24x7 Anchorage Critical Crypto-Ransomware
Infection Damage Assessment and Remediation Support

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses of all sizes vulnerable to an assault. Different iterations of crypto-ransomware such as Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still inflict havoc. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with more as yet unnamed newcomers, not only encrypt on-line data but also infiltrate most configured system restores and backups. Data synchronized to the cloud can also be encrypted. In a vulnerable environment, it can make automated recovery useless and basically knocks the network back to zero.

Getting back on-line applications and information after a crypto-ransomware intrusion becomes a race against time as the victim tries its best to stop the spread, remove the crypto-ransomware, and restore mission-critical activity. Because ransomware requires time to replicate, penetrations are usually launched during nights and weekends, when penetrations in many cases take longer to detect. This compounds the difficulty of rapidly assembling and coordinating a qualified response team.

Progent has a variety of support services for protecting organizations from crypto-ransomware attacks. These include team member training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security solutions with artificial intelligence technology from SentinelOne to identify and disable day-zero cyber threats rapidly. Progent in addition provides the services of veteran ransomware recovery professionals with the talent and commitment to reconstruct a breached environment as quickly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware event, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will provide the needed keys to decipher all your data. Kaspersky determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to piece back together the vital parts of your Information Technology environment. Without access to essential information backups, this calls for a broad range of skill sets, well-coordinated project management, and the capability to work continuously until the job is completed.

For decades, Progent has offered expert IT services for businesses throughout the United States and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of expertise provides Progent the ability to quickly identify critical systems and re-organize the surviving components of your network environment following a crypto-ransomware penetration and configure them into a functioning system.

Progent's security team deploys state-of-the-art project management tools to orchestrate the complex restoration process. Progent appreciates the urgency of acting rapidly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to get critical systems back on line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A client sought out Progent after their organization was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by Northern Korean state criminal gangs, suspected of adopting techniques exposed from America's NSA organization. Ryuk goes after specific businesses with little ability to sustain operational disruption and is one of the most lucrative versions of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in Chicago and has around 500 employees. The Ryuk event had shut down all essential operations and manufacturing processes. The majority of the client's information backups had been on-line at the beginning of the attack and were encrypted. The client was pursuing financing for paying the ransom (more than two hundred thousand dollars) and praying for good luck, but in the end reached out to Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the essential elements that needed to be restored in order to restart departmental operations:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then charged ahead with setup and storage recovery of key servers. All Exchange data and configuration information were intact, which facilitated the restore of Exchange. Progent was able to collect intact OST files (Outlook Email Off-Line Data Files) on staff desktop computers and laptops to recover mail information. A not too old off-line backup of the customer's accounting/ERP systems made them able to recover these required applications back servicing users. Although a large amount of work remained to recover fully from the Ryuk damage, the most important services were restored quickly:

During the next month key milestones in the recovery process were achieved through tight collaboration between Progent engineers and the customer:

• In-house web sites were brought back up without losing any information.
• The MailStore Server exceeding 4 million archived messages was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory functions were completely recovered.
• A new Palo Alto Networks 850 firewall was set up.
• Ninety percent of the user desktops and notebooks were fully operational.

Conclusion
A possible business-killing catastrophe was dodged with top-tier professionals, a wide spectrum of IT skills, and tight teamwork. Although in post mortem the crypto-ransomware incident described here should have been stopped with up-to-date cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well designed security procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, remediation, and file disaster recovery.

To review or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Anchorage a range of online monitoring and security evaluation services to help you to reduce your vulnerability to crypto-ransomware. These services incorporate next-generation machine learning capability to detect zero-day variants of crypto-ransomware that are able to evade legacy signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily get by legacy signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud-based resources and provides a single platform to automate the complete threat lifecycle including filtering, identification, mitigation, remediation, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth security for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, device management, and web filtering through cutting-edge technologies packaged within a single agent accessible from a unified console. Progent's security and virtualization consultants can help you to plan and implement a ProSight ESP deployment that addresses your organization's specific needs and that allows you demonstrate compliance with government and industry data protection standards. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that call for immediate attention. Progent can also assist you to install and verify a backup and restore system like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with advanced backup technology providers to create ProSight Data Protection Services, a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your backup processes and enable non-disruptive backup and fast recovery of critical files/folders, applications, images, and VMs. ProSight DPS lets your business avoid data loss caused by equipment breakdown, natural disasters, fire, malware such as ransomware, user error, ill-intentioned insiders, or application bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of top information security companies to provide web-based management and world-class protection for all your email traffic. The hybrid architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This decreases your exposure to external attacks and saves system bandwidth and storage. Email Guard's onsite security gateway device adds a further level of analysis for incoming email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The onsite gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller organizations to diagram, monitor, enhance and troubleshoot their networking appliances such as routers, firewalls, and access points as well as servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are always current, copies and manages the configuration information of virtually all devices on your network, monitors performance, and generates alerts when potential issues are detected. By automating time-consuming management and troubleshooting activities, WAN Watch can cut hours off ordinary tasks like network mapping, reconfiguring your network, locating appliances that require critical software patches, or resolving performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) technology to keep your network operating efficiently by tracking the state of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your specified IT management personnel and your Progent consultant so all looming problems can be addressed before they can disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Because the system is virtualized, it can be moved easily to a different hosting environment without requiring a lengthy and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, retrieve and protect data about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or warranties. By cleaning up and organizing your IT documentation, you can eliminate up to half of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents related to managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior-based machine learning technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily escape traditional signature-based AV tools. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a unified platform to manage the entire threat lifecycle including blocking, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Help Center managed services permit your IT group to offload Call Center services to Progent or split responsibilities for Service Desk support seamlessly between your internal network support team and Progent's nationwide pool of IT service technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent supplement to your corporate IT support staff. End user interaction with the Service Desk, delivery of technical assistance, problem escalation, trouble ticket creation and updates, performance metrics, and maintenance of the service database are consistent whether issues are resolved by your corporate network support resources, by Progent, or by a combination. Find out more about Progent's outsourced/shared Service Desk services.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of any size a flexible and affordable alternative for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your dynamic IT system. In addition to optimizing the protection and functionality of your computer network, Progent's patch management services permit your IT staff to concentrate on line-of-business projects and activities that derive the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to defend against password theft by using two-factor authentication. Duo enables one-tap identity verification on iOS, Google Android, and other personal devices. Using 2FA, whenever you sign into a protected application and give your password you are asked to confirm who you are via a device that only you have and that is accessed using a separate network channel. A wide range of devices can be utilized as this second means of ID validation including a smartphone or watch, a hardware/software token, a landline telephone, etc. You may register multiple validation devices. For details about ProSight Duo identity authentication services, visit Duo MFA two-factor authentication services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of in-depth reporting tools created to work with the industry's top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.