Bristol Ransomware Prevention and Cleanup Consulting

Ransomware has been widely adopted by cybercriminals and bad-actor governments, representing a possibly existential risk to businesses that are successfully attacked. The latest versions of ransomware target everything, including backup, making even partial recovery a challenging and expensive exercise. Novel versions of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Conti and Egregor have emerged, displacing WannaCry, TeslaCrypt, and NotPetya in notoriety, sophistication, and destructive impact.

90% of ransomware breaches come from innocuous-looking emails with malicious hyperlinks or attachments, and many are "zero-day" strains that can escape the defenses of traditional signature-based antivirus filters. Although user education and frontline detection are important to defend your network against ransomware attacks, best practices dictate that you expect that some attacks will eventually get through and that you prepare a solid backup mechanism that enables you to repair the damage rapidly with little if any damage.

Progent's ProSight Ransomware Vulnerability Checkup is a low-cost service centered around an online discussion with a Progent cybersecurity consultant experienced in ransomware defense and recovery. During this assessment Progent will work with your Bristol IT management staff to collect pertinent information concerning your cybersecurity configuration and backup processes. Progent will utilize this information to generate a Basic Security and Best Practices Assessment documenting how to apply leading practices for implementing and administering your security and backup solution to block or clean up after a ransomware assault.

Progent's Basic Security and Best Practices Report highlights key issues related to crypto-ransomware prevention and restoration recovery. The review addresses:

Cybersecurity

• Proper use of admin accounts
• Appropriate NTFS and SMB (Server Message Block) permissions
• Proper firewall configuration
• Safe Remote Desktop Protocol (RDP) access
• Recommend AntiVirus tools identification and deployment

• Split permission model for backup integrity
• Backing up critical servers such as AD
• Offsite backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malware that encrypts or steals a victim's files so they cannot be used or are publicized. Ransomware often locks the target's computer. To prevent the carnage, the victim is required to send a specified amount of money, typically via a crypto currency like Bitcoin, within a short time window. It is never certain that paying the extortion price will recover the damaged files or avoid its publication. Files can be altered or deleted across a network based on the victim's write permissions, and you cannot reverse engineer the military-grade encryption technologies used on the compromised files. A typical ransomware attack vector is booby-trapped email, in which the victim is lured into responding to by a social engineering technique called spear phishing. This causes the email message to look as though it came from a trusted sender. Another common vulnerability is a poorly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker opened the modern era of crypto-ransomware in 2013, and the damage caused by the many strains of ransomware is estimated at billions of dollars per year, more than doubling every other year. Famous examples include Locky, and NotPetya. Recent headline variants like Ryuk, DoppelPaymer and CryptoWall are more elaborate and have caused more havoc than earlier strains. Even if your backup/recovery processes allow you to recover your ransomed data, you can still be threatened by so-called exfiltration, where stolen documents are made public (known as "doxxing"). Because additional variants of ransomware are launched daily, there is no certainty that conventional signature-matching anti-virus filters will block the latest attack. If an attack does show up in an email, it is important that your end users have been taught to identify phishing techniques. Your last line of protection is a solid process for scheduling and keeping offsite backups and the use of dependable restoration platforms.

Contact Progent About the ProSight Ransomware Readiness Checkup in Bristol
For pricing details and to learn more about how Progent's ProSight Ransomware Preparedness Report can bolster your defense against ransomware in Bristol, call Progent at 800-462-8800 or see Contact Progent.