis Engine will only run the rules in the policy that apply to switches.

Rules contain the logic for when to issue an alert.
An analysis policy is a collection of one or more rules that is assigned to an object or group.
The analysis engine compares monitored data to the conditions in a rule, and triggers alerts when a rule is matched.

An analysis rule template is a set of instructions that defines the rules logic. When a rule template is added to an analysis policy, the Analysis Engine carries out certain operations and then displays the resulting events in the Alerts section of the web console.

For example, a rule template can be created to monitor whether a file system is likely to exceed 90% utilization in the next hour. An Analysis Policy contains multiple rules that apply to different object types. The Analysis Engine only runs the rules that are applicable to a given object. For example, if the object is a switch, then the Analysis Engine will only run the rules in the policy that apply to switches..

14 of 57

DPA Analysis Engine

Cyber Anomaly �Threat Detection

The Data Protection Advisor Analysis Engine is a powerful feature which inspects data collected from various sources, runs predefined rules established by application owners, and reports the findings
Data Protection Advisor Analysis Engine provides rules, policies and alerts
Data Protection Advisor acts on state changes based on the analysis rules that have been applied and triggering alert/s to external components and clients which require attention.

14

Internal Use - Confidential

15 of 57

Rules & Policy

Analysis Engine

An analysis rule template is a set of instructions that defines the rules logic. When a rule template is added to an analysis policy, the Analysis Engine carries out certain operations and then displays the resulting events in the Alerts section of the web console.
An Analysis Policy contains multiple rules that apply to different object types. The Analysis Engine only runs the rules that are applicable to a given object. For example, if the object is a switch, then the Analysis Engine will only run the rules in the policy that apply to switches.

15

Internal Use - Confidential

16 of 57

Rules & Policy

Analysis Engine

Rules contain the logic for when to issue an alert.
An analysis policy is a collection of one or more rules that is assigned to an object or group.
The analysis engine compares monitored data to the conditions in a rule, and triggers alerts when a rule is matched.

16

Internal Use - Confidential

17 of 57

Rules & Policy

Analysis Engine

An analysis rule template is a set of instructions that defines the rules logic. When a rule template is added to an analysis policy, the Analysis Engine carries out certain operations and then displays the resulting events in the Alerts section of the web console.
For example, a rule template can be created to monitor whether a file system is likely to exceed 90% utilization in the next hour. An Analysis Policy contains multiple rules that apply to different object types. The Analysis Engine only runs the rules that are applicable to a given object. For example, if the object is a switch, then the Analysis Engine will only run the rules in the policy that apply to switches..

17

Internal Use - Confidential

18 of 57

Data Protection Advisor Analysis Engine Workflow

Setup Policy

Data Protection Advisor

Define Rules

Assign policies or rules Objects

1

2

3

4

Analysis Engine

Analysis Engine starts monitoring

Anomaly

5

Detects Anomaly

6

Send Alerts

SNMP Trap

Message via local script

Event log Entry

Email

In Data Protection Advisor UI :
1. Setup Analysis Engine Policy -An analysis policy is a collection of one or more rules that is assigned to an object or group.
2. Define a Rule - Rules contain the logic for when to issue an alert.
3. Assign policies or rules to an Object
4. & 5.The analysis engine compares monitored data to the conditions in a rule, and triggers alerts when a rule is matched. Event-based rules trigger an alert in response to data that is streaming into the Data Protection Advisor server. Schedule-based rules periodically compare data in the Data Protection Advisor Datastore against rules to detect a match.
6. The alerts can be sent via SNMP trap, local script e.g send text message , Event log Entry or Email.

Note : An analysis rule template is a set of instructions that defines the rules logic. When a rule template is added to an analysis policy, the Analysis Engine carries out certain operations and then displays the resulting events in the Alerts section of the web console.
An Analysis Policy contains multiple rules that apply to different object types. The Analysis Engine only runs the rules that are applicable to a given object. For example, if the object is a switch, then the Analysis Engine will only run the rules in the policy that apply to switches.

19 of 57

How to setup anomalies detection?

Data Protection Advisor User Interface

1. Setup Analysis Engine Policy�An analysis policy is a collection of one or more rules that is assigned to an object or group.�

2. Define a Rule �Rules contain the logic for when to issue an alert.�

3. Assign policies or rules to an Object

4. & 5.�The analysis engine compares monitored data to the conditions in a rule, and triggers alerts when a rule is matched. Event-based rules trigger an alert in response to data that is streaming into the Data Protection Advisor server. Schedule-based rules periodically compare data in the Data Protection Advisor Datastore against rules to detect a match.�

6. The alerts can be sent via SNMP trap, local script e.g send text message , Event log Entry or Email.

19

Internal Use - Confidential

20 of 57

Examples

CYBER ANOMALY THREAT DETECTION

20

Internal Use - Confidential

21 of 57

Rule – Full backup larger than average time window

Cyber Attack Vector: Ransomware

Typical modus operandi: Data Encryption

An increase in deviation of “Size” of data sent to server based on that job’s historical average may indicate “encryption” at play

As a start, we can use this rule to detect a 50% increase in the current job to its 2 week historical size and trigger an alert if true.

