Rubrik expands AWS cyber recovery tools for cloud apps

Rubrik has expanded its cyber recovery tools for workloads running on Amazon Web Services, and Autonomous Business Recovery for AWS Cloud Applications is now generally available.

The additions include near real-time deletion detection, impact investigation, sensitive data blast radius reporting and what Rubrik describes as surgical recovery for cloud virtual machines. They are intended to help organisations identify the effects of an attack and restore systems from a clean point.

The latest release targets a growing cloud security problem: attackers using compromised identities and cloud application programming interfaces to disrupt operations. Rubrik is adding investigation and recovery features intended to reduce the time security teams spend piecing together events across separate logs and tools.

Near real-time deletion detection is designed to flag the deletion of critical cloud resources within seconds, rather than waiting for the next backup cycle. Impact investigation is intended to bring alerts tied to cloud workloads into one view, while sensitive data blast radius reporting is designed to show whether exposed systems contained sensitive information.

Surgical recovery focuses on cloud virtual machines. According to Rubrik, the feature removes malicious files, including those encrypted or infected with malware, then rolls forward clean changes to reduce data loss compared with restoring an entire machine to an earlier snapshot.

Application recovery

The broader update also centres on Autonomous Business Recovery, or ABR, for AWS Cloud Applications. Rubrik says the product is intended to help organisations recover what it calls their Minimum Viable Business: the minimum set of applications and services needed to support customers, employees, revenue and operations after a cyber incident.

Cloud applications often depend on a mix of compute, storage, databases, networking settings and other configurations, which can make restoration difficult after an attack. Traditional methods, Rubrik says, often require teams to manually reconstruct applications from snapshots and runbooks.

ABR is intended to automate that process by discovering, protecting and recovering complete AWS applications. The generally available version supports a broader set of AWS services, including Amazon Elastic Kubernetes Service, Amazon Elastic Container Registry, AWS Lambda and Amazon Simple Storage Service, in addition to Amazon Elastic Compute Cloud instances and Amazon Relational Database Service databases previewed earlier.

The release also includes a pre-emptive clean point function, which continuously identifies a known clean recovery point before an incident occurs. It is also designed to restore applications at the application level, including both data and configurations, in dependency order.

Anneka Gupta, Chief Product Officer at Rubrik, said the expansion responds to changing attack methods in cloud environments.

"As more cybercriminals compromise identities and use cloud APIs to bring business operations to a halt, it's vital for organisations to be able to quickly gain a comprehensive understanding of an attack's blast radius and restore their systems," said Anneka Gupta, Chief Product Officer at Rubrik.

"The expansion of Rubrik's cyber recovery capabilities for AWS arms organisations with the detection and investigation tools required to confront modern threats. We are delivering continuous cyber resilience from initial detection through complete business recovery," Gupta said.

Broader context

The announcement reflects a wider shift in cyber security spending towards recovery as well as prevention, particularly in cloud environments where business applications are spread across managed services, containers, virtual machines and serverless functions. Security teams increasingly face pressure not only to detect an intrusion, but also to establish what was affected, what data may have been exposed and what systems can be safely restored.

For companies operating heavily on AWS, complex dependencies across services can slow restoration after an incident. Tools that identify a clean recovery point and rebuild applications in the correct order are becoming more central to resilience planning, especially for organisations that need to restore critical customer-facing and operational systems quickly.

The newly announced cyber recovery functions for critical AWS workloads are expected to become generally available in the coming months. ABR for AWS Cloud Applications is available now with expanded support across cloud-native services.