Saudi Arabia Network Attack Shamoon (v1 & v2) and Ransomware

[MOIDIN KUNHI]

Hello Support Team,

For the last four years, many large scale companies in Saudi Arabia faced major virus attack on their networks, servers and many user computers. Evidently, small scale companies are very few where they faced these viruses. However, these small scales securing their servers/networks by implementing FortiGate, SOPHOS, Sonicwall and etc.. 

As I'm Cisco Engineer, I strongly recommend you to implement Cisco device only!!

I would like to share with you that one of the victims in this virus affect, called me to suggest best solutions for their SAP data-center Network to protect the servers. Then I suggested them to take CISCO product in which hardware and software both are available which will prevent from the viruses and other harmful resources for the servers/networks.

Below Which is the best services to protect the servers and  any other source to protect !?.

Subscription You Purchase	License You Assign in FirePOWER System
TA	Control + Protection (a.k.a. "Threat & Apps," required for system updates)
TAC	Control + Protection + URL Filtering
TAM	Control + Protection + Malware
TAMC	Control + Protection + URL Filtering + Malware
AMP	Malware (add-on where TA is already present)
URL	URL Filtering (add-on where TA is already present)

BR,

Moidin Kunhi

[Dennis Mink]

Thanks for sharing Moidin.  greatly appreciated

[Rahul Govindan]

If you are looking at ransomware defense, AMP is the most critical component for this. This only provides protection at the network level. In order to have a complete protection, you should look at combining the Firepower AMP with other complimentary solutions such as Amp for Endpoints and Cisco Umbrella for DNS level protection. You can read more here:

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/ransomware-defense/at-a-glance-c45-737465.pdf

[MOIDIN KUNHI]

thanks Rahul,

what about Shamoom v1 and v2!! which is the best vendor can defense!??

[Rahul Govindan]

I can talk from a Cisco perspective that Firepower AMP should be able to detect and mitigate Shamoon attacks. This is detailed in the Cisco Talos blog here:

http://blog.talosintel.com/2017/01/shamoon-2.html#more

[MOIDIN KUNHI]

thanks mr. Rahul, appreciated your valuable feedback.