Providence Ransomware Protection and Remediation Expertise

Ransomware has become the weapon of choice for cyber extortionists and bad-actor states, representing a possibly existential risk to companies that are successfully attacked. The latest variations of ransomware go after all vulnerable resources, including online backup, making even selective recovery a challenging and expensive process. Novel versions of ransomware such as Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Snatch and Nephilim have made the headlines, replacing Locky, Spora, and CryptoWall in notoriety, sophistication, and destructive impact.

90% of ransomware breaches are the result of innocent-seeming emails that have malicious links or attachments, and a high percentage are "zero-day" variants that elude detection by legacy signature-based antivirus (AV) tools. Although user training and up-front identification are critical to defend against ransomware, best practices dictate that you expect that some attacks will inevitably succeed and that you put in place a solid backup mechanism that enables you to repair the damage quickly with little if any damage.

Progent's ProSight Ransomware Preparedness Report is an ultra-affordable service built around an online interview with a Progent security expert experienced in ransomware defense and recovery. During this interview Progent will cooperate with your Providence IT managers to collect critical data about your security posture and backup environment. Progent will utilize this information to create a Basic Security and Best Practices Report documenting how to apply leading practices for implementing and administering your security and backup solution to block or recover from a crypto-ransomware attack.

Progent's Basic Security and Best Practices Report focuses on key issues related to crypto-ransomware defense and restoration recovery. The report addresses:

Cybersecurity

• Effective allocation and use of admin accounts
• Assigning NTFS (New Technology File System) and SMB (Server Message Block) authorizations
• Proper firewall settings
• Secure RDP access
• Recommend AntiVirus tools identification and deployment

• Split permission architecture for backup protection
• Protecting key servers including Active Directory
• Offsite backups with cloud backup to Microsoft Azure

About Ransomware
Ransomware is a variety of malicious software that encrypts or steals a victim's files so they cannot be used or are made publicly available. Crypto-ransomware often locks the victim's computer. To avoid the carnage, the target is asked to send a specified amount of money (the ransom), typically in the form of a crypto currency like Bitcoin, within a brief period of time. It is not guaranteed that delivering the ransom will recover the damaged data or avoid its publication. Files can be encrypted or deleted across a network depending on the target's write permissions, and you cannot break the strong encryption technologies used on the compromised files. A typical ransomware attack vector is spoofed email, whereby the user is tricked into responding to by means of a social engineering exploit known as spear phishing. This makes the email message to look as though it came from a familiar source. Another common attack vector is an improperly secured Remote Desktop Protocol (RDP) port.

CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses caused by the many strains of ransomware is estimated at billions of dollars per year, more than doubling every other year. Notorious examples include Locky, and Petya. Recent high-profile variants like Ryuk, Maze and Cerber are more sophisticated and have wreaked more havoc than older strains. Even if your backup/recovery processes permit your business to recover your encrypted files, you can still be threatened by so-called exfiltration, where ransomed data are exposed to the public (known as "doxxing"). Because additional variants of ransomware are launched every day, there is no guarantee that conventional signature-based anti-virus tools will detect a new malware. If threat does appear in an email, it is critical that your users have learned to be aware of social engineering tricks. Your last line of defense is a solid scheme for scheduling and keeping remote backups plus the use of dependable restoration tools.

Contact Progent About the ProSight Ransomware Susceptibility Report in Providence
For pricing details and to find out more about how Progent's ProSight Crypto-Ransomware Preparedness Review can enhance your protection against crypto-ransomware in Providence, phone Progent at 800-462-8800 or visit Contact Progent.