Exclusive: 45Drives expands ransomware protection and adds multi-server management to its storage line

Storage vendor 45Drives has bolstered its cybersecurity offering with a new SnapShield platform that bolsters protection against data exfiltration and allows centralized management of multiple servers. The company, specializing in high-density storage devices, positions SnapShield as a crucial last line of defense against ransomware attacks, intercepting malicious payloads before they can corrupt enterprise data.

According to 45Drives, the platform operates directly on storage servers to analyze file activity for suspicious behavior. If activity surpasses defined thresholds, it can instantly cut off the suspected user or client’s connection while permitting unaffected systems to continue operating normally. The company emphasizes that SnapShield is designed to complement existing cybersecurity measures like firewalls, endpoint security, network monitoring, and backups, rather than replace them.

Notably, SnapShield's agentless design means customers do not need to install software on every workstation. The new Data Exfiltration Protection capability extends the behavioral analysis beyond encryption to spot signs of data exfiltration, typically marked by repeated file reads followed by data being exfiltrated. By monitoring for unusual patterns such as spikes in file access or interaction with decoy files, SnapShield can promptly alert administrators or automatically isolate the offending user or IP address.

This addition was spurred by a past ransomware attack, which, although backups were available, made identifying affected computers and determining which files to restore a disruptive and time-consuming process. 45Drives also introduced Precision Restore, which precisely identifies affected files during an attack, enabling administrators to selectively restore only those files rather than restoring an entire environment.

This targeted rollback capability limits damage in large environments with millions of files. SnapShield supports deployments on Rocky Linux and Ubuntu, including single servers and multi-node Ceph clusters, facilitated through an Ansible playbook. Real-time notifications keep administrators informed about suspicious events as they unfold.

The company acknowledges the possibility of false positives and allows administrators to temporarily disable protection for specific users or during maintenance tasks that may otherwise appear suspicious. The Centralized Management System, the other major addition, addresses the challenge of administering SnapShield across numerous servers or clusters.

It provides a unified console for overseeing deployments, active events, user activity, analytics, and audit logs. This feature is particularly valuable for large enterprises and managed service providers managing multiple sites or customer environments.