Guarulhos Ransomware Filtering and Restoration Expertise

Ransomware has been weaponized by the major cyber-crime organizations and bad-actor states, representing a possibly lethal risk to businesses that are successfully attacked. The latest versions of crypto-ransomware go after everything, including backup, making even selective recovery a long and expensive process. New variations of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, LockBit and Nephilim have emerged, replacing Locky, Cerber, and NotPetya in notoriety, elaborateness, and destructive impact.

90% of ransomware infections come from innocent-looking emails with malicious hyperlinks or file attachments, and many are so-called "zero-day" strains that can escape the defenses of legacy signature-matching antivirus (AV) tools. Although user training and frontline detection are critical to protect your network against ransomware, best practices dictate that you expect that some malware will inevitably get through and that you deploy a solid backup solution that allows you to restore files and services rapidly with little if any losses.

Progent's ProSight Ransomware Vulnerability Assessment is a low-cost service centered around a remote interview with a Progent cybersecurity consultant experienced in ransomware defense and repair. In the course of this interview Progent will cooperate with your Guarulhos network managers to gather critical data about your security setup and backup environment. Progent will use this data to produce a Basic Security and Best Practices Report detailing how to follow best practices for implementing and managing your security and backup systems to block or clean up after a ransomware assault.

Progent's Basic Security and Best Practices Report focuses on vital issues related to ransomware defense and restoration recovery. The review addresses:

Security

• Effective allocation and use of admin accounts
• Appropriate NTFS (New Technology File System) and SMB (Server Message Block) permissions
• Optimal firewall setup
• Safe RDP connections
• Recommend AntiVirus tools selection and configuration

• Split permission model for backup integrity
• Backing up key servers including Active Directory
• Geographically dispersed backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a variety of malicious software that encrypts or deletes files so they cannot be used or are made publicly available. Ransomware often locks the target's computer. To avoid the carnage, the victim is asked to send a specified amount of money (the ransom), usually in the form of a crypto currency such as Bitcoin, within a brief period of time. There is no guarantee that delivering the extortion price will recover the lost files or avoid its exposure to the public. Files can be altered or erased throughout a network based on the target's write permissions, and you cannot solve the military-grade encryption technologies used on the compromised files. A common ransomware delivery package is tainted email, whereby the user is lured into responding to by a social engineering technique called spear phishing. This causes the email message to look as though it came from a trusted sender. Another common attack vector is an improperly secured RDP port.

CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the damage attributed to by the many strains of ransomware is estimated at billions of dollars per year, roughly doubling every other year. Famous examples are Locky, and Petya. Recent headline variants like Ryuk, DoppelPaymer and TeslaCrypt are more complex and have wreaked more damage than earlier versions. Even if your backup/recovery procedures allow you to recover your encrypted files, you can still be threatened by exfiltration, where stolen documents are made public (known as "doxxing"). Because additional versions of ransomware are launched every day, there is no guarantee that traditional signature-matching anti-virus filters will block the latest malware. If an attack does show up in an email, it is critical that your end users have learned to identify phishing tricks. Your ultimate defense is a solid process for performing and retaining remote backups plus the use of dependable restoration platforms.

Ask Progent About the ProSight Crypto-Ransomware Susceptibility Checkup in Guarulhos
For pricing details and to learn more about how Progent's ProSight Crypto-Ransomware Vulnerability Review can enhance your defense against crypto-ransomware in Guarulhos, phone Progent at 800-462-8800 or see Contact Progent.