I am reading a book on network security and when talking about user confusion it writes:


  "It is not uncommon for a user to be asked security questions such as
  Is it safe to quarantine this attachment? With little or no direction, users are inclined to provide answers to questions without
  understanding the security risks."


Could someone please tell me, a confused user, what are the dangers of quarantining an attachment? My understanding is that a file in quarantine cannot interact with the OS in any way, thus it isn't a security risk but we also cannot analyze it to see if it is a virus.

No

Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them).

This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage.

In most anti-virus programs, the quarantine files are stored in internal binary formats. Since there is no physical connection between the infector file to your system (your anti-virus program works as the storage format is also a plus point), it is not dangerous.

Analyzing:

Regarding analyzing an infected file, yes it is not possible after quarantine. If you want to do that, you either try disinfecting it or restoring it to its original place (you have to disable your anti-virus program to do this and this is the place where you are opening the cage) and then analyze it. But remember the zombie might eat you up (unless you are good with shotguns)! So it is at your own risk. 

Why not just send the infected/suspicious files to the anti-virus program team? They might give you a better picture after inspecting it with their updated virus signatures.

Bottom line: A quarantined file is not dangerous. But analyzing them yourself might be.
