Ransomware Defense and Remediation with Pure Storage.

1. Ransomware Defense and
Remediation
January 27, 2022

2. 2
2022 Pure Storage, Inc.
As the nation’s cyber defense agency, CISA help organizations
prepare for, respond to, and mitigate the impact of cyber-attacks.
Given the recent political climate involving Russia, CISA has
issued guidance, leadership recommendations, and resources
for all organizations - regardless of size - to adopt a heightened
cybersecurity posture in order to protect their most critical
assets.
Guidance includes steps for organizations to:
“Shields Up” Guidance
U.S. Cybersecurity and Infrastructure Security Agency (CISA)
Reduce the likelihood of a damaging cyber intrusion
Detect a potential intrusion
Maximize resilience to destructive cyber incidents
Ensure preparedness to respond if an intrusion occurs
For more information, visit: https://www.cisa.gov/shields-up
All organizations should report incidents and/or anomalous
activity to CISA via 24/7 CISA Central (central@cisa.dhs.gov,
888-282-0870) and/or your local FBI field office.
Empower leadership to drive adoption of meaningful security
measures

3. 3
The Current Situation
Downtime tolerance is low even for normal applications.
“Always-on” is driving the need for Rapid Restore.
• Work & Personal expectations converging
Data protection is the last line of defense in ransomware recovery.
• Being able to recover avoids paying Ransom
Customers are recovering larger datasets than ever before.
• Recovering from a Ransomware event
Customers are tired of the backup appliance model.
• Forklift Upgrades, Expensive & Complex
• Can’t meet the demanding recovery requirements in a Ransomware
situation
• Based on legacy technology
SOURCE: ESG SLA Survey, 2020

4. Pure Storage Confidential - Internal Use Only 4
Nearly half of the organizations
identified are improving their
SLAs, RPOs and RTOs as a top
challenge.”
“
Data Protection Landscape
ESG

5. 5
Ransomware Protection
A ransomware attack takes place
every 11 seconds
The average payout for a
ransomware attack is $233,317
34% of businesses hit with malware
took more than one week to regain
access to their data
In 2021, ransomware attacks against businesses will occur every 11 seconds. (Source: Cybercrime Magazine)
On average, organizations pay a ransom of $233,217 (Source: Coveware, security firm)
34% of businesses hit with malware took a week or more to regain access to their data. (Source: Kaspersky)

6. 6
2022 Pure Storage, Inc.
Anatomy of a Ransomware Attack
Attacker Timeline & Recovery
Assume all business
is going to be
attacked one day or
another.
Selling network
access is a business
on its own
Security
Breach
Advanced Persistent
threat software
(malicious)
introduced to
discover data and
backup
Access &
Observe
Important data is
identified &
encrypted. Data may
copied and original
source & backup is
destroyed
Encrypt &
Remove access
Limited time .
Assessment of data
stolen . Explore data
recovery & Business
continuity options
Ransom
May take months to
analyze full extent of
attack penetration.
Payment does not
guarantee recovery
or stop of data
release.
Analysis &
Full Recovery
2 3
1 4 5
Weeks / Months Weeks / Months Days / Week Hours / Days Days / Months

7. 7
2022 Pure Storage, Inc.
Paying the ransom only gets you
some of your data...
Should You Pay the Ransom?
35%
report missing data
after paying the
ransom
...And the time to restore with hacker
keys often exceeds normal SLAs.

8. 8
2022 Pure Storage, Inc.
Why Now?
Potential
Data Loss
Financial
Risk
Reputation
Risk
Why Pure?
Integrated
Industry-Leading
Solution
3x Faster Backup
and Restore
Simple to Deploy,
Manage, and Innovate
Ransomware
Threats
Need Fast
Restore
Need For
Scale
Case for
Change
Securing Your Data and the Business
Modern Data Protection for Ransomware with Fast Recovery

9. © 2022 Pure Storage, Inc.
Roadmap for Resiliency
Building a secure architecture with Pure Storage
Enable Immutable Snapshots &
Extend Eradication Timer
FlashArray
FlashBlade
Enable SafeMode
FlashArray
FlashBlade
Turn-on Snapshots
FlashArray//X
FlashArray//C
Evaluate Secure & Fast
Logging Platforms
FlashBlade with
SafeMode
Evaluate
Replication
ActiveCluster
Snapshot
Replication
FlashArray
with SafeMode
Snap to Cloud
FlashArray//C
with SafeMode
Evaluate
Snapshot offload
K8S Backup & DR
with PortWorx
Backup Software
Integration
FlashBlade
Rapid Restore
FlashArray//C
with SafeMode
Primary Storage

