Skip to main content
NetApp Knowledge Base

Comparing ransomware protection technologies for Snapshots in ONTAP

  1. Last updated
  2. Save as PDF
Views:
23
Visibility:
Public
Votes:
0
Category:
snaplock
Specialty:
dp
Last Updated:

Applies to

  • ONTAP 9
  • SnapLock
  • Snapshot locking (Tamperproof Snapshots)
  • Autonomous Ransomware Protection (ARP-AI) Snapshots
  • NetApp Console Backup and Recovery with DataLock

Answer

  • There are several technologies that protect against Snapshot deletion by malicious actors or ransomware
  • This KB describes some of the differences between Snapshot protection technologies and is meant as a general overview
  • Review the associated documentation and thoroughly test any technology before relying on it in production
Technology Description Multi-Admin Verification compatable Protection
  • SnapLock for SnapVault (LockVault)
  • CyberVault

SnapLock for SnapVault replicates Snapshots to secondary storage and commits Snapshots to WORM protection. When used with SnapLock Compliance, this is the strongest form of protection and is the basis for the Ransomware Recovery Guarantee.

CyberVault bundles SnapLock for SnapVault and other protections in a complete, "air-gapped" solution.

Yes
  • SnapLock Compliance - Immutable and indelible. SnapLock Compliance provides disk-level protection that survives re-image or storage re-initialization and protects expiration dates with a tamperproof SnapLock Compliance Clock.
  • SnapLock Enterprise - The trusted admin model allows volume deletion by a cluster admin even with unexpired Snapshots.

Autonomous Ransomware Protection (ARP-AI) Snapshots

 Proactive ransomware protection and real-time detection. Snapshots are created on intervals as well as on attack confirmation. Yes ARP-AI Snapshots can be deleted if necessary. Multi-Admin verification (MAV) is recommended to protect against Snapshot deletion by a compromised or malicious admin.
Snapshot locking / Tamperproof Snapshots Snapshot locking (aka Tamperproof Snapshots) provides protection against Snapshot deletion by a compromised or malicious cluster admin. Yes Unexpired locked Snapshots or their containing volume cannot be deleted by a compromised or malicious cluster admin. Expiration dates cannot be made shorter.
NetApp Console Backup and Recovery with DataLock Backup and Recovery with DataLock leverages an object-store's native object locking capabilities No When the "Locked" or most-restrictive setting is used, DataLock protects Snapshots and their objects from deletion by malicious or compromised accounts. Specific protection details depends on the object-store provider's object locking implementation.

Additional Information

additionalInformation_text

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.