Cyberstorage Overview

NIST defines zero trust as moving from an implicit trust model based on a user's position within the network to a dynamic trust model where each transaction with an enterprise resource is evaluated for trust. Files and unstructured data are an organization's most indispensable assets. Counterintuitively, however, they are often an under protected enterprise resource.

BrickStor SP can evaluate trust for each file operation at the speed of any mission without negatively affecting user experience or application performance. Out of the box, BrickStor SP satisfies all the requirements of the data pillar for the CISA zero trust maturity model. Organizations can adopt a data-centric zero trust architecture seamlessly, while meeting the requirements of the Cybersecurity Executive Order and the CISA zero trust maturity model, without having to change workflows or user behaviors.

RackTop is the first storage solution to implement a data-centric zero trust architecture with active defense and policy enforcement against ransomware, insider threats, and unusual or excessive file access. The active defense features of BrickStor SP immediately alert security and infrastructure teams about suspicious behavior and block those user accounts and IP addresses from accessing further data.

BrickStor SP's cyber resilient architecture stops and contains a ransomware attack in real time while simultaneously allowing non-offending users and applications to continue to access the data and deliver critical services. Built-in incident management and automatically generated incident reports make it easy to determine the source of an attack, immediately restore affected files from immutable snapshots, and quickly resume normal operations.

BrickStor SP proactively protects unstructured data through inline real-time assessors that look for malicious and abnormal file activity perpetrated by a user or application. Its active defense features are extensive and can tie into an organization's security ecosystem through webhooks and email alerts. In addition to detecting abnormal access and employing a zero trust evaluation model for file operations, BrickStor SP can enforce policy and stop an attack in real time before it is too late.

BrickStor SP is designed by default to be secure and compliant, yet operationally structured with IT generalists in mind. It eliminates the need for subject matter experts by relying on policy-based configurations and system automation.

The platform can scale from just a few terabytes to multiple petabytes per node. A single BrickStor can service thousands of users and virtual machines, and multiple BrickStor appliances across data centers can be managed through a single pane of glass user interface.

BrickStor SP has a policy driven architecture that ensures consistent and compliant behaviors on the system, including data security, data encryption, data protection, data retention, and data replication. The platform automatically applies settings based on use case and associated data protection policies, which set the frequency and retention period of snapshots. Replication can also be configured as a policy to replicate snapshots efficiently, with replication windows, priority, and bandwidth throttling from one instance to others.

BrickStor provides complete visibility and governance into how users and applications are accessing data without the need to deploy any agents on the client or endpoints. The BrickStor user behavior audit log can be stored locally, or forwarded and streamed to external log repositories, which allows for easy integration with Security Incident Event Managers (SIEMs) like Elastic Search, Splunk, HPE ArcSight, and IBM QRadar.

These integrations allow user activity, file activity, and key orchestration events to be reviewed and executed upon as part of cyber response operations. Audit functions coupled with workflow allow users to have a platform to monitor and execute response plans that include removing user access to data and data exposure. BrickStor's integrated analysis tools allow for detailed threat hunting and discovery with a fidelity and granularity that was not previously possible or available to security analysts. This built-in tool is paramount for active defense against insider threats and enterprise monitoring.

Every BrickStor includes always-on ransomware protection and zero footprint snapshots to enable users and administrators to revert to previous versions of files, folders, and virtual machines instantly. These snapshots can be replicated asynchronously to other BrickStors for complete disaster recovery and Continuity of Operations (COOP). BrickStor's replication capability is WAN efficient and can systematically replicate over high latency, low bandwidth connections.

The embedded data protection policies and user behavior auditing and analysis capabilities provide cyber defense and resiliency against ransomware, so that an organization never has to pay a ransom. Should a ransomware attack successfully encrypt some files on the platform, administrators can immediately see which accounts have the ransomware and are infecting the environment. Administrators can immediately deny those accounts access to data to stifle malware spread and reinfection. Because the data protection features of BrickStor keep data in an immutable format, the infected files can be restored in seconds to a previous, unmaligned version.

BrickStor SP has a built-in key manager, or it can work with a KMIP compliant external key manager. BrickStor SP can manage FIPS Self-Encrypting Drives to provide inline data at rest encryption without sacrificing performance. It also supports dataset level encryption, so that each folder has its own unique encryption key. This offers double encryption for data and the ability to securely clean up data spillage without having to erase or destroy the entire system.

BrickStor SP also supports the latest file protocols to provide encryption for data in flight between the client and BrickStor SP, as well as between multiple BrickStors for replication. In an instant, BrickStor SP can cryptographically erase drives in the field to protect data from getting into the wrong hands.

A major issue facing government organizations is ensuring that only those people with a need to know have access to data. BrickStor SP makes it easy for data owners to review access policies, to ensure users no longer involved in a project are removed and sensitive data is not over exposed. Furthermore, BrickStor SP alerts the security team when administrator or privileged access credentials are used to access files. This enables unusual activity to be scrutinized, thwarting common insider threat tactics, Advanced Persistent Threats (APT), and many others.

BrickStor includes compliance reports that enable organizations to quickly demonstrate they are meeting the controls of cybersecurity and regulatory frameworks such as NIST 800-53. There are 25 categories of compliance reports including, but not limited to, data encryption, key management, privileged access management, administrator auditing, user behavior auditing, and data retention.

BrickStor SP makes it easy to comply with Cybersecurity Executive Order 14028, which requires all federal agencies to implement a data-centric zero trust architecture. The order calls for organizations to improve detection of cybersecurity incidents on federal government networks. Poor logging hampers an organization's ability to detect intrusions, mitigate those in progress, and determine the extent of an incident after the fact. BrickStor SP's user behavior auditing and active defense provide immediate capabilities to ensure full visibility into what is happening, and what happened, within an environment.

Organizations that want to eliminate physical system segmentation and silos to enable centralized monitoring and dynamic resource allocation can overcome previous security challenges with the advanced access control features built into BrickStor SP's operating system. BrickStor SP includes granular access control capabilities to restrict access down to the individual file level.

BrickStor SP includes discretionary access control across all client platforms, which are the most common access control scenarios, and sufficient for government security accreditation of multiple enclaves within the same security domain. Additionally, BrickStor SP supports host-based access control on top of discretionary access control. With SE Linux and NFS 4.2, BrickStor SP can enable mandatory access control through the support of context security labels. With this architecture, a single BrickStor SP system can be accredited for access from multiple security domains and enclaves.