Brighton Ransomware Filtering and Remediation Consulting

Ransomware has been weaponized by cyber extortionists and malicious governments, posing a potentially lethal threat to companies that are victimized. The latest strains of ransomware target all vulnerable resources, including backup, making even partial recovery a challenging and expensive exercise. New variations of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Phobos, Conti and Egregor have emerged, replacing WannaCry, TeslaCrypt, and NotPetya in notoriety, sophistication, and destructiveness.

90% of ransomware breaches come from innocent-looking emails that include dangerous links or file attachments, and a high percentage are so-called "zero-day" strains that can escape the defenses of traditional signature-matching antivirus (AV) tools. Although user training and up-front identification are critical to protect against ransomware, leading practices demand that you assume some attacks will eventually succeed and that you implement a strong backup mechanism that permits you to recover quickly with little if any damage.

Progent's ProSight Ransomware Preparedness Checkup is an ultra-affordable service centered around a remote interview with a Progent cybersecurity consultant experienced in ransomware defense and recovery. In the course of this assessment Progent will work directly with your Brighton IT management staff to collect pertinent information concerning your cybersecurity configuration and backup processes. Progent will use this data to create a Basic Security and Best Practices Assessment detailing how to follow best practices for implementing and managing your cybersecurity and backup solution to prevent or clean up after a ransomware assault.

Progent's Basic Security and Best Practices Assessment focuses on key issues associated with ransomware defense and restoration recovery. The report addresses:

Cybersecurity

• Correct use of admin accounts
• Assigning NTFS and SMB permissions
• Optimal firewall settings
• Safe RDP configuration
• Advice about AntiVirus (AV) tools selection and configuration

• Split permission architecture for backup integrity
• Protecting critical servers such as Active Directory
• Geographically dispersed backups with cloud backup to Azure

About Ransomware
Ransomware is a type of malicious software that encrypts or steals a victim's files so they are unusable or are publicized. Crypto-ransomware sometimes locks the victim's computer. To avoid the damage, the victim is asked to send a certain amount of money, typically in the form of a crypto currency such as Bitcoin, within a short period of time. It is never certain that delivering the extortion price will recover the damaged data or prevent its exposure to the public. Files can be encrypted or deleted across a network based on the victim's write permissions, and you cannot break the military-grade encryption algorithms used on the compromised files. A typical ransomware delivery package is tainted email, in which the user is tricked into interacting with by a social engineering exploit called spear phishing. This causes the email message to look as though it came from a familiar source. Another popular attack vector is a poorly protected Remote Desktop Protocol (RDP) port.

The ransomware variant CryptoLocker ushered in the modern era of crypto-ransomware in 2013, and the monetary losses attributed to by different strains of ransomware is estimated at billions of dollars annually, more than doubling every two years. Notorious examples are Locky, and NotPetya. Current headline variants like Ryuk, Sodinokibi and Spora are more sophisticated and have caused more havoc than older strains. Even if your backup/recovery processes permit your business to restore your ransomed data, you can still be threatened by exfiltration, where ransomed documents are exposed to the public. Because additional versions of ransomware are launched every day, there is no certainty that conventional signature-based anti-virus tools will block a new malware. If threat does show up in an email, it is critical that your users have learned to be aware of phishing tricks. Your ultimate defense is a solid process for performing and keeping offsite backups plus the deployment of reliable recovery platforms.

Contact Progent About the ProSight Crypto-Ransomware Readiness Testing in Brighton
For pricing details and to learn more about how Progent's ProSight Ransomware Vulnerability Report can enhance your protection against crypto-ransomware in Brighton, call Progent at 800-462-8800 or see Contact Progent.