Ransomware and Lateral Movement Protection

Silverfort’s Ransomware Protection solution aims to prevent ransomware attacks and halt their spread through a network. It enforces Multi-Factor Authentication (MFA) protection on various protocols and interfaces like PsExec, PowerShell, and WMI to eliminate attackers’ ability to perform lateral movement.

Key features

  • The Power of MFA: Silverfort uses MFA to block ransomware from spreading through a network using compromised credentials. It places MFA policies on PsExec, PowerShell, WMI, and more.
  • Attack Surface Reduction: The solution helps isolate and remediate compromised machines to prevent a ransomware attack from propagating through the network.
  • Last Line of Defense: Silverfort layers up security measures to contain and limit the scope of an attack, even if existing measures to prevent ransomware delivery and execution are bypassed.
  • RDP and Compromised Credentials: A large number of ransomware attacks are launched via Remote Desktop Protocol (RDP), and 82% of them are enabled by compromised credentials. Silverfort’s access policies aim to eliminate the ability of attackers to use these vectors for ransomware delivery.
  • Anomalous Traffic Detection: Silverfort’s risk engine can immediately detect any anomalous authentication traffic that indicates attempted propagation via tools like CMD, PowerShell, etc.
  • Risk-Based Policies: The solution leverages risk-based policies to trigger MFA upon access of machines or users at high risk, ensuring that ransomware attacks are contained in the initially infected machine ('patient zero') with no further impact.
Silverfort’s Ransomware Protection solution aims to prevent ransomware attacks and halt their spread through a network. It enforces Multi-Factor Authentication (MFA) protection on various protocols and interfaces like PsExec, PowerShell, and WMI to eliminate attackers’ ability to perform lateral movement.

Key features

  • The Power of MFA: Silverfort uses MFA to block ransomware from spreading through a network using compromised credentials. It places MFA policies on PsExec, PowerShell, WMI, and more.
  • Attack Surface Reduction: The solution helps isolate and remediate compromised machines to prevent a ransomware attack from propagating through the network.
  • Last Line of Defense: Silverfort layers up security measures to contain and limit the scope of an attack, even if existing measures to prevent ransomware delivery and execution are bypassed.
  • RDP and Compromised Credentials: A large number of ransomware attacks are launched via Remote Desktop Protocol (RDP), and 82% of them are enabled by compromised credentials. Silverfort’s access policies aim to eliminate the ability of attackers to use these vectors for ransomware delivery.
  • Anomalous Traffic Detection: Silverfort’s risk engine can immediately detect any anomalous authentication traffic that indicates attempted propagation via tools like CMD, PowerShell, etc.
  • Risk-Based Policies: The solution leverages risk-based policies to trigger MFA upon access of machines or users at high risk, ensuring that ransomware attacks are contained in the initially infected machine ('patient zero') with no further impact.
Additional

insights

  • Ransomware Propagation: The typical ransomware protection stack often lacks measures against the propagation stage, which is usually carried out by connecting to multiple machines with compromised admin credentials.
  • How Silverfort Protects: Silverfort integrates with all Identity Providers (IDP) to perform continuous monitoring, risk analysis, and adaptive access policies. As a result, access is never granted based solely on credentials. Silverfort’s risk analysis determines whether to allow access, request further authentication through MFA, or block the access attempt altogether.
  • What are Lateral Movement Attacks?: These are methods used by a threat actor to expand their presence within an environment and log into additional machines. The purpose varies depending on the attacker’s motive; for example, they could seek to plant ransomware on as many machines as possible.
  • Detecting Identity-Based Attacks: Silverfort combines rule-based policies, risk-based policies, and protocol anomaly policies to detect various lateral movement techniques such as Pass the Hash, Kerberoasting, and Pass the Ticket.
moving

Forward

REQUEST

your own PoV

REQUEST

your own PoV

SILVERFORT MFA

Protect the Unprotectable – White Paper

SILVERFORT MFA

Protect the Unprotectable – White Paper

WATCH A WEBINAR

and get your own copy of a whitpaper "The State of the Identity Attack Surface"

WATCH A WEBINAR

and get your own copy of a whitpaper "The State of the Identity Attack Surface"

SILVERFORT

Solution Briefs

SILVERFORT

Solution Briefs

SafeWave Ltd.

Złota 59 Street, 00-120 Warsaw
VATIN PL9542247262 || KRS 0000192350

Copyright © 2023, SafeWave. Powered by AI.

Design & support: Studio Grafiki - Advertising Agency