Ransomware Defense and Removal for Practices of All Sizes

Ransomware is one of the most critical threats to any enterprise. Mainstream media reports on ransomware hitting large corporations and governments on an almost daily basis. While the attacks these entities face are the ones that make the headlines, the fact is every business is at risk no matter the industry or size of the organization. Scarlett Cybersecurity provides a solid frontline that defends against ransomware while offering rapid business continuity solutions for a rainy day.

Ransomware – What is it?

The technical details of ransomware can change depending on the strain, but they mostly follow the same general methodology. The attackers will commonly get a foothold within the environment via phishing or by utilizing an exploit. Once inside the network, the malware will generally propagate rapidly to as many systems as possible by acting as a network worm. This is not a manual process and the ransomware will use cutting-edge techniques that are nearly impossible to defend against without up-to-date systems and security measures.

The machines or data infected will then be “locked” until a ransom is paid. Unfortunately, there is no guarantee that paying the ransom will get the data back. The insidious nature of ransomware allows it to infect data backups as well if not properly segmented. The reality is that many times there is no other choice but to roll the dice if proper measures were not in place.

Ransomware’s Effects on an Unprepared Business 

The timeline of a normal ransomware attack looks something like this:

  1. A user receives an email containing the initial payload and patient zero is established.
     
  2. The ransomware spreads freely through the under-secured and unpatched network, possibly remaining silent until fully propagated.
     
  3. All the systems that were vulnerable are locked in some way. Often the ransomware will encrypt the files on the device in a manner that is not recoverable unless the ransom is paid.
     
  4. During this period, it is highly likely that the entire organization will come to a grinding halt. The business will likely lose all avenues of continuity and a complete remediation effort will be necessary.
     
  5. Unfortunately, many businesses do not use backups properly and these backups can take a long time to deploy, leaving a critical gap in business operations. A common scenario is that the backups themselves are infected, leading to a total loss of data and operations.
     
  6. At this point the unprepared business has a few options, none of which are ideal.
    • Pay the ransom and hope that the adversary is honest, a risky and expensive prospect. The worst case with this option is the scenario when the original authors of the ransomware strain are now defunct. This can lead to a situation where there is nobody on the other end to receive your payment, so no key will be provided.
       
    • Attempt to decrypt the data, but this is highly unlikely and will waste valuable time while infrequently yielding results and likely costing a fortune for the reverse engineering talent required.
       
    • Completely rebuild the systems without using backups, potentially losing invaluable data and time but circumventing the expensive ransom.

 

How We Help

Just like a disease, the single best counter to ransomware is inoculation. Here at Scarlett Cybersecurity, our Complete Managed IT Service (MSP) offering can drastically increase your organization’s chance of unimpeded operations.

Many of our offerings specifically defend against the most threatening malware while simultaneously preventing other issues within the network from crippling your revenue stream. Unsure if you are prepared? Consider our Comprehensive IT Assessment to ensure that your business is ready for anything.

Security:
Scarlett Cybersecurity offers comprehensive security packages for those that are concerned that ransomware may be a threat. The most secure corporations utilize a SIEM/SOC solution to monitor logs for real-time threats. Scarlett Cybersecurity offers these services along with a comprehensive AV solution that can help prevent the spread of ransomware. Our services even include dedicated anti-ransomware tools that can stop the encryption as soon as it’s detected. 

Awareness:
The ugly truth is that users are the weak point of any security stack. People will find a way to click a bad link regardless of news headlines warning against it. The only real solution to user (mis)behavior is real-world experience. We utilize tools that simulate real attacks and generate easy-to-read reports showing the threat presented by the users. These users are then presented with a thorough, interactive training session that has been proven to significantly improve the security posture of the organization.

Patching:
Scarlett Cybersecurity prides itself on a robust patch management system that will act as an excellent defense against the cutting-edge techniques used by malware authors. It’s no secret that ransomware’s spread is countered in many cases by patched devices, and our MSP services will keep the entire network up to date to prevent the most common forms of malware propagation.
 

What should a victim do?   

Unfortunately, there is no substitute for preparation. There are thorough remediation techniques that may allow us to recover your data and have you up-and-running as fast as possible while removing the ransomware from the environment.

The bad news is that we may not be able to guarantee the full recovery of the data if your network hasn’t been hardened using our services. Be wary of any companies that claim guaranteed decryption. The encryption algorithms used by most ransomware authors are specifically engineered to be non-reversable. If entire cities cannot decrypt their data, it is highly unlikely that any vendor has the resources to reverse-engineer the encryption algorithm.

Scarlett Cybersecurity will ensure that your company has all the resources needed to recover from an attack and will handle remediation if the unthinkable happens.

Incident Prevention Services

Prevent cybersecurity incidents by working with Scarlett Cybersecurity. We provide a robust array of cybersecurity services ranging from cybersecurity consulting to full defense-in-depth security services. Scarlett Cybersecurity uses the latest tools and techniques to help secure your organization. Our unique focus on transparency enables us to form close relationships with our clients and provide incident prevention services that emphasize effectiveness and cost-efficiency.

