Cincinnati Ransomware Filtering and Recovery Consulting

Ransomware has been weaponized by cyber extortionists and bad-actor governments, representing a possibly existential risk to companies that fall victim. The latest versions of crypto-ransomware target everything, including backup, making even partial restoration a long and expensive exercise. New strains of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Conti and Egregor have emerged, replacing WannaCry, Spora, and NotPetya in notoriety, sophistication, and destructiveness.

Most ransomware infections are the result of innocuous-seeming emails that include dangerous links or file attachments, and a high percentage are so-called "zero-day" attacks that elude the defenses of legacy signature-matching antivirus (AV) filters. Although user training and frontline identification are important to protect your network against ransomware attacks, best practices dictate that you expect that some attacks will eventually succeed and that you put in place a solid backup mechanism that enables you to recover rapidly with minimal losses.

Progent's ProSight Ransomware Preparedness Assessment is a low-cost service centered around a remote discussion with a Progent cybersecurity consultant skilled in ransomware protection and repair. In the course of this interview Progent will work directly with your Cincinnati network managers to gather pertinent information about your security configuration and backup processes. Progent will utilize this information to generate a Basic Security and Best Practices Assessment documenting how to apply best practices for configuring and administering your security and backup systems to block or clean up after a crypto-ransomware assault.

Progent's Basic Security and Best Practices Assessment focuses on key issues associated with crypto-ransomware prevention and restoration recovery. The report covers:

Cybersecurity

• Effective use of admin accounts
• Correct NTFS (New Technology File System) and SMB permissions
• Optimal firewall settings
• Safe Remote Desktop Protocol connections
• Advice about AntiVirus filtering identification and deployment

• Split permission architecture for backup integrity
• Backing up critical servers such as Active Directory
• Offsite backups with cloud backup to Azure

About Ransomware
Ransomware is a type of malware that encrypts or deletes files so they cannot be used or are made publicly available. Ransomware sometimes locks the target's computer. To avoid the carnage, the victim is required to pay a specified amount of money (the ransom), typically via a crypto currency such as Bitcoin, within a short time window. It is never certain that delivering the ransom will restore the damaged files or avoid its exposure to the public. Files can be altered or deleted across a network based on the victim's write permissions, and you cannot reverse engineer the strong encryption technologies used on the compromised files. A typical ransomware attack vector is booby-trapped email, whereby the user is tricked into interacting with by means of a social engineering technique known as spear phishing. This makes the email message to look as though it came from a familiar sender. Another common vulnerability is a poorly secured RDP port.

CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses attributed to by the many versions of ransomware is said to be billions of dollars annually, more than doubling every other year. Notorious examples are WannaCry, and Petya. Current headline threats like Ryuk, Sodinokibi and Spora are more complex and have caused more damage than earlier versions. Even if your backup/recovery procedures allow you to restore your ransomed files, you can still be hurt by so-called exfiltration, where ransomed data are exposed to the public. Because additional variants of ransomware are launched daily, there is no guarantee that traditional signature-matching anti-virus filters will block the latest malware. If an attack does appear in an email, it is important that your users have learned to identify social engineering techniques. Your last line of protection is a solid scheme for scheduling and retaining offsite backups plus the use of reliable restoration tools.

Ask Progent About the ProSight Ransomware Preparedness Evaluation in Cincinnati
For pricing information and to find out more about how Progent's ProSight Ransomware Readiness Assessment can enhance your defense against crypto-ransomware in Cincinnati, call Progent at 800-462-8800 or visit Contact Progent.