Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive

Enabling Ransomware Prevention and Backup

Updated on 2025-01-07 GMT+08:00

Once being attacked by ransomware, we need to identify and isolate ransomware and back up and restore service data in a timely manner. HSS is an anti-intrusion, anti-encryption, and anti-proliferation ransomware detection engine that uses the dynamic deception technology. HSS can scan and kill ransomware in seconds, back up and recover service data in minutes, and provide industry-leading ransomware prevention and control capabilities.

You can enable ransomware prevention and backup to defend against ransomware attacks and reduce service loss risks, enhancing the ransomware prevention capabilities.

Step 1: Creating a Ransomware Prevention Policy

Create a ransomware prevention policy and configure honeypot file directories, excluded directories, and protected file types based on service requirements.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. Choose Server Protection > Ransomware Prevention.
  4. Click the Policies tab. Click Add Policy. The Add Policy dialog box is displayed.

    Figure 1 Adding a protection policy

  1. Configure the policy information by referring to Table 1.

    Figure 2 Protection policy parameters
    Table 1 Protection policy parameters

    Parameter

    Description

    Example Value

    OS

    Server OS.

    Linux

    Policy

    Policy name

    test

    Action

    Indicates how an event is handled.

    • Report alarm and isolate
    • Report alarm

    Report alarm and isolate

    Dynamic Honeypot Protection

    After honeypot protection is enabled, the system deploys honeypot files in protected directories and other random locations (unless otherwise specified by users). The honeypot files deployed in random locations are automatically deleted every 12 hours and then randomly deployed again. A honeypot file occupies a few server resources. Therefore, configure the directories that you do not want to deploy the honeypot file in the excluded directories.

    NOTE:

    Currently, Linux servers support dynamic generation and deployment of honeypot files. Windows servers support only static deployment of honeypot files.

    Enable

    Honeypot File Directories

    Directory that needs to be protected by static honeypot (excluding subdirectories). You are advised to configure important service directories or data directories.

    Separate multiple directories with semicolons (;). You can configure up to 20 directories.

    This parameter is mandatory for Linux servers and optional for Windows servers.

    Linux: /etc

    Windows: C:\Test

    Excluded Directory (Optional)

    Directory that does not need to be protected by honeypot files.

    Separate multiple directories with semicolons (;). You can configure up to 20 excluded directories.

    Linux: /etc/lesuo

    Windows: C:\Test\ProData

    File Type

    Types of files to be protected.

    More than 70 file formats can be protected, including databases, containers, code, certificate keys, and backups.

    This parameter is mandatory for Linux servers only.

    Select all

    (Optional) Process Whitelist

    Paths of the process files that can be automatically ignored during the detection, which can be obtained from alarms.

    This parameter is mandatory only for Windows servers.

    -

  2. Confirm the policy information and click OK.

Step 2: Enabling Ransomware Prevention

If the version of the agent installed on the Linux server is 3.2.8 or later or the version of the agent installed on the Windows server is 4.0.16 or later, ransomware prevention is automatically enabled with the HSS premium, WTP, or container edition. If the agent version does not support the automatic enabling of ransomware prevention, you can manually enable it.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. Choose Server Protection > Ransomware Prevention.
  4. Click the Protected Servers tab.
  5. Select the target server and click Enable Ransomware Prevention above the list.
  6. In the Enable Ransomware Prevention dialog box, confirm the server information and select a protection policy.
  7. Click OK.

    If the Ransomware Prevention Status of the server changes to Enabled, ransomware protection is enabled successfully.

Step 3: Enabling Backup

To prevent service loss caused by ransomware attacks, enable the backup function for your servers to periodically back up service data.

NOTE:

If you do not have available vaults, purchase one by referring to Purchasing a Server Backup Vault and then enable the backup function.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. Choose Server Protection > Ransomware Prevention.
  4. Click the Protected Servers tab.
  5. Select a server and click Enable Backup in the upper part of the server list.

    Figure 3 Enabling backup

  6. In the Enable Backup dialog box, select a vault.

    NOTE:
    A vault that meets the following conditions can be bound:
    • The vault is in Available or Locked state.
    • The backup policy is in Enabled state.
    • The vault has backup capacity available.
    • The vault is bound to fewer than 256 servers.

  7. Click OK.

Step 4: Handling the Alarm and Isolate the Infected Device.

When an intruder bypasses the defense mechanism, if you can detect and block the intruder in a timely manner, a disaster can be avoided. When enabling ransomware protection, you need to handle intrusion alarms in a timely manner to prevent ransomware from running and spreading.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation tree on the left, choose Server Protection > Ransomware Prevention.
  4. Click the Events tab to view ransomware alarms.
  5. Click an alarm name to view its details.

    You can check whether ransomware exists on the server based on alarms and forensics.

  6. Select an alarm handling mode at the bottom of the page.

    Figure 4 Selecting an alarm handling mode
    • Mark as handled: If you have handled the event manually, you can choose Mark as handled.
    • Ignore: If an alarm does not need to be handled, you can choose Ignore. After the alarm is ignored, the alarm status changes to Handled. HSS will not collect statistics on this event.
    • Add to alarm whitelist: If an alarm is falsely reported, you can select Add to alarm whitelist. HSS will not report alarms later.
    • Isolate and kill: If the alarm is caused by a ransomware program, you can select Isolate and kill. After the isolation, the program cannot perform read/write operations, and the process of the program is terminated immediately.
    CAUTION:

    Once being attacked, immediately disconnect the network or power off the system to prevent the spread of the ransomware attack. In addition, change the passwords of infected devices and other devices on the same LAN in a timely manner.

  7. In the Handle Event dialog box, click OK.

Related Operations

Besides using HSS and CBR, you are advised to use the following methods to improve anti-attack capabilities.

  • Minimize the scope exposed to the Internet: Periodically scan external ports and ensure only necessary ports are enabled.
  • Enhance network access control: Clearly define network security zones and access control rules, minimize access rights, and update access control rules in a timely manner.
  • Enhance account permission control: Assign accounts and permissions to different roles based on access control rules such as identity management and fine-grained permission control. Improve the security of privileged accounts. Properly set and save accounts and passwords for key service assets of your company. Configure two-factor authentication to identify the personnel that access key assets and reduce brute-force cracking risks.
  • Establish high-reliability service architecture: Deploy cloud services in cluster mode. If an emergency occurs on a node, services will be switched to the standby node, improving reliability and preventing data loss. If you have sufficient resources, you can build intra-city or remote DR and backup systems. If the primary system is attacked by ransomware, your services can be quickly switched to the backup system and will not be interrupted.
  • Develop emergency plans for security incidents: Establish an emergency organization and management mechanism to deal with cybersecurity incidents such as ransomware attacks, and specify work principles, division of responsibilities, emergency handling processes, and key measures. Once your service is attacked by ransomware, immediately start the internal cyber security emergency plan and carry out standardized emergency handling to mitigate and eliminate the impact of the ransomware attack.
  • Enhance employees' security awareness: Improve employees' cyber security awareness through training and drills. Ensure that employees understand national cyber security laws and regulations and Huawei cyber security regulations, can identify common cyber security attacks such as phishing, have certain incident handling capabilities, and know the consequences and impacts of security incidents.

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback