Hi all
I'm tossing around an idea, or requirement rather, I have and need some input. It's concerning all these ransomware that are causing me much headache. Some get caught by different layers in my defence but those that get through manage to do damage and cost us man hours to recover. What about all these encryptions that are going on in parallel, executed on the infected user PC and carried out on our file servers? I mean when a user, instead of having one or three files open at the same time, start accessing and writing thousands...there should be a clear market for a behavior analisys/protection feature there. Right?
Might not be a Cisco thing but you never know.
Regards
Fredrik