Ottawa Ransomware Defense and Restoration Consulting

Ransomware has been weaponized by cybercriminals and malicious governments, representing a potentially existential risk to businesses that are breached. Current variations of ransomware go after everything, including online backup, making even partial restoration a complex and costly process. Novel variations of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Snatch and Nephilim have emerged, displacing WannaCry, Spora, and CryptoWall in prominence, sophistication, and destructive impact.

90% of ransomware penetrations are caused by innocuous-looking emails that have malicious links or attachments, and a high percentage are "zero-day" variants that can escape detection by legacy signature-based antivirus tools. Although user education and up-front detection are important to defend against ransomware attacks, leading practices demand that you take for granted some attacks will inevitably succeed and that you prepare a strong backup solution that permits you to repair the damage rapidly with minimal damage.

Progent's ProSight Ransomware Preparedness Report is an ultra-affordable service built around an online interview with a Progent cybersecurity consultant skilled in ransomware defense and recovery. In the course of this interview Progent will cooperate with your Ottawa IT management staff to gather critical data concerning your security profile and backup processes. Progent will use this information to produce a Basic Security and Best Practices Assessment documenting how to apply best practices for configuring and managing your cybersecurity and backup solution to prevent or clean up after a crypto-ransomware attack.

Progent's Basic Security and Best Practices Report highlights vital areas related to ransomware prevention and restoration recovery. The review covers:

Security

• Proper allocation and use of admin accounts
• Correct NTFS (New Technology File System) and SMB (Server Message Block) authorizations
• Proper firewall configuration
• Secure RDP access
• Advice about AntiVirus (AV) tools identification and configuration

• Split permission architecture for backup protection
• Backing up key servers such as AD
• Geographically dispersed backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malware that encrypts or steals files so they are unusable or are made publicly available. Ransomware sometimes locks the victim's computer. To avoid the damage, the victim is required to send a specified ransom, usually in the form of a crypto currency like Bitcoin, within a brief time window. It is not guaranteed that paying the ransom will restore the damaged files or avoid its publication. Files can be encrypted or deleted throughout a network based on the victim's write permissions, and you cannot reverse engineer the strong encryption algorithms used on the hostage files. A typical ransomware attack vector is booby-trapped email, whereby the victim is tricked into responding to by means of a social engineering exploit called spear phishing. This makes the email to appear to come from a trusted sender. Another common attack vector is a poorly protected Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker opened the modern era of crypto-ransomware in 2013, and the monetary losses attributed to by the many versions of ransomware is said to be billions of dollars per year, more than doubling every other year. Famous attacks include Locky, and Petya. Current headline variants like Ryuk, Sodinokibi and Spora are more complex and have wreaked more damage than older versions. Even if your backup processes allow you to recover your encrypted data, you can still be threatened by exfiltration, where ransomed documents are made public (known as "doxxing"). Because new variants of ransomware crop up daily, there is no guarantee that conventional signature-based anti-virus tools will block the latest malware. If threat does appear in an email, it is important that your users have learned to identify social engineering tricks. Your last line of protection is a solid process for scheduling and retaining remote backups plus the deployment of reliable recovery tools.

Contact Progent About the ProSight Ransomware Preparedness Checkup in Ottawa
For pricing information and to learn more about how Progent's ProSight Ransomware Vulnerability Audit can bolster your protection against ransomware in Ottawa, phone Progent at 800-462-8800 or see Contact Progent.