Ransomware Protection and Recovery Services

Ransomware has become the weapon of choice for cyber extortionists and rogue governments, representing a potentially existential risk to businesses that are breached. The latest strains of ransomware target all vulnerable resources, including backup, making even partial restoration a challenging and costly process. Novel variations of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, DopplePaymer, LockBit and Egregor have emerged, replacing Locky, Cerber, and CryptoWall in notoriety, sophistication, and destructive impact.

90% of crypto-ransomware infections are the result of innocent-seeming emails that have dangerous hyperlinks or attachments, and many are "zero-day" attacks that elude the defenses of traditional signature-based antivirus filters. While user training and frontline identification are critical to defend against ransomware, leading practices demand that you assume some malware will eventually succeed and that you put in place a solid backup mechanism that allows you to restore files and services rapidly with little if any losses.

Progent's ProSight Ransomware Vulnerability Assessment is an ultra-affordable service built around an online interview with a Progent security expert skilled in ransomware protection and repair. During this assessment Progent will cooperate directly with your IT staff to collect critical data concerning your security configuration and backup environment. Progent will utilize this information to create a Basic Security and Best Practices Assessment documenting how to adhere to best practices for implementing and managing your cybersecurity and backup solution to prevent or recover from a crypto-ransomware attack.

Progent's Basic Security and Best Practices Assessment highlights vital areas related to ransomware prevention and restoration recovery. The report addresses:

Security

• Proper allocation and use of admin accounts
• Assigning NTFS (New Technology File System) and SMB (Server Message Block) permissions
• Proper firewall setup
• Safe RDP connections
• Advice about AntiVirus (AV) tools identification and deployment

• Split permission model for backup integrity
• Protecting required servers such as Active Directory
• Geographically dispersed backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a form of malware that encrypts or steals files so they are unusable or are made publicly available. Ransomware sometimes locks the target's computer. To prevent the carnage, the victim is asked to pay a specified amount of money, usually via a crypto currency such as Bitcoin, within a brief time window. There is no guarantee that paying the extortion price will restore the damaged files or avoid its exposure to the public. Files can be encrypted or deleted throughout a network depending on the victim's write permissions, and you cannot reverse engineer the military-grade encryption algorithms used on the compromised files. A typical ransomware delivery package is spoofed email, whereby the user is tricked into interacting with by a social engineering technique known as spear phishing. This causes the email message to look as though it came from a trusted sender. Another popular vulnerability is an improperly secured Remote Desktop Protocol (RDP) port.

CryptoLocker opened the new age of crypto-ransomware in 2013, and the damage attributed to by different strains of ransomware is said to be billions of dollars per year, roughly doubling every two years. Famous attacks are Locky, and NotPetya. Recent headline variants like Ryuk, Sodinokibi and Cerber are more sophisticated and have caused more havoc than earlier versions. Even if your backup/recovery procedures permit you to recover your ransomed files, you can still be hurt by so-called exfiltration, where ransomed data are exposed to the public (known as "doxxing"). Because additional versions of ransomware are launched every day, there is no guarantee that traditional signature-based anti-virus tools will block the latest malware. If threat does show up in an email, it is important that your users have been taught to identify social engineering techniques. Your last line of protection is a solid scheme for scheduling and keeping offsite backups and the deployment of reliable recovery platforms.

Contact Progent About the ProSight Ransomware Vulnerability Report
For pricing information and to learn more about how Progent's ProSight Ransomware Preparedness Assessment can bolster your protection against crypto-ransomware, call Progent at 800-462-8800 or visit Contact Progent.