Brighton Ransomware Prevention and Restoration Expertise

Ransomware has been weaponized by cyber extortionists and bad-actor governments, representing a possibly existential threat to companies that fall victim. Current versions of crypto-ransomware target everything, including backup, making even selective restoration a complex and expensive exercise. Novel strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Conti and Egregor have emerged, replacing WannaCry, Spora, and Petya in prominence, elaborateness, and destructive impact.

Most crypto-ransomware breaches come from innocuous-seeming emails with malicious links or attachments, and many are so-called "zero-day" variants that elude the defenses of legacy signature-based antivirus tools. Although user training and frontline detection are critical to defend against ransomware attacks, leading practices demand that you take for granted some malware will inevitably get through and that you prepare a solid backup mechanism that allows you to restore files and services rapidly with little if any losses.

Progent's ProSight Ransomware Preparedness Report is a low-cost service centered around an online interview with a Progent cybersecurity expert experienced in ransomware defense and recovery. In the course of this assessment Progent will collaborate directly with your Brighton network managers to collect pertinent data about your cybersecurity configuration and backup environment. Progent will utilize this information to create a Basic Security and Best Practices Report documenting how to follow best practices for configuring and administering your cybersecurity and backup systems to block or clean up after a ransomware assault.

Progent's Basic Security and Best Practices Report highlights vital issues related to crypto-ransomware prevention and restoration recovery. The review addresses:

Cybersecurity

• Proper use of administration accounts
• Correct NTFS and SMB (Server Message Block) authorizations
• Optimal firewall settings
• Secure Remote Desktop Protocol configuration
• Recommend AntiVirus (AV) filtering identification and deployment

• Split permission model for backup integrity
• Protecting key servers including AD
• Geographically dispersed backups with cloud backup to Azure

About Ransomware
Ransomware is a form of malicious software that encrypts or steals files so they cannot be used or are made publicly available. Ransomware often locks the victim's computer. To avoid the carnage, the victim is required to send a certain amount of money, usually in the form of a crypto currency such as Bitcoin, within a short period of time. It is not guaranteed that paying the extortion price will recover the damaged data or avoid its exposure to the public. Files can be altered or erased throughout a network based on the target's write permissions, and you cannot break the military-grade encryption algorithms used on the hostage files. A typical ransomware attack vector is tainted email, whereby the victim is tricked into responding to by means of a social engineering technique known as spear phishing. This causes the email message to look as though it came from a familiar source. Another popular vulnerability is an improperly protected Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the modern era of ransomware in 2013, and the monetary losses attributed to by the many versions of ransomware is said to be billions of dollars annually, roughly doubling every other year. Famous examples include Locky, and Petya. Current high-profile variants like Ryuk, Sodinokibi and Cerber are more elaborate and have wreaked more damage than earlier versions. Even if your backup/recovery processes permit you to restore your ransomed files, you can still be hurt by so-called exfiltration, where ransomed data are exposed to the public (known as "doxxing"). Because additional versions of ransomware crop up every day, there is no guarantee that conventional signature-based anti-virus filters will block the latest attack. If an attack does appear in an email, it is critical that your users have been taught to identify phishing techniques. Your last line of protection is a sound scheme for scheduling and keeping offsite backups and the deployment of dependable restoration platforms.

Ask Progent About the ProSight Crypto-Ransomware Preparedness Consultation in Brighton
For pricing details and to learn more about how Progent's ProSight Ransomware Preparedness Report can enhance your defense against crypto-ransomware in Brighton, phone Progent at 800-462-8800 or see Contact Progent.