Bullwall - Version 2

Global Leaders in Ransomware Containment

Data protection against known and unknown ransomware variants

Secure your organization,

reputation and bottom line when other security solutions fail.

BullWall is a fast-growing international cybersecurity solution provider with a dedicated focus on protecting critical data during active ransomware attacks. We are the only security solution able to contain both known and unknown ransomware variants in seconds, preventing encryption and exfiltration across all data storage types.

" IT security leaders should work under the assumption that a ransomware attack will be successful and ensure that the organization is prepared to detect it as early as possible and recover as quickly as possible. "

Gartner VP of Midsize Enterprise Security, Paul Furtado, stated in Computer Weekly

99%

Ransomware variants that bypassed EDR security solutions

75%

Zero-day vulnerabilities exploitable by ransomware that involve Microsoft, Apple, and Google products

132%

Increase in encryption threats throughout 2022

Agentless solution requiring nothing to install on endpoints

Protects all critical IT infrastructure on-prem and cloud with 24×7 automated containment

Automated compliance reporting for standards such as GDPR and NIST

Try Our Cost of Downtime Calculator

Let’s face facts :

Even the most well-protected organizations fall victim to ransomware.

Malicious attackers are constantly innovating new and novel methods to defeat traditional, prevention-based detection methods. Our unique, agentless, multi-layered detection system detects and isolates ongoing illegitimate encryption and file corruption via a three-tiered action sequence. RansomCare is engineered to:

MONITOR & DETECT

Monitors data activity on file shares in real time

Instantly detects ongoing illegitimate encryption

ISOLATE & QUARANTINE

Identifies and isolates the user and client initiating the encryption

Deploys built-in scripts to isolate the affected user and stop the file encryption

RECOVER & REPORT

Quickly identifies any encrypted files that can be restored from the backup

Automates any necessary incident reporting

There were over 200 million ransomware attacks in the last half-year of 2020. That’s nearly 25 attacks per second. The COVID-19 pandemic has caused a surge in cybercrime. While organizations are moving workers outside of the corporate-grade firewall, more and more cybercrime groups want a piece of the pie. Experts agree that it is no longer a question of if, but when you get hit.

Ransomware is evolving. So must your security response.

Ransomware is evolving. So must your security response. New strains of ransomware can disable endpoint protection, AV, firewalls, and even backup solutions before encryption starts. What do you do if your perimeter and endpoint protection is breached? BullWall RansomCare focus to protect your data storages; not your endpoints. You already have protection in place on your computers and endpoints, but what do you have to stop ongoing illegitimate encryption on file shares?

RansomCare is the answer. It detects and responds the very second illegitimate encryption and file corruption begins on file shares, providing your IT team a critical Last Line of Defense.

A Different Approach

RansomCare leverages heuristic analysis and file metadata to monitor traffic between endpoints and file shares(on-premise or cloud) to swiftly and efficiently detect evidence of an active ransomware breach. Instead of searching for ransomware, RansomCare detects and responds to ransomware’s malicious intent: illegitimate file encryption.

Agentless Solution

RansomCare is not installed on endpoints or any existing file servers. Our agentless solution is easily deployed within days and leverages Machine Learning to configure automatically. RansomCare creates no network performance overhead and supports integration with existing security solutions to strengthen the overall defense.

Detects the Unknown

Cybercriminal development teams constantly monitor prevention-based security vendors for software updates; they know when existing variants are at risk of being detected and when to change their methods. RansomCare circumvents this problem by detecting encryption caused by known and unknown ransomware variants.

Utilize the Cloud

RansomCare works seamlessly with Office 365, Sharepoint and Google Drive. RC is OS-agnostic to the device type accessing the cloud, including mobile devices, tablets, MAC, IoT, and laptops, and also for OS independent environments, such as Windows, Android, IOS and Linux.

