Lexington-Fayette Ransomware Protection and Cleanup Consulting

Ransomware has been widely adopted by cyber extortionists and rogue governments, representing a potentially existential threat to businesses that are successfully attacked. Current variations of ransomware target all vulnerable resources, including online backup, making even partial recovery a long and costly exercise. Novel versions of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, LockBit and Nephilim have emerged, replacing Locky, Spora, and Petya in notoriety, elaborateness, and destructive impact.

90% of ransomware breaches are the result of innocuous-seeming emails with dangerous links or attachments, and many are so-called "zero-day" attacks that elude the defenses of traditional signature-based antivirus filters. While user training and frontline identification are critical to protect against ransomware, best practices dictate that you expect that some malware will inevitably succeed and that you prepare a strong backup solution that permits you to restore files and services rapidly with minimal damage.

Progent's ProSight Ransomware Preparedness Report is an ultra-affordable service built around an online discussion with a Progent cybersecurity expert experienced in ransomware defense and repair. During this assessment Progent will work directly with your Lexington-Fayette network managers to gather critical information concerning your security setup and backup processes. Progent will use this data to create a Basic Security and Best Practices Report detailing how to adhere to best practices for configuring and managing your security and backup systems to block or recover from a crypto-ransomware assault.

Progent's Basic Security and Best Practices Assessment focuses on key areas associated with crypto-ransomware prevention and restoration recovery. The report addresses:

Cybersecurity

• Effective allocation and use of administration accounts
• Correct NTFS (New Technology File System) and SMB (Server Message Block) permissions
• Optimal firewall settings
• Secure Remote Desktop Protocol (RDP) connections
• Guidance for AntiVirus filtering identification and configuration

• Split permission model for backup protection
• Protecting critical servers such as AD
• Offsite backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malware that encrypts or deletes a victim's files so they are unusable or are made publicly available. Crypto-ransomware often locks the victim's computer. To prevent the damage, the target is required to send a certain ransom, usually in the form of a crypto currency such as Bitcoin, within a brief period of time. There is no guarantee that paying the extortion price will recover the lost files or avoid its exposure to the public. Files can be altered or erased throughout a network depending on the victim's write permissions, and you cannot break the strong encryption algorithms used on the hostage files. A common ransomware attack vector is tainted email, whereby the user is lured into responding to by a social engineering technique called spear phishing. This causes the email message to appear to come from a trusted source. Another popular attack vector is an improperly secured RDP port.

CryptoLocker ushered in the modern era of ransomware in 2013, and the monetary losses attributed to by the many versions of ransomware is estimated at billions of dollars annually, more than doubling every two years. Notorious examples include WannaCry, and Petya. Recent headline threats like Ryuk, Sodinokibi and Cerber are more complex and have wreaked more damage than earlier strains. Even if your backup/recovery processes allow your business to restore your ransomed files, you can still be hurt by so-called exfiltration, where stolen documents are made public (known as "doxxing"). Because new versions of ransomware crop up daily, there is no certainty that traditional signature-matching anti-virus filters will block the latest malware. If threat does show up in an email, it is critical that your end users have been taught to identify social engineering techniques. Your last line of protection is a solid scheme for scheduling and keeping offsite backups and the use of dependable recovery tools.

Ask Progent About the ProSight Ransomware Vulnerability Audit in Lexington-Fayette
For pricing information and to learn more about how Progent's ProSight Ransomware Preparedness Audit can bolster your defense against crypto-ransomware in Lexington-Fayette, phone Progent at 800-462-8800 or see Contact Progent.