Hello all,
I am looking to have deep understanding about risks from Ransomware malware and see how Virtualization helps us to protect from.
I have read somewhere on Internet that "Ransomware removes itself once it detects the machine is VM not physical", not sure if I remember correctly ?
Lets say all my production servers (file server, erp, etc.) on VMs on top of Hyper-V / XenServer/ VMWare Virtualization Server.
Scenarios :
- If user's computer infected, virus will encrypt all his computer data and also shared folder (on which he have write access) from File Server (which is on VM). Scheduled VMs Snapshot enabled. So if I revert back to snapshot earlier to infection on File Server, I can get back whole data (by losing some data, depends on snapshot), right ?
Note: I can understand with this above step reverting back with snapshot can undo settings and loss of some data which was not infected and not required to recover.
-
So we were talking about on top of VM. How about Virtualization server itself ? Few of vectors for risk are Administrator computer ? as he will access the Virtualization Server and VMs through Hyper-V Manger, XenCenter, vSphere etc. ? But I didn't seen any credentials saved on Windows for XenCenter, so what are the actual risk here ?
-
I heard so many big companies effected with ransomware virus, so if Virtualization is great, why it didn't helped them ? Aren't they virtual (servers) ? maybe they meant for user computers only ?
-
What effect can be with sudden power failure for Virtualization Server, how its going to effect VMs and Host itself ? (out of topic, but bcoz Virtual, including here
) Is that same effect as if a physical server ?
Thanks. I will add more questions, as they are available 