Brighton Ransomware Prevention and Remediation Consulting

Ransomware has been weaponized by the major cyber-crime organizations and rogue states, representing a potentially lethal risk to companies that fall victim. Modern variations of ransomware target everything, including online backup, making even selective restoration a complex and expensive exercise. Novel strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, DopplePaymer, LockBit and Nephilim have made the headlines, replacing Locky, Cerber, and Petya in prominence, elaborateness, and destructiveness.

90% of ransomware penetrations come from innocuous-seeming emails that include malicious hyperlinks or attachments, and many are so-called "zero-day" strains that can escape the defenses of traditional signature-matching antivirus tools. While user training and up-front detection are critical to protect against ransomware attacks, leading practices dictate that you expect that some attacks will inevitably get through and that you implement a strong backup mechanism that permits you to repair the damage quickly with little if any damage.

Progent's ProSight Ransomware Preparedness Report is a low-cost service built around a remote interview with a Progent cybersecurity consultant skilled in ransomware defense and recovery. In the course of this assessment Progent will collaborate with your Brighton network managers to collect critical information about your security profile and backup processes. Progent will use this information to generate a Basic Security and Best Practices Report detailing how to apply best practices for configuring and managing your security and backup solution to block or clean up after a crypto-ransomware assault.

Progent's Basic Security and Best Practices Report focuses on vital areas associated with crypto-ransomware prevention and restoration recovery. The review addresses:

Security

• Correct use of administration accounts
• Appropriate NTFS and SMB authorizations
• Proper firewall setup
• Safe RDP connections
• Recommend AntiVirus tools selection and deployment

• Split permission architecture for backup integrity
• Protecting key servers including AD
• Geographically dispersed backups with cloud backup to Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or deletes files so they are unusable or are made publicly available. Ransomware sometimes locks the target's computer. To prevent the damage, the target is required to send a certain ransom, typically via a crypto currency such as Bitcoin, within a short time window. It is never certain that paying the ransom will restore the lost data or prevent its exposure to the public. Files can be altered or deleted across a network depending on the target's write permissions, and you cannot reverse engineer the strong encryption technologies used on the hostage files. A typical ransomware delivery package is booby-trapped email, whereby the victim is tricked into interacting with by a social engineering technique called spear phishing. This makes the email message to appear to come from a trusted source. Another common attack vector is a poorly secured Remote Desktop Protocol (RDP) port.

CryptoLocker ushered in the new age of crypto-ransomware in 2013, and the monetary losses attributed to by the many strains of ransomware is said to be billions of dollars per year, more than doubling every other year. Notorious attacks include WannaCry, and NotPetya. Current headline variants like Ryuk, Maze and Cerber are more complex and have wreaked more damage than earlier versions. Even if your backup processes enable your business to restore your ransomed data, you can still be hurt by so-called exfiltration, where stolen documents are made public (known as "doxxing"). Because additional versions of ransomware crop up every day, there is no guarantee that traditional signature-matching anti-virus tools will detect a new attack. If threat does show up in an email, it is important that your users have learned to identify social engineering tricks. Your last line of protection is a solid process for scheduling and retaining offsite backups plus the deployment of reliable restoration platforms.

Ask Progent About the ProSight Ransomware Vulnerability Report in Brighton
For pricing details and to find out more about how Progent's ProSight Ransomware Vulnerability Report can enhance your protection against crypto-ransomware in Brighton, phone Progent at 800-462-8800 or see Contact Progent.