CAV : Ransomware : - Typical modus operandi – Encryption

Data Protection Advisor : In Data Protection Advisor’s dedupe environment, metrics are collected regarding the “size” of the job (amount of data sent for backup post dedupe) and “size scanned” (amount of data pre dedupe). Typical ransomware or malware attacks, require a fair amount of unique, encrypted data to succeed. Therefore, an increase or deviation of job size based on that job’s historical two-week average may indicate encryption at play. Setting alerts to flag such increases in data can alert administrators to possible malicious code. As a start, we can use this rule to detect a 50% increase in the current job compared to its 2-week historical Size and trigger an alert, but both the time frame of the average and the percentage of deviation can be customized during assignment.

22 of 57

Am I encrypted?

Examples of rules

CAV : Ransomware : - Typical modus operandi – Encryption
Rule – Full backup larger than average time window
In Data Protection Advisor’s dedupe environment, metrics are collected regarding the “size” of the job (amount of data sent for backup post dedupe) and “size scanned” (amount of data pre dedupe). Typical ransomware or malware attacks, require a fair amount of unique, encrypted data to succeed. Therefore, an increase or deviation of job size based on that job’s historical two-week average may indicate encryption at play. Setting alerts to flag such increases in data can alert administrators to possible malicious code. As a start, we can use this rule to detect a 50% increase in the current job compared to its 2-week historical Size and trigger an alert, but both the time frame of the average and the percentage of deviation can be customized during assignment.

22

Internal Use - Confidential

23 of 57

Rule – Backup Application Configuration Changed

Cyber Attack Vector: Insider attack or remote execution

Modus operandi: Backup Appliance control

During an internal malicious attack (or remote execution), one could make configuration changes to the backup application

Data Protection Advisor can detect changes to a backup application’s configuration and send alerts.

24 of 57

Is backup being hacked?

Examples of rules

CAV : Insider attack or remote execution
Rule – Backup Application Configuration Changed
During an internal malicious attack (or remote execution), a bad actor could make configuration changes to the backup application such as disabling backups, backup schedules, or workflows, or even shutting down servers.

Data Protection Advisor can detect changes to a backup application’s configuration – typically used for change management – but could also be used a means to detect foul play or human error.

Data Protection Advisor’s Analysis Engine can trigger an alert when configuration changes are detected. By default, Data Protection Advisor collects configuration data from the backup application twice a day (and can be customized).

24

Internal Use - Confidential

25 of 57

Rule – Data Domain capacity high

Cyber Attack Vector: Ransomware

Typical modus operandi: Data Encryption

An encryption threat will cause the creation of a lot of unique data, deduplication rate will drop down filling up PowerProtect DD

Data Protection Advisor collects data directly from the PowerProtect DD and can send an alert if file system utilization is crossing the threshold.

26 of 57

Am I encrypted?

Examples of rules

CAV : Ransomware : Encryption
Rule – Data Domain capacity high
An encryption threat will cause the creation of a lot of unique data, and in a deduplication environment, this will cause the PowerProtect DD appliance to fill up very quickly upon the next backup.

Data Protection Advisor collects data directly from the PPDD and can look at the PPDD’s “Data” filesystem (this is where user data is stored), and if this “Data” filesystem utilization is high – it could indicate a malware/ransomware attach in progress.

Default threshold is 90% and should be customised to 80% for PPDD systems

26

Internal Use - Confidential

27 of 57

Rule – Many backups failed

Cyber Attack Vector: Backup Missed or Unavailable

Multiple backups failing within a limited time window can mean clients are offline or under cyber attack and it should be reported immediately.

Data Protection Advisor will send an alert if 5 Backups fail with 30 minutes. This is a default value and can be changed

28 of 57

Am I being attacked?

Examples of rules

CAV : Unavailability or Exposures
Rule – Many backups failed
Backup clients could be a) maliciously tampered with or b) undergoing ransomware encryption or c) out of network or made unavailable .
This will cause multiple job failures for a client or multiple clients backups failed within a certain time window.

This policy tracks <Num Failed> backups failed in the last <Number of Minutes to Check> minutes.

Default Value :
Max. Number of Failed Backups :5
Number of Minutes to Check :30

28

Internal Use - Confidential

29 of 57

Rule – Network Utilization High

Cyber Attack Vector: Network control or unusual traffic

Abnormal network utilization can be caused by cyber attacks

Default value set is 70% but can be customized.

