Ransomware Protection Solutions by Ricoh- Securing Your Digital Workspace
                     Ransomware 
Containment    
& Isolation
An automated solution to stop a ransomware outbreak within your organization
Let’s face facts: Even the most well-protected organizations fall victim to 
ransomware. Cybercriminals are constantly developing new and innovative Can you answer these 
questions in the event of a 
methods to defeat traditional, prevention-based detection methods. ransomware outbreak?
To stay safe from ransomware, an organization must evolve its security 
defenses and introduce a layered approach. Once ransomware triggers its • How do you see which files are 
encrypted and where they reside? 
payload (encryption), it may be too late for existing security to react. At this 
point, the only thing that matters is how fast you can stop the illegitimate • How do you identify which user and 
encryption of  up to 10,000 files per minute. which device is encrypting files? 
• How do you stop the ongoing 
A layered approach includes a complementary solution to detect and stop encryption quickly before significant 
illegitimate encryption once it is ongoing. It can do that by monitoring the      damage occurs? 
file activity on monitored file- and cloud shares. As soon as it sees ongoing • How long will it take you to restore 
criminal encryption and file corruption, it reacts and isolates the user causing it. hundreds of thousands of files, and 
what is the total cost of downtime? 
Introducing the Ricoh ransomware containment solution, RansomCare 
(RC) by BullWall, a unique and proven layer of defense. Over 20 detection • What amount of time is needed to 
accurately report to data authorities 
sensors assess each file change on monitored shares. If the tell-tale signs if thousands of files with personal 
of ransomware (illegitimate encryption) are initiated, and files are actively information have been illegally 
being encrypted on monitored file- and cloud shares, RC reacts by isolating encrypted? 
the compromised device and user to stop the criminal encryption process. It 
is a vital element of your overall defense strategy, providing critical security 
defense for a small portion of your available security budget.
www.ricoh-usa.com/ransomcare
Why Ransomware Matters
Hassle free remote installation
Now more than ever, the C-suite (CIO, CISO, CFO, and CEO) has a 
RansomCare is an agentless solution and 
significant stake in securing data and intellectual capital to protect is not installed on endpoints or existing 
personally identifiable information (PII), revenue, maintain customer servers, or file servers. There is no impact 
on network performance. Agentless file 
loyalty, and secure shareholder value. Traditional security defenses behavior monitoring and machine learning 
focus on preventing malware from executing and protecting your techniques are deployed with ease in 4 to 6 
organization, should endpoints be the target of malware. But what if hours, and RansomCare will be configured 
according to your environment. RC features 
they fail? Ransomware is another story. It has crippled organizations Cloud Connectors for organizations 
even though they had the best-of-breed security solution in place. utilizing Microsoft O365 (SharePoint, 
Organizations today should consider deploying an additional line of Teams, OneDrive) and Google Drive. Full 
integration to other security solutions like 
defense acting as the ‘sprinkler system’ should prevention-based security Cisco ISE and Windows Defender ATP 
solutions fail. or SIEM system is available via RESTful 
API allowing your security teams to unify 
It’s critical that organizations don’t rely solely on a reactive response to security management across an increasingly 
modern malware threats. Daily we hear reports on how this strategy complex sea of endpoints. 
has proven to fail. The future defense strategy needs to include business • No Cloud Installation 
continuity and disaster recovery with a solution, enabling automatic • No Endpoint Installation (agentless) 
• No File Server / Storage Installation 
alerting, shutdown response, and quick recovery without the vast costs 
often associated with ransomware attacks. Alerts and Integrations 
RansomCare built-in alerting services 
How it works Email Notifications SMS Alert 
Mobile “SOC” 
With a rapidly expanding attack surface to defend and multiple entry API to other systems
points for malware into organizations today, RansomCare delivers a 24/7 2-Way Interface to Restful API (pre-configured scripts)
automated containment response to ransomware outbreaks with built-in Splunk
Cisco ISE
response and reporting. It does not matter which user or which device Windows Defender
triggered the encryption. Nor does it matter if it is a known or unknown Aruba
IBM Radar
ransomware variant or if the outbreak started on an endpoint, a mobile McAfee
phone, an IoT device, via email, USB, or were deployed by someone inside Symantec
TrendMicro
your organization. RC investigates the heuristics of each file accessed by ForeScout
a user on monitored file shares either on-premise or in the cloud, without and many others ...
causing any network overhead. When RansomCare detects ongoing 
encryption and file corruption on monitored shares, an alert is raised 
instantly, and a response is triggered to disable and isolate the device and 
Ransomware Assessment Test
user encrypting your data.
Ricoh and BullWall can perform a 
RansomCare also works in virtual environments like Citrix servers/ Ransomware Assessment Test where a safe 
sessions, Terminal servers/sessions, Hyper-V, VMware, and the Cloud, and controlled ransomware simulator is used 
including Azure and Amazon AWS/EC2, SharePoint, Google Drive, and to simulate zero-day file encryption and rapid 
file changes. We will then test RansomCare 
Microsoft 365. A wide range of customizable isolation methods can be in your environment to demonstrate how 
utilized, such as forced shutdown, disable VPN, disable AD-user, disable the solution responds to an outbreak of file 
network access, revoke cloud permissions, and many others. Integration encryption. Ask a sales representative for 
through RESTful API to other security solutions means your security more information.
teams can unify security management across an increasingly complex 
sea of endpoints.
This document is for informational purposes only and this document and any related services or products described herein are not intended to provide any 
legal, regulatory, compliance, or other similar advice. You are solely responsible for ensuring your own compliance with all legal, regulatory, compliance, 
or other similar obligations. While care has been taken to ensure the accuracy of this information, Ricoh makes no representation or warranties about the 
accuracy, completeness or adequacy of the information contained herein, and shall not be liable for any errors or omissions in these materials. Actual results 
will vary depending upon use of the products and services and the conditions and factors affecting performance. The only warranties for Ricoh products and 
services are as set forth in the express warranty statements accompanying them.
R4049