Des Moines Ransomware Protection and Remediation Consulting

Ransomware has been weaponized by cyber extortionists and malicious governments, representing a potentially existential risk to businesses that are breached. Modern versions of ransomware go after all vulnerable resources, including online backup, making even partial restoration a challenging and costly process. New versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, DopplePaymer, LockBit and Nephilim have made the headlines, replacing Locky, Cerber, and Petya in prominence, elaborateness, and destructiveness.

90% of ransomware breaches are the result of innocuous-looking emails that have malicious hyperlinks or file attachments, and a high percentage are so-called "zero-day" variants that elude detection by legacy signature-based antivirus tools. While user education and up-front detection are critical to defend against ransomware attacks, best practices demand that you take for granted some malware will inevitably get through and that you put in place a strong backup solution that enables you to restore files and services rapidly with little if any losses.

Progent's ProSight Ransomware Preparedness Report is an ultra-affordable service built around a remote discussion with a Progent cybersecurity expert experienced in ransomware defense and repair. During this assessment Progent will work with your Des Moines network managers to collect critical information about your security setup and backup processes. Progent will utilize this information to create a Basic Security and Best Practices Report detailing how to follow best practices for implementing and managing your security and backup solution to prevent or recover from a crypto-ransomware attack.

Progent's Basic Security and Best Practices Report highlights vital areas related to crypto-ransomware prevention and restoration recovery. The review covers:

Security

• Correct use of administration accounts
• Assigning NTFS (New Technology File System) and SMB (Server Message Block) authorizations
• Proper firewall settings
• Secure Remote Desktop Protocol (RDP) access
• Advice about AntiVirus (AV) filtering identification and deployment

• Split permission model for backup integrity
• Protecting required servers such as Active Directory
• Geographically dispersed backups including cloud backup to Azure

About Ransomware
Ransomware is a type of malware that encrypts or deletes files so they are unusable or are publicized. Ransomware often locks the victim's computer. To prevent the carnage, the target is required to pay a certain amount of money (the ransom), usually in the form of a crypto currency such as Bitcoin, within a short period of time. There is no guarantee that paying the extortion price will restore the damaged data or prevent its publication. Files can be encrypted or deleted across a network depending on the target's write permissions, and you cannot reverse engineer the military-grade encryption technologies used on the compromised files. A typical ransomware attack vector is spoofed email, in which the user is lured into interacting with by a social engineering technique called spear phishing. This makes the email message to appear to come from a familiar source. Another common attack vector is an improperly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the new age of ransomware in 2013, and the damage attributed to by the many strains of ransomware is estimated at billions of dollars per year, roughly doubling every two years. Notorious attacks are Locky, and NotPetya. Recent high-profile variants like Ryuk, DoppelPaymer and TeslaCrypt are more elaborate and have caused more havoc than older strains. Even if your backup procedures allow your business to restore your ransomed files, you can still be threatened by so-called exfiltration, where stolen data are made public. Because new versions of ransomware are launched daily, there is no guarantee that conventional signature-based anti-virus filters will block a new malware. If an attack does appear in an email, it is important that your users have learned to identify phishing techniques. Your last line of protection is a sound process for performing and keeping offsite backups plus the use of dependable restoration platforms.

Ask Progent About the ProSight Crypto-Ransomware Readiness Assessment in Des Moines
For pricing information and to learn more about how Progent's ProSight Ransomware Readiness Testing can enhance your protection against crypto-ransomware in Des Moines, call Progent at 800-462-8800 or see Contact Progent.