ServiceDescription
Scarlett Managed IT ServicesFully outsourced IT and security managed by Scarlett Cybersecurity. Specific services are be determined on a per-client basis.
Co-Managed IT ServicesScarlett Cybersecurity will design a managed solution based on your business needs, existing IT expertise, geography, regulatory requirements and current business applications.
Scarlett Managed Cybersecurity ServicesA fully managed security solution with implementation based on client needs and expectations.
Scarlett Co-Managed Cybersecurity ServicesA co-managed security solution with implementation based on client needs and expectations. Work with existing client internal security to achieve goals.
Cybersecurity Awareness TrainingTraining sessions designed to test users and provide actionable reports. Simulated phishing attacks test training effectiveness.
Managed AV ServicesManaged AV with custom alerting and issue resolution.
Managed Patching ServicesManaged monitoring and patching of devices to ensure updates are implemented in a timely manner.
Managed Network Security ServicesManaged Firewalls and Network Security Appliances. Only available with other managed service packages.
OpenDNSDNS resolution with built-in security features that helps prevent malicious or undesired traffic from resolving.
Single-Sign-On (SSO)Implement SSO solution to enable use of a single set of credentials for most services.
Centralized Password ManagementCentralized password management including the implementation of a password manager for all users.
Multi-Factor AuthenticationImplement MFA solutions to provide enhanced authentication security.
Application WhitelistingManaged application that provides the ability to control what runs in the environment and what users can install.
Managed Cloud Web Application FirewallFully managed cloud WAF to reduce risk to exposed Web Servers. Prevents common attacks and exploits and provides DDOS protection.


Incident Detection Services

Detecting a cybersecurity incident can be a difficult task. Partner with Scarlett Cybersecurity to ensure all threats are detected and eradicated before they cause irreparable harm to your organization.

ServiceDescription
SIEM/SOCCentralized logging and alerting. Used for network visibility and compliance. Provides 24/7/365 customized alerting and reporting.
Data-loss Prevention SolutionsDLP solutions classify and protect confidential and critical information in order to prevent end users from accidentally or maliciously sharing data that could put the organization at risk.
Endpoint Detection and ResponseEDR is an endpoint protection solution designed to be a full replacement for AV.  Network isolation, rollbacks, IR forensics, and machine learning are some of the flagship features.
Hardware MonitoringMonitored hardware health with proactive notifications.
Vulnerability TestingExtensive network scans with annotated reports that provide insight into network health and security gaps.
Penetration TestingAdvanced manual penetration test to discovery specific vulnerabilities.
Network Security and Health MonitoringCentral administration and monitoring of the network.

 

Incident Response Services

Whether your organization is the victim of an attack or you just want to be prepared, working with Scarlett Cybersecurity can ensure that you will be able to recover quickly should an attack happen.

ServiceDescription
Disaster Recovery as a Services (DRaas)DRaaS is an enhanced backup solution. It is fully managed by Scarlett Cybersecurity. DRaaS provides managed, rapid network recovery from catastrophic events.
Incident Response on RetainerContact Scarlett Cybersecurity to get your organization's information on file for rapid response in the case of a cybersecurity incident. Incident Response services are billed, but the initial registration is free and information can be kept on file to facilitate rapid response procedures.
Scarlett|CIRT (Cyber Incident Response Team)Utilize Scarlett|CIRT's expertise to resolve cybersecurity incidents. Includes all phases of the IR process and the follow-up "Post-Incident" cybersecurity improvements. 
Emergency Network RestorationA specialized Incident Response service focuses on rapid restoration of network services.
Persistent Malware RemovalAssistance in removing persistent or highly evasive malware from a network.
Ransomware Recovery ServicesAssistance in recovering from a ransomware attack utilizing all available options to get an organization back online as quickly as possible.
Cyberinsurance Incident Response AssistanceWork with an organization's current cyberinsurance retainer IR team to deploy recovery solutions and remediate out-of-scope network issues. 

 

Consultation Services

Scarlett Cybersecurity’s Consulting Team is led by ISACA Certified Auditors. These services provide information to clients as a trusted partner. Specific services are offered to assist in the realization of large projects. We are highly specialized in “Virtual CIO” services, Cloud Strategy, and IT Governance consultation.

ServiceDescription
Virtual CIOA virtual CIO is an outsourced specialist who acts as an overall IT strategy partner for client. This service can augment existing IT leadership or act in an advisory capacity.
Virtual CISOA virtual CISO is an outsourced specialist who acts as an overall Cybersecurity strategy partner for client. This service can augment existing IT leadership or act in an advisory capacity.
Governance ConsultingIT governance is a framework that provides a structure for organizations to ensure that IT investments support business objectives. Our Governance Consultants often augment an organization’s current staff. 
DRBC ConsultingConsultants assist in the creation of a DRBC plan with consideration for infrastructure, applications, staff, data, and IT availability.  They will design and recommend options to accomplish disaster readiness.
Cloud Strategy ConsultingTasks focused on migrating a client to the cloud. Consultants formulate a strategy based on requirements from client. Hybrid solutions available.
Workflow ConsultingBusiness process mapping focused on providing an objective picture into procedural improvement opportunities.
Compliance ConsultingConsulting focused exclusively on achieving compliance. Examples include HIPAA, HITRUST, NIST, PCI DSS, GDPR.
RFP ServicesEvaluating and selecting new IT solutions within guidelines. Assistance can be provided at any point in the purchasing process.

 

IT Audit Services

Scarlett Cybersecurity was founded and built by certified Information Technology Auditors. The assessments listed below are commonly used to provide objective metrics and gain insight into the current network posture. Our assessments can be utilized as a standalone deliverable or as a precursor to more significant projects.   

ServiceDescription
Comprehensive IT AssessmentPerformed by our ISACA Certified Auditors, this is a comprehensive report on the status of your entire IT infrastructure (security included).
Cybersecurity AssessmentIn-depth security analysis performed by our ISACA Certified Auditors. Includes extensive report with recommendations.
Disaster Recovery | Business Continuity AssessmentIn-depth disaster readiness analysis performed by our ISACA Certified Auditors. Includes extensive report with recommendations.