Copy of Reaction - Concept

Control a Ransomware Infection

The following section describes the steps that should be taken when one or more systems become infected by ransomware. The goal is to stop the spreading completely. A quicker reaction will result in less data to recover.

Isolating an infected client

Steps to contain a ransomware spread:

1. Remove infected system from network.
2. Disable backups on infected system to ensure that no files are backed up.
3. Disable data aging for infected system to ensure that encrypted files can restored to a previous version.
4. Stop all suspected services and kill all suspected process.

Recover from a Ransomware Attack

Once all the infected systems are clean, it is now time to recover the data. The following steps ensure a smooth recovery.

Steps to recover from a ransomware attack:

1. Sanitize the infected system and delete ransomware files.
2. Once clean, put the system back on the network.
3. If one of the infected system is the CommServe^® server and the database is no longer available, recover it from a clean backup, such as one sent to Commvault^® Cloud Services.
4. If one of the infected system is a MediaAgent and the configured storage was infected, ensure to have access to an unaffected copy, such as offsite tapes.
5. On previously infected systems, recover the data that was deleted during the cleaning process.
6. Re-enable backups on the systems.
7. Once the first backup is completed successfully and you are sure the systems are now clean, re-enable data aging.

DR Strategy in Prevention of an Attack

To ensure the recoverability of the data, the backup system data must be available and unaffected.

Review the following best practices when architecting your DR solution:

• Protect the CommServe^® server database and send a copy to an inaccessible location, such as Commvault Cloud Services.
• Create an offline backup copy such as tape media.
• Replicate backup data using Commvault^® DASH copy technology rather than storage replication.

Lock down CommCell^® storage against ransomware attacks by enabling the Ransomware Protection option in MediaAgents.