Eugene Ransomware Protection and Cleanup Consulting

Ransomware has become the weapon of choice for cybercriminals and rogue states, posing a possibly existential threat to companies that are successfully attacked. The latest strains of crypto-ransomware target everything, including online backup, making even selective recovery a long and expensive exercise. Novel strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Conti and Egregor have made the headlines, displacing WannaCry, TeslaCrypt, and CryptoWall in notoriety, elaborateness, and destructiveness.

90% of ransomware breaches are the result of innocent-looking emails that include dangerous links or file attachments, and many are "zero-day" strains that elude the defenses of traditional signature-matching antivirus (AV) filters. While user training and frontline detection are critical to protect your network against ransomware, best practices dictate that you expect that some malware will inevitably get through and that you prepare a solid backup mechanism that permits you to repair the damage rapidly with minimal losses.

Progent's ProSight Ransomware Vulnerability Assessment is a low-cost service built around a remote discussion with a Progent security consultant experienced in ransomware defense and recovery. In the course of this interview Progent will collaborate with your Eugene network management staff to gather pertinent data concerning your security profile and backup environment. Progent will utilize this data to create a Basic Security and Best Practices Assessment documenting how to adhere to best practices for implementing and administering your cybersecurity and backup systems to block or recover from a ransomware attack.

Progent's Basic Security and Best Practices Report highlights key areas associated with crypto-ransomware defense and restoration recovery. The report covers:

Security

• Effective allocation and use of admin accounts
• Correct NTFS (New Technology File System) and SMB permissions
• Proper firewall setup
• Safe RDP access
• Guidance for AntiVirus tools identification and configuration

• Split permission architecture for backup protection
• Protecting critical servers including Active Directory
• Geographically dispersed backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malware that encrypts or deletes files so they cannot be used or are publicized. Ransomware often locks the victim's computer. To avoid the carnage, the target is required to pay a specified amount of money (the ransom), usually via a crypto currency like Bitcoin, within a brief time window. It is not guaranteed that paying the ransom will recover the damaged data or prevent its exposure to the public. Files can be encrypted or deleted throughout a network based on the victim's write permissions, and you cannot reverse engineer the strong encryption algorithms used on the hostage files. A typical ransomware attack vector is booby-trapped email, in which the user is tricked into interacting with by a social engineering exploit known as spear phishing. This makes the email to look as though it came from a familiar source. Another common attack vector is a poorly secured Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker ushered in the new age of crypto-ransomware in 2013, and the damage caused by the many strains of ransomware is estimated at billions of dollars per year, roughly doubling every other year. Famous examples are Locky, and Petya. Recent headline threats like Ryuk, Sodinokibi and Spora are more sophisticated and have wreaked more damage than older strains. Even if your backup/recovery procedures permit you to recover your ransomed data, you can still be hurt by so-called exfiltration, where ransomed data are exposed to the public. Because additional variants of ransomware crop up every day, there is no certainty that conventional signature-matching anti-virus filters will detect the latest attack. If threat does show up in an email, it is important that your end users have been taught to identify social engineering techniques. Your ultimate protection is a sound process for performing and keeping offsite backups plus the deployment of reliable restoration tools.

Contact Progent About the ProSight Ransomware Vulnerability Consultation in Eugene
For pricing details and to learn more about how Progent's ProSight Crypto-Ransomware Preparedness Testing can bolster your defense against crypto-ransomware in Eugene, call Progent at 800-462-8800 or visit Contact Progent.