10. 10
2022 Pure Storage, Inc.
Don't Think You Can Recover. Know You Can.
Proven ransomware recovery technology (SafeMode™ Snapshots), ensure corporate and
customer data can’t be deleted or encrypted, even those with admin credentials.
How Pure Can Help Mitigate Ransomware
Respond and Resume Operations In a Fraction of the Time.
Best in class recovery performance gets data back in place for use up to 6.5x faster* and
lets you safeguard up to 5x more data** so you don't have to choose what to safeguard.
Make the Move Now, Without Adding Complexity or Software Costs.
Ransomware recovery safeguards are included at no extra charge and work with existing
backup software so defending against attacks is simple and fast.
Know Thyself. And Thy Data.
Self-tuning, multi-dimensional performance for delivering very high throughput to support
real-time threat detection, anomaly detection and advanced analytics.

11. 11
2022 Pure Storage, Inc.
Ransomware Lifecycle Best Practices

12. Simplify Management of
System Hygiene and Patching
Multi-Factor Authentication
Implement SIEM and Speed Up
Processing to Identify Threats
Before: Preventive
Maintenance

13. 13
2022 Pure Storage, Inc.
Accelerate Real-Time Threat Detection
Speed up SIEM and Check for More Threats in Less Time
13
©2022 Pure Storage, Inc.
Scale storage and compute independently and on-demand.
App Data
Structured
Data
Machine &
Unstructured Log Data
Security &
Operation
Dashboards
Storage
Index &
Ingest
Search
Network /
IDS
Server
SaaS
Application
Log and Retain More for Richer Analysis:
Embedded data reduction and on demand
scaling with Pure as a Service allow you to hold
and review data for longer without breaking
budget.
Run More Concurrent Queries in Less Time: Pure
solutions ingest, index and correlate data in less
time so you can analyze more threats.
Test New Analysis & Innovate: Provide teams
with the agility to build new queries and
dashboards, improving business efficiency.

14. 14
Evergreen Storage: Subscription to Innovation
Delivering an always-improving, aaS-like experience even with traditional CAPEX purchases
Always-improving
Infrastructure
World-class Customer
Experience
Always-improving Data
Services
• All-inclusive software
subscription, with enterprise-
grade data services
• New features and capabilities
added continually
• AI-based intelligent management
via Pure1; plus, Portworx license
• Included controller upgrades at
regular intervals
• On-demand, unlimited controller
upgrades with full-value trade-in
• Capacity consolidation & flash
media upgrades
• Evergreen lifetime component
replacement
• Love your storage satisfaction
guarantee
• Right-size guarantee
• Premium-level proactive &
predictive support
• Flat & fair subscription renewals

15. PureStorage Confidential - Internal Use Only 15
Pure1 Data Protection Monitoring
Deliver peace of mind from downtime, data
loss, or data destruction and a path to
integrated data protection as a service
• Checks if volumes are protected for ransomware
• Checks if protection services are meeting RPOs
• Delivers local & remote protection report
• *Coming soon!* RTO / RPO & ransomware alerting
• *Coming soon!* Recommend & quote safeguards
NEW!
© 2022 Pure Storage, Inc.

16. Lockdown Systems with Always-
on Encryption at rest
Identify Attack and Severity
Prevent Snapshots from
modification or deletion
During: Mobilize the
Response

17. 17
2022 Pure Storage, Inc.
Prevents permanent loss of data due to admin
mistakes or malicious attack
Secure snapshots of deleted data that can’t be
altered for up to 400 days even with admin
privilege
Quick data restores with all flash
Added protection with FlashArray replication
Fast Data Recovery with Immutable Snapshots That Can’t Be Eradicated
Purity SafeMode Snapshots

18. After: Recovery
Effort
Rapid Recovery for Priority
Systems
Offline Restoration for
Malware Cleansing
Support Forensics with
Space-Efficient Snapshots

19. 19
© 2021 Pure Storage, Inc.
Pure Storage
SafeMode Snapshots
with FlashBlade®
Prevents permanent loss of data due to
admin mistakes or malicious attack
Unalterable/Immutable Filesystem Snapshots
Immediate Filesystem Snapshot Rollback
Or up to 270 TB per hour restore at scale
Immutable file system protection
0-400 days – Database Dumps & Backups
© 2022 Pure Storage, Inc.

