Introduction

The risk of a cybersecurity failure is no longer limited to the reputation of a company, or something to be borne by its customers, but is an existential risk to the company itself. Ransomware extorts the business with the one universal thing all businesses value – their own data. Needless to say, you need to be well prepared for this danger.

In this article, we will help you understand how Ransomware Recovery by Druva can help save the day in case you are unfortunately attacked by ransomware.

In case of an infection, to quarantine is to isolate the infected parts in order to contain the infection and not allow it to spread. To this effect, Ransomware Recovery enables you to quarantine infected snapshots on the impacted resources, which helps safeguard your system from further infection by barring users or administrators from downloading or restoring data to other resources.

To reduce downtime and loss of productivity, you can restore the data from the latest secure snapshot that you deem safe and get the resource operational again.

Here's how you can use Ransomware Recovery to quarantine infected snapshots in the following ways:

• Manually search for the impacted resource and quarantine the infected or all the snapshots.
• Integrate Ransomware Recovery with third-party security and incident response solutions and automate the response to quarantine the resources using Ransomware Recovery APIs.

Know the impact of quarantining 

• After you quarantine snapshots, access to the quarantined snapshots is blocked for the administrators and the users of that resource.
• Administrators and users cannot download data or restore data from the quarantined snapshots.
  You can identify quarantined snapshots by the lock icon () displayed beside the snapshot creation timestamp in the Restore Data window.
  
  

Decide your approach

Druva enables you to set up your response to the Ransomware Recovery. You can either manually quarantine snapshots on an impacted device or automate the quarantine process by integrating with third-party security and incident response solutions using Ransomware Recovery APIs.

Manually quarantine infected snapshots

The manual way of quarantining the snapshots on a resource is helpful when you get to know about an impacted device from a trusted source such as the device user himself or alerts raised by your security infrastructure and antivirus software about a potential risk.

Prerequisites
Identify the potential date when the resource was infected by ransomware. It helps you decide from which date onwards you want to quarantine the snapshots on the resource.

Note: If you are unaware or not sure about the date, you can start quarantining the snapshots of the impacted resource from the current date or from November 10, 2019, a system-defined limit, before which you cannot quarantine snapshots in Druva inSync.

Choose the best way to quarantine the resource

You can manually quarantine devices using any of the following available methods -

• Search and then quarantine a resource - Use this option when you want to search for an impacted resource, identify the snapshots, and then take quarantine action on the snapshots. To use this option, see Search and quarantine a resource.
• Quarantine resources in bulk using CSV - Use this option when you have to quarantine multiple devices and have the following information available with you to save on your efforts -
  • Email - Email address of the users whose devices need to be quarantined. 
  • Device Name - Name of the devices that you want to quarantine. 
  • From Date - The date from which you want to quarantine the snapshots, in the YYYY-MM-DD format. This should be the date on which the device was impacted. If you do not enter date, inSync will start quarantining all snapshots of the device from November 10, 2019.
  • To Date -  The date till which you want to quarantine the device, in the YYYY-MM-DD  format. If you want to quarantine snapshots in a specific time period, enter the date till which inSync should quarantine snapshots. If you do not enter date, inSync will keep quarantining snapshots indefinitely. 
    To use this option, see Quarantine snapshots in bulk using CSV.

Unquarantine a resource 

After you have completed the required inquiry into the impacted resources with the help of your Data Security and IT teams, you may find that some resources were falsely marked as ransomware impacted. In this case, you might want to remove the resource and the snapshots from the quarantined state and mark it as clean!

After you unquarantine the snapshots, inSync administrators and users can again securely restore and download data from those clean snapshots resulting in no loss of data.

Procedure

1. Log in to Druva Cloud Platform (DCP) Console. 
2. On the DCP Console dashboard, under Cyber Resilience, click the Ransomware Recovery service.
3. On the left pane, click Quarantine Bay > EndPoints.
4. Select the resource that you want to remove. 
   
   
5. Click more options > Remove from Quarantine Bay. 

Once removed, users and administrators can access the data in the unquarantined snapshots and can download and restore it.

Delete infected snapshots of a resource

You might have to clean the existing device or provide a new device to the user after your Data or Information Security teams have completed their analysis on the impacted resource. 

After the user has synced all their data to a new device, you can delete all the infected snapshots on their old device.

Note : You cannot delete the last clean snapshot of the resource. When you go to the Manage Snapshots window for that device, the last clean snapshot is denoted with an info icon that tells that the snapshot cannot be deleted.

Procedure

1. Log in to Druva Cloud Platform (DCP) Console. 
2. On the DCP Console dashboard, under Cyber Resilience, click the Ransomware Recovery service.
3. On the left pane, click Quarantine Bay > EndPoints.
4. Click the resource name to view the snapshots of that resource. 
5. Click the Snapshots tab. The list of all the infected snapshots is displayed.
   
   
6. On the Confirm Deletion confirmation pop-up, specify the reason for deletion (the reason is mandatory with a character limit between 10-150) and then click Delete. Data once deleted cannot be retrieved. The reason for deletion will be captured in the Audit Trail for auditing purposes.

Note: In the case of deleted devices, you cannot view the quarantine range for those devices. However, you can retrieve the deleted devices and view their quarantine range with the Rollback Action option.

Automatically quarantine infected snapshots using APIs

You can use APIs to integrate Ransomware Recovery with your existing security tools or build custom scripts to automatically take action if there is a ransomware attack. 

Here are a few links to help you get started:

• To learn more about Druva APIs, visit our developer portal. 
• See the Ransomware Recovery APIs to try out the APIs that we offering to make your organization more secure.

The following is a probable workflow if you know the IDs of the infected devices and the date of infection and want to quarantine snapshots using APIs.