HPE InfoSight

With the purchase of Nimble, HPE gained a great storage platform. It also gained the valuable asset of InfoSight. InfoSight is an AI-driven predictive analytics tool which enables customers to gain higher efficiency and reliability with smarter, easy to manage infrastructure. HPE InfoSight automatically predicts and resolves 86 percent of issues before a problem is identified.

Since that time, HPE has extended the InfoSight predictive analytics and recommendation capabilities to the HPE Server line This includes Proliant, Apollo and Synergy compute products.

 

Benefits

InfoSight will enable a smarter, self-monitoring infrastructure. This helps to drive down operating costs. It analyzes millions of sensors across the installed base across the globe. Using this data, it will provide trend insights, forecasting and recommendations, to predict and prevent problems.

HPE storage customers are already enjoying the benefits of HPE InfoSight. They are seeing operational costs decreased by as much as 79 percent. Trouble tickets are resolved in 85 percent less time. Above all, 86 percent of issues are automatically predicted and resolved before a problem is identified.

The Infrastructure for Servers will provide Global Visibility into the Server Infrastructure through the wellness monitoring dashboard. Predictive Analytics on parts failures, and recommendations based on patterns or signs of abnormality will be available to eliminate performance bottlenecks on servers.

 

Capabilities

A foundational set of capabilities that can be augmented over time has been delivered by the first release of HPE InfoSight for servers.

 

The Capabilities includes:
1) Predictive data analytics for parts failure
2) Data analytics for server security
2) Global Operational Dashboard with a consolidated view of the status, performance, and health of their server infrastructure. This includes system information, server warranty, and support status
4) Global Wellness Dashboard with a consolidated view of the health of the server infrastructure, including recommendations
5) Recommendations to eliminate performance bottlenecks on servers
6) Support for HPE ProLiant servers, HPE Synergy compute modules and HPE Apollo systems (Gen10, Gen9, and Gen8 with iLO 5 and iLO 4)

 

HPE Infosight improves the customers infrastructure management experience. When combined with HPE OneView, it can simplify the on-premises experience. HPE OneView provides compute lifecycle management and template driven infrastructure deployment. It transforms the infrastructure to software-defined. This allows customers to deploy infrastructure faster, simplify lifecycle operations and increase productivity.

 

How to Install

To start using HPE InfoSight for servers, you’ll need to download and install the iLO Amplifier Pack which serves as the aggregation point for the collection of the data for all of the servers. In addition, it passes the health, configuration, and performance data of each server to InfoSight. Should InfoSight need to take any action on the servers, InfoSight will communicate the action to iLO Amplifier Pack to perform the action.

 

Contact Zunesis to see how InfoSight can improve your current infrastructure.

Ransomware

 

In May 2017, the National Health Service of England and Scotland was hit with the largest ransomware attack at that time. The attack affected an estimated 200,000 computers across 150 countries. The estimated economic loss ranges from hundreds of millions to four billion dollars. This attack, dubbed the WannaCry ransomware attack, catapulted network security to the top of many organization’s priority list.  It brought to light the amount of damage that could be done by a malicious virus.

 

What is Ransomware?

 

Ransomware is a type of malicious software, or malware. It is designed to deny access to a computer system or its data until a ransom is paid. It is typically spread through phishing emails or by visiting an infected website. The virus works by encrypting all the data on the user’s hard drive. Then, it requests a payment, usually in the form of cryptocurrency, to be sent to the hackers. However, there is no guarantee the user will recover their files if they pay that ransom.

 

Ransomware can be devastating for users and organizations. Currently, we are seeing a lot of government agencies, education organizations, and healthcare organizations targeted by these attacks.

 

What precautions can you take?

 

In order to protect your user’s and organization’s data, there are a number of precautions you can take. Most of which are best practice even without the threat of ransomware.

 

First, keep all applications and operating systems up to date. Outdated apps and OS’s are the target of most attacks. This was the case in the WannaCry attack.

 

Second, train users to avoid phishing emails. These are emails designed to look legitimate at first glance but have links that redirect you to an infected site, or attachments that download the malware directly. Phishing emails and sites are also associated with social engineering attacks designed to steal credentials. It is always a good idea to train users to never click on links or open attachments in unsolicited emails.

 

Next, backup your data on a regular basis. Backing up your data is a good idea for a myriad of reasons. It can really save you in the case of a ransomware attack. Best practice would be to keep 3 copies of your backups, with one offline and another in a geologically separate location. These backups should also be regularly tested.

 

A great way to control what is installed on your organization’s computers is access control. Restricting privileges may not allow malware to be installed on a system without an administrator’s approval. This will limit the spread of the malware through a network.

 

Similarly, another useful tool for fighting malware is a spam filter on your emails. A strong spam filter will prevent most phishing emails from making it to users’ inboxes. It will authenticate inbound emails to prevent spoofing.

