Putting an End to Ransomware: Mastering Antivirus & Malware for Windows Endpoints

Ransomware is a particularly painful type of malware. Malware is “hostile or intrusive software” that is illegally introduced onto your system for malicious reasons. When ransomware infects your system it blocks access to your data until the payment is delivered to the criminals who are extorting you or your business. It's an illegal threat to your data.

Acronis Active Protection is an advanced ransomware protection technology. Completely compatible with the most common anti-malware solutions, Acronis technology actively protects all of the data on your systems, including documents, media files, programs, and more – even your Acronis Cyber Backup files

EDR (Endpoint Detection and Response) is an active, endpoint security solution that does real-time continuous monitoring correlating different events that happen on an endpoint level to detect malicious activity, compromised processes and suspicious behavior on end-user devices. The purpose is to identify in-progress attacks, potential security incidents, compromises or breaches – and then acting as a response system, providing capabilities to remediate it.

The primary EDR capabilities as defines by Gartner are:

- Detect security incidents
- Contain the incident at the endpoint
- Investigate security incidents
- Provide remediation guidance

Acronis Advanced Security + EDR enables you to simplify endpoint protection — rapidly detect, analyze and remediate advanced attacks while ensuring unmatched business continuity. Eliminate the cost and complexity of multiple point products and enable your team with one complete cyber protection solution that is simple to manage and deploy.

An endpoint (workload) is any device or node that serves as a source or destination for communication over a network. Examples of endpoints include desktop computers, laptops, tablets, smartphones, printers, servers, ATM machines and IOT devices.

But they do not typically include devices designed to manage and forward data communication, such as routers, gateways, firewalls and load balancers.

The concept of an endpoint has played an increasingly important role in cybersecurity in recent years. This has largely been the result of the growing trend toward remote work and bring-your-own-device (BYOD) policies.

The endpoint protection strategy of any company that is a potential target of cyber threats and/or that stores valuable endpoint data should include advanced endpoint threat detection capabilities and response tools.

SMB and mid-market organizations are under increased risks of advanced cyber threats due to limited internal capabilities and budget constraints, affecting their access to advanced endpoint security solutions, historically targeted at emprises due to costs and complexity.

Moreover, for businesses of all sizes operating in industries with high regulatory requirements and increased cyber risks such as Finance, Healthcare, Legal, Online Retail, Public Sector, EDR is a must for the organization’s cybersecurity strategy to enable compliance and ensure sensitive endpoint data is out of reach of cyber threats.

With Advanced Security + EDR you can ensure that organizations of varying size and complexity are protected with high-value services, scalable across multiple clients.

There’re multiple types of advanced cyber threats, capable of bypassing other endpoint protection layers like existing antivirus software, some of the most common ones include:

Zero-day malware and ransomware – Malware and/or ransomware that infiltrates the system through a zero-day vulnerability (a vulnerability that is exploitable, but the software vendor has not released a patch for it yet – the vulnerability can be known or unknown). Can bypass some behavior-based detections.

Advanced persistent threats (APTs) - Attacks that use continuous, sophisticated and highly evasive hacking techniques to gain unauthorized access to system and stay undetected for a prolonged period of time, with potentially destructive consequences. They usually consist of a few phases, including system infiltration, escalation and lateral movement within the system, and exfiltration of sensitive data. Advanced persistent threats commonly depend on “living off the land” techniques that refer to attacker-behavior that uses tools that already exist in the targeted environment – making it harder to detect, on considerably cheaper to carry out. 

Fileless attacks - Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect attacks and remediate them.

Hacking - Hacking is the act of identifying and then exploiting vulnerabilities in a computer system or network, usually to gain unauthorized access to personal or organizational data. Depending on the used techniques, hacking can be hard to detect, as it might leverage stolen credentials or other techniques that make it look like a perfectly normal process until exfiltration happens and it’s already too late to respond.

Detecting and responding to these and other advanced threats requires more advanced security controls like EDR.

Existing, best-of-breed EDR tools and solutions are oriented at enterprises due to costs and complexity and require large security teams to operate. Moreover, security analysts need to manually perform threat hunting activities by scanning hundreds lines of logs with hours of investigating suspicious activities. But even then, a cross-NIST protection, ensuring business continuity, requires additional solutions and software agents to achieve, increasing the complexity and solution sprawl even further.

Advanced Security + EDR performs continuous data collection based on security related events, similar as other EDR tools, but then the solution streamlines your analysis capabilities by raising alerts on any potential incidents and aggregating data in guided attack interpretations mapped to MITRE ATT&CK®. This helps security analysts to rapidly investigate suspicious activities across multiple clients, cutting investigation times from hours to minutes to achieve better scalability.

Moreover, Advanced Security + EDR is an integrated endpoint security solution in Acronis Cyber Protect Cloud, unlocking unique benefits for administrators such as a single-click response across the NIST, including recovery. This removes solution sprawl and enables you to deliver comprehensive endpoint protection via a single Acronis agent and console.