San Francisco Ransomware Defense and Recovery Expertise

Ransomware has been weaponized by the major cyber-crime organizations and rogue states, representing a possibly lethal risk to companies that are victimized. The latest versions of ransomware target everything, including online backup, making even selective recovery a complex and costly process. Novel versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), DopplePaymer, Conti and Nephilim have made the headlines, replacing Locky, TeslaCrypt, and NotPetya in prominence, sophistication, and destructiveness.

Most ransomware penetrations are the result of innocent-seeming emails that have dangerous links or attachments, and a high percentage are "zero-day" strains that elude the defenses of traditional signature-based antivirus (AV) filters. While user education and up-front detection are critical to defend your network against ransomware, leading practices demand that you assume some malware will inevitably get through and that you implement a solid backup solution that allows you to restore files and services rapidly with little if any losses.

Progent's ProSight Ransomware Vulnerability Checkup is a low-cost service built around an online interview with a Progent security consultant skilled in ransomware protection and repair. In the course of this assessment Progent will work directly with your San Francisco IT managers to gather pertinent data concerning your security setup and backup processes. Progent will use this data to create a Basic Security and Best Practices Assessment documenting how to adhere to best practices for implementing and administering your cybersecurity and backup systems to block or recover from a ransomware assault.

Progent's Basic Security and Best Practices Assessment highlights vital issues related to crypto-ransomware defense and restoration recovery. The review addresses:

Cybersecurity

• Effective use of admin accounts
• Assigning NTFS and SMB authorizations
• Proper firewall settings
• Safe Remote Desktop Protocol (RDP) connections
• Guidance for AntiVirus filtering identification and configuration

• Split permission model for backup protection
• Protecting key servers including AD
• Offsite backups including cloud backup to Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or steals a victim's files so they are unusable or are made publicly available. Ransomware sometimes locks the target's computer. To avoid the damage, the victim is required to send a specified ransom, usually via a crypto currency such as Bitcoin, within a short period of time. It is not guaranteed that delivering the ransom will recover the lost data or avoid its publication. Files can be encrypted or deleted throughout a network based on the target's write permissions, and you cannot reverse engineer the military-grade encryption technologies used on the compromised files. A common ransomware delivery package is tainted email, in which the victim is lured into interacting with by means of a social engineering exploit known as spear phishing. This makes the email message to look as though it came from a trusted source. Another common attack vector is a poorly secured Remote Desktop Protocol port.

The ransomware variant CryptoLocker ushered in the new age of ransomware in 2013, and the monetary losses caused by different versions of ransomware is estimated at billions of dollars per year, more than doubling every two years. Notorious attacks are Locky, and NotPetya. Current headline threats like Ryuk, DoppelPaymer and Spora are more complex and have wreaked more havoc than earlier versions. Even if your backup/recovery procedures allow you to recover your ransomed data, you can still be threatened by exfiltration, where ransomed documents are exposed to the public. Because new variants of ransomware crop up daily, there is no certainty that conventional signature-based anti-virus filters will block the latest malware. If an attack does show up in an email, it is critical that your users have been taught to identify social engineering techniques. Your ultimate defense is a sound scheme for performing and keeping remote backups plus the use of dependable restoration tools.

Ask Progent About the ProSight Ransomware Readiness Consultation in San Francisco
For pricing information and to learn more about how Progent's ProSight Ransomware Vulnerability Audit can bolster your protection against ransomware in San Francisco, call Progent at 800-462-8800 or visit Contact Progent.