Sophos Report: Endpoint Protection Best Practices to Block Ransomware

In our recent survey of 5,000 IT Managers across 26 countries, 51% of respondents revealed that they were hit by ransomware in the last year. In 73% of those incidents, attackers succeeded in encrypting data. Furthermore, the average global cost to remediate these attacks was an eye-watering $761,106.

An endpoint protection solution is one of the most effective methods to protect against ransomware – but only if it’s properly configured.

Our new guide, Endpoint Protection Best Practices to Block Ransomware, explores how ransomware attacks work, how they can be stopped, and best practices for configuring your endpoint solution for the strongest protection possible.

Seven endpoint protection best practices to block ransomware

To maximize the effectiveness of your anti-ransomware defenses, we recommend:

1. Turning on all policies and ensuring all features are enabled. It sounds obvious, but this is a surefire way that you’ll get the best protection out of your endpoint solution. Be sure to enable features that detect file-less attack techniques and ransomware behavior.
2. Regularly reviewing your exclusions. Exclusions are sometimes leveraged to soften complaints from users who feel your protection solution is slowing down their systems. Malware that manages to make its way into excluded directories will likely succeed because it’s excluded from being checked.
3. Enabling multi-factor authentication (MFA) within your security console. MFA provides an additional layer of security after the first factor, which is often a password.
4. Ensuring every endpoint is protected and up to date. Checking your devices regularly to know if they’re protected and up to date is a quick way to ensure optimum protection.
5. Maintaining good IT hygiene. Not only does this mitigate your cybersecurity risk, but it can save you a lot of time when it comes to remediating potential incidents in the future.
6. Hunting for active adversaries on your network. Malicious actors are more cunning than ever. Take advantage of endpoint detection and response (EDR) technologies in your endpoint solution to identify advanced threats and active adversaries, and take swift action to stop threats.
7. Closing the gap with human intervention. Hackers typically spend time exploring your network before deploying ransomware. The best way to detect this malicious activity is to combine human expertise with advanced endpoint technology.

These best practices and more are covered in greater detail our new Endpoint Protection Best Practices to Block Ransomware whitepaper.

How Sophos keeps you protected from ransomware

Sophos Intercept X includes all the features you need to help protect your organization from advanced ransomware attacks like Ryuk, Sodinokibi, Maze, and Ragnar Locker.

• Deep learning identifies and blocks known and unknown ransomware variants
• Anti-exploit technology stops the delivery and installation of ransomware
• CryptoGuard identifies and rolls back the unauthorized encryption of files

Sophos EDR, available for endpoints and servers, lets you hunt for threats and maintain good IT operations hygiene across your entire estate.

If you want to add human expertise to your layered security strategy, Sophos Managed Threat Response (MTR) proactively hunts for and neutralizes threats on your behalf.