Brighton Ransomware Filtering and Restoration Expertise

Ransomware has been weaponized by cyber extortionists and bad-actor states, posing a possibly lethal risk to companies that are breached. Modern variations of crypto-ransomware go after all vulnerable resources, including online backup, making even selective restoration a complex and costly exercise. New variations of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Phobos, Snatch and Nephilim have emerged, replacing WannaCry, TeslaCrypt, and CryptoWall in notoriety, sophistication, and destructiveness.

Most ransomware penetrations are caused by innocuous-looking emails with dangerous links or file attachments, and many are so-called "zero-day" variants that elude detection by legacy signature-matching antivirus (AV) tools. While user education and frontline detection are important to protect against ransomware attacks, leading practices dictate that you expect that some attacks will inevitably succeed and that you prepare a strong backup solution that permits you to restore files and services quickly with little if any damage.

Progent's ProSight Ransomware Preparedness Assessment is an ultra-affordable service built around an online discussion with a Progent cybersecurity consultant experienced in ransomware defense and repair. In the course of this interview Progent will work directly with your Brighton IT management staff to gather pertinent data about your cybersecurity configuration and backup processes. Progent will use this information to create a Basic Security and Best Practices Assessment detailing how to apply best practices for configuring and administering your security and backup systems to block or clean up after a ransomware assault.

Progent's Basic Security and Best Practices Report focuses on key issues associated with ransomware prevention and restoration recovery. The report addresses:

Security

• Correct allocation and use of admin accounts
• Assigning NTFS and SMB (Server Message Block) authorizations
• Proper firewall setup
• Safe RDP connections
• Guidance for AntiVirus tools identification and configuration

• Split permission model for backup protection
• Protecting key servers including Active Directory
• Offsite backups including cloud backup to Azure

About Ransomware
Ransomware is a type of malware that encrypts or steals a victim's files so they cannot be used or are publicized. Crypto-ransomware sometimes locks the target's computer. To prevent the damage, the victim is required to send a specified amount of money, usually in the form of a crypto currency such as Bitcoin, within a short period of time. It is not guaranteed that paying the ransom will restore the lost data or prevent its publication. Files can be encrypted or deleted across a network depending on the victim's write permissions, and you cannot solve the military-grade encryption technologies used on the compromised files. A common ransomware attack vector is spoofed email, whereby the user is tricked into responding to by means of a social engineering technique known as spear phishing. This makes the email message to look as though it came from a trusted sender. Another common vulnerability is a poorly protected RDP port.

The ransomware variant CryptoLocker ushered in the new age of crypto-ransomware in 2013, and the damage attributed to by the many strains of ransomware is said to be billions of dollars annually, more than doubling every two years. Famous attacks are WannaCry, and Petya. Current high-profile variants like Ryuk, Maze and TeslaCrypt are more sophisticated and have wreaked more damage than older versions. Even if your backup procedures allow you to recover your ransomed data, you can still be threatened by exfiltration, where ransomed data are exposed to the public. Because new versions of ransomware crop up daily, there is no guarantee that conventional signature-based anti-virus filters will block a new attack. If threat does show up in an email, it is important that your users have learned to identify social engineering techniques. Your ultimate defense is a sound process for performing and keeping remote backups plus the use of dependable recovery tools.

Contact Progent About the ProSight Ransomware Vulnerability Report in Brighton
For pricing information and to learn more about how Progent's ProSight Crypto-Ransomware Readiness Review can bolster your protection against ransomware in Brighton, phone Progent at 800-462-8800 or see Contact Progent.