Jundiaí Ransomware Defense and Recovery Consulting

Ransomware has been widely adopted by cybercriminals and malicious states, representing a potentially lethal threat to companies that are successfully attacked. Modern strains of crypto-ransomware target all vulnerable resources, including backup, making even partial restoration a long and costly process. New versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, DopplePaymer, Conti and Nephilim have emerged, displacing Locky, Cerber, and NotPetya in prominence, sophistication, and destructive impact.

Most crypto-ransomware breaches come from innocuous-seeming emails that include malicious links or file attachments, and many are "zero-day" strains that can escape detection by traditional signature-matching antivirus (AV) filters. Although user training and frontline detection are critical to protect against ransomware, best practices dictate that you assume some malware will inevitably get through and that you put in place a solid backup solution that enables you to recover rapidly with little if any losses.

Progent's ProSight Ransomware Vulnerability Report is a low-cost service centered around an online interview with a Progent security consultant skilled in ransomware protection and recovery. In the course of this interview Progent will cooperate directly with your Jundiaí network management staff to collect critical data about your cybersecurity configuration and backup environment. Progent will use this data to produce a Basic Security and Best Practices Report detailing how to adhere to best practices for implementing and managing your cybersecurity and backup systems to prevent or clean up after a crypto-ransomware attack.

Progent's Basic Security and Best Practices Assessment focuses on vital issues related to ransomware prevention and restoration recovery. The review covers:

Cybersecurity

• Effective allocation and use of admin accounts
• Appropriate NTFS and SMB (Server Message Block) permissions
• Optimal firewall settings
• Safe Remote Desktop Protocol connections
• Guidance for AntiVirus filtering selection and deployment

• Split permission architecture for backup protection
• Protecting required servers such as AD
• Geographically dispersed backups with cloud backup to Azure

About Ransomware
Ransomware is a type of malware that encrypts or deletes files so they are unusable or are publicized. Ransomware sometimes locks the target's computer. To avoid the carnage, the victim is required to pay a specified amount of money (the ransom), typically in the form of a crypto currency such as Bitcoin, within a short period of time. There is no guarantee that delivering the extortion price will recover the lost files or prevent its exposure to the public. Files can be altered or erased across a network depending on the target's write permissions, and you cannot break the strong encryption algorithms used on the compromised files. A common ransomware attack vector is booby-trapped email, in which the user is lured into responding to by means of a social engineering technique called spear phishing. This causes the email message to look as though it came from a familiar sender. Another popular attack vector is an improperly secured Remote Desktop Protocol (RDP) port.

CryptoLocker opened the new age of ransomware in 2013, and the monetary losses caused by different strains of ransomware is said to be billions of dollars per year, roughly doubling every other year. Famous attacks include WannaCry, and Petya. Recent headline threats like Ryuk, Sodinokibi and Spora are more sophisticated and have caused more damage than older versions. Even if your backup/recovery processes allow you to restore your ransomed files, you can still be threatened by so-called exfiltration, where ransomed documents are made public. Because additional versions of ransomware crop up every day, there is no certainty that traditional signature-based anti-virus filters will block a new attack. If threat does show up in an email, it is important that your users have been taught to be aware of phishing techniques. Your ultimate protection is a solid scheme for performing and keeping offsite backups and the use of dependable recovery platforms.

Ask Progent About the ProSight Crypto-Ransomware Susceptibility Assessment in Jundiaí
For pricing information and to find out more about how Progent's ProSight Ransomware Preparedness Assessment can bolster your defense against crypto-ransomware in Jundiaí, call Progent at 800-462-8800 or visit Contact Progent.