Cover all Entry Points

Regardless of whether an attack starts on an endpoint, a mobile phone, an IOT device, via email, website drive-by-attack, USB cable, or was deployed by someone inside your organization, RansomCare reacts immediately when said device or user causes encryption on file shares either on-premise or in the cloud. RansomCare responds by isolating and containing the compromised device and user, instantly halting the encryption process.

Complementary

Organizations that fall victim to ransomware typically have between 4-7 prevention-based security tools in place. RansomCare is not a replacement, but a complementary last line of defense security layer.

We don’t compete. We complement.

BullWall RansomCare is not a replacement for your current security solution; rather, it complements the security defenses you have in place today. The graph on the right shows the most common solutions used by our RC customers. While many of the EDR/AV/Next-Gen AV products will protect you under most attack scenarios, they are largely endpoint-focused and therefore, not 100% failsafe.

The increasing number of successful ransomware attacks prove there is no perfect solution. Truth is, preventative-only solutions sometimes fail, and once illegal encryption begins, the source of the malware matters not; swift action to stop the attack before significant damage can occur is your #1 priority. And here is where BullWall RansomCare steps in.

Our customers utilize a wide range of different end point solutions, ranging from well-established global vendors, next gen technologies and emerging solutions. All have one thing in common: they rely on RansomCare as their Last Line of Defense.

Gain control without costly network requirements or performance overhead.

DETECT

RansomCare’s live data activity monitoring instantly detects ongoing encryption on file shares

Organizations are often unaware of the enormous amount of file changes that occurs on their file shares. RC listens into existing network notifications to analyze all file changes (created, modified, renamed and deleted) to detect ongoing illegitimate encryption within seconds.

RESPOND

Isolate and eliminate in seconds

The moment illegitimate encryption detected on file shares (not the individual device), RansomCare activates an isolation and containment protocol. Actions can include the forced shutdown of the compromised device, disabling the compromised user’s VPN, and revoking cloud access, network access and AD access. Illegitimate file encryption ceases in seconds, and your security team is instantly alerted. Integration through RESTful API to other security solutions (such as SIEM, NAC and EDR) enables your security teams to unify security management across all devices.

RECOVER

Keep your organization running with minimal impact

BullWall RansomCare’s data-recovery protocol has your organization up and running with minimal cost and downtime. After the threat has been mitigated, a comprehensive list of any files infected pre-isolation is generated, and can easily be restored from your backup either manually or via integration. An advanced history log captures all attack details, offering your security team valuable and actionable insights over any affected files.

How impenetrable are your defenses?

Despite having the best prevention-based solutions that money can buy, an increasing number of organizations are falling victim to ransomware. Preventative solutions don’t stand a chance if even one user or device is compromised, or a patch is missing. Today’s ransomware variants are capable of encrypting up to 10,000 files per minute per infected machine. It takes, on average, hours before an organization realizes they are under attack; at this point, stopping the breach is next to impossible.

Ransomware’s financial and reputational impact is increasingly damaging and costly. Paying the ransom only incentivizes criminals to launch even more attacks and develop new methods to breach your defenses. Understanding the total effectiveness of your current security posture is therefore crucial; these few questions can help determine how well your current defenses can protect your data in the event of a ransomware breach.

Assess your risk

Discover your hidden vulnerabilities.

Does your current security setup allow you to identify the user and device that initiated the outbreak (Patient Zero)?

Do you have the ability to immediately stop illegitimate encryption before significant damage occurs?

Do you have complete visibility over what files have been encrypted and their location?

Test your current defenses

Are you unable to answer the questions above? If so, you’re not alone.
Few organizations are 100% aware of their hidden vulnerabilities.

To help organizations gain an overview of their current security profile and assist in the battle against ransomware criminals, we offer a non-binding Ransomware Assessment Test. The assessment is conducted by our cybersecurity experts who test your current infrastructure resilience against a ransomware outbreak.

The two-hour assessment will give you a clear overview of your current defense posture and demonstrate how RC’s Last Line of Defense solution provides an additonal, and crucial, layer of security.

