Dayton Ransomware Filtering and Remediation Services

Ransomware has been weaponized by cybercriminals and malicious states, posing a potentially lethal risk to businesses that are successfully attacked. The latest variations of ransomware target everything, including backup, making even selective restoration a challenging and costly process. Novel strains of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, LockBit and Egregor have emerged, replacing WannaCry, Spora, and NotPetya in notoriety, sophistication, and destructive impact.

90% of crypto-ransomware infections are the result of innocuous-looking emails that include malicious links or file attachments, and a high percentage are so-called "zero-day" attacks that can escape detection by legacy signature-matching antivirus (AV) filters. While user training and frontline identification are important to protect against ransomware, best practices demand that you take for granted some attacks will eventually succeed and that you implement a solid backup solution that enables you to restore files and services quickly with little if any damage.

Progent's ProSight Ransomware Preparedness Checkup is a low-cost service built around an online discussion with a Progent cybersecurity consultant experienced in ransomware protection and recovery. In the course of this interview Progent will cooperate directly with your Dayton network management staff to collect pertinent information about your security configuration and backup environment. Progent will use this information to generate a Basic Security and Best Practices Report detailing how to apply leading practices for implementing and managing your cybersecurity and backup solution to prevent or recover from a ransomware attack.

Progent's Basic Security and Best Practices Assessment highlights vital issues related to crypto-ransomware defense and restoration recovery. The report covers:

Cybersecurity

• Correct allocation and use of administration accounts
• Assigning NTFS (New Technology File System) and SMB (Server Message Block) permissions
• Proper firewall configuration
• Safe Remote Desktop Protocol (RDP) connections
• Advice about AntiVirus filtering identification and deployment

• Split permission model for backup integrity
• Backing up required servers such as Active Directory
• Offsite backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a variety of malware that encrypts or deletes files so they are unusable or are made publicly available. Crypto-ransomware sometimes locks the victim's computer. To avoid the carnage, the victim is required to pay a specified amount of money, usually via a crypto currency such as Bitcoin, within a brief period of time. It is never certain that paying the extortion price will recover the damaged data or avoid its exposure to the public. Files can be altered or erased throughout a network based on the victim's write permissions, and you cannot reverse engineer the strong encryption technologies used on the hostage files. A typical ransomware attack vector is spoofed email, in which the target is lured into interacting with by a social engineering exploit known as spear phishing. This makes the email to appear to come from a trusted source. Another common attack vector is an improperly secured Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker opened the modern era of ransomware in 2013, and the monetary losses attributed to by different strains of ransomware is estimated at billions of dollars per year, roughly doubling every other year. Famous examples include Locky, and Petya. Current headline variants like Ryuk, DoppelPaymer and Cerber are more elaborate and have caused more damage than older versions. Even if your backup/recovery procedures allow your business to restore your encrypted files, you can still be threatened by exfiltration, where ransomed data are exposed to the public. Because new variants of ransomware are launched every day, there is no guarantee that conventional signature-matching anti-virus tools will detect a new malware. If an attack does show up in an email, it is important that your end users have been taught to identify social engineering tricks. Your last line of defense is a solid process for scheduling and retaining remote backups plus the use of dependable recovery tools.

Contact Progent About the ProSight Crypto-Ransomware Preparedness Testing in Dayton
For pricing details and to find out more about how Progent's ProSight Ransomware Preparedness Testing can bolster your defense against ransomware in Dayton, call Progent at 800-462-8800 or visit Contact Progent.