Quarantine

Quarantine in the cybersecurity world happens when files containing malware are placed into isolation for future disinfection or examination. This strategy puts the malware in a specific area of the storage device in order to prevent it from contaminating other files or systems. The quarantine process starts when anti-virus or anti-malware solutions detect a threat but can’t eliminate it immediately.

Most solutions should be configured to not delete malware suspected files immediately in case the threat reported is a false-positive.

CyberHoot remembers the day when an AV product was set to delete malware files upon discovery.  An AV vendor signature update tagged a critical system file as malware and this led to blue screens of death throughout the server infrastructure and a terribly long day for IT.  Always quarantine and manually delete malware files. AV Vendors are not perfect and you will save yourself a nightmare scenario of rebuilding systems from scratch.

Files marked for quarantine are encrypted and moved to a protected folder, preventing potential harm to the user’s system. Each solution has a ‘Quarantine Manager’ feature, where users can permanently delete or restore files from quarantine. Upon review of the archived files, an exception list (white/allow list) option is commonly given to bypass false positive detection.