License editions: To understand the applicable license editions, see Plans & Pricing.

The risk of a cybersecurity failure is no longer limited to the reputation of a company or something to be borne by its customers but is an existential risk to the company itself. Ransomware extorts the business with the one universal thing all businesses value – their own data. Needless to say, you need to be well prepared for this danger.

In this article, we will help you understand how Ransomware Recovery by Druva can help save the day in case you are unfortunately attacked by ransomware.

In case of an infection, to quarantine is to isolate the infected parts in order to contain the infection and not allow it to spread. To this effect, Ransomware Recovery enables you to quarantine infected snapshots on the impacted resources, which helps safeguard your system from further infection by barring users or administrators from downloading or restoring data to other resources.

To reduce downtime and loss of productivity, you can restore the data from the latest secure snapshot that you deem safe and get the resource operational again.

Here's how you can use Ransomware Recovery to quarantine infected snapshots in the following ways:

❗ Important

The data in the unquarantined (clean) snapshots of the resource are still accessible and can be viewed, downloaded, or restored by administrators and users.

Druva enables you to set up your response to the Ransomware Recovery. You can either manually quarantine snapshots on an impacted resource or automate the quarantine process by integrating with third-party security and incident response solutions using Ransomware Recovery APIs.

The manual way of quarantining the snapshots on a resource is helpful when you get to know about an impacted resource (OneDrive/SharePoint site) from a trusted source such as the user himself or alerts raised by your security infrastructure and antivirus software about a potential risk.

Prerequisites
Identify the potential date when the resource was infected by ransomware. It helps you decide from which date onwards you want to quarantine the snapshots on the resource.

📝 Note
​ If you are unaware or not sure about the date, you can start quarantining the snapshots of the impacted resource from the current date or from November 10, 2019, a system-defined limit, before which you cannot quarantine snapshots.

💡 Tip

You can always talk to the people in your organization whose resources are impacted and track their potential activities such as the files they downloaded or interacted with on a particular day that infected the resource.

Choose the best way to quarantine the resource

You can manually quarantine resources using any of the following available methods -

Use this option when you want to search for a resource, identify the snapshots, and then quarantine it.

Procedure

📝 Note
​ In case if Rollback Action feature is enabled and the Rollback window is configured for deleted snapshots, these deleted snapshots will be listed on the Quarantine Bay listing page only after the rollback action is complete and the deleted snapshots are rolled back. The deleted snapshots that are still in the configured rollback window will not be listed.

7. Click Finish.

Quarantining of snapshots starts based on the selection of options mentioned above. See What's next to take the suggested course of action.

Use this option when you want to quarantine snapshots for multiple OneDrive users.

Procedure

Use this option when you want to quarantine snapshots for multiple SharePoint sites.

Procedure

After the CSV is validated, the snapshots of the OneDrive users and SharePoint sites mentioned in the CSV start.

You have successfully quarantined the infected resources, which will now help contain the ransomware attack. Refresh the Ransomware Recovery page to view the quarantined list of resources.

Now that you have now quarantined the infected snapshots, you might be wondering what to do next? You can take the following actions to contain the ransomware and bring up the resource to resume productivity.

❗ Important

We highly recommend that you work with your Data Security and IT teams to take appropriate steps to resolve such a situation.

After you have completed the required inquiry into the impacted resources with the help of your Data Security and IT teams, you may find that some resources were falsely marked as ransomware impacted. In this case, you might want to remove the resource and the snapshots from the quarantined state and mark it as clean!

When you unquaratine a resource, it removes all the specified or defined quarantine ranges for that resource from the quarantine state.

After you unquarantine the snapshots, inSync administrators and users can again securely restore and download data from those clean snapshots resulting in no loss of data.

Procedure

Once removed, users and administrators can access the data in the unquarantined snapshots and can download and restore it.

❗ Important

You cannot delete snapshots of a resource if Data Lock is enabled for that resource in the backup configuration.

You might have to clean the existing device/SharePoint Site or provide a new device/SharePoint Site to the user after your Data or Information Security teams have completed their analysis of the impacted resource.

📝 Note
​ You cannot delete the last clean snapshot of the resource. The last clean snapshot is denoted with an info icon that tells you that the snapshot cannot be deleted.

Procedure

You can use APIs to integrate Ransomware Recovery with your existing security tools or build custom scripts to automatically take action if there is a ransomware attack.

Here are a few links to help you get started:

The following is a probable workflow if you know the IDs of the infected devices and the date of infection and want to quarantine snapshots using APIs.