30 of 57

Am I encrypted?

Examples of rules

CAV :Abnormal network activity
Rule – Network Utilization High
Data Protection Advisor can collect data from a host’s NIC and detect high utilization. This could indicate abnormal network/bandwidth utilization possibly being caused by a cyber attack.

Default threshold is 70% and can be customised

30

Internal Use - Confidential

31 of 57

Rule – Three strike failure

Cyber Attack Vector: Unavailability or Exposures

A backup client failing, or missing backups consecutively for three days is exposed to cyber attacks.

This rule will send alert if a client has failed to run backup atleast three days.

32 of 57

Am I being attacked?

Examples of rules

CAV : Unavailability or Exposures
Rule – Three strike failure
A backup client could be exposed to cyber attacks by not having backups over 3 consecutive days.

The rule “Three-strike Failures” could be used to detect this and if found, Data Protection Advisor can trigger an alert if Client has failed at least three days running.

32

Internal Use - Confidential

33 of 57

Rule – Many backup devices unavailable

Cyber Attack Vector: Unavailability of Backup appliance

In case of cyber attacks, attackers will try to target the backup appliances so that recovery of data is restricted.

Backup appliances are monitored by Data Protection Advisor and if more than two (default) are down it will send alert.

34 of 57

Am I being attacked?

Examples of rules

CAV : unavailability
Rule – Many backup devices unavailable
In case of cyber attacks if backup appliances are down or unavailable then recovery will not be possible so backup appliances should be closely monitored.

Data Protection Advisor collects device status from the backup application and if more than 2 are down, Data Protection Advisor can trigger an alert (can be customised without rewriting the rule – assigned/changed upon use).

34

Internal Use - Confidential

35 of 57

Rule – No NetWorker bootstrap generated

Cyber Attack Vector: Restrict Disaster Recovery

NetWorker bootstrap job is required in order to recover a NetWorker Server in an DR scenario

Alert is generated if no NetWorker bootstrap has been generated for 2 days (default)

36 of 57

Am I being attacked?

Examples of rules

CAV : unavailability/Disaster recovery
Rule – No NetWorker bootstrap generated
Data Protection Advisor collects the NetWorker bootstrap job data – this is required in order to recover a NetWorker Server in an DR scenario.

Data Protection Advisor will alert if no NetWorker bootstrap has been generated in 2 days (can be customised)

36

Internal Use - Confidential

37 of 57

Demo

CYBER ANOMALY THREAT DETECTION

37

Internal Use - Confidential

38 of 57

Data Protection Advisor Analysis Engine Workflow

Setup Policy

Data Protection Advisor

Define Rules

Assign policies or rules Objects

1

2

3

4

Analysis Engine

Analysis Engine starts monitoring

Anomaly

5

Detects Anomaly

6

Send Alerts

SNMP Trap

Message via local script

Event log Entry

Email

In Data Protection Advisor UI :
1. Setup Analysis Engine Policy -An analysis policy is a collection of one or more rules that is assigned to an object or group.
2. Define a Rule - Rules contain the logic for when to issue an alert.
3. Assign policies or rules to an Object
4. & 5.The analysis engine compares monitored data to the conditions in a rule, and triggers alerts when a rule is matched. Event-based rules trigger an alert in response to data that is streaming into the Data Protection Advisor server. Schedule-based rules periodically compare data in the Data Protection Advisor Datastore against rules to detect a match.
6. The alerts can be sent via SNMP trap, local script e.g send text message , Event log Entry or Email.

Note : An analysis rule template is a set of instructions that defines the rules logic. When a rule template is added to an analysis policy, the Analysis Engine carries out certain operations and then displays the resulting events in the Alerts section of the web console.
An Analysis Policy contains multiple rules that apply to different object types. The Analysis Engine only runs the rules that are applicable to a given object. For example, if the object is a switch, then the Analysis Engine will only run the rules in the policy that apply to switches.

39 of 57

Steps # 1 – Create a policy

40 of 57

Steps # 2-Set up the external alerting (optional) – can update/set later

41 of 57

Creating policy

Demo

Under Create Analysis Policy :

Provide a name and description for the a for example “Cyber Threat Anomaly Detection” .
Make sure Enable Policy checkbox is selected.
Next if user wants to setup Policy Based Action Select “Edit Policy Based Action” and fill in the details for Action item.The Analysis Engine actions can be:

● generate an email

● run a script

● send an SNMP trap

● write an event to a Windows Event Log

When an analysis policy finds a matching condition, Data Protection Advisor generates an event. All events are automatically logged in to the Data Protection Advisor Datastore. You can view all events in the Alerts section of the web console.

