File system level data protection during potential security breach

A system, comprising:

• a processing unit;
• a computer readable memory in communication with the processing unit;
• and
• a tangible computer-readable storage medium in communication with the processing unit;
• wherein the processing unit, in response to identifying a suspected breach to a file system, at a time of the identifying the suspected breach, executes program instructions comprising at least one file system protection command and stored on the tangible computer-readable storage medium via the computer readable memory and thereby:
• generates a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system;
• restricts access to the snapshot of the at least one file set of data;
• detects a user credential associated with the suspected breach;
• extracts from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;
• refers to an access table of the file system to identify a first plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of the generated read-only snapshot;
• and
• invokes a file system protection that restricts access, by any user with the user identification indicia and the group identification indicia, to the identified first plurality of file sets stored within the system storage resources.

A computer program product for generating a data snapshot and protecting the data snapshot upon a suspected breach of a file system, the computer program product comprising:

• a computer readable tangible storage medium having computer readable program code embodied therewith, the computer readable program code comprising instructions comprising at least one file system protection command for execution by a computer processing unit that causes the computer processing unit to, in response to identifying a suspected breach to a file system, at a time of the identifying the suspected breach:
• generate a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system;
• restrict access to the snapshot of the at least one file set of data;
• detect a user credential associated with the suspected breach;
• extract from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;
• refer to an access table of the file system to identify a first plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of the generated read-only snapshot;
• and
• invoke a file system protection that restricts access, by any user with the user identification indicia and the group identification indicia, to the identified first plurality of file sets stored within the system storage resources.