Baltimore 24x7 Critical Crypto
Computer Malware Damage Assessment and Removal Support

Crypto-Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that poses an extinction-level threat for businesses poorly prepared for an attack. Different versions of ransomware like the Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for many years and still cause harm. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as daily unnamed newcomers, not only encrypt on-line critical data but also infiltrate many configured system backup. Data synchronized to off-site disaster recovery sites can also be ransomed. In a poorly architected data protection solution, this can make any restoration useless and effectively sets the datacenter back to zero.

Retrieving applications and data following a crypto-ransomware intrusion becomes a sprint against time as the targeted organization fights to contain the damage, remove the virus, and resume mission-critical activity. Since ransomware needs time to replicate, attacks are usually sprung during weekends and nights, when penetrations are likely to take longer to uncover. This multiplies the difficulty of rapidly mobilizing and orchestrating a capable response team.

Progent provides a variety of solutions for protecting organizations from crypto-ransomware penetrations. Among these are user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security gateways with machine learning technology from SentinelOne to identify and disable zero-day cyber attacks intelligently. Progent in addition provides the assistance of expert ransomware recovery consultants with the talent and commitment to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware event, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the keys to unencrypt any or all of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to setup from scratch the vital elements of your IT environment. Absent access to essential data backups, this calls for a broad complement of IT skills, well-coordinated team management, and the capability to work non-stop until the recovery project is completed.

For decades, Progent has provided professional Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of experience gives Progent the capability to quickly understand important systems and re-organize the remaining pieces of your IT system after a ransomware event and configure them into an operational network.

Progent's security team of experts has powerful project management tools to orchestrate the complicated restoration process. Progent understands the urgency of working swiftly and together with a client's management and IT resources to assign priority to tasks and to get critical systems back on-line as fast as possible.

Business Case Study: A Successful Ransomware Intrusion Response
A client hired Progent after their network was penetrated by the Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, suspected of adopting approaches leaked from the U.S. NSA organization. Ryuk goes after specific organizations with limited tolerance for operational disruption and is among the most profitable examples of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in Chicago with around 500 employees. The Ryuk event had brought down all company operations and manufacturing processes. Most of the client's information backups had been directly accessible at the time of the attack and were destroyed. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked with the customer to quickly understand and prioritize the most important services that needed to be addressed to make it possible to restart departmental operations:

• Active Directory
• E-Mail
• MRP System

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then assisted with rebuilding and storage recovery on needed servers. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Outlook Email Offline Folder Files) on team PCs and laptops to recover email data. A not too old off-line backup of the businesses financials/MRP systems made them able to return these vital programs back available to users. Although significant work needed to be completed to recover fully from the Ryuk virus, core systems were restored rapidly:

Over the next month critical milestones in the restoration process were achieved in close cooperation between Progent team members and the client:

• Internal web sites were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million historical messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100 percent operational.
• A new Palo Alto Networks 850 firewall was set up.
• Most of the user workstations were back into operation.

Conclusion
A probable business-killing disaster was avoided due to results-oriented experts, a wide array of subject matter expertise, and close collaboration. Although in retrospect the ransomware attack described here would have been identified and disabled with current security technology solutions and best practices, staff education, and well thought out incident response procedures for data backup and proper patching controls, the reality is that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware penetration, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, cleanup, and information systems disaster recovery.

To review or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Baltimore a portfolio of remote monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services utilize modern machine learning technology to uncover zero-day strains of ransomware that are able to evade traditional signature-based security products.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system running efficiently by checking the health of vital computers that drive your information system. When ProSight LAN Watch detects an issue, an alert is sent automatically to your specified IT management personnel and your Progent engineering consultant so any looming problems can be resolved before they have a chance to impact productivity. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for monitoring and managing your client-server infrastructure by providing tools for performing common tedious jobs. These can include health checking, patch management, automated remediation, endpoint setup, backup and recovery, anti-virus protection, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alert to your designated IT personnel and your Progent consultant so that emerging issues can be taken care of before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map, track, enhance and troubleshoot their networking hardware such as routers and switches, firewalls, and load balancers plus servers, printers, endpoints and other devices. Incorporating state-of-the-art RMM technology, WAN Watch ensures that infrastructure topology diagrams are always updated, copies and displays the configuration of almost all devices on your network, monitors performance, and sends alerts when problems are detected. By automating tedious management processes, ProSight WAN Watch can cut hours off common tasks such as making network diagrams, reconfiguring your network, locating appliances that need critical updates, or resolving performance problems. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth reporting utilities created to work with the top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore software providers to produce ProSight Data Protection Services, a selection of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup processes and enable transparent backup and rapid restoration of critical files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural disasters, fire, malware like ransomware, human error, malicious employees, or software glitches. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading information security companies to deliver web-based management and comprehensive protection for your email traffic. The hybrid structure of Progent's Email Guard managed service integrates cloud-based filtering with an on-premises security gateway device to provide complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. The cloud filter serves as a preliminary barricade and keeps most threats from making it to your security perimeter. This reduces your vulnerability to inbound threats and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a deeper level of analysis for inbound email. For outgoing email, the on-premises security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The local security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email traffic that stays within your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity confirmation with iOS, Android, and other out-of-band devices. Using Duo 2FA, whenever you log into a secured application and enter your password you are requested to verify who you are via a device that only you have and that uses a different network channel. A broad range of devices can be utilized for this added form of authentication such as a smartphone or wearable, a hardware token, a landline phone, etc. You can register multiple verification devices. For details about Duo identity validation services, see Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Call Desk: Help Desk Managed Services
  Progent's Help Desk managed services enable your information technology staff to offload Support Desk services to Progent or divide activity for Service Desk support seamlessly between your internal network support team and Progent's nationwide roster of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless supplement to your corporate IT support resources. Client interaction with the Service Desk, provision of support, problem escalation, ticket generation and tracking, efficiency measurement, and maintenance of the support database are consistent whether issues are taken care of by your core support organization, by Progent, or by a combination. Read more about Progent's outsourced/shared Help Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior-based analysis tools to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily get by legacy signature-based anti-virus products. Progent ASM services protect on-premises and cloud resources and provides a unified platform to address the complete threat lifecycle including filtering, identification, containment, remediation, and forensics. Key capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and protect data related to your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be warned automatically about upcoming expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can save as much as 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management features a common repository for storing and sharing all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're making enhancements, performing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of any size a versatile and affordable alternative for evaluating, validating, scheduling, implementing, and documenting updates to your dynamic information network. In addition to maximizing the security and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT team to concentrate on line-of-business projects and tasks that derive the highest business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and maintained by Progent's IT support experts. Under the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the applications. Since the system is virtualized, it can be ported immediately to a different hosting environment without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects local and cloud resources and provides a unified platform to address the complete malware attack lifecycle including blocking, identification, mitigation, remediation, and forensics. Top features include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer economical in-depth security for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP provides firewall protection, penetration alarms, device control, and web filtering through cutting-edge tools incorporated within one agent accessible from a single console. Progent's security and virtualization consultants can assist you to plan and implement a ProSight ESP deployment that meets your organization's unique requirements and that allows you demonstrate compliance with government and industry data security standards. Progent will assist you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also help you to set up and verify a backup and restore system like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.