The Verify-Then-Vault Architecture: Securing AWS Logically Air-Gapped Vaults

Why Quarantine Matters More Now

Immutable storage (AWS Logically Air-Gapped Vault) is the gold standard for protecting backup data from deletion. However, it has a critical architectural blind spot: it cannot distinguish between valid data and ransomware-encrypted data.

If an adversary encrypts your production environment, standard AWS Backup policies will dutifully replicate those encrypted blocks into your LAG Vault. This creates an "Immutable Infection Loop," where your recovery points are secured, compliant, and completely unusable.

Elastio Quarantine solves this by introducing a data integrity gatekeeper upstream of your immutable vault. By inspecting every recovery point for encryption and corruption before vaulting, Elastio ensures that only verified clean data enters your air-gapped environment.

Why Malware Detection Is Not Enough

Most security tools focus on finding the attacker (malware signatures, command & control activity). Elastio focuses on the damage (encryption, corruption, and data loss). To guarantee recovery, finding the virus is not enough.

• Malware Scans Miss "Clean" Destruction: An attacker can encrypt your database and delete the ransomware binary. A standard malware scan will report the backup as "Clean" (no virus found), even though the data is 100% unrecoverable.
• They Miss "Low-and-Slow" Corruption: Modern ransomware uses striped or partial encryption to evade detection. Standard block-level change tracking often misses these subtle corruption events.
• The Elastio Difference: We don't just look for the burglar; we check if the house is still standing. Elastio analyzes the structural integrity of the data—detecting ransomware encrypted data, header destruction, and encryption patterns that signature scanners ignore.

The Elastio Advantage: Integrity vs. Infection

Architecture: How the Quarantine Workflow Works

Elastio operates as an event-driven, agentless validation layer integrated natively with AWS Backup and AWS Organizations.

1. Backup Created
   AWS Backup writes the recovery point to your default vault.
2. Automated Scan
   Elastio scans it using detection engines that look for signs of encryption, corruption, and malicious behavior—not just malware signatures.
3. Clean Backups Promoted
   If the scan finds nothing malicious, the point is copied to your Clean Vault (e.g. LAG/Bunker). These points become part of your provable recovery set.
4. Infected Backups Quarantined
   If Elastio detects anomalies or encryption, the recovery point is diverted to a Forensics Vault and tagged “Quarantined.” It’s isolated from restores and replication. Your IR and Security teams can safely access quarantined data to trace root cause, timeline, and attacker behavior, without risk to production.

By combining Quarantine with continuous validation and provable recovery, Elastio transforms recovery from a weak link into a security control you can count on.

Key Benefits of Quarantine + Provable Recovery

How to Configure Quarantine (Best Practices)

To implement a "Verify-Then-Vault" architecture, we recommend the following configuration:

• Designate your Clean Vault: Configure your primary storage (e.g., AWS LAG Vault or Bunker) to accept only validated data.
• Configure your Forensics Vault: Establish a separate vault with strict access control (IR/SecOps only) for quarantined snapshots.
• Monitor Elastio Alerts: Integrate Elastio notifications with your SIEM (e.g., Splunk, Datadog) or AWS Security Hub to trigger incident response workflows immediately upon a quarantine event.
• Pair with Dashboards: Use Elastio’s recovery dashboards to visually trace clean vs. dirty points over time, establishing a clear "Last Known Clean" baseline.

Available Now & Next Steps

The Quarantine feature is available immediately to all Elastio users. You don’t need to wait, just configure it and start benefiting from clean-vs-infected recovery point isolation.

Review Configuration Instructions
The setup and configuration details are fully documented in the Elastio support portal.