2008: files that could always go back
Long before ransomware, offices lost files the ordinary ways. A disk died. Someone deleted the wrong folder. An employee cleaned out a share on their way out the door. A virus corrupted a few documents and nobody noticed for a week.
So we started moving client file shares onto Linux and BSD file servers with frequent, read-only snapshots and detailed file auditing. Every one of those problems then had the same answer: roll the files back to a few minutes ago, and look at the log to see what happened.
2013: CryptoLocker
When CryptoLocker appeared, a healthcare client of ours was infected. It took one of their offices offline for several hours while we found the infected computer, restored files from snapshots and backups, and restarted services. The files came back. The downtime was the problem.
We reviewed what happened and wrote a plan for spotting and responding to the next infection. A few weeks later the client was hit again. Using the plan, we had the office back in about an hour. That was better, but we still weren't satisfied, so our engineers were asked to find a way to detect attacks sooner and cut the downtime further.
Detect, isolate, repair
The malware was easy for a person to spot. It left behind files with names like DECRYPT_INSTRUCT or README_TO_DECRYPT. Automating that on the Windows servers of the time was slow and limited, but our file shares were already on Linux, where we could watch every read and write. A script recognized CryptoLocker variants and suspicious file activity, identified the user and computer responsible, and alerted our staff immediately.
Once we could identify the user, IP address, and hardware address involved, isolation was straightforward. The system locked the user account, found the computer's port on the office switches, and shut it off. A technician then called the office and swapped the computer for a freshly built one.
Repair came almost for free, because the snapshots had been there since 2008. Detection worked so quickly that the malware rarely encrypted more than one folder before it was stopped, and rolling that folder back took moments.
The result
Within months we were detecting and isolating most infections within a minute of someone opening an infected attachment. Customers used to call us in a panic because their files were encrypted and their office was down. Now our team was often already recovering by the time the phone rang.
That healthcare client was attacked repeatedly over the following years. They rarely had downtime and never lost data.
Ransomware gets the headlines, but it was never the only reason to build this. The same snapshots still cover the boring disasters they were built for, and they've kept improving: today every client gets read-only snapshots every 15 minutes, encrypted off-site copies that nothing on their network can reach, decoy services, and full audit logging of shared files.