Addison 24-7 Critical Crypto
Infection Assessment and Remediation Consulting

Ransomware : Your Feared IT Catastrophe
Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level danger for businesses vulnerable to an assault. Different iterations of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and still inflict damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with additional unnamed newcomers, not only encrypt online data but also infect most accessible system protection. Files synched to cloud environments can also be ransomed. In a poorly architected environment, it can render automated recovery hopeless and basically sets the entire system back to square one.

Getting back services and data after a ransomware outage becomes a sprint against time as the targeted business fights to contain the damage, remove the crypto-ransomware, and resume enterprise-critical activity. Due to the fact that ransomware needs time to spread, penetrations are often launched on weekends, when successful penetrations typically take longer to recognize. This compounds the difficulty of quickly marshalling and coordinating a qualified response team.

Progent makes available a range of help services for protecting enterprises from ransomware events. These include team member education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of next-generation security solutions with machine learning technology from SentinelOne to detect and quarantine zero-day threats intelligently. Progent in addition can provide the assistance of seasoned ransomware recovery professionals with the skills and perseverance to rebuild a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
Subsequent to a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the needed codes to unencrypt any or all of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to piece back together the key parts of your Information Technology environment. Without the availability of complete data backups, this calls for a wide range of skill sets, top notch team management, and the ability to work 24x7 until the job is done.

For two decades, Progent has provided professional Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded advanced industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of experience provides Progent the skills to quickly ascertain necessary systems and organize the surviving pieces of your Information Technology system after a ransomware event and configure them into a functioning network.

Progent's security team of experts uses best of breed project management applications to coordinate the complicated recovery process. Progent appreciates the urgency of acting quickly and in concert with a client's management and Information Technology resources to prioritize tasks and to put critical services back online as fast as possible.

Client Story: A Successful Crypto-Ransomware Intrusion Restoration
A business contacted Progent after their organization was attacked by Ryuk crypto-ransomware. Ryuk is believed to have been developed by Northern Korean government sponsored criminal gangs, suspected of adopting technology exposed from the United States NSA organization. Ryuk targets specific businesses with limited room for operational disruption and is among the most lucrative iterations of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business located in the Chicago metro area with about 500 employees. The Ryuk intrusion had paralyzed all company operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the time of the intrusion and were destroyed. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and praying for the best, but in the end made the decision to use Progent.

Progent worked together with the customer to quickly assess and assign priority to the mission critical areas that had to be restored to make it possible to continue departmental operations:

• Active Directory (AD)
• E-Mail
• Financials/MRP

In less than 2 days, Progent was able to restore Active Directory services to its pre-virus state. Progent then performed reinstallations and storage recovery on the most important applications. All Microsoft Exchange Server ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect intact OST files (Outlook Offline Folder Files) on various PCs in order to recover email information. A not too old off-line backup of the customer's financials/MRP software made it possible to restore these essential applications back on-line. Although significant work still had to be done to recover fully from the Ryuk virus, essential systems were recovered rapidly:

Throughout the following few weeks important milestones in the recovery process were made through close cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than 4 million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were fully recovered.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A probable business catastrophe was evaded through the efforts of dedicated experts, a broad range of knowledge, and close collaboration. Although in hindsight the ransomware penetration detailed here should have been stopped with current cyber security solutions and best practices, user and IT administrator education, and well designed security procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, cleanup, and information systems recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Addison a portfolio of remote monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services include next-generation artificial intelligence capability to detect new strains of ransomware that can get past legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management techniques to keep your network operating efficiently by tracking the state of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your designated IT management personnel and your Progent engineering consultant so all looming issues can be resolved before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your client-server infrastructure by offering tools for streamlining common time-consuming jobs. These can include health checking, patch management, automated repairs, endpoint setup, backup and restore, anti-virus defense, secure remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alarm to your designated IT management staff and your assigned Progent technical consultant so potential issues can be fixed before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller organizations to diagram, monitor, enhance and debug their networking hardware like routers, firewalls, and load balancers plus servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology maps are always updated, captures and displays the configuration of almost all devices connected to your network, monitors performance, and sends notices when issues are discovered. By automating time-consuming management processes, ProSight WAN Watch can knock hours off common chores like network mapping, reconfiguring your network, locating devices that need important updates, or resolving performance problems. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth reporting plug-ins designed to work with the industry's leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to produce ProSight Data Protection Services, a family of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your data backup processes and enable non-disruptive backup and rapid restoration of critical files, applications, system images, and VMs. ProSight DPS helps your business protect against data loss resulting from equipment breakdown, natural calamities, fire, malware such as ransomware, human error, malicious insiders, or application glitches. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading information security vendors to provide centralized management and comprehensive security for all your inbound and outbound email. The hybrid structure of Progent's Email Guard integrates cloud-based filtering with an on-premises security gateway device to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter acts as a preliminary barricade and blocks most unwanted email from making it to your security perimeter. This reduces your exposure to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of analysis for inbound email. For outgoing email, the onsite gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The local gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that originates and ends inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation on Apple iOS, Android, and other personal devices. Using Duo 2FA, whenever you sign into a protected online account and enter your password you are requested to verify who you are on a unit that only you possess and that is accessed using a different network channel. A broad selection of out-of-band devices can be used for this added means of authentication including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate multiple validation devices. To learn more about Duo identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Help Center services allow your information technology team to outsource Support Desk services to Progent or split responsibilities for support services seamlessly between your internal support staff and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless supplement to your corporate support organization. End user interaction with the Service Desk, provision of support services, issue escalation, trouble ticket generation and tracking, performance measurement, and maintenance of the service database are cohesive whether incidents are taken care of by your corporate network support group, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Help Center services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior analysis technology to defend endpoints as well as servers and VMs against new malware assaults such as ransomware and file-less exploits, which routinely evade legacy signature-based anti-virus tools. Progent ASM services protect local and cloud-based resources and provides a single platform to automate the entire malware attack lifecycle including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard information related to your network infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can eliminate up to 50% of time spent trying to find vital information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're making improvements, performing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a flexible and affordable solution for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your dynamic information network. Besides optimizing the security and functionality of your computer network, Progent's software/firmware update management services allow your IT staff to focus on line-of-business projects and activities that deliver maximum business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which routinely escape traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to automate the entire malware attack lifecycle including filtering, detection, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer security for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP provides firewall protection, intrusion alarms, device control, and web filtering through leading-edge technologies incorporated within a single agent accessible from a unified console. Progent's security and virtualization experts can help you to plan and configure a ProSight ESP environment that addresses your company's unique requirements and that helps you demonstrate compliance with government and industry data security regulations. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent can also assist you to install and test a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange email filtering.