Ransomware is constantly evolving, let’s take a look at the evolution of Ransomware, especially last 2-3 years. Demonstration of what happens when you click on the wrong document and how different Ransomware systems work Let’s show the dark side of the ransomware (how do the criminals operate with ransomware as a service)   And what can you do as a sysadmin to mitigate these threats. Many tips & tricks wille be shared for this!     

1. Ransomware vs. SysAdmin
ERIK LOEF

2. B

3. Erik Loef
@erikloef
CTO

5. 2day
• Ransomware general
• DEMO
• Application Whitelisting
• DEMO
• Fileserver Protection
• DEMO
• Windows 10 Fall Creators Update
• DEMO
• Recap

7. general
variants
• Lockers
• Crypters
Known variants
• Aids virus (1989)
• Police | Fake Anitvirus
• Cryptolocker/TelsaCrypt/Wildfirelocker

8. DEMO
Ransomware end user experience

9. the other side

10. Pay

12. Application Whitelisting
let‘s take a look at SRP

13. Application Whitelisting
Microsoft Options
• AppLocker/Device Guard
• Good – Old – SRP
Third Party solutions
• RES
• Lumension
• Symantec
• and many many others

14. SRP
Advantages
• Working since Windows XP / Server 2003
• You can put it in ‘monitoring mode’ as a start
• Easy, everybody can do this
• Free
• Many examples and tools, I advise take a look at
CryptoPrevent

15. DEMO
Ransomware & SRP

16. File Server Resource Manager
• Quota Management
• File Screening Management
• Storage Reports Management
• Classification Management

17. File Screening Management
• unauthenticated API
• active vs. passive
• command execution
SEE https://fsrm.experiant.ca/

18. DEMO
Ransomware & FSRM

23. DEMO
Controlled Folder Access
Attack Surface Reduction Rules

24. RECAP
• Ransomware still has the attention!
• You can fix this! (without high investments)
• Windows 10 Fall Creators Update first OS with specific built-in anti- Ransomware
mechanismes

25. LINKS
• https://technet.microsoft.com/en-us/library/cc732431(v=ws.11).aspx
• https://fsrm.experiant.ca/
• http://windowsitpro.com/systems-management/q-how-can-we-verify-software-restriction-policy-srp-rule-
we-defined-one-our-appli
• https://technet.microsoft.com/en-us/library/bb457006.aspx
• https://www.foolishit.com/cryptoprevent-malware-prevention/
• https://technet.microsoft.com/en-us/library/3f1faff2-cf65-42ce-9df8-a22bac671047
• https://www.nomoreransom.org/
• https://www.fraudehelpdesk.nl/
• www.twitter.com/erikloef
• https://gallery.technet.microsoft.com/scriptcenter/Protect-your-File-Server-f3722fce
• http://blog.netwrix.com/2016/04/11/ransomware-protection-using-fsrm-and-powershell/

26. Thanks to our event sponsors
Silver
Gold