Lincoln Ransomware Filtering and Removal Consulting

Ransomware has been widely adopted by the major cyber-crime organizations and rogue states, posing a potentially lethal risk to businesses that are breached. Current strains of ransomware target all vulnerable resources, including backup, making even partial restoration a complex and costly exercise. New strains of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Conti and Nephilim have emerged, replacing WannaCry, Spora, and NotPetya in prominence, elaborateness, and destructive impact.

90% of ransomware infections come from innocent-seeming emails that have malicious links or attachments, and many are "zero-day" strains that elude the defenses of legacy signature-based antivirus filters. While user education and up-front detection are critical to protect your network against ransomware, best practices demand that you take for granted some attacks will inevitably get through and that you prepare a solid backup mechanism that permits you to restore files and services quickly with minimal damage.

Progent's ProSight Ransomware Preparedness Assessment is a low-cost service centered around an online interview with a Progent cybersecurity expert skilled in ransomware protection and repair. In the course of this assessment Progent will work with your Lincoln network management staff to gather pertinent data about your cybersecurity profile and backup processes. Progent will use this data to create a Basic Security and Best Practices Report detailing how to follow best practices for configuring and administering your cybersecurity and backup systems to prevent or clean up after a ransomware attack.

Progent's Basic Security and Best Practices Assessment focuses on key issues associated with crypto-ransomware prevention and restoration recovery. The review covers:

Security

• Effective allocation and use of admin accounts
• Appropriate NTFS and SMB permissions
• Optimal firewall setup
• Safe Remote Desktop Protocol configuration
• Advice about AntiVirus tools identification and deployment

• Split permission model for backup integrity
• Protecting required servers such as AD
• Geographically dispersed backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or deletes files so they are unusable or are made publicly available. Crypto-ransomware sometimes locks the victim's computer. To avoid the carnage, the target is asked to pay a certain amount of money (the ransom), usually in the form of a crypto currency like Bitcoin, within a short period of time. It is never certain that delivering the extortion price will recover the damaged data or avoid its publication. Files can be altered or deleted across a network depending on the victim's write permissions, and you cannot solve the military-grade encryption algorithms used on the compromised files. A typical ransomware delivery package is booby-trapped email, in which the victim is tricked into responding to by means of a social engineering technique called spear phishing. This makes the email message to appear to come from a familiar source. Another common attack vector is an improperly secured RDP port.

CryptoLocker ushered in the new age of crypto-ransomware in 2013, and the monetary losses attributed to by different versions of ransomware is estimated at billions of dollars per year, more than doubling every other year. Famous attacks are WannaCry, and NotPetya. Recent headline threats like Ryuk, Maze and Spora are more complex and have wreaked more havoc than earlier strains. Even if your backup/recovery processes permit you to restore your ransomed files, you can still be threatened by so-called exfiltration, where ransomed documents are exposed to the public. Because additional versions of ransomware crop up daily, there is no guarantee that traditional signature-based anti-virus tools will detect a new attack. If threat does show up in an email, it is important that your end users have been taught to identify social engineering techniques. Your last line of defense is a sound process for scheduling and retaining remote backups plus the use of reliable recovery tools.

Contact Progent About the ProSight Crypto-Ransomware Readiness Consultation in Lincoln
For pricing information and to learn more about how Progent's ProSight Crypto-Ransomware Susceptibility Review can bolster your protection against ransomware in Lincoln, phone Progent at 800-462-8800 or see Contact Progent.