Walnut Creek Ransomware Filtering and Cleanup Consulting

Ransomware has become the weapon of choice for cyber extortionists and malicious governments, representing a potentially lethal risk to businesses that are successfully attacked. Current strains of crypto-ransomware target all vulnerable resources, including online backup, making even selective restoration a complex and costly process. New variations of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, DopplePaymer, Conti and Nephilim have made the headlines, displacing Locky, TeslaCrypt, and CryptoWall in notoriety, elaborateness, and destructiveness.

Most crypto-ransomware penetrations come from innocuous-looking emails with malicious links or file attachments, and a high percentage are "zero-day" attacks that can escape detection by legacy signature-matching antivirus tools. Although user training and frontline detection are critical to defend your network against ransomware, leading practices dictate that you assume some malware will inevitably succeed and that you implement a strong backup solution that allows you to restore files and services quickly with minimal damage.

Progent's ProSight Ransomware Preparedness Checkup is a low-cost service built around a remote interview with a Progent security consultant experienced in ransomware protection and recovery. In the course of this assessment Progent will cooperate directly with your Walnut Creek network management staff to gather pertinent data about your cybersecurity configuration and backup processes. Progent will use this data to produce a Basic Security and Best Practices Assessment documenting how to follow leading practices for implementing and managing your security and backup solution to block or recover from a crypto-ransomware attack.

Progent's Basic Security and Best Practices Assessment highlights key issues related to crypto-ransomware defense and restoration recovery. The report addresses:

Security

• Correct use of admin accounts
• Correct NTFS (New Technology File System) and SMB permissions
• Optimal firewall settings
• Safe Remote Desktop Protocol (RDP) connections
• Guidance for AntiVirus filtering selection and configuration

• Split permission architecture for backup integrity
• Backing up required servers such as AD
• Geographically dispersed backups including cloud backup to Azure

About Ransomware
Ransomware is a form of malware that encrypts or steals a victim's files so they are unusable or are made publicly available. Crypto-ransomware often locks the target's computer. To prevent the carnage, the victim is asked to pay a specified ransom, usually in the form of a crypto currency like Bitcoin, within a brief period of time. It is not guaranteed that delivering the extortion price will restore the damaged data or prevent its exposure to the public. Files can be altered or erased across a network depending on the victim's write permissions, and you cannot reverse engineer the military-grade encryption algorithms used on the compromised files. A common ransomware attack vector is tainted email, whereby the victim is tricked into responding to by means of a social engineering technique known as spear phishing. This causes the email to appear to come from a trusted sender. Another popular vulnerability is a poorly secured RDP port.

The ransomware variant CryptoLocker opened the modern era of crypto-ransomware in 2013, and the monetary losses caused by different strains of ransomware is said to be billions of dollars annually, more than doubling every other year. Notorious attacks include Locky, and NotPetya. Current high-profile variants like Ryuk, Maze and Spora are more complex and have caused more havoc than earlier versions. Even if your backup processes permit you to restore your encrypted data, you can still be threatened by exfiltration, where stolen data are exposed to the public (known as "doxxing"). Because new variants of ransomware crop up daily, there is no certainty that conventional signature-matching anti-virus tools will block the latest malware. If an attack does appear in an email, it is important that your end users have learned to identify social engineering techniques. Your ultimate protection is a solid process for performing and keeping remote backups plus the use of reliable recovery platforms.

Contact Progent About the ProSight Crypto-Ransomware Susceptibility Testing in Walnut Creek
For pricing details and to find out more about how Progent's ProSight Ransomware Vulnerability Review can enhance your protection against crypto-ransomware in Walnut Creek, call Progent at 800-462-8800 or visit Contact Progent.