Centennial Ransomware Filtering and Recovery Expertise

Ransomware has been weaponized by cyber extortionists and bad-actor governments, posing a potentially lethal risk to companies that fall victim. Modern variations of crypto-ransomware target all vulnerable resources, including online backup, making even partial recovery a complex and costly process. New strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, LockBit and Egregor have emerged, displacing Locky, Spora, and NotPetya in prominence, sophistication, and destructive impact.

Most ransomware breaches are the result of innocent-looking emails that have dangerous hyperlinks or attachments, and a high percentage are "zero-day" variants that elude detection by legacy signature-based antivirus filters. Although user education and frontline identification are important to defend against ransomware attacks, best practices demand that you assume some malware will inevitably get through and that you put in place a strong backup solution that allows you to restore files and services quickly with minimal losses.

Progent's ProSight Ransomware Preparedness Assessment is a low-cost service centered around an online interview with a Progent cybersecurity consultant experienced in ransomware defense and repair. During this interview Progent will work with your Centennial network managers to collect pertinent data concerning your cybersecurity profile and backup environment. Progent will use this data to produce a Basic Security and Best Practices Report documenting how to apply leading practices for configuring and administering your cybersecurity and backup solution to prevent or recover from a ransomware attack.

Progent's Basic Security and Best Practices Assessment focuses on key areas related to crypto-ransomware prevention and restoration recovery. The review addresses:

Security

• Correct use of administration accounts
• Correct NTFS (New Technology File System) and SMB permissions
• Proper firewall configuration
• Safe Remote Desktop Protocol (RDP) configuration
• Advice about AntiVirus tools identification and deployment

• Split permission architecture for backup protection
• Backing up required servers such as Active Directory
• Offsite backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malware that encrypts or steals a victim's files so they cannot be used or are publicized. Crypto-ransomware sometimes locks the target's computer. To avoid the carnage, the target is required to pay a certain amount of money (the ransom), usually in the form of a crypto currency like Bitcoin, within a brief period of time. It is never certain that paying the ransom will recover the damaged files or prevent its publication. Files can be altered or erased throughout a network based on the target's write permissions, and you cannot reverse engineer the military-grade encryption algorithms used on the compromised files. A common ransomware delivery package is tainted email, whereby the target is tricked into responding to by a social engineering exploit known as spear phishing. This makes the email message to look as though it came from a familiar source. Another popular vulnerability is an improperly protected Remote Desktop Protocol port.

CryptoLocker ushered in the modern era of ransomware in 2013, and the damage attributed to by the many strains of ransomware is estimated at billions of dollars per year, more than doubling every other year. Notorious attacks are Locky, and Petya. Current headline threats like Ryuk, Maze and CryptoWall are more sophisticated and have caused more havoc than older versions. Even if your backup/recovery processes permit your business to restore your encrypted data, you can still be hurt by so-called exfiltration, where ransomed data are made public (known as "doxxing"). Because additional versions of ransomware crop up daily, there is no guarantee that traditional signature-matching anti-virus tools will block the latest malware. If threat does appear in an email, it is critical that your end users have learned to identify phishing techniques. Your last line of defense is a sound scheme for scheduling and keeping offsite backups and the use of reliable recovery tools.

Ask Progent About the ProSight Crypto-Ransomware Readiness Checkup in Centennial
For pricing details and to learn more about how Progent's ProSight Ransomware Readiness Evaluation can bolster your protection against crypto-ransomware in Centennial, phone Progent at 800-462-8800 or see Contact Progent.