Alexandria Ransomware Filtering and Cleanup Consulting

Ransomware has been widely adopted by the major cyber-crime organizations and bad-actor governments, posing a possibly existential risk to businesses that are successfully attacked. Current variations of crypto-ransomware go after everything, including backup, making even selective restoration a long and costly exercise. Novel strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Snatch and Egregor have made the headlines, displacing Locky, Spora, and CryptoWall in prominence, sophistication, and destructive impact.

Most ransomware penetrations are caused by innocuous-seeming emails that have malicious hyperlinks or file attachments, and many are so-called "zero-day" variants that elude the defenses of traditional signature-based antivirus filters. While user training and up-front identification are critical to protect against ransomware attacks, leading practices dictate that you assume some malware will eventually get through and that you deploy a strong backup solution that enables you to recover rapidly with little if any damage.

Progent's ProSight Ransomware Preparedness Report is an ultra-affordable service centered around an online interview with a Progent cybersecurity expert experienced in ransomware protection and recovery. In the course of this assessment Progent will collaborate directly with your Alexandria network managers to collect pertinent information about your security profile and backup environment. Progent will utilize this data to generate a Basic Security and Best Practices Assessment detailing how to adhere to best practices for implementing and managing your security and backup solution to prevent or clean up after a crypto-ransomware assault.

Progent's Basic Security and Best Practices Report focuses on key areas related to crypto-ransomware defense and restoration recovery. The report addresses:

Cybersecurity

• Correct allocation and use of admin accounts
• Correct NTFS and SMB permissions
• Optimal firewall settings
• Safe Remote Desktop Protocol (RDP) connections
• Guidance for AntiVirus tools identification and deployment

• Split permission architecture for backup integrity
• Protecting critical servers including Active Directory
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malware that encrypts or steals a victim's files so they cannot be used or are publicized. Crypto-ransomware sometimes locks the target's computer. To avoid the damage, the target is required to pay a specified ransom, usually in the form of a crypto currency like Bitcoin, within a brief period of time. It is never certain that delivering the ransom will restore the damaged data or avoid its publication. Files can be encrypted or deleted across a network based on the victim's write permissions, and you cannot reverse engineer the military-grade encryption algorithms used on the hostage files. A typical ransomware attack vector is tainted email, whereby the victim is lured into responding to by means of a social engineering technique called spear phishing. This causes the email to appear to come from a trusted source. Another common vulnerability is an improperly secured RDP port.

The ransomware variant CryptoLocker opened the new age of crypto-ransomware in 2013, and the monetary losses caused by the many versions of ransomware is said to be billions of dollars per year, more than doubling every two years. Famous examples are Locky, and NotPetya. Recent high-profile variants like Ryuk, DoppelPaymer and Cerber are more complex and have wreaked more damage than earlier strains. Even if your backup/recovery procedures enable you to recover your ransomed files, you can still be hurt by so-called exfiltration, where stolen data are exposed to the public (known as "doxxing"). Because new variants of ransomware crop up every day, there is no certainty that traditional signature-based anti-virus filters will block a new malware. If an attack does show up in an email, it is important that your users have been taught to be aware of social engineering techniques. Your last line of defense is a solid process for performing and keeping offsite backups and the deployment of dependable restoration tools.

Ask Progent About the ProSight Crypto-Ransomware Preparedness Report in Alexandria
For pricing details and to learn more about how Progent's ProSight Ransomware Readiness Checkup can bolster your defense against crypto-ransomware in Alexandria, phone Progent at 800-462-8800 or visit Contact Progent.