Alexandria Ransomware Protection and Remediation Consulting

Ransomware has been weaponized by cyber extortionists and malicious governments, representing a potentially existential risk to businesses that are breached. Current strains of ransomware target all vulnerable resources, including backup, making even selective recovery a long and expensive process. Novel variations of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Phobos, Snatch and Egregor have emerged, replacing WannaCry, Cerber, and Petya in prominence, sophistication, and destructive impact.

90% of crypto-ransomware breaches are caused by innocuous-seeming emails that have malicious hyperlinks or file attachments, and a high percentage are "zero-day" strains that can escape the defenses of legacy signature-matching antivirus (AV) tools. While user education and frontline detection are important to defend your network against ransomware attacks, best practices demand that you take for granted some attacks will eventually succeed and that you prepare a strong backup mechanism that permits you to repair the damage rapidly with minimal losses.

Progent's ProSight Ransomware Vulnerability Report is a low-cost service built around an online interview with a Progent cybersecurity expert skilled in ransomware protection and recovery. During this interview Progent will work with your Alexandria IT management staff to collect pertinent information concerning your cybersecurity posture and backup processes. Progent will use this information to create a Basic Security and Best Practices Report documenting how to follow leading practices for configuring and managing your security and backup systems to prevent or recover from a crypto-ransomware assault.

Progent's Basic Security and Best Practices Report highlights vital issues associated with ransomware defense and restoration recovery. The report addresses:

Security

• Effective allocation and use of administration accounts
• Assigning NTFS (New Technology File System) and SMB authorizations
• Optimal firewall settings
• Safe Remote Desktop Protocol connections
• Advice about AntiVirus filtering identification and configuration

• Split permission model for backup integrity
• Backing up key servers such as AD
• Offsite backups with cloud backup to Azure

About Ransomware
Ransomware is a form of malicious software that encrypts or steals files so they cannot be used or are made publicly available. Ransomware often locks the target's computer. To prevent the damage, the victim is required to pay a specified amount of money, usually via a crypto currency like Bitcoin, within a short period of time. It is never certain that paying the extortion price will recover the damaged data or avoid its publication. Files can be altered or deleted across a network depending on the victim's write permissions, and you cannot break the military-grade encryption algorithms used on the hostage files. A common ransomware attack vector is booby-trapped email, whereby the target is lured into interacting with by means of a social engineering technique known as spear phishing. This causes the email message to look as though it came from a trusted source. Another popular vulnerability is a poorly protected Remote Desktop Protocol (RDP) port.

CryptoLocker opened the new age of ransomware in 2013, and the damage attributed to by different versions of ransomware is estimated at billions of dollars annually, more than doubling every two years. Notorious attacks are Locky, and Petya. Recent headline variants like Ryuk, DoppelPaymer and CryptoWall are more elaborate and have wreaked more damage than older strains. Even if your backup/recovery processes permit your business to recover your encrypted data, you can still be threatened by exfiltration, where ransomed documents are exposed to the public (known as "doxxing"). Because additional variants of ransomware crop up every day, there is no certainty that conventional signature-based anti-virus filters will block the latest malware. If threat does appear in an email, it is critical that your users have learned to be aware of social engineering techniques. Your ultimate protection is a sound process for performing and keeping offsite backups plus the use of dependable recovery platforms.

Ask Progent About the ProSight Crypto-Ransomware Preparedness Review in Alexandria
For pricing information and to find out more about how Progent's ProSight Ransomware Vulnerability Audit can bolster your protection against crypto-ransomware in Alexandria, call Progent at 800-462-8800 or visit Contact Progent.