Many of them it is the first time they have had any training about what a phishing scam is etc.Įnd result of security etc is a multi tired environment which does not allow the user to even trigger the activation. My partner did the set up and does the maintenance so i am not that knowledgeable about its workings etc but it at least gives our users some idea of what to look out for. We started using the knowbe4 product as a starting point for user training. We are a 2 man IT department with maybe 120 users. Spam, anti-virus and anti malware are all implemented.ītw for those who said it wasn't a virus, Norton did see it once i manually scanned.ĭeal with it after the infection or put some time in to attempted prevention. The company i work for is part of a bigger org that is in a bigger corp.
I do sent email to entire company showing example to not open once in a while. I seriously don't have the time for it we are a small team (2 people), for over 200 users, including night shift.
Realtime-scan of anything is still blacklists based. You guys are killing yourselves out there relying on a straw house built on quicksand by using this form of AV - "- anti-virus and anti-malware real-time scanning". Stop relying on signature/blacklist based detection. if you haven't implemented ALL of these, you haven't done a good - "by the time some AV/spam protection company builds a definition for it - the file checksum has changed and they can't detect the new variant". anti-virus and anti-malware real-time scanning If you can't let it get that far, to the actual encryption step, all you will get is the popup and the text file that says pay the ransom - no files actually get encrypted. The second step of the cryptolocker crap is to go to a foreign site and get/generate an encryption key, or with earlier variants: to download another bad program that actually does the encryption.
You also need to block any outbound traffic with an IP in the URL (nothing legitimate uses that, legitimate software makes a DNS lookup) that I'm guessing your US company has no business reason to visit.
What you NEED is an Internet filter, to block all the foreign domains like *.cn *.ru *.in *.cc etc. All the email security in the world isn't going to detect this - the file that is getting spammed out changes too quick - by the time some AV/spam protection company builds a definition for it - the file checksum has changed and they can't detect the new variant.
0 kommentar(er)
