Palo Alto Ransomware Prevention and Remediation Solutions

Ransomware has become the weapon of choice for cyber extortionists and malicious states, posing a possibly lethal threat to companies that are successfully attacked. Modern strains of ransomware target everything, including online backup, making even selective recovery a challenging and expensive process. New variations of ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Conti and Egregor have made the headlines, displacing Locky, Cerber, and NotPetya in notoriety, sophistication, and destructive impact.

Most ransomware infections come from innocent-looking emails that include malicious hyperlinks or attachments, and many are so-called "zero-day" variants that can escape the defenses of traditional signature-matching antivirus (AV) tools. Although user training and up-front detection are critical to protect against ransomware, best practices dictate that you expect that some malware will eventually succeed and that you prepare a strong backup mechanism that enables you to restore files and services quickly with little if any losses.

Progent's ProSight Ransomware Preparedness Assessment is a low-cost service centered around an online discussion with a Progent security expert experienced in ransomware protection and repair. In the course of this assessment Progent will collaborate directly with your Palo Alto network management staff to gather critical data concerning your security posture and backup processes. Progent will utilize this information to create a Basic Security and Best Practices Assessment detailing how to follow best practices for implementing and managing your security and backup systems to block or recover from a crypto-ransomware attack.

Progent's Basic Security and Best Practices Assessment highlights key areas associated with crypto-ransomware defense and restoration recovery. The report covers:

Security

• Correct allocation and use of administration accounts
• Correct NTFS and SMB authorizations
• Optimal firewall settings
• Safe RDP configuration
• Guidance for AntiVirus (AV) tools selection and deployment

• Split permission model for backup protection
• Backing up critical servers including Active Directory
• Offsite backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malware that encrypts or steals files so they are unusable or are publicized. Ransomware sometimes locks the victim's computer. To avoid the damage, the target is asked to pay a certain ransom, typically in the form of a crypto currency such as Bitcoin, within a brief period of time. It is not guaranteed that delivering the extortion price will restore the lost files or avoid its exposure to the public. Files can be encrypted or deleted throughout a network depending on the target's write permissions, and you cannot break the military-grade encryption technologies used on the compromised files. A typical ransomware attack vector is tainted email, whereby the target is tricked into interacting with by a social engineering technique called spear phishing. This makes the email message to appear to come from a familiar sender. Another common vulnerability is an improperly secured Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker opened the new age of ransomware in 2013, and the monetary losses attributed to by the many versions of ransomware is said to be billions of dollars annually, more than doubling every two years. Famous examples are Locky, and NotPetya. Current headline variants like Ryuk, Maze and TeslaCrypt are more complex and have wreaked more damage than earlier strains. Even if your backup procedures allow you to restore your encrypted data, you can still be hurt by so-called exfiltration, where stolen data are made public. Because new variants of ransomware crop up every day, there is no guarantee that conventional signature-based anti-virus filters will block a new malware. If threat does appear in an email, it is important that your users have learned to identify social engineering techniques. Your last line of defense is a solid process for scheduling and keeping remote backups plus the use of reliable restoration platforms.

Contact Progent About the ProSight Ransomware Preparedness Assessment in Palo Alto
For pricing details and to learn more about how Progent's ProSight Crypto-Ransomware Preparedness Testing can bolster your protection against ransomware in Palo Alto, phone Progent at 800-462-8800 or see Contact Progent.