Ransomware Detection Challenges and Free Protection Tips
Learn about the main problems with ransomware detection and simple, cost-effective tips to protect your systems from ransomware attacks. Topics include the limitations of reactive technology, the importance of reputation-based protection, and practical advice on exploiting, macro malware, whitelisting, and backups.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Zoltn Balzs MRG Effitas A ransomware jelens g mellet nem lehet elmenni
Main problems with ransomware detection Any reactive technology will fail Antivirus signatures IDS/IPS Spam filter Previously, reactive malware detection was fine for most people, it was OK if the malware was found in 24 hours With ransomware, 1 hour detection rate is a real issue Reputation based protection is a lot better than signatures
(Almost) Free tips - exploit Enforce Chrome for Internet browsing Use EMET free It only protects IE, but not Firefox or Chrome! Instead of EMET, use paid MBAE or HitmanPro Alert The paid versions protect all browsers against exploits
(Almost) Free tips - macro Macro malware Disable all macros except digitally signed macros OR Office 2016 GPO Block macros from running in Office files downloaded from the Internet
(Almost) Free tips Whitelist C:\Users\ execution Windows built-in Applocker http://www.mcbsys.com/blog/2013/10/block-user- folder-executables/ .exe, .scr, .com, .js, .jse, .wsh, .vbs, .cs, .cab, This is a lot of work, lot of things will break. But works. Backup Offline backup is more important than ever Show hidden file extensions Use generic ransomware protection product Comparative test coming soon ;P
