Detection and Rollback of Ransomware with VMware Carbon Black Cloud
With VMware Carbon Black we need to ensure we are adapting for our customers as ransomware evolves. Utilizing Live Response Carbon Black Cloud can restore shadow copies by running the vssadmin command and then restoring using mlink on this particular device. Live Response is an extensible remote shell which can be used on Windows, MacOS or Linux, without the need for additional OS configuration. This tool is built into all Carbon Black Cloud products. Ransomware is pervasive, and as defenders it is VMware’s responsibility to adapt and provide security that is future-ready. So in the case of rollback providing not only the ability to restore to a particular shadow copy, it is also providing disaster recovery tools to ensure business operations can resume as quickly as possible.