Ransomware is real

It’s not a matter of if anymore, only a matter of when. Recovery from a ransomware attack is not easy. How do we recover a machine if we can’t trust any files on the local machine, we can’t trust the operating system, and we can’t even trust our own internal IT servers to deploy a new OS cleanly?

Overview

2Pint Software offers several technologies that make recovery from real-world ransomware attacks easier. Our state-of-the-art technologies include:

  • iPXE Anywhere - Can boot to a recovery operating system without touching the local disk which may be quarantined.
  • Peer-to-peer – Our suite of peer-to-peer technologies can install new operating systems and applications with minimal impact on your network.
  • And more! – Depending on circumstances, 2Pint Software recovery solutions may include PowerShell Deployment (PSD), DeployR, Autopilot, and other technology.

With 2Pint Software, during a real-world ransomware attack, your employees and your business can get back to work with less disruption.

Office building lobby
Point of sale system

Ransomware recovery

When a ransomware attack happens, time is not your friend. Your organization loses revenue and productivity every hour, every day, and every week your systems are down. Affected endpoints may include:

  • Business critical banking, manufacturing and point of sale systems
  • Employee desktops and laptops
  • Server systems

Getting your systems up and running again is a top priority.

But the path to recovery can be a chicken-and-egg scenario. How do we get our systems up and running again if the systems typically used to recover IT assets may be compromised?

Typical case

A typical ransomware scenario could develop as follows:

  • Employee Bob opens an e-mail attachment that contains malware.
  • Bob is a local administrator on the box, so his user credentials provide full access to the box.
  • Using techniques found in the Mimikatz exploit, the attackers traverse the corporate network to install their malware packages.
  • When enough machines are infected with malware, attackers encrypt and lock critical files – or even the entire operating system.
  • A ransom is demanded to provide the keys to unlock the files. Will the negotiations be successful?

There are several great solutions on the market to help mitigate some of the vulnerabilities listed above (shame on Bob for opening the attachment 😊).

But IT departments need to be prepared for the worst-case scenario: that no recovery is possible, and all machines must be wiped and re-installed.

Alert circle icon

The challenge

During a real-world ransomware scenario, we may need to start recovering machines from various locations. That includes each branch office location, and wherever remote workers are based.

With internal systems compromised, the cloud anchors our strategy for rebuilding the recovery environment.