20. 20
© 2021 Pure Storage, Inc.
Pure Storage®
SafeMode Snapshots
with FlashArray™
Prevents permanent loss of data due to
admin mistakes or malicious attack
Unalterable / Immutable Snapshots
Immediate Snapshot Rollback of Production Data
Or Up to 8.7 TB per hour restore per FA//C
Immutable protection of suggested
10-30+ days of production
© 2022 Pure Storage, Inc.

21. 21
© 2021 Pure Storage, Inc.
Data Protection for Kubernetes
PX-Backup is built for
Kubernetes
Container-granular
Machine-based backups are no longer sufficient
Kubernetes namespace-aware
Must speak the language of k8s
Application consistent
Distributed systems require application consistency
Capable of backing up data AND app config
Just data is not enough. Neither is just app config.
Optimized for multi-cloud world
Options for local and WAN-based DR
and for
FlashBlade
© 2022 Pure Storage, Inc.

22. ©2022 Pure Storage 22
“Our investment in Pure has
more than proven its short-
term worth, but we’re in it for
the long-term value it
provides to our citizens.”
Kimberly Lagrue
CIO, City of New Orleans
Geo
North America
Industry
Government
Solution Area
Modernizing Data
Protection
Products in Use
Pure Storage
FlashBlade, Pure
Storage FlashArray
Protecting City Data from
Cyber Attack
Objective
The City of New Orleans reacted quickly to a cyberattack, preventing the spread of malware
and a demand for ransom. But to return to full operations, the IT team needed new
infrastructure including twice as much storage.
Results
Accelerates time to value
with storage that is easy to
deploy and manage
Provides an additional
layer of protection from
ransomware attacks
Minimizes disruption of
delivering critical services
and data to citizens
Solution
The Pure Storage team worked with the City of New Orleans to migrate data to Pure Storage.
FlashArray replicates data to a second data center, while FlashBlade uses snapshots to
protect the city’s data backups from further ransomware attacks.

23. ©2022 Pure Storage 23
“When we first adopted the
Pure platform, I was afraid I
was going to work myself out
of a job because it was so
easy.”
Scott Pedram
Storage Architect, One Gas
Geo
NOAM
Industry
Utilities
Solution Area
Modernize Data
Protection
Products in Use
FlashArray™
Evergreen™ Storage
Keeping the Power on
Across Three States
Objective
To provide reliable service to millions of residential and commercial customers, ONE Gas
must keep key systems up and running and protect data against cyber threats.
Results
Provides lower long-term
TCO and keeps costs
predictable
Reduces time spent on
management from
around 65% down to
20%
Protects customer data
with always-on
encryption
Solution
Using Splunk on Pure Storage FlashArray ONE Gas boosts performance for cybersecurity,
application monitoring, analytics, and critical business applications. With an all-flash
environment through the Evergreen Storage model, the company gains unprecedented speed
while keeping costs flat.

24. ©2022 Pure Storage
24
“Splunk on Pure Storage
returns answers in seconds;
it’s very fast.”
Tony Garza
Infrastructure Team Manager, Frost Bank
Geo
NOAM
Industry
Financial
Services
Solution Area
Accelerate Core
Applications
Products in Use
FlashArray,
FlashBlade,
Evergreen Storage
Investing in Storage
Pays Dividends for Bank
Objective
Customers want rock-solid reliability when it comes to keeping their financial assets safe. Frost
Bank needed a dependable storage foundation to ensure that critical applications, such as e-
commerce and transaction processing, run smoothly while also detecting and managing security
risks.
4 years of 100% uptime on 8
arrays, with infrastructure
troubleshooting in seconds
Helps eliminate business
interruptions during
upgrades and updates
Ingests 600 GB of Splunk
data daily for fast insights
and analysis
100%
Solution
Frost Bank chose Pure Storage to support its growing use of analytics and to provide customers
with excellent and highly secure experiences, grow its business, and pursue new market
opportunities while reducing total cost of ownership.
Results
600GB

