Campinas Ransomware Defense and Restoration Services

Ransomware has become the weapon of choice for the major cyber-crime organizations and rogue states, representing a possibly existential risk to businesses that are breached. Current variations of crypto-ransomware target everything, including online backup, making even partial restoration a long and expensive exercise. Novel versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Phobos, Conti and Egregor have made the headlines, replacing WannaCry, TeslaCrypt, and NotPetya in notoriety, sophistication, and destructive impact.

Most crypto-ransomware penetrations come from innocuous-seeming emails that include malicious links or file attachments, and many are so-called "zero-day" attacks that elude the defenses of legacy signature-matching antivirus filters. Although user training and frontline identification are critical to protect against ransomware, best practices dictate that you expect that some malware will inevitably succeed and that you put in place a strong backup solution that enables you to restore files and services quickly with little if any losses.

Progent's ProSight Ransomware Preparedness Assessment is a low-cost service built around an online interview with a Progent cybersecurity expert skilled in ransomware defense and recovery. During this assessment Progent will collaborate directly with your Campinas network management staff to collect pertinent information about your cybersecurity profile and backup processes. Progent will use this data to produce a Basic Security and Best Practices Report documenting how to apply best practices for configuring and managing your security and backup systems to block or clean up after a crypto-ransomware attack.

Progent's Basic Security and Best Practices Assessment highlights vital areas related to crypto-ransomware prevention and restoration recovery. The review addresses:

Security

• Proper allocation and use of admin accounts
• Correct NTFS and SMB permissions
• Proper firewall settings
• Secure Remote Desktop Protocol (RDP) configuration
• Advice about AntiVirus (AV) filtering selection and configuration

• Split permission model for backup integrity
• Backing up key servers such as AD
• Geographically dispersed backups including cloud backup to Azure

About Ransomware
Ransomware is a form of malware that encrypts or deletes a victim's files so they are unusable or are made publicly available. Ransomware often locks the target's computer. To prevent the carnage, the victim is required to pay a specified ransom, typically via a crypto currency like Bitcoin, within a short time window. It is not guaranteed that paying the ransom will restore the damaged data or prevent its publication. Files can be encrypted or deleted throughout a network based on the victim's write permissions, and you cannot solve the strong encryption algorithms used on the compromised files. A typical ransomware delivery package is spoofed email, whereby the user is tricked into interacting with by means of a social engineering technique known as spear phishing. This causes the email message to look as though it came from a familiar source. Another common vulnerability is an improperly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the damage attributed to by different versions of ransomware is estimated at billions of dollars annually, roughly doubling every other year. Famous attacks are WannaCry, and NotPetya. Current high-profile threats like Ryuk, Sodinokibi and Cerber are more elaborate and have caused more havoc than older versions. Even if your backup/recovery procedures permit your business to restore your encrypted files, you can still be hurt by exfiltration, where ransomed data are exposed to the public (known as "doxxing"). Because new versions of ransomware crop up daily, there is no certainty that traditional signature-based anti-virus tools will block a new attack. If threat does appear in an email, it is critical that your users have learned to be aware of social engineering techniques. Your last line of protection is a solid scheme for performing and keeping offsite backups plus the use of reliable recovery platforms.

Contact Progent About the ProSight Ransomware Susceptibility Consultation in Campinas
For pricing details and to find out more about how Progent's ProSight Ransomware Preparedness Consultation can enhance your protection against ransomware in Campinas, call Progent at 800-462-8800 or see Contact Progent.