RansomShield
Ransomware defence built to detect, contain and recover. RansomShield pairs Linux and Windows agents with a control plane and an investigation console, so an operator can see what is happening on a host, understand it and act on it.
THE PRODUCT, EXPLAINED
Protect the work that matters.
Start with the short film. Then see how it works in the full demonstration.
A short introduction to ransomware warnings, controlled response and recovery.
Press Play. CC adds captions. Use full screen for the clearest view.
Illustrative scenarios. * Extended features in final R&D.
See it, understand it, act on it
Ransomware is an incident an operator has to understand quickly and on the host where it is happening. RansomShield is Governor Technologies' ransomware defence research, built to detect, contain and recover: agents on Linux and Windows hosts observe what happens on the machine, a control plane coordinates the agents and holds the state of the fleet, and an investigation console gives the operator the picture needed to understand an incident and act on it.
RansomShield is in active internal and external pilots and is also exercised against a gate suite in a controlled lab. Observation and detection are implemented; containment, automatic recovery and inline blocking are in active development.
Built to detect
Agents observe the host and surface the signs of an attack to the control plane and the console.
Built to contain
Containment is in active development, so that an incident on one host can be held there.
Built to recover
Automatic recovery is in active development, so that an operator can bring a host back from an incident.
Agents, a control plane and a console
Three parts, each with one job.
Agents
Agents for Linux and Windows hosts observe what happens on the machine and report it to the control plane.
Control plane
Coordinates the agents and holds the state of the fleet, so the operator sees one consistent picture rather than one host at a time.
Investigation console
For the operator who has to understand an incident: what the agents observed, where, and what to do about it.
Detect, contain, recover
Each capability area carries its own status.
| Capability area | Purpose | Status |
|---|---|---|
| Observation and detection | Agents observe the host and detect the signs of ransomware activity. | Implemented; in active development |
| Containment | Hold an incident to the host where it started. | In active development |
| Automatic recovery | Bring an affected host back from an incident. | In active development |
| Inline blocking | Stop a detected action on the host as it happens. | In active development |
Developed against a gate suite
RansomShield is developed and exercised against a gate suite in a controlled lab. Each gate is a check the build has to pass before a capability advances.
Same discipline as the rest of Governor. Lab results are labelled as lab results, and each capability area carries its own true status. RansomShield is part of the security and resilience research discipline, alongside Governor Lock and Security Research.
RansomShield at a glance
Talk to us about your hosts
Request a briefing on RansomShield and the product line around it.
Request a Briefing