Working with Quarantine

In the event of a security breach, Tachyon can quarantine devices. This will cut off the device from all network traffic except for the Tachyon Switch. This can contain an outbreak while the device is remediated. In this exercise, we will target a specific system and quarantine it. We with then remove it from quarantine.

Checking Quarantine State

1. Logged into 1ETRNW102 as 1ETRN\Tachyon_AdminPP
2. Open Google Chrome and Navigate to the Explorer Application
3. From the Home screen click All Instructions
4. Expand Quarantine
5. Click Are my devices quarantined?
Read the warning here – this is a very powerful feature and can take all your devices off the network if the coverage is not correct.
6. Click Ask this question
7. This is a simple query to see if the devices are actually quarantined. As you can see none of our devices are in quarantine

Quarantine a Device

In this task we are going to quarantine 1ETRNW72

8. Navigate to Explorer application – Home screen
9. In the I want to know field type in Quarantine
10. Click on Quarantine Selected Devices. Click Edit on parameters
It is possible to quarantine the Tachyon server so be extremely careful with your coverage.
11. Click coverage
12. Expand Device. Choose = in the first field and type in 1ETRNW72.1ETRN.local in the second field
Use the FQDN here to ensure you don't quarantine the wrong machine.
13. Click Set
14. Click Perform this Action
15. Type in your Password
16. Open LiveMail and enter your authentication code

17. Open LiveMail and Launch the Notification Page or refresh Chrome and navigate to Notifications
18. Approve the Request

Checking the Quarantined Device

19. In the Explorer application check the results from the instruction
20. Notice there is now 1 device quarantined
21. Click on Quarantined in Status and see the device name
22. Launch a Command Prompt and type in ping 1etrnw72. Your request will time out without a response

23. Launch a command prompt and ping 1ETRNDC
24. Ping 1ETRNCM
These should both time out without a response. Once placed in quarantine a device can only be accessed from the Tachyon server.
25. Ping Tachyon (our alias for 1ETRNAP)
This should ping as normal – all remediation efforts will have to originate from the Tachyon server for this device that is quarantined. This will greatly stop the propagation of any malware that gets introduced into your environment.
26. Launch a new browser window and navigate to Google.com
27. Notice that our device cannot get to other devices or the internet

Removing a Device from Quarantine

Now we will issue the instruction that will remove the device from quarantine. The device can only communicate with the Tachyon Switch at this time.

28. Still logged in as 1ETRN\Tachyon_Admin1
29. Open Google Chrome – the Explorer Application should still be open
30. Navigate to Home and in the I want to know field type in Quaran and Select Releases Selected devices from Quarantine
31. Click Edit on the Parameters
32. Expand Coverage – Expand Device
33. In the contains field select =
34. In the next field type in 1ETRNW72.1ETRN.Local click Set
35. Type in the entire FQDN or the instruction will fail
36. Click Perform this action
37. Type in Passw0rd and click Confirm and Send
38. Open LiveMail and copy the authentication code for Instruction X
39. Paste the code into the Authentication Code box. Click Submit

40. Still logged in as 1ETRN\Tachyon_AdminG
41. Open Chrome and refresh the page
42. In the Explorer Application navigate to Notifications
43. Approve Instruction X from above

44. In the Explorer Application – Navigate to Instructions – History
45. Select our Releases selected devices from quarantine
46. Wait for this one to complete
47. Move back to Instructions – History. Select Are my devices quarantined?
48. Rerun this instruction
49. Wait for it to complete and see that all 7 devices are now NotQuarantined
50. Open a command prompt and Ping 1ETRNW72. Device should respond

51. Ping any of the other devices in the lab
All the devices should now respond to the ping request
52. Browse to the Internet
53. The device should be able to get to the internet
The ability to quarantine devices is critical to be able to combat a security emergency. This functionality is also dangerous as the devices are only able to communicate with the Tachyon server to enable the ability to remediate the issue and the remove the quarantine. It is possible to quarantine the Tachyon Server, and this would prevent you from removing the quarantine.

Lab Summary

In this lab, We learned how to use Quarantine to help us remediate security issues and prevent further spread. 

Next Page

Ex 7 - Tachyon v5.2 - Using - Using Explorer - The Device View