Buffalo Ransomware Prevention and Remediation Consulting

Ransomware has been weaponized by the major cyber-crime organizations and malicious states, posing a possibly lethal threat to companies that are victimized. The latest variations of ransomware go after all vulnerable resources, including online backup, making even partial recovery a complex and costly exercise. New variations of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, LockBit and Egregor have emerged, displacing Locky, Spora, and NotPetya in prominence, sophistication, and destructiveness.

90% of crypto-ransomware breaches are the result of innocent-looking emails with dangerous hyperlinks or attachments, and a high percentage are "zero-day" attacks that can escape the defenses of legacy signature-based antivirus (AV) filters. Although user education and up-front detection are critical to defend your network against ransomware attacks, best practices dictate that you assume some malware will inevitably get through and that you put in place a solid backup mechanism that enables you to recover quickly with minimal losses.

Progent's ProSight Ransomware Vulnerability Report is a low-cost service centered around a remote interview with a Progent cybersecurity expert skilled in ransomware protection and recovery. During this assessment Progent will work directly with your Buffalo network managers to collect critical data about your security configuration and backup processes. Progent will utilize this data to generate a Basic Security and Best Practices Report documenting how to adhere to best practices for implementing and administering your security and backup systems to prevent or clean up after a ransomware attack.

Progent's Basic Security and Best Practices Assessment highlights key issues associated with crypto-ransomware defense and restoration recovery. The review addresses:

Cybersecurity

• Proper allocation and use of admin accounts
• Correct NTFS and SMB (Server Message Block) authorizations
• Optimal firewall configuration
• Secure Remote Desktop Protocol access
• Guidance for AntiVirus (AV) tools selection and configuration

• Split permission architecture for backup integrity
• Backing up key servers such as AD
• Offsite backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a variety of malware that encrypts or steals files so they cannot be used or are publicized. Ransomware often locks the target's computer. To avoid the carnage, the target is required to pay a specified amount of money (the ransom), usually in the form of a crypto currency like Bitcoin, within a short period of time. It is not guaranteed that delivering the extortion price will restore the damaged files or prevent its publication. Files can be encrypted or deleted throughout a network depending on the target's write permissions, and you cannot solve the strong encryption technologies used on the hostage files. A common ransomware delivery package is tainted email, whereby the target is tricked into interacting with by means of a social engineering technique called spear phishing. This makes the email message to appear to come from a familiar source. Another common attack vector is an improperly secured RDP port.

The ransomware variant CryptoLocker ushered in the modern era of ransomware in 2013, and the monetary losses attributed to by the many versions of ransomware is said to be billions of dollars annually, roughly doubling every two years. Famous examples include WannaCry, and Petya. Current headline threats like Ryuk, Sodinokibi and CryptoWall are more complex and have wreaked more damage than older versions. Even if your backup/recovery procedures enable your business to recover your ransomed files, you can still be threatened by exfiltration, where ransomed data are made public. Because additional versions of ransomware crop up daily, there is no guarantee that conventional signature-based anti-virus filters will detect the latest malware. If an attack does appear in an email, it is critical that your end users have been taught to identify phishing techniques. Your last line of defense is a sound scheme for performing and retaining offsite backups and the deployment of dependable restoration platforms.

Ask Progent About the ProSight Crypto-Ransomware Susceptibility Evaluation in Buffalo
For pricing information and to find out more about how Progent's ProSight Ransomware Readiness Audit can bolster your defense against ransomware in Buffalo, call Progent at 800-462-8800 or see Contact Progent.