Chesapeake Ransomware Defense and Removal Consulting

Ransomware has become the weapon of choice for cybercriminals and rogue governments, representing a potentially lethal risk to companies that are victimized. The latest strains of ransomware target everything, including backup, making even partial recovery a complex and costly process. New versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, LockBit and Egregor have emerged, displacing WannaCry, TeslaCrypt, and CryptoWall in notoriety, sophistication, and destructiveness.

90% of ransomware infections come from innocent-seeming emails with dangerous hyperlinks or attachments, and a high percentage are so-called "zero-day" variants that elude the defenses of legacy signature-matching antivirus (AV) tools. While user training and frontline detection are important to protect against ransomware, leading practices dictate that you expect that some attacks will eventually succeed and that you implement a strong backup solution that enables you to recover rapidly with minimal damage.

Progent's ProSight Ransomware Vulnerability Report is an ultra-affordable service centered around an online discussion with a Progent security consultant skilled in ransomware defense and repair. During this interview Progent will cooperate directly with your Chesapeake network management staff to gather pertinent data concerning your security posture and backup processes. Progent will use this data to generate a Basic Security and Best Practices Report documenting how to apply best practices for implementing and managing your cybersecurity and backup solution to block or recover from a ransomware assault.

Progent's Basic Security and Best Practices Assessment highlights key areas related to crypto-ransomware prevention and restoration recovery. The review addresses:

Cybersecurity

• Proper allocation and use of administration accounts
• Appropriate NTFS (New Technology File System) and SMB permissions
• Optimal firewall settings
• Safe RDP configuration
• Advice about AntiVirus (AV) tools selection and configuration

• Split permission model for backup integrity
• Backing up required servers such as AD
• Geographically dispersed backups with cloud backup to Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or steals files so they cannot be used or are made publicly available. Crypto-ransomware often locks the target's computer. To avoid the carnage, the victim is required to send a certain ransom, typically via a crypto currency such as Bitcoin, within a short time window. There is no guarantee that delivering the ransom will recover the lost data or avoid its exposure to the public. Files can be altered or deleted throughout a network based on the target's write permissions, and you cannot solve the strong encryption algorithms used on the hostage files. A common ransomware delivery package is booby-trapped email, whereby the user is tricked into responding to by means of a social engineering technique called spear phishing. This makes the email to look as though it came from a trusted sender. Another common attack vector is an improperly protected Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses caused by different versions of ransomware is estimated at billions of dollars annually, roughly doubling every two years. Notorious attacks are Locky, and Petya. Recent headline variants like Ryuk, DoppelPaymer and Cerber are more complex and have wreaked more havoc than older versions. Even if your backup/recovery processes enable you to recover your ransomed files, you can still be threatened by so-called exfiltration, where ransomed data are made public (known as "doxxing"). Because additional versions of ransomware crop up daily, there is no certainty that traditional signature-matching anti-virus filters will block the latest attack. If an attack does appear in an email, it is important that your users have learned to identify social engineering techniques. Your last line of protection is a solid scheme for performing and keeping remote backups and the use of reliable recovery tools.

Contact Progent About the ProSight Ransomware Preparedness Report in Chesapeake
For pricing information and to learn more about how Progent's ProSight Ransomware Readiness Audit can enhance your defense against ransomware in Chesapeake, call Progent at 800-462-8800 or visit Contact Progent.