25. 25
2022 Pure Storage, Inc.
Introducing Ransomware Recovery Bundles
Close the Gaps In Your Ransomware Strategy and Protect Your Reputation & Customers
20%
Off*
Save More with SafeMode
Pure Storage Fast Recovery Bundle: Get the peace of mind
that only comes from having immutable, hacker proof
backups of your data with the industry leading FlashArray//C.
Pure Storage Rapid Recovery Bundle: Turbocharge recovery
of critical applications & SIEM systems with hacker proof
backups stored on the high performance FlashBlade.
Pure Storage Ultimate Recovery Bundle: Mitigate business
disruptions. Restart business with SafeMode protected
disaster recovery on FlashArray//C while threat analysis
continues at the original site using FlashBlade recovery.
*Estimated net savings between $20,000 - $150,000 on the target storage depending
on sizing, discounting, etc. Limited time promotion. Available to January 31, 2022.

26. 26
2022 Pure Storage, Inc.
Pure Storage Fast Recovery Bundle
The Perfect Blend of Price, Performance and Peace of Mind
Backup Using
Your Choice of
Backup Software
FA//X
SafeMode
Local
Recovery
FA//C
SafeMode
Protected Off
Box Backups
Bundle Components
FlashArray //X 70 or //X 90 > 90TB primary storage to run business
applications in VM, container and bare metal environments
FlashArray //C to host immutable backup copies of data.
20% lower list price (CapEx purchase)
Up to 75% lower PaaS starting reserve commit (50TiB reserve vs. the
standard 200TiB / on-demand model with no reserve).*
Benefits of FlashArray //C
Cost Effective, All Flash Backup Industry leading QLC flash storage
design and data reduction lowers cost versus other all-flash alternatives.
Fast Recovery / Lower Downtime all flash performance minimize time to
restore data from attacks & get running.

27. 27
2022 Pure Storage, Inc.
Pure Storage Rapid Recovery Bundle
When Data Has to Be Back & Available As Quickly As Possible
Backup Using
Your Choice of
Backup Software
FA//X
SafeMode
On Box
Recovery
FB
SafeMode
Protected Off
Box Backups
Bundle Components
FlashArray //X 70 or //X 90 > 90TB primary storage to run business
applications in VM, container and bare metal environments
FlashBlade to host immutable backup copies of data.
20% lower list price (CapEx purchase)
Same 50 TiB minimum OR on-demand with no reserve (on-
demand model with no reserve).
Benefits of FlashBlade
High Speed, Scalable All Flash Backup True linear performance and capacity
scaling to protect growing data stores in shrinking backup windows.
Best in Class, Rapid Restore Up to 270TB/hour of critical app or SIEM data
recovery for fastest possible recovery of business operations & resumption
of security analysis.

28. 28
2022 Pure Storage, Inc.
Pure Storage Ultimate Recovery Bundle
A Complete, Recovery Defense That Lets Your Resume Operations During Investigations
FA//X
Bundle Components
FlashArray //X 70 or //X 90 > 90TB primary storage to run business
applications in VM, container and bare metal environments
FlashBlade to host immutable backup copies of data for rapid restore.
FlashArray //C as a DR target if primary site is completely shutdown.
20% lower list price for both FB and FA//C (CapEx purchase)
Lower PaaS reserves (50TiB reserve or on-demand model with no
reserve for FA and on-demand model with no reserve for FB).*
Benefits of FlashBlade + FlashArray //C
Keep the Business Running While Performing In Depth Analysis In the event
the primary site (with the backup system) has to be taken offline,
immediately restart operations at the DR site while security teams use FB
backups to do a detailed threat actor analysis.
FA//C
SafeMode
On Box
Recovery
SafeMode
Protected Off
Box Backups
SafeMode
Protected DR
copies.

29. 29
2022 Pure Storage, Inc.
Summary: A Holistic Data Protection Approach
Advancing Protection for Digital Businesses
Improve Ability to Stop Attacks
• Accelerate analytics & increase the
number of scans IT teams can run
Eliminate Downtime
• Prevent downtime
• Recover from downtime faster
Secure Data from Ransom
• Secure data from illegal access
• Rapid Ransomware recovery
29

30. 30
2022 Pure Storage, Inc.
Next Steps:
1. Learn More
1. Assess
1. Test Drive