Sandy Springs Ransomware Defense and Remediation Solutions

Ransomware has become the weapon of choice for the major cyber-crime organizations and rogue governments, posing a potentially existential risk to businesses that are successfully attacked. The latest versions of crypto-ransomware go after all vulnerable resources, including backup, making even selective restoration a complex and expensive process. Novel variations of ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, LockBit and Nephilim have made the headlines, replacing Locky, Spora, and Petya in prominence, sophistication, and destructive impact.

90% of ransomware infections are the result of innocent-seeming emails with malicious hyperlinks or attachments, and a high percentage are so-called "zero-day" strains that can escape the defenses of legacy signature-based antivirus (AV) filters. While user training and up-front detection are important to defend against ransomware, best practices demand that you take for granted some malware will eventually get through and that you prepare a strong backup solution that enables you to recover rapidly with minimal damage.

Progent's ProSight Ransomware Preparedness Report is a low-cost service built around an online interview with a Progent cybersecurity consultant experienced in ransomware protection and recovery. In the course of this assessment Progent will work directly with your Sandy Springs network managers to collect pertinent data concerning your security configuration and backup processes. Progent will utilize this data to generate a Basic Security and Best Practices Assessment documenting how to adhere to leading practices for configuring and managing your security and backup systems to block or clean up after a crypto-ransomware assault.

Progent's Basic Security and Best Practices Report highlights key issues associated with ransomware prevention and restoration recovery. The review covers:

Security

• Correct allocation and use of admin accounts
• Correct NTFS and SMB (Server Message Block) permissions
• Proper firewall setup
• Safe RDP access
• Advice about AntiVirus (AV) tools identification and deployment

• Split permission architecture for backup protection
• Backing up key servers such as AD
• Geographically dispersed backups including cloud backup to Azure

About Ransomware
Ransomware is a variety of malicious software that encrypts or steals files so they are unusable or are publicized. Crypto-ransomware sometimes locks the target's computer. To avoid the carnage, the victim is required to send a specified ransom, typically via a crypto currency like Bitcoin, within a brief time window. It is not guaranteed that paying the ransom will restore the damaged data or avoid its exposure to the public. Files can be altered or deleted throughout a network based on the target's write permissions, and you cannot reverse engineer the military-grade encryption technologies used on the compromised files. A typical ransomware delivery package is tainted email, in which the victim is lured into responding to by a social engineering technique called spear phishing. This causes the email to look as though it came from a familiar source. Another popular attack vector is an improperly protected Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the new age of crypto-ransomware in 2013, and the damage attributed to by different versions of ransomware is estimated at billions of dollars per year, more than doubling every other year. Famous examples include WannaCry, and Petya. Current high-profile variants like Ryuk, DoppelPaymer and CryptoWall are more elaborate and have wreaked more damage than older strains. Even if your backup/recovery procedures enable you to recover your encrypted files, you can still be threatened by so-called exfiltration, where ransomed data are made public (known as "doxxing"). Because additional variants of ransomware crop up every day, there is no certainty that traditional signature-based anti-virus filters will detect the latest attack. If threat does show up in an email, it is important that your users have learned to identify phishing tricks. Your last line of protection is a sound process for scheduling and keeping offsite backups and the deployment of reliable restoration tools.

Ask Progent About the ProSight Crypto-Ransomware Readiness Consultation in Sandy Springs
For pricing details and to learn more about how Progent's ProSight Ransomware Preparedness Evaluation can bolster your protection against crypto-ransomware in Sandy Springs, call Progent at 800-462-8800 or see Contact Progent.