Chandler Ransomware Protection and Restoration Consulting

Ransomware has become the weapon of choice for cyber extortionists and rogue governments, representing a possibly lethal risk to companies that are successfully attacked. The latest strains of crypto-ransomware target all vulnerable resources, including backup, making even selective recovery a complex and expensive exercise. Novel versions of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, LockBit and Nephilim have emerged, displacing Locky, Spora, and NotPetya in notoriety, sophistication, and destructive impact.

90% of crypto-ransomware infections come from innocent-seeming emails that have malicious hyperlinks or attachments, and a high percentage are "zero-day" variants that can escape the defenses of traditional signature-matching antivirus filters. Although user training and frontline identification are important to defend your network against ransomware attacks, best practices demand that you take for granted some attacks will eventually succeed and that you implement a solid backup mechanism that allows you to restore files and services quickly with little if any damage.

Progent's ProSight Ransomware Vulnerability Assessment is an ultra-affordable service centered around a remote interview with a Progent security expert experienced in ransomware protection and recovery. During this assessment Progent will work with your Chandler IT management staff to gather pertinent data about your security setup and backup processes. Progent will use this data to produce a Basic Security and Best Practices Assessment detailing how to follow leading practices for configuring and administering your cybersecurity and backup systems to block or recover from a ransomware attack.

Progent's Basic Security and Best Practices Report highlights vital issues associated with crypto-ransomware prevention and restoration recovery. The report addresses:

Security

• Effective use of administration accounts
• Correct NTFS and SMB (Server Message Block) authorizations
• Optimal firewall setup
• Secure Remote Desktop Protocol (RDP) connections
• Guidance for AntiVirus (AV) filtering selection and deployment

• Split permission architecture for backup protection
• Protecting required servers including Active Directory
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malicious software that encrypts or steals a victim's files so they are unusable or are made publicly available. Ransomware often locks the victim's computer. To prevent the carnage, the victim is asked to pay a certain amount of money (the ransom), typically via a crypto currency such as Bitcoin, within a brief time window. It is never certain that paying the ransom will restore the damaged data or avoid its exposure to the public. Files can be altered or erased across a network depending on the victim's write permissions, and you cannot break the military-grade encryption algorithms used on the compromised files. A common ransomware delivery package is tainted email, in which the target is lured into responding to by a social engineering technique called spear phishing. This makes the email message to appear to come from a familiar sender. Another common attack vector is an improperly protected Remote Desktop Protocol (RDP) port.

CryptoLocker ushered in the new age of ransomware in 2013, and the monetary losses caused by different versions of ransomware is estimated at billions of dollars annually, roughly doubling every other year. Notorious attacks include Locky, and NotPetya. Current high-profile threats like Ryuk, Maze and Cerber are more elaborate and have caused more damage than earlier versions. Even if your backup procedures allow your business to restore your ransomed data, you can still be hurt by exfiltration, where stolen documents are exposed to the public. Because additional variants of ransomware crop up daily, there is no guarantee that traditional signature-based anti-virus tools will detect the latest attack. If an attack does show up in an email, it is important that your end users have been taught to be aware of phishing techniques. Your last line of defense is a sound process for performing and keeping offsite backups and the deployment of reliable recovery tools.

Contact Progent About the ProSight Crypto-Ransomware Vulnerability Report in Chandler
For pricing details and to find out more about how Progent's ProSight Ransomware Susceptibility Testing can enhance your defense against crypto-ransomware in Chandler, call Progent at 800-462-8800 or see Contact Progent.