Punti di forza
- Le strategie tradizionali di resilienza stanno cedendo di fronte alla portata,alla velocità e all’autonomia dei sistemi basati sull’intelligenza artificiale.
- Gli attacchi ransomware industrializzati e quelli basati sull’IA prendono ora di mira i sistemi di backup,minando le fondamenta del processo di Recovery.
- Le organizzazioni devono passare da team di sicurezza e Recovery operanti in modo isolato a un modello unificato e continuo denominato “operazioni di resilienza”.
- La resilienza basata sull’IA richiede visibilità dei dati in tempo reale,rilevamento continuo delle minacce e un Recovery intelligente e pulito su larga scala.
- Le piattaforme moderne consentono una Recovery rapida e verificata,aiutando le organizzazioni a evitare il compromesso tra Recovery veloce e Recovery sicura.
Mentre le organizzazioni si affrettano ad adottare l’IA,i CISO e i CIO stanno giungendo a una cruda consapevolezza: le strategie di resilienza che funzionavano per le infrastrutture tradizionali stanno fallendo. Sistemi che prima potevano riprendersi dagli attacchi in poche ore ora potrebbero impiegare giorni. Gli approcci di backup progettati per dati centralizzati potrebbero avere difficoltà con carichi di lavoro distribuiti tra cloud e piattaforme di IA. Nel frattempo,le minacce e le potenziali vulnerabilità crescono di giorno in giorno.,David Nowak,responsabile del Cyber Risk Service di Deloitte; Kent Meyer,amministratore delegato di Deloitte; e Shilpi Handa,vicedirettrice della ricerca di IDC per la sicurezza informatica nella regione META,si sono uniti a me per discutere di ciò che la resilienza operativa richiede effettivamente in termini di strategia,architettura e operazioni quotidiane.,Tim Zonca,vicepresidente del marketing di portafoglio presso Commvault,ha affrontato una questione urgente che i responsabili della sicurezza devono affrontare: come mantenere la resilienza quando l’IA cambia radicalmente le regole?
What Industrialized Ransomware and AI Mean for Resilience
CISOs and CIOs are under pressure. In spite of billions spent on cyber defense,nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread,and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks,adversaries are undermining the very foundation of resilience.
As attacks become more sophisticated,targets are becoming more vulnerable. AI is scaling faster than organizations can secure,with exponential data growth,fragmentation across environments,more complex supply chains,and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities,the impact can cascade across interconnected business processes.
Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems,centralized data,and isolated failures,the answer may well be no.
Making Resilience Operational
As AI agents make decisions across the environment,including a significant number of errors,it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:
- Garantire continuamente la sicurezza dei dati alla fonte e monitorare le anomalie.
- Controllare le identità delle persone,delle entità non umane e dei dispositivi che accedono e utilizzano i dati in modo autonomo.
- Garantire una Recovery prevedibile dei dati su vasta scala senza compromissioni o corruzioni.
Tradizionalmente,la sicurezza dei dati,la resilienza delle identità e il Recovery informatico hanno operato come discipline indipendenti,ciascuna con il proprio team,i propri strumenti,le proprie politiche e i propri requisiti. Questi silos lasciano vulnerabilità che gli aggressori possono sfruttare e rallentano il Recovery in caso di guasto dei sistemi di IA. Per colmare tali lacune,le organizzazioni devono unificare queste capacità in un ciclo continuo e automatizzato. Chiamiamo questo approccio“operazioni di resilienza” (ResOps).
ResOps comprende tre requisiti essenziali per la resilienza dell’IA:
- Understanding your data landscape: Knowing where data lives,its sensitivity,who’s accessing it (including AI agents and non-human identities),and what policies govern that access in real time. For AI workloads,this extends to protections like LLM prompt governance to control how models access data.
- Continuous threat detection: Automated systems that constantly monitor for anomalies,compromised identities,and data corruption. When AI systems are making thousands of autonomous decisions,you can’t wait for periodic security reviews.
- Recovery intelligente: ripristino automatizzato e completo di intere applicazioni cloud-native e delle loro dipendenze. Per prevenire una nuova infezione,i team devono verificare l’integrità dei dati ed effettuare analisi forensi in un ambiente isolato e protetto prima di riportare i dati attendibili in produzione.
Come implementare il ResOps nella pratica
Per aiutare le aziende a passare al ResOps,Commvault ha introdottoCommvault Cloud Unity,la versione della piattaforma più significativa della nostra storia. È progettata per riunire tutte e tre le dimensioni della resilienza:
- Unirela sicurezza dei dati,della resilienza delle identità,and recupero cyberin un unico modello operativo.
- Protecting all workloads,from both today’s production systems to tomorrow’s emerging AI stacks.
- Safeguarding data regardless of location,whether in clouds,regions,data centers,or edge locations.
A next-generation architecture brings AI automation to all facets of data protection,la sicurezza dei dati,della resilienza delle identità,and recovery. For security and IT teams,the platform provides simplicity at scale with one experience,one policy engine,and one interface designed to protect data,predict threats,and accelerate clean recoveries.
As security leaders know all too well,recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.
With Commvault Cloud,il monitoraggio continuo delle minacce and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems,helps maintain immutable backups,and helps enable one-click restoration of entire environments. Recovery can be both fast and clean,helping minimize loss as well as risk.
See ResOps in action
Guarda il webinar completo on-demand to learn more about ResOps,explore the architecture and services of Commvault Cloud,and rethink your resilience strategy for the AI age.
FAQs
Q: What is Resilience Operations (Res Ops)?
A: ResOps is an operating model that unifies la sicurezza dei dati,della resilienza delle identità,and recupero cyber into a continuous,automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns,helps detect threats and anomalies,and enables fast,intelligent recovery at scale.
Q: Why can’t traditional backup and recovery handle AI workloads?
A: Traditional backup tools were designed for centralized,human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers,and they operate at a scale that manual processes can’t match.
When AI systems fail or are attacked,you need to recover not just data but entire application infrastructures with all their configurations,policies,and relationships – capabilities traditional backup tools lack.
Q: What does “unified resilience” mean in practice?
A: Unified resilience means bringing la sicurezza dei dati,identity management,and recupero cyber together under a single platform,policy engine,and operational model rather than managing them as separate functions with different teams and tools.
In practice,this provides a consistent approach to protect all workloads and data locations,automatically correlate security events with access patterns,and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.
Q: What’s the difference between cyber resilience and AI resilience?
A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents,treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight,exponential growth of data and non-human identities across environments,and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.
Q: How does ransomware target backup systems?
A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access,moving laterally from production systems to connected backup repositories,or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points,preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline,immutable,or air-gapped backups essential for resilience.
Q: What is the clean vs. complete recovery dilemma?
A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety,while modern resilience platforms aim to provide both simultaneously through il monitoraggio continuo delle minacce and verified recovery points.
Q: What is a cleanroom in recupero cyber?
A: A cleanroom in recupero cyber is an isolated,secure environment completely separated from production systems to help organizations safely test,validate,and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems,testing of recovery procedures,and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.
Sam Curcuruto è direttore del marketing di prodotto presso Commvault.
Blog correlatiRivedere la resilienza nell’era dell’IA
A CIO’s Perspective: Strengthening Business Resilience in the AI Era
Resilienza contro la macchina dell’intelligenza artificiale
Le innovazioni per Cleanroom Recovery consentono una nuova era nella resilienza informatica
