Bristol Ransomware Defense and Recovery Consulting

Ransomware has been weaponized by cyber extortionists and bad-actor governments, representing a possibly lethal risk to companies that fall victim. Current versions of ransomware go after everything, including backup, making even selective recovery a complex and expensive process. New strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Snatch and Egregor have emerged, replacing WannaCry, TeslaCrypt, and CryptoWall in notoriety, sophistication, and destructiveness.

90% of crypto-ransomware penetrations are the result of innocuous-seeming emails that have malicious links or file attachments, and many are so-called "zero-day" variants that elude detection by traditional signature-based antivirus (AV) tools. While user training and up-front detection are critical to defend your network against ransomware, best practices demand that you take for granted some malware will eventually succeed and that you put in place a solid backup mechanism that allows you to repair the damage rapidly with minimal losses.

Progent's ProSight Ransomware Preparedness Checkup is an ultra-affordable service built around a remote interview with a Progent cybersecurity consultant skilled in ransomware defense and repair. In the course of this interview Progent will cooperate with your Bristol IT management staff to gather critical information about your security profile and backup environment. Progent will utilize this data to generate a Basic Security and Best Practices Report documenting how to adhere to best practices for configuring and managing your security and backup systems to block or clean up after a crypto-ransomware attack.

Progent's Basic Security and Best Practices Report focuses on key areas related to ransomware prevention and restoration recovery. The report covers:

Cybersecurity

• Effective use of admin accounts
• Assigning NTFS and SMB authorizations
• Proper firewall configuration
• Safe Remote Desktop Protocol (RDP) access
• Guidance for AntiVirus filtering selection and deployment

• Split permission architecture for backup protection
• Protecting key servers including Active Directory
• Offsite backups with cloud backup to Azure

About Ransomware
Ransomware is a form of malicious software that encrypts or deletes a victim's files so they cannot be used or are publicized. Ransomware often locks the target's computer. To prevent the damage, the victim is asked to pay a certain amount of money, usually via a crypto currency such as Bitcoin, within a short time window. It is not guaranteed that delivering the extortion price will recover the lost data or prevent its exposure to the public. Files can be altered or deleted across a network based on the target's write permissions, and you cannot solve the strong encryption algorithms used on the compromised files. A common ransomware attack vector is spoofed email, whereby the target is tricked into interacting with by a social engineering technique called spear phishing. This makes the email to look as though it came from a familiar sender. Another popular attack vector is a poorly protected Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses attributed to by different strains of ransomware is estimated at billions of dollars annually, roughly doubling every two years. Notorious attacks are WannaCry, and Petya. Current high-profile threats like Ryuk, Maze and CryptoWall are more sophisticated and have wreaked more havoc than earlier versions. Even if your backup processes allow your business to restore your ransomed files, you can still be threatened by so-called exfiltration, where ransomed data are made public (known as "doxxing"). Because additional variants of ransomware crop up daily, there is no certainty that conventional signature-matching anti-virus filters will detect the latest malware. If threat does appear in an email, it is important that your users have learned to be aware of social engineering techniques. Your last line of protection is a solid process for performing and keeping offsite backups plus the deployment of reliable restoration tools.

Ask Progent About the ProSight Crypto-Ransomware Vulnerability Evaluation in Bristol
For pricing details and to find out more about how Progent's ProSight Crypto-Ransomware Preparedness Checkup can enhance your protection against crypto-ransomware in Bristol, phone Progent at 800-462-8800 or see Contact Progent.