Aurora Ransomware Prevention and Restoration Services

Ransomware has become the weapon of choice for the major cyber-crime organizations and rogue states, representing a potentially lethal risk to businesses that are successfully attacked. Current variations of ransomware target everything, including online backup, making even partial restoration a long and expensive exercise. New variations of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, LockBit and Nephilim have made the headlines, replacing Locky, Cerber, and Petya in notoriety, sophistication, and destructive impact.

Most ransomware breaches come from innocent-seeming emails with dangerous links or file attachments, and a high percentage are so-called "zero-day" variants that can escape the defenses of legacy signature-matching antivirus filters. While user education and frontline identification are critical to protect against ransomware attacks, leading practices demand that you take for granted some attacks will inevitably get through and that you deploy a solid backup solution that permits you to repair the damage quickly with minimal losses.

Progent's ProSight Ransomware Vulnerability Assessment is a low-cost service built around a remote discussion with a Progent cybersecurity expert experienced in ransomware defense and recovery. In the course of this interview Progent will work directly with your Aurora network management staff to collect critical data about your cybersecurity posture and backup environment. Progent will utilize this information to produce a Basic Security and Best Practices Report detailing how to follow best practices for implementing and managing your security and backup systems to prevent or clean up after a crypto-ransomware assault.

Progent's Basic Security and Best Practices Report focuses on vital issues associated with ransomware defense and restoration recovery. The report addresses:

Cybersecurity

• Effective allocation and use of administration accounts
• Correct NTFS (New Technology File System) and SMB authorizations
• Proper firewall settings
• Secure RDP access
• Guidance for AntiVirus (AV) tools identification and configuration

• Split permission model for backup protection
• Backing up required servers including Active Directory
• Offsite backups with cloud backup to Azure

About Ransomware
Ransomware is a variety of malicious software that encrypts or steals a victim's files so they cannot be used or are publicized. Ransomware sometimes locks the target's computer. To avoid the damage, the target is required to pay a specified ransom, typically in the form of a crypto currency like Bitcoin, within a brief time window. There is no guarantee that delivering the extortion price will restore the damaged data or avoid its exposure to the public. Files can be encrypted or deleted throughout a network based on the victim's write permissions, and you cannot solve the strong encryption technologies used on the compromised files. A typical ransomware attack vector is spoofed email, whereby the victim is tricked into interacting with by means of a social engineering exploit called spear phishing. This makes the email message to look as though it came from a trusted sender. Another popular vulnerability is an improperly protected RDP port.

CryptoLocker ushered in the new age of ransomware in 2013, and the monetary losses caused by the many versions of ransomware is said to be billions of dollars annually, roughly doubling every other year. Notorious attacks are WannaCry, and Petya. Recent high-profile variants like Ryuk, Sodinokibi and Spora are more complex and have wreaked more havoc than earlier versions. Even if your backup procedures enable you to restore your encrypted files, you can still be threatened by exfiltration, where ransomed data are exposed to the public (known as "doxxing"). Because new variants of ransomware crop up every day, there is no guarantee that traditional signature-matching anti-virus tools will block a new attack. If an attack does show up in an email, it is important that your end users have learned to identify phishing techniques. Your last line of defense is a solid scheme for performing and retaining remote backups plus the use of reliable recovery platforms.

Contact Progent About the ProSight Ransomware Preparedness Consultation in Aurora
For pricing details and to learn more about how Progent's ProSight Crypto-Ransomware Susceptibility Report can enhance your defense against ransomware in Aurora, call Progent at 800-462-8800 or visit Contact Progent.