Durham Ransomware Prevention and Remediation Solutions

Ransomware has been weaponized by cyber extortionists and rogue governments, representing a possibly existential threat to businesses that fall victim. Modern variations of ransomware go after everything, including online backup, making even selective restoration a challenging and expensive exercise. New strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Conti and Nephilim have emerged, displacing Locky, Cerber, and CryptoWall in prominence, sophistication, and destructiveness.

Most ransomware penetrations are the result of innocuous-seeming emails with dangerous hyperlinks or attachments, and a high percentage are "zero-day" attacks that can escape detection by legacy signature-matching antivirus (AV) filters. Although user training and frontline detection are important to defend your network against ransomware attacks, best practices demand that you expect that some malware will inevitably get through and that you implement a strong backup solution that permits you to repair the damage rapidly with little if any damage.

Progent's ProSight Ransomware Preparedness Report is an ultra-affordable service built around an online interview with a Progent cybersecurity consultant skilled in ransomware defense and repair. In the course of this interview Progent will collaborate directly with your Durham IT managers to gather pertinent information about your security configuration and backup environment. Progent will utilize this data to create a Basic Security and Best Practices Report detailing how to adhere to best practices for implementing and managing your cybersecurity and backup systems to block or recover from a ransomware attack.

Progent's Basic Security and Best Practices Assessment focuses on key issues related to crypto-ransomware prevention and restoration recovery. The report covers:

Security

• Correct use of administration accounts
• Assigning NTFS (New Technology File System) and SMB (Server Message Block) authorizations
• Proper firewall configuration
• Safe RDP connections
• Guidance for AntiVirus (AV) filtering selection and configuration

• Split permission model for backup protection
• Protecting key servers including AD
• Offsite backups with cloud backup to Azure

About Ransomware
Ransomware is a form of malicious software that encrypts or steals files so they cannot be used or are made publicly available. Ransomware often locks the victim's computer. To avoid the carnage, the target is asked to send a certain amount of money, usually via a crypto currency such as Bitcoin, within a brief period of time. It is never certain that paying the extortion price will restore the damaged data or prevent its exposure to the public. Files can be altered or erased throughout a network depending on the target's write permissions, and you cannot solve the military-grade encryption algorithms used on the hostage files. A common ransomware delivery package is tainted email, in which the user is tricked into interacting with by means of a social engineering technique known as spear phishing. This makes the email message to look as though it came from a trusted source. Another popular vulnerability is an improperly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker opened the new age of ransomware in 2013, and the monetary losses caused by different strains of ransomware is estimated at billions of dollars annually, more than doubling every two years. Famous examples are Locky, and Petya. Recent headline threats like Ryuk, Maze and TeslaCrypt are more complex and have wreaked more havoc than earlier versions. Even if your backup procedures permit your business to restore your ransomed data, you can still be hurt by exfiltration, where stolen documents are made public (known as "doxxing"). Because additional versions of ransomware crop up every day, there is no certainty that traditional signature-based anti-virus tools will detect the latest malware. If an attack does appear in an email, it is critical that your end users have been taught to be aware of social engineering techniques. Your last line of defense is a solid scheme for scheduling and keeping offsite backups and the use of reliable recovery platforms.

Contact Progent About the ProSight Crypto-Ransomware Preparedness Checkup in Durham
For pricing information and to find out more about how Progent's ProSight Crypto-Ransomware Readiness Assessment can enhance your defense against ransomware in Durham, phone Progent at 800-462-8800 or see Contact Progent.