Toledo Ransomware Protection and Cleanup Consulting

Ransomware has become the weapon of choice for the major cyber-crime organizations and bad-actor governments, posing a possibly existential threat to companies that fall victim. Current strains of ransomware target all vulnerable resources, including backup, making even partial recovery a complex and expensive process. Novel strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Mailto (aka Netwalker), Phobos, Conti and Egregor have emerged, displacing WannaCry, TeslaCrypt, and Petya in notoriety, sophistication, and destructiveness.

Most crypto-ransomware breaches are caused by innocent-seeming emails with dangerous hyperlinks or attachments, and a high percentage are so-called "zero-day" variants that elude detection by legacy signature-based antivirus filters. Although user training and up-front identification are critical to protect against ransomware, best practices demand that you expect that some attacks will inevitably succeed and that you prepare a strong backup solution that allows you to restore files and services quickly with minimal damage.

Progent's ProSight Ransomware Vulnerability Checkup is an ultra-affordable service centered around a remote interview with a Progent cybersecurity consultant experienced in ransomware defense and recovery. During this assessment Progent will cooperate directly with your Toledo network management staff to gather critical information about your security configuration and backup environment. Progent will utilize this information to generate a Basic Security and Best Practices Report documenting how to apply leading practices for implementing and managing your security and backup systems to prevent or clean up after a crypto-ransomware attack.

Progent's Basic Security and Best Practices Assessment focuses on key issues associated with crypto-ransomware prevention and restoration recovery. The review covers:

Cybersecurity

• Proper use of administration accounts
• Assigning NTFS (New Technology File System) and SMB (Server Message Block) authorizations
• Proper firewall setup
• Secure Remote Desktop Protocol (RDP) access
• Advice about AntiVirus (AV) tools identification and deployment

• Split permission architecture for backup integrity
• Backing up key servers such as Active Directory
• Geographically dispersed backups including cloud backup to Microsoft Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or deletes files so they are unusable or are made publicly available. Crypto-ransomware often locks the target's computer. To avoid the carnage, the victim is required to send a specified amount of money (the ransom), typically in the form of a crypto currency like Bitcoin, within a short time window. There is no guarantee that delivering the ransom will restore the lost files or prevent its exposure to the public. Files can be encrypted or erased across a network based on the target's write permissions, and you cannot break the military-grade encryption algorithms used on the hostage files. A common ransomware delivery package is booby-trapped email, whereby the target is lured into interacting with by means of a social engineering technique called spear phishing. This makes the email to appear to come from a familiar source. Another common attack vector is a poorly protected RDP port.

CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses attributed to by the many strains of ransomware is said to be billions of dollars annually, roughly doubling every other year. Notorious attacks include Locky, and NotPetya. Recent headline variants like Ryuk, DoppelPaymer and Cerber are more complex and have wreaked more havoc than older strains. Even if your backup processes allow your business to recover your encrypted files, you can still be threatened by so-called exfiltration, where ransomed documents are made public (known as "doxxing"). Because new versions of ransomware are launched daily, there is no guarantee that traditional signature-based anti-virus filters will detect the latest attack. If threat does appear in an email, it is critical that your end users have learned to identify phishing techniques. Your last line of protection is a solid process for scheduling and retaining offsite backups plus the deployment of reliable restoration platforms.

Contact Progent About the ProSight Ransomware Susceptibility Report in Toledo
For pricing details and to find out more about how Progent's ProSight Crypto-Ransomware Susceptibility Consultation can enhance your defense against crypto-ransomware in Toledo, call Progent at 800-462-8800 or see Contact Progent.