Data Security, Ransomware Resilience, and Compliance
Data Security, Ransomware Resilience, and Compliance
This domain tests how the platform is hardened against insider misuse and ransomware, and what evidence it produces for audits. Scenario questions often describe an attack or an auditor request and ask which control applies.
Access control
Role-based access control assigns roles such as cluster admin, backup admin, restore-only, and viewer. Authentication can integrate with Active Directory, LDAP, or SAML single sign-on, with multi-factor authentication for administrative access. Organisations provide multi-tenancy so tenants see only their own sources, groups, and snapshots.
Protecting the copies
- Encryption - data encrypted at rest (AES-256) and in flight (TLS), with internal key management or an external KMIP key server; FIPS mode is available for regulated environments.
- DataLock - makes snapshots immutable for a defined retention period, so neither an administrator nor compromised credentials can delete or alter them early.
- Quorum - requires approval from a defined number of distinct authorised users before a protected snapshot can be deleted.
- Air gap - an isolated copy in FortKnox with credentials and infrastructure outside the production trust boundary.
- Audit logs - record administrative and data-access actions for compliance evidence.
Detection and response
DataHawk watches backup and file activity for anomalies such as mass encryption or unusual deletion patterns and raises alerts. CyberScan inspects backup copies for vulnerabilities and indicators of compromise so you can prove a restore point is clean before recovering.
Worked example
Ransomware encrypts production file shares and attackers hold domain-admin credentials. Reasoning: the on-premises cluster is now within the compromised trust boundary, so replicated copies alone are suspect. Recovery should come from an immutable copy: DataLock prevented early deletion, quorum blocked single-actor destruction, and the FortKnox air-gapped copy survives credential theft. CyberScan validates the chosen restore point before recovery.
Traps that cost marks
Believing DataLock retention can be shortened after the fact; assuming quorum works with one administrator approving twice; thinking replication alone is ransomware protection; confusing audit logs with alerts; assuming deleting a protection group immediately purges snapshots.