IBM's new Power11 server chips are focused on two things: AI and ransomware

(Image credit: Shutterstock)

It can be easy to forget that x86, Arm, and RISC-V aren't the only instruction set architectures on the planet. IBM today offered its periodic reminder that its Power ISA exists with the announcement of new Power11 hardware that, among other things, promises to help minimize disruptions related to attempted ransomware attacks.

"Power11 is designed to be the most resilient server in the history of the IBM Power platform, with 99.9999% of uptime," IBM said. "Together with zero planned downtime for system maintenance and less than one-minute guaranteed ransomware threat detection with IBM Power Cyber Vault, Power11 sets a new bar for business continuity, addressing both planned and cyber-incident-related downtime."

There is a caveat: IBM said in a footnote that "this guarantee covers only the displaying of an alert in less then one minute" and that "remediation is in the form of drive replacement up to the cost of the Covered Product." (The same "terms and conditions apply" disclaimer used by pretty much every company on Earth is also present.) It's up to IBM's customers to act on that alert before the ransomware attack continues.

This is a critical aspect of responding to ransomware attacks. There are times when ransomware is straight-up destructive, whether it's because the "ransom" aspect is simply cover for a nation-state's intentional sabotage or because the group deploying the ransomware unintentionally caused more damage than expected, but these attacks typically focus on denying an organization's access to critical information.

That means organizations can mitigate the potential impact of a ransomware attack by having reliable backups they can use to restore critical data without figuring out how to buy the cryptocurrency du jour and transfer it to whoever's extorting them. But establishing a reliable backup infrastructure is easier said than done--especially when it has to be set up in a way that doesn't allow the ransomware to affect the backups too.

Cyber Vault essentially lays the groundwork for a ransomware-resistant network. Notifying an organization of an ongoing attack within a minute is critical; Splunk said in 2022 that "the median ransomware variant can encrypt nearly 100,000 files totalling 53.93GB in forty two minutes and fifty-two seconds." New variants are probably even faster, so it's critical for defenders to be alerted to an attack as soon as possible.

Nathaniel Mott is a freelance news and features writer for Tom's Hardware US, covering breaking news, security, and the silliest aspects of the tech industry.

3 Comments Comment from the forums

Marlin1975

Seems its more an updated Power10 than a new design. Still built on Samsungs 7nm and many other parts, of what's known, is similar.

So still way behind everything else and IBM still not putting much money into it.
Reply
FunSurfer

Well its about time AI starts fighting ransomware. Looking at you, Copilot.
Reply
bit_user

FunSurfer said:
Well its about time AI starts fighting ransomware.
Back when Intel bought McAfee, they made some announcements about it automatically detecting hackers/malware/etc. However, the problem with any sort of automated detection is that there will always be false positives. So, what you can actually do about it is quite limited, because you don't want to be randomly halting or killing programs that aren't true positives.

As the article says, this is the true weakness in IBM's scheme. They state that it will detect ransomware, but then actually doing anything about it is left up to the operator. That means you basically need skilled 24/7 operations staff that are capable of assessing the threat and taking the appropriate action, or else the feature isn't so useful. Also, the false-positive rate needs to be exceedingly low, or else the feature will be likewise virtually unusable.

So, I'd put almost no stock in such a feature. At the very least, it needs to be independently tested, including deployment at scale.

What's more interesting is their data vaulting system. However, that's really just software and nothing fundamental to their CPUs. So, you could potentially use similar solutions from other vendors (or, for all I know, maybe even comparable open source solutions exist).
Reply