Baltimore 24/7/365 Critical Crypto
Computer Virus Assessment and Recovery Help

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become a modern cyberplague that represents an enterprise-level danger for businesses poorly prepared for an attack. Multiple generations of ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for many years and continue to cause havoc. Recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, as well as frequent unnamed viruses, not only encrypt online data files but also infect any available system protection. Data synched to cloud environments can also be corrupted. In a poorly architected environment, this can render automated recovery hopeless and effectively knocks the datacenter back to zero.

Getting back online services and data following a ransomware intrusion becomes a sprint against the clock as the targeted organization struggles to stop lateral movement and remove the ransomware and to resume enterprise-critical operations. Due to the fact that ransomware requires time to spread, attacks are frequently sprung at night, when successful attacks typically take more time to uncover. This compounds the difficulty of quickly marshalling and orchestrating an experienced response team.

Progent offers an assortment of support services for securing organizations from ransomware penetrations. Among these are team education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of modern security solutions with machine learning capabilities from SentinelOne to discover and quarantine new cyber threats quickly. Progent in addition provides the assistance of experienced ransomware recovery professionals with the talent and commitment to rebuild a breached network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
Soon after a crypto-ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed keys to decipher any of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET averages to be around $13,000. The other path is to piece back together the mission-critical parts of your IT environment. Absent access to complete information backups, this requires a wide range of skill sets, top notch project management, and the capability to work non-stop until the recovery project is finished.

For two decades, Progent has offered professional IT services for businesses in Baltimore and across the US and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned advanced certifications in key technologies including Microsoft, Cisco, VMware, and major distros of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP software solutions. This breadth of expertise affords Progent the ability to knowledgably understand critical systems and consolidate the surviving pieces of your computer network system after a crypto-ransomware event and rebuild them into an operational network.

Progent's security group has top notch project management systems to orchestrate the complex restoration process. Progent knows the importance of working swiftly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to get the most important systems back on line as soon as humanly possible.

Client Story: A Successful Ransomware Virus Response
A client contacted Progent after their organization was crashed by the Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state criminal gangs, possibly using technology exposed from America's NSA organization. Ryuk targets specific companies with limited ability to sustain operational disruption and is among the most profitable instances of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area and has around 500 staff members. The Ryuk penetration had shut down all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the time of the intrusion and were destroyed. The client considered paying the ransom (in excess of $200,000) and wishfully thinking for the best, but in the end called Progent.

Progent worked with the customer to quickly identify and assign priority to the mission critical areas that had to be restored in order to continue company functions:

• Windows Active Directory
• Electronic Messaging
• MRP System

Within 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then assisted with setup and hard drive recovery of the most important servers. All Microsoft Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on team PCs in order to recover email data. A not too old off-line backup of the customer's accounting systems made them able to return these essential applications back available to users. Although major work needed to be completed to recover completely from the Ryuk virus, essential systems were recovered quickly:

During the next month key milestones in the restoration process were achieved through close cooperation between Progent engineers and the customer:

• Internal web applications were returned to operation without losing any data.
• The MailStore Server exceeding four million archived messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were 100 percent functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• Nearly all of the user PCs were being used by staff.

Conclusion
A potential business-ending catastrophe was dodged with results-oriented professionals, a wide array of technical expertise, and tight teamwork. Although in post mortem the crypto-ransomware virus incident detailed here could have been identified and disabled with current security technology and ISO/IEC 27001 best practices, staff education, and well designed security procedures for information backup and keeping systems up to date with security patches, the reality remains that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus defense, cleanup, and data restoration.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Baltimore a portfolio of online monitoring and security assessment services to assist you to reduce the threat from ransomware. These services utilize modern machine learning technology to uncover zero-day variants of ransomware that are able to get past legacy signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior machine learning technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-matching AV products. ProSight ASM safeguards local and cloud-based resources and provides a single platform to manage the entire malware attack lifecycle including protection, identification, containment, cleanup, and forensics. Key features include single-click rollback with Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection services offer ultra-affordable multi-layer security for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP provides firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge technologies packaged within one agent managed from a unified console. Progent's security and virtualization experts can help your business to design and configure a ProSight ESP environment that meets your organization's unique requirements and that helps you demonstrate compliance with legal and industry data protection regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require urgent attention. Progent's consultants can also help you to set up and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology providers to create ProSight Data Protection Services, a family of management outsourcing plans that deliver backup-as-a-service. ProSight DPS services automate and track your data backup processes and enable transparent backup and rapid recovery of vital files, apps, images, and virtual machines. ProSight DPS helps your business protect against data loss caused by hardware failures, natural calamities, fire, malware such as ransomware, user error, malicious insiders, or software glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top data security vendors to deliver web-based control and comprehensive security for your email traffic. The powerful architecture of Email Guard integrates cloud-based filtering with a local security gateway appliance to provide advanced protection against spam, viruses, Dos Attacks, DHAs, and other email-borne malware. The cloud filter serves as a first line of defense and keeps most threats from making it to your network firewall. This decreases your exposure to inbound attacks and saves system bandwidth and storage. Email Guard's on-premises gateway device provides a further layer of inspection for incoming email. For outgoing email, the local security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The local security gateway can also assist Microsoft Exchange Server to monitor and protect internal email that stays inside your security perