Augusta-Richmond County Ransomware Protection and Restoration Consulting

Ransomware has been widely adopted by the major cyber-crime organizations and malicious governments, posing a potentially lethal threat to companies that are successfully attacked. Modern variations of crypto-ransomware go after everything, including backup, making even partial restoration a long and costly exercise. New versions of ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Snatch and Egregor have emerged, displacing WannaCry, Spora, and NotPetya in notoriety, sophistication, and destructiveness.

90% of crypto-ransomware penetrations are caused by innocent-seeming emails with malicious links or file attachments, and a high percentage are "zero-day" strains that can escape the defenses of legacy signature-based antivirus tools. Although user training and up-front detection are important to defend against ransomware attacks, leading practices demand that you expect that some malware will inevitably succeed and that you implement a strong backup mechanism that allows you to recover rapidly with minimal damage.

Progent's ProSight Ransomware Vulnerability Report is a low-cost service centered around a remote interview with a Progent cybersecurity expert skilled in ransomware protection and recovery. In the course of this interview Progent will work directly with your Augusta-Richmond County IT managers to gather critical information concerning your cybersecurity posture and backup environment. Progent will utilize this information to create a Basic Security and Best Practices Assessment detailing how to follow best practices for configuring and administering your cybersecurity and backup solution to prevent or recover from a crypto-ransomware assault.

Progent's Basic Security and Best Practices Report highlights key areas associated with crypto-ransomware prevention and restoration recovery. The review covers:

Cybersecurity

• Correct use of administration accounts
• Appropriate NTFS and SMB (Server Message Block) permissions
• Proper firewall configuration
• Secure Remote Desktop Protocol (RDP) configuration
• Recommend AntiVirus (AV) tools selection and deployment

• Split permission architecture for backup integrity
• Protecting critical servers including AD
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a variety of malware that encrypts or deletes a victim's files so they are unusable or are publicized. Crypto-ransomware often locks the victim's computer. To avoid the damage, the target is asked to pay a certain ransom, usually in the form of a crypto currency such as Bitcoin, within a short time window. It is not guaranteed that paying the ransom will restore the damaged files or prevent its publication. Files can be encrypted or erased throughout a network based on the victim's write permissions, and you cannot reverse engineer the military-grade encryption algorithms used on the compromised files. A typical ransomware delivery package is tainted email, in which the victim is tricked into responding to by means of a social engineering technique known as spear phishing. This makes the email message to look as though it came from a familiar sender. Another common attack vector is a poorly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the new age of crypto-ransomware in 2013, and the monetary losses attributed to by different strains of ransomware is said to be billions of dollars annually, roughly doubling every other year. Notorious attacks include WannaCry, and NotPetya. Recent high-profile threats like Ryuk, DoppelPaymer and TeslaCrypt are more sophisticated and have caused more havoc than older versions. Even if your backup/recovery processes enable your business to recover your encrypted files, you can still be threatened by so-called exfiltration, where ransomed data are made public. Because new variants of ransomware crop up every day, there is no guarantee that conventional signature-matching anti-virus filters will block the latest attack. If threat does show up in an email, it is critical that your users have been taught to be aware of social engineering tricks. Your last line of protection is a solid process for scheduling and retaining offsite backups and the use of dependable recovery tools.

Ask Progent About the ProSight Ransomware Vulnerability Audit in Augusta-Richmond County
For pricing details and to find out more about how Progent's ProSight Crypto-Ransomware Susceptibility Assessment can enhance your defense against crypto-ransomware in Augusta-Richmond County, call Progent at 800-462-8800 or see Contact Progent.