Unify and Strengthen your Defense

Skyrocket the value of your Security Spend with a critical Last Line of Defense solution engineered to fully integrate with your existing security measures.

Does your current security setup allow you to identify the user and device that initiated the outbreak (Patient Zero)?

BullWall RansomCare seamlessly integrates with Cisco ISE, Aruba, Splunk, IBM QRadar, ATP and other solutions typically within hours.

In the event illegitimate encryption is detected, RansomCare immediately sends an alert and relevant information to integrated solutions.

All integration, communication and alert functions are fully operable whether you’re hosting in the cloud or have an MSP managing your IT solutions and infrastructure.

The Cost of Downtime

A successful ransomware outbreak can wreak serious and long lasting damage on an organization’s reputation and bottom line. Aside from the immediate costs and expenses related to downtime, ransomware can undermine relationships with suppliers, partners, customers and institutions your business depends upon.

Forward-thinking technology leaders understand that building a security profile that effectively mitigates risk and can respond to potential breaches requires a firm understanding of the costs related to downtime.

Hassle Free Reporting & Compliance

A ransomware breach can encrypt files on multiple shares and folders across your network, making mandatory reporting a formidable challenge. Compliance reporting such as GDPR, CCPA, HIIPA and PCI-DSS-regulated entities often carry the additional burden of having to file a report within a certain timeframe following a breach event1.

RansomCare’s immediate response means that in the event of a breach very few files are likely to be compromised and require the filing of a minor incident report to document the incident. RansomCare’s fully automated internal and external incident reporting ensures accuracy and compliance.

RansomCare ensures compliancy by automatically:

Recording the exact time of the attack (beginning to end)

Listing all affected files and their owner

Generating an incident report to key stakeholders

Identify the compromised user and device

Detailing how and when the breach was stopped

Generating an incident report for sharing with Data Protection Authorities

1Art. 33 GDPR Section 1: In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority…”

Immediate Response and Integration Options

INTEGRATION OVERVIEW

RC is engineered to fully integrate with other security solutions such as SIEM, NAC, Backup and EDR solutions via the RESTful API, making it easy for your security team to unify security management across all devices.

RC also works seamlessly in virtual environments such as Citrix servers/sessions, Terminal servers/sessions, Hyper-V, VMware and the cloud, including Azure and Amazon AWS/EC2, SharePoint, Google Drive and Office 365.

Seamless Integration with Other Security Tools

RC can be integrated 2 ways to almost any SIEM and Network Access Control (NAC) solution. RC has a full featured RESTful WebAPI which can be easily adapted and setup, as it comes with pre-configured scripts for most used SIEM and NAC solutions. This secures easy implementation and RC can be tailored to fit your setup solution. Setting up an integration to Cisco ISE, Aruba, Splunk, IBM QRadar, ATP and other solutions can in most cases be done in less than 1 hour. When RC detects a ransomware attack, RC will immediately alert and send information to integrated solutions.

In case of using SIEM integration to e.g., Splunk, RC will use JSON files sent to sensors in Splunk through TCP/Port listeners or through file integration. This will immediately trigger an alert in Splunk that will follow the workflow which is configured in Splunk for your Security Operations Centre (SOC) or Response Team to take appropriate action.

All product names, trademarks and registered trademarks are property of their respective owners. All company, product and service names used in this website are for identification purposes only.

In case of using NAC integration to for e.g., Cisco ISE, RC will use the “ANC_Policy_Quarantine” using XML to send to Cisco ISE WebAPI which immediately will isolate the attacked client/user from the network and the attack will instantly stop.

Setting up integration in RC is optional and not required. All integration, communication and alerting functions are also working if you are hosting in the cloud or having an MSP taking care of your IT solutions and infrastructure.

File Type	File Name	Download	Share
Product Information	Version 2 PPT - FEB 9th 2023
Product Information	RC Info Sheet - USA 2022-1
Product Information	BullWall Ransomware Assessment Doc_FINAL Dec 2022