Albany 24/7 Critical Ransomware
Virus Detection and Repair Support

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for businesses of all sizes unprepared for an attack. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and still cause damage. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, plus frequent unnamed newcomers, not only do encryption of online critical data but also infect all available system protection mechanisms. Data synched to cloud environments can also be corrupted. In a vulnerable environment, this can render any restoration hopeless and basically knocks the network back to square one.

Getting back on-line programs and data following a crypto-ransomware event becomes a race against the clock as the victim tries its best to contain the damage, remove the ransomware, and resume business-critical activity. Since ransomware requires time to replicate, assaults are usually sprung during nights and weekends, when successful penetrations are likely to take longer to identify. This compounds the difficulty of promptly marshalling and orchestrating an experienced mitigation team.

Progent has an assortment of services for securing organizations from crypto-ransomware penetrations. These include user education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of next-generation security appliances with artificial intelligence capabilities from SentinelOne to detect and suppress day-zero cyber attacks rapidly. Progent in addition offers the assistance of veteran crypto-ransomware recovery engineers with the talent and perseverance to reconstruct a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Recovery Services
Soon after a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will return the needed keys to unencrypt all your information. Kaspersky estimated that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to piece back together the critical components of your Information Technology environment. Without access to essential system backups, this requires a wide range of skill sets, top notch project management, and the willingness to work continuously until the recovery project is finished.

For two decades, Progent has made available professional IT services for businesses throughout the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of experience provides Progent the skills to quickly identify necessary systems and consolidate the surviving pieces of your Information Technology environment after a ransomware attack and assemble them into a functioning network.

Progent's ransomware group has best of breed project management tools to coordinate the complex restoration process. Progent appreciates the urgency of working swiftly and in unison with a client's management and IT resources to assign priority to tasks and to put key services back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Intrusion Recovery
A business escalated to Progent after their network was crashed by the Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, possibly using algorithms exposed from America's NSA organization. Ryuk seeks specific businesses with little or no tolerance for operational disruption and is among the most profitable instances of crypto-ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer based in the Chicago metro area with around 500 staff members. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's system backups had been online at the start of the attack and were damaged. The client was evaluating paying the ransom (in excess of $200K) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked with the client to quickly determine and prioritize the most important elements that needed to be addressed to make it possible to continue company functions:

• Active Directory
• Email
• Accounting/MRP

Within two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then initiated reinstallations and hard drive recovery on needed servers. All Exchange Server schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate local OST files (Outlook Email Offline Data Files) on staff PCs and laptops in order to recover mail information. A not too old offline backup of the client's financials/MRP systems made them able to restore these required services back servicing users. Although significant work remained to recover completely from the Ryuk event, the most important systems were returned to operations rapidly:

Throughout the next couple of weeks important milestones in the recovery project were achieved through tight collaboration between Progent team members and the client:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Server containing more than four million archived emails was spun up and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were completely recovered.
• A new Palo Alto 850 security appliance was set up and programmed.
• Nearly all of the user desktops were back into operation.

Conclusion
A likely business extinction catastrophe was dodged with results-oriented experts, a broad range of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus attack described here should have been identified and disabled with advanced security systems and best practices, staff education, and well designed security procedures for data protection and proper patching controls, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of experts has proven experience in ransomware virus blocking, mitigation, and file disaster recovery.

To review or download a PDF version of this customer story, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Albany a range of online monitoring and security assessment services designed to assist you to reduce the threat from ransomware. These services incorporate next-generation artificial intelligence capability to uncover new variants of crypto-ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which easily get by legacy signature-matching AV products. ProSight ASM safeguards on-premises and cloud-based resources and provides a single platform to automate the entire threat lifecycle including protection, infiltration detection, containment, cleanup, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer economical in-depth security for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint control, and web filtering through leading-edge tools packaged within a single agent accessible from a single control. Progent's security and virtualization consultants can assist you to design and configure a ProSight ESP environment that meets your organization's unique needs and that helps you demonstrate compliance with government and industry information security regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for urgent action. Progent's consultants can also assist your company to install and test a backup and restore system like ProSight Data Protection Services so you can get back in business quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange email filtering.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup technology providers to produce ProSight Data Protection Services, a portfolio of management offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and enable non-disruptive backup and rapid restoration of vital files/folders, applications, images, and VMs. ProSight DPS lets you recover from data loss resulting from equipment failures, natural calamities, fire, malware such as ransomware, human mistakes, malicious insiders, or software glitches. Managed services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading data security companies to deliver web-based management and comprehensive security for all your inbound and outbound email. The powerful structure of Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based threats. Email Guard's cloud filter serves as a first line of defense and keeps most unwanted email from reaching your security perimeter. This decreases your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a further layer of inspection for inbound email. For outbound email, the local security gateway offers anti-virus and anti-spam protection, DLP, and email encryption. The local security gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to diagram, monitor, enhance and troubleshoot their networking hardware like routers, firewalls, and load balancers as well as servers, printers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology maps are always updated, captures and manages the configuration of almost all devices on your network, tracks performance, and sends alerts when problems are detected. By automating complex management and troubleshooting activities, WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, finding devices that require important updates, or resolving performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to keep your network running efficiently by tracking the state of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your designated IT management staff and your assigned Progent consultant so that any potential issues can be addressed before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a secure Tier III data center on a fast virtual host configured and maintained by Progent's IT support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the applications. Since the system is virtualized, it can be moved easily to an alternate hosting environment without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and protect data about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSL certificates or domains. By updating and managing your IT infrastructure documentation, you can eliminate as much as 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management features a common location for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT information. Whether you're planning enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior analysis technology to defend endpoints as well as physical and virtual servers against new malware attacks such as ransomware and email phishing, which routinely get by traditional signature-based AV products. Progent ASM services safeguard on-premises and cloud-based resources and offers a single platform to automate the entire threat progression including blocking, infiltration detection, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new threats. Read more about Progent's ransomware defense and cleanup services.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Help Desk managed services enable your IT staff to outsource Support Desk services to Progent or divide activity for Help Desk services seamlessly between your in-house network support team and Progent's nationwide roster of certified IT service engineers and subject matter experts. Progent's Shared Service Desk offers a transparent supplement to your corporate IT support staff. Client access to the Help Desk, provision of support, escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the support database are consistent regardless of whether issues are resolved by your internal support staff, by Progent's team, or both. Find out more about Progent's outsourced/co-managed Help Desk services.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of all sizes a versatile and affordable alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving information system. Besides maximizing the security and functionality of your IT environment, Progent's patch management services free up time for your IT team to concentrate on line-of-business projects and activities that deliver the highest business value from your network. Find out more about Progent's patch management services.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification with Apple iOS, Android, and other out-of-band devices. With Duo 2FA, when you log into a protected online account and give your password you are requested to verify your identity on a device that only you possess and that is accessed using a separate network channel. A wide selection of devices can be used as this added means of ID validation such as a smartphone or wearable, a hardware token, a landline telephone, etc. You may register multiple verification devices. To find out more about ProSight Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time reporting utilities designed to work with the top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.