Skip to main content
NetApp Knowledge Base

What actions can be taken in ONTAP to prevent the spread of ransomware infections?

  1. Last updated
  2. Save as PDF
Views:
123
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
core
Last Updated:

Applies to

  • ONTAP 9.10.1
  • ONTAP Autonomous Ransomware Protection(ARP)

Answer

Work with your Security Team to identify and remediate the source of the ransomware attack.

Phase 1: Detection and Initial Response

  • Use ARP to detect abnormal file activity: ARP monitors workload behavior and can trigger alerts and snapshots upon detection.
  • Proactively enable CIFS / NAS auditing to trace abnormal file share activity.
  • Use Data Infrastructure Insights that integretes ARP event and FPolicy to monitor ARP alert and abnormal client access activity.

Phase 2: Containment Measures to Prevent Further Ransomware Propagation

  • Stop accepting new client access (New Sessions)

Note: 

Clients holding a large number of locks are likely candidates for infection sources and should be prioritized for blocking.

  • Block access from specific clients
    • Modify existing export policy Or create a new deny rule:
      • vserver export-policy rule modify -clientmatch <client IP or subnet> -rorule none -rwrule none
      • vserver export-policy rule create -clientmatch <client IP or subnet> -rorule none -rwrule none

Note:

NFS does not provide strong session-level disconnection capabilities, even after applying export-policy restrictions, existing client I/O may continue for a period of time. To fully stop I/O, volume isolation (see section 4) is recommended.

  • Terminate Existing CIFS Sessions
    1. Identify active CIFS sessions and locks:
      • vserver cifs session show -vserver <vserver>
      • vserver locks show -vserver <vserver> -volume <volume> -protocol cifs
    2. Terminate specific sessions (by user/client/file access):
  • Stop CIFS / NFS Services
    • vserver cifs stop -vserver <vserver>
    • vserver nfs stop -vserver <vserver>
  • Volume Isolation:
    • Take the affected volume offline to stop all I/O: volume offline -vserver <vserver> -volume <volume>
  • Data LIF Isolation:
    1. Identify data LIFs: network interface show -role data
    2. Disable data LIFs: network interface modify -status-admin down -vserver <vserver> -lif <data LIF>

WARNING

Intercluster LIFs are dedicated logical interfaces used for cross‑cluster communication, enabling SnapMirror/SnapVault replication, NDMP backup, cluster peering, and data transport to external object storage (e.g., FabricPool/cloud). Connection via intercluster LIF fails when LIF is disabled.
  • (Optional) Intercluster LIF Isolation: 
    • Preventing any further data replication or propagation of potentially compromised data.
      1. Identify intercluster LIFs: network interface show -role intercluster
      2. Disable intercluster LIFs: network interface modify -status-admin down -vserver <vserver> -lif <intercluster LIF>

Phase 3: Impact Assessment

Identify affected scope using the following logs:

  • ARP reports: Identify affected directories and volumes

  • Audit logs (CIFS / NFS): Identify client access activities, including accessed files, client IP addresses, access patterns, and timeline of the attack.

Phase 4: Recovery

Restore data using ARP-generated Snapshot copies prior to the event.

Additional Information

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.