Alpharetta Ransomware Filtering and Remediation Expertise

Ransomware has been widely adopted by cybercriminals and bad-actor states, posing a potentially existential threat to companies that fall victim. Modern versions of ransomware target all vulnerable resources, including backup, making even partial restoration a challenging and costly exercise. Novel versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, LockBit and Egregor have made the headlines, displacing WannaCry, TeslaCrypt, and NotPetya in prominence, elaborateness, and destructiveness.

Most crypto-ransomware breaches come from innocent-seeming emails with malicious hyperlinks or file attachments, and many are so-called "zero-day" variants that elude detection by legacy signature-based antivirus (AV) tools. While user training and up-front identification are critical to defend your network against ransomware attacks, leading practices dictate that you assume some attacks will eventually get through and that you deploy a strong backup mechanism that allows you to repair the damage rapidly with minimal losses.

Progent's ProSight Ransomware Preparedness Checkup is a low-cost service centered around a remote discussion with a Progent cybersecurity consultant skilled in ransomware defense and recovery. In the course of this interview Progent will work with your Alpharetta network management staff to gather critical information concerning your security setup and backup environment. Progent will use this information to create a Basic Security and Best Practices Report documenting how to adhere to best practices for implementing and administering your cybersecurity and backup solution to block or clean up after a ransomware attack.

Progent's Basic Security and Best Practices Report focuses on vital issues associated with ransomware prevention and restoration recovery. The report addresses:

Cybersecurity

• Effective allocation and use of admin accounts
• Correct NTFS (New Technology File System) and SMB permissions
• Proper firewall configuration
• Secure RDP connections
• Guidance for AntiVirus (AV) filtering identification and configuration

• Split permission model for backup protection
• Protecting required servers including Active Directory
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malware that encrypts or steals a victim's files so they are unusable or are made publicly available. Ransomware often locks the victim's computer. To prevent the carnage, the victim is asked to pay a specified amount of money (the ransom), usually via a crypto currency like Bitcoin, within a short period of time. There is no guarantee that delivering the extortion price will restore the damaged data or avoid its publication. Files can be encrypted or deleted across a network based on the victim's write permissions, and you cannot reverse engineer the military-grade encryption algorithms used on the hostage files. A common ransomware delivery package is spoofed email, whereby the target is tricked into responding to by means of a social engineering exploit known as spear phishing. This makes the email to appear to come from a trusted sender. Another common attack vector is a poorly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses caused by different versions of ransomware is estimated at billions of dollars annually, more than doubling every other year. Notorious examples are WannaCry, and Petya. Current high-profile threats like Ryuk, Sodinokibi and Cerber are more complex and have caused more damage than older versions. Even if your backup procedures allow your business to restore your encrypted files, you can still be hurt by so-called exfiltration, where stolen data are made public. Because additional variants of ransomware are launched daily, there is no certainty that conventional signature-based anti-virus tools will detect the latest malware. If threat does appear in an email, it is critical that your end users have been taught to identify social engineering tricks. Your ultimate protection is a sound scheme for performing and keeping offsite backups plus the use of reliable restoration platforms.

Contact Progent About the ProSight Crypto-Ransomware Susceptibility Checkup in Alpharetta
For pricing information and to learn more about how Progent's ProSight Crypto-Ransomware Preparedness Audit can enhance your defense against ransomware in Alpharetta, phone Progent at 800-462-8800 or visit Contact Progent.