NetApp to promise ransomware warranty payout

NetApp has made a series of nudges in several product areas that include new entry level ASA (All-SAN Array) block storage hardware – the ASA A150 and A250 – enhancements to its Advance subscription model that include a ransomware data guarantee and data availability guarantees around six nines, or just over 30 seconds, a year maximum downtime.

Also, Ontap One, which allows customers unlimited access to all OS and software features, is now available across all NetApp hardware

NetApp’s All-SAN Array is the company’s block storage offering in hardware form for on-premise deployments with the ability to add cloud capacity. ASA is basically NetApp’s AFF all-flash array family with NAS functionality turned off.

“ASA removes NAS functions and makes it SAN-only,” said NetApp field chief technology officer Grant Caley. “You can’t do that in the unified box and it comes at a better price point.”

The two new products – the ASA A150 and ASA A250 – come in at the lower end of the range, with capacity up to 0.5PB and 1.1PB respectively raw and about 4x that with data reduction. The arrays can be clustered to provide capacities of up to 13PB and 26PB.

As part of Advance, NetApp now guarantees it will recover data affected by ransomware, though at the time of writing it did not specify precisely the level of potential compensation.

NetApp claims to be the first storage supplier to offer payouts in case of ransomware attacks on primary storage, although Veeam and Rubrik have made similar offers in the backup space.

Advance forms parts of NetApp’s consumption models of purchasing. It is own-outright but with upgrades by subscription, and so occupies one end of a continuum with Keystone storage as a service at the other.

The company said that as long as all NetApp systems are deployed correctly, it will recover customer data affected by ransomware or pay out a penalty fee.

Of course, NetApp is confident it won’t come to this, and points to its ransomware detection and recovery functionality. This comes in the form of machine learning-based anomaly detection that spots unusual patterns involving data encryption as well as anomalous user activity.

“It can detect ransomware write patterns,” said Caley. “If it sees encryption, it will trigger a snapshot. Or if a file type is of a known ransomware type.”

Such snapshots will run in addition to any customer-scheduled snapshots and, he said, that means customers can “roll back within a minute or two” to a good copy of data.

Given the recovery snapshot is not triggered until some anomalous patterns of activity are detected, will that be sufficient? After all, that means some data will already be corrupted.

“It’s not too late,” said Caley. “Just one or two files might be compromised by the time the snapshot is triggered.”