4. Next Select “Add/Remove Rules”

41

Internal Use - Confidential

42 of 57

Steps # 3– Add the rule template/s into the policy

43 of 57

Rules

Demo

All System or Custom Rule Template list will be populated , from the list select one or multiple event-based rule . Then select “Add” Button.

43

Internal Use - Confidential

44 of 57

Steps # 4 – Set the parameter/s according to customer environment (optional and if relevant)

45 of 57

Rules

Demo

Next ,for each rule we will see the default value for system rules . These values can be modified according to customer environment.

Once done Select “ok”.

45

Internal Use - Confidential

46 of 57

Steps # 5 – Save it and verify in Analysis policy Library

47 of 57

Rules

Demo

Verify that all the rules are visible in the policy.

47

Internal Use - Confidential

48 of 57

Steps # 6 – Apply the policy to desired individual objects or Groups

49 of 57

Rules

Demo

Go to Policies>Analysis Policy >Applied Analysis Policies

Select one object or group of objects like PowerProtect DD , Avamar or Networker and assign the policy to the object using “Applied Policy”.

Note: The demonstrated steps are one of the method to assign a policy/rule to an object. Please check Data Protection Advisor Install & Admin Guide for more details.

49

Internal Use - Confidential

50 of 57

Licensing

CYBER ANOMALY THREAT DETECTION

50

Internal Use - Confidential

51 of 57

DPS Bundles Offers

Product Name		Power Protect Data Manager	Data Protection Suite	Data Protection Suite +	PowerProtect Data Manager Essentials	DPS for vmware (EMEA ONLY)
PowerProtect Data Manager		✔	✔	✔	✔	X
PowerProtect VM Replication		✔	✔	✔	✔	✔
PowerProtect Cyber Recovery		✔	✔	✔	✔	X
PowerProtect Storage Direct		✔	✔	✔	✔	X
PowerProtect Vprotect		✔	✔	✔	✔	X
NetWorker, Networker Virtual Edition*		X	✔*	✔	X	✔ (Limited)
Avamar (incl. vRealize DP Extension) &AVE		X	✔	✔	X	✔ (Limited)
Data Protection Central		✔	✔	✔	✔	✔
Data Protection Advisor		✔	✔	✔	✔	✔
DP Search		Embedded	✔	✔	Embedded	✔
Boost FS		✔	✔	✔	✔	X
CloudBoost		X	✔	✔	X	✔
Data Domain Virtual Edition		✔	X	✔	✔	X
Cloud Tier*		✔	X	✔	✔	X
Cloud Snapshot Manager*		✔	✔	✔	✔	X
Cloud DR		✔	X	✔	✔	X
Licensing	Metric	FETB/Socket	FETB/Socket	FETB/Socket	FETB/Socket (Limited to 50)	Socket
Licensing	Sales Method	Perpetual & Subscription	Perpetual & Subscription	Perpetual & Subscription	Perpetual & Subscription	Perpetual

*Cloud Tier can be used with either DDVE or Physical Appliances

*For perpetual licenses, the entitlement to use Cloud Snapshot Manager is tied to a valid support agreement. The customer is required to enter the end date of the support agreement at the time of activation in the CSM portal.

51

of 23

51

of Y

Internal Use - Confidential

52 of 57

Licensing

Cyber Anomaly �Threat Detection

Per client licensing for other software

52

Internal Use - Confidential

53 of 57

Materials

CYBER ANOMALY THREAT DETECTION

53

Internal Use - Confidential

54 of 57

White papers

Cyber Anomaly �Threat Detection

Advanced Anomaly Detection with Data Protection Advisor

https://www.delltechnologies.com/asset/en-us/products/data-protection/industry-market/h19503-advanced-anomaly-detection-with-data-protection-advisor.pdf

A Cyber Resilient Strategy With Dell Data Protection Solutions

https://www.delltechnologies.com/asset/en-us/products/data-protection/industry-market/enhancing-cyber-resilience-whitepaper.pdf

54

Internal Use - Confidential

55 of 57

Videos

Cyber Anomaly �Threat Detection

Video-Introduction to Analysis Engine�https://youtu.be/xfGCEKfZ3HA

�

55

Internal Use - Confidential

56 of 57

Materials

Cyber Anomaly �Threat Detection

Data Protection Advisor page:�https://www.dell.com/en-us/dt/data-protection/data-protection-suite/data-protection-advisor.htm
Data Sheet - Data Protection Advisor:�https://www.delltechnologies.com/asset/en-in/products/data-protection/briefs-summaries/h1767-data-protection-advisor-data-sheet.pdf

56

Internal Use - Confidential

57 of 57

End logo slide

Questions

Daniel.Olkowski@dell.com

57

Internal Use - Confidential