This guide explains how to safely recover from ransomware attacks using Arpio's Enterprise feature, which quarantines systems and performs malware scanning during recovery.
Enabling Ransomware Recovery
To activate this protection, check the "Enable Ransomware Recovery" box in the Failover dialog (this functionality is not available during a test).
The system then:
- Completes a full failover of all resources, data, and configuration
- For each virtual network, Arpio provisions a deny-all Quarantine Network Security Group (NSG) and an empty Forensics Application Security Group (ASG). The Quarantine NSG blocks all outbound traffic and allows inbound traffic only from members of the Forensics ASG.
- For each Virtual Machine (VM) in the VNet, its NIC is configured to use the Quarantine NSG, effectively isolating the VM.
- Each VM is then started so it can be investigated via the Forensics ASG.
- Quarantined resources display a QUARANTINED status.
Unquarantine Process
The UNQUARANTINE button opens a dialog allowing selection of single or multiple resources to release from quarantine.
For each resource selected:
- On the NIC, the Quarantine NSG is replaced with the original NSG (if one existed) or removed if there was no NSG originally. This restores original network connectivity.
- The resource's "QUARANTINED" status is removed.
Conclusion
Once all resources are unquarantined, you can proceed with failback or conclude recovery operations.