Alexandria Ransomware Filtering and Cleanup Expertise

Ransomware has become the weapon of choice for the major cyber-crime organizations and bad-actor states, representing a possibly existential threat to businesses that fall victim. Current versions of ransomware go after everything, including online backup, making even partial restoration a long and costly process. Novel versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Phobos, Snatch and Nephilim have made the headlines, replacing WannaCry, Spora, and NotPetya in prominence, elaborateness, and destructiveness.

90% of crypto-ransomware breaches come from innocent-looking emails with malicious links or attachments, and many are so-called "zero-day" strains that can escape the defenses of legacy signature-matching antivirus (AV) filters. While user training and frontline identification are important to protect your network against ransomware, leading practices dictate that you assume some malware will eventually get through and that you implement a solid backup mechanism that permits you to restore files and services quickly with minimal damage.

Progent's ProSight Ransomware Vulnerability Assessment is an ultra-affordable service built around an online interview with a Progent security consultant skilled in ransomware protection and recovery. In the course of this assessment Progent will cooperate directly with your Alexandria IT managers to collect critical information concerning your cybersecurity configuration and backup processes. Progent will utilize this information to produce a Basic Security and Best Practices Report detailing how to apply leading practices for implementing and administering your security and backup systems to prevent or recover from a ransomware assault.

Progent's Basic Security and Best Practices Report focuses on key issues related to ransomware prevention and restoration recovery. The report covers:

Cybersecurity

• Effective allocation and use of administration accounts
• Appropriate NTFS and SMB (Server Message Block) permissions
• Optimal firewall setup
• Secure Remote Desktop Protocol (RDP) connections
• Advice about AntiVirus filtering selection and configuration

• Split permission architecture for backup integrity
• Backing up critical servers including AD
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or steals files so they cannot be used or are made publicly available. Crypto-ransomware sometimes locks the victim's computer. To prevent the carnage, the target is asked to pay a specified ransom, typically via a crypto currency like Bitcoin, within a brief time window. There is no guarantee that delivering the ransom will restore the damaged data or prevent its exposure to the public. Files can be encrypted or deleted across a network depending on the victim's write permissions, and you cannot break the military-grade encryption technologies used on the hostage files. A common ransomware attack vector is spoofed email, whereby the user is lured into interacting with by means of a social engineering technique called spear phishing. This causes the email to look as though it came from a familiar source. Another popular attack vector is a poorly protected Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker opened the modern era of ransomware in 2013, and the damage caused by different strains of ransomware is estimated at billions of dollars per year, roughly doubling every two years. Notorious examples include WannaCry, and NotPetya. Recent headline threats like Ryuk, DoppelPaymer and Cerber are more complex and have caused more damage than older versions. Even if your backup procedures allow you to recover your encrypted data, you can still be threatened by so-called exfiltration, where ransomed data are made public (known as "doxxing"). Because new variants of ransomware are launched daily, there is no guarantee that conventional signature-based anti-virus filters will block a new attack. If threat does appear in an email, it is critical that your end users have been taught to identify phishing tricks. Your last line of defense is a solid process for scheduling and retaining remote backups and the use of dependable restoration platforms.

Ask Progent About the ProSight Ransomware Vulnerability Audit in Alexandria
For pricing information and to learn more about how Progent's ProSight Crypto-Ransomware Readiness Audit can enhance your defense against ransomware in Alexandria, phone Progent at 800-462-8800 or visit Contact Progent.