 

 

What to do when you’ve been infected by ransomware

 

The first thing anyone should do when infected by ransomware is to contact law enforcement immediately. You should report the infection to the FBI’s cyber task forces and internet crime complaint center.

 

Currently, the FBI does not recommend paying any ransom. While it could cost organizations large sums of money to be down for any length of time, there is no guarantee that paying the ransom will restore your data. There are numerous cases of this happening. Some victims who have paid the ransom have even been targeted again. Other victims have even been asked to pay more after the original ransom to get all their data back. Paying may inadvertently encourage this criminal business model. This makes it more prevalent in the future.

 

Once you have found out that you are infected, you should isolate any infected machines immediately.  In addition, one should take any unaffected machines offline so they don’t get infected. Same goes for backups. They should be taken offline immediately to stop the ransomware from spreading into your backups.

 

From there, you should follow your organization’s incident response plan. Follow any instruction given to you by law enforcement.

 

There will never be any way that you can guarantee you won’t fall victim to one of these attacks. Malware is always evolving, just like security practices are. It will always be an arms race between hackers and security experts. Your best bet is to always follow best security practices, and to always have a plan to recover from any successful attacks.

 

Where to report Activity

 

FBI

Cyber Task Force

Internet Crime Complaint Center

United States Secret Service

Electronic Crimes Task Force

Local Field Offices

 

Contact Zunesis to have an assessment done on your current infrastructure.  Ask us about helpful hints to help keep your data secure.

New Ransomware Focus

Ransomware has a new focus. Recent studies and surveys report that ransomware attacks have sky rocketed against government agencies, public healthcare providers and schools in the first nine months of 2019.

A report published by Emsisoft noted that at least 68 state, county and municipal entities have been affected by ransomware attacks this year.  In addition, at least 62 ransomware attacks have involved School Districts.  Healthcare providers reported 491 ransomware attacks.

 This report also cited the following trends in 2019:

• Cybercriminals Target MSPs: Cybercriminals are increasingly targeting software used by MSPs and other third-party service providers. They simultaneously attack service providers and their customers.
• Ransoms Are Increasing: Cybercriminals want to maximize their profits, and as such, are increasing their ransom requests.
• Cyber Insurance Drives Ransom Payments: Organizations that leverage cyber insurance are more prone than others to pay cybercriminals’ ransoms.
• Cybercriminals Prioritize Email and Remote Desktop Protocol(RDP): Emails and RDP attachments represent the top choices for cybercriminals to launch ransomware attacks.

Credibility & Sophistication

Ironically, Ransomware cybercriminals consistently operate with integrity by following through on their commitment to decipher encrypted data once a ransom is paid.  These criminals understand that for their crimes to continue to be profitable, they must follow through and make the data available to their victims after they have received payments.

Local Governments and School Districts find themselves in a tough situation. They often are forced to rapidly make arrangements for the ransom payment because their IT systems completely stop working.

 

Recent Video from ZDNet

To ensure that their damage is inflicted, cyber-criminals are making their attacks more sophisticated.  Today’s ransomware attacks often include “time delayed fuses”. These attacks are designed to infect not only an organization’s primary data storage but also their replicated data sets and backups.  When an organization attempts to recover from a ransomware attack using their backup data, they soon find that their backup data is also infected and encrypted.  As countermeasures against ransomware become increasingly sophisticated, so do the attacks.

The Voice of America: Ransomware Focus

A report just published by IBM Security-Morning Consult showed the following:

• 79% of Americans are concerned about the threat of ransomware to cities across the US. While 68% are concerned about the threat of ransomware to their specific city. 75% are worried about threats to their personal data.
• 56% of Americans would disapprove of their local government using tax dollars to pay a ransomware hacker.  When given an explicit choice, 63% of respondents would prefer to pay higher repair costs and not pay a ransom rather than using taxpayer dollars to pay for a ransom.
• More than 50% of Americans would not be willing to pay additional taxes to protect their city, county, or town from ransomware attacks. Among those who are unwilling to pay additional taxes for cyber-security, respondents are split 50/50 on whether they would support cutting funding from other local priorities for cyber-security.
• Nearly half (49%) of the respondents view the Federal Government as having the greatest responsibility to protect cities from ransomware attacks. 22% seeing it as a state-level responsibility. 28% view it as the responsibility of the local Government.

These statistics explain the complexity that our civic leaders face when addressing the threat of ransomware.  Public policy will evolve over time and likely make substantial progress as knowledge is gained. Unfortunately, the threat to our local governments and public institutions is very real today.

 

A Step in the Right Direction

Organizations of all sizes can take a meaningful first step to reduce their risk to ransomware. They need to assess their data backup and data protection policies.  Having the right processes and technology in place will substantially lessen the risk of ransomware.

Zunesis specializes in helping organizations evaluate and assess their backup and data protection policies. This includes retention policies and “air gaps”.  This is one step in providing greater overall security for Government agencies, schools and healthcare providers.  Often considered to be the important first step.