Cohesity CyberScan scans backup copies for security risks
Cohesity CyberScan uses Tenable.io to find security vulnerabilities in backup copies. Because the app is scanning backups, it doesn't affect performance of production environments.
The latest application added to Cohesity Marketplace is designed to trawl through backups to look for security vulnerabilities.
Cohesity CyberScan is a free application available on the Cohesity Marketplace. Using Tenable.io, it compares applications in a backup environment against the public Common Vulnerabilities and Exposures (CVE) database to detect possible security flaws. The admin can then address these flaws, whether it's an out-of-date patch, software bugs or vulnerabilities around open ports.
Cohesity CyberScan doesn't affect the production environment when it performs its scan. The application boots up a backup snapshot and performs an API call to Tenable.io in order to find vulnerabilities. This process has the added benefit of confirming whether a particular snapshot is recoverable in the first place.
Raj Dutt, director of product marketing at Cohesity, said because the vulnerability scan happens in Cohesity's runtime environment and not the live environment, many customers may be prompted to perform these scans. Citing a recent study performed by independent IT research firm Ponemon Institute, Dutt said 37% of respondents who suffered a security breach did not scan their environments for vulnerabilities.
"They work in an environment where the organization is expected to run 24/7/365, so essentially, there is no downtime to run these scans or make the patches," Dutt said.
Dutt said even organizations that do perform vulnerability scans don't do them often enough. Vulnerabilities and exposures published on the CVE database are known to bad actors, so weekly or monthly scans still leave organizations with a wide window in which they can be attacked. Dutt said since Cohesity CyberScan doesn't interfere with the production environment, customers are free to run scans more frequently.
The Security Dashboard houses the vulnerability scan and anti-ransomware capabilities.
Phil Goodwin, a research director at IT analyst firm IDC, said there are applications that scan backup copies or secondary data but scan mostly to detect out-of-date drivers or other roadblocks to a successful restore or failover. Running it against a CVE database to look for potential security problems is unique.
End users are talking about data protection and security in the same sentence. It really is two sides of the same coin.
Phil GoodwinResearch director, IDC
Goodwin said Cohesity CyberScan is the latest example of backup vendors adding security capabilities. Security and data protection are different IT disciplines that call for different technology, but Goodwin said he has encountered customers conflating the two.
"End users are talking about data protection and security in the same sentence," Goodwin said. "It really is two sides of the same coin."
Security is the proactive approach of preventing data loss, while data protection and backup are reactive. Goodwin said organizations should ideally have both, and backup vendors are starting to provide proactive features such as data masking, air gapping and immutability. But Goodwin said he has noticed many vendors stop shy of malware detection.
Indeed, Cohesity CyberScan does not have malware detection. Dutt stressed that the application's use cases are focused on detecting cyberattack exposures and ensuring recoverability of snapshots. He pointed out that Cohesity DataPlatform does have anti-ransomware capabilities, and they can be accessed from the same dashboard as CyberScan's vulnerability scan.
Cohesity CyberScan is generally available now to customers who have upgraded to the latest Cohesity Pegasus 6.4 software. The application itself is free, but customers are required to have their own Tenable license.
