Curitiba Ransomware Protection and Cleanup Expertise

Ransomware has become the weapon of choice for cyber extortionists and malicious states, posing a potentially existential risk to businesses that fall victim. The latest versions of crypto-ransomware go after all vulnerable resources, including online backup, making even selective recovery a challenging and expensive process. New versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Snatch and Nephilim have emerged, replacing WannaCry, Cerber, and Petya in notoriety, sophistication, and destructiveness.

90% of crypto-ransomware breaches are caused by innocent-seeming emails that include malicious links or file attachments, and many are so-called "zero-day" attacks that elude the defenses of legacy signature-matching antivirus (AV) tools. While user education and frontline identification are critical to defend against ransomware attacks, leading practices dictate that you take for granted some malware will inevitably get through and that you prepare a solid backup solution that allows you to recover rapidly with little if any damage.

Progent's ProSight Ransomware Preparedness Report is a low-cost service centered around an online interview with a Progent security expert experienced in ransomware defense and recovery. In the course of this assessment Progent will collaborate with your Curitiba network managers to collect pertinent data concerning your cybersecurity configuration and backup processes. Progent will use this data to create a Basic Security and Best Practices Assessment documenting how to apply best practices for implementing and managing your cybersecurity and backup solution to prevent or recover from a ransomware assault.

Progent's Basic Security and Best Practices Assessment highlights vital issues associated with ransomware defense and restoration recovery. The review covers:

Cybersecurity

• Correct allocation and use of admin accounts
• Correct NTFS and SMB (Server Message Block) permissions
• Proper firewall configuration
• Secure RDP access
• Guidance for AntiVirus (AV) filtering identification and configuration

• Split permission model for backup protection
• Backing up critical servers such as AD
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malicious software that encrypts or deletes a victim's files so they are unusable or are made publicly available. Ransomware often locks the target's computer. To prevent the carnage, the target is asked to pay a specified ransom, typically via a crypto currency such as Bitcoin, within a short time window. It is never certain that paying the extortion price will recover the lost data or avoid its exposure to the public. Files can be encrypted or deleted throughout a network depending on the victim's write permissions, and you cannot break the military-grade encryption technologies used on the compromised files. A common ransomware attack vector is tainted email, whereby the target is tricked into interacting with by means of a social engineering exploit called spear phishing. This causes the email message to look as though it came from a trusted sender. Another common vulnerability is an improperly protected Remote Desktop Protocol (RDP) port.

CryptoLocker ushered in the modern era of ransomware in 2013, and the damage caused by the many strains of ransomware is estimated at billions of dollars annually, roughly doubling every two years. Notorious attacks include Locky, and NotPetya. Recent high-profile variants like Ryuk, DoppelPaymer and Cerber are more complex and have wreaked more havoc than older versions. Even if your backup/recovery processes permit you to restore your encrypted files, you can still be threatened by exfiltration, where stolen documents are made public (known as "doxxing"). Because new versions of ransomware are launched every day, there is no guarantee that traditional signature-based anti-virus tools will block a new attack. If an attack does appear in an email, it is important that your users have learned to identify social engineering techniques. Your ultimate protection is a sound scheme for scheduling and keeping offsite backups and the use of reliable restoration platforms.

Contact Progent About the ProSight Ransomware Readiness Consultation in Curitiba
For pricing information and to find out more about how Progent's ProSight Ransomware Vulnerability Assessment can enhance your defense against crypto-ransomware in Curitiba, phone Progent at 800-462-8800 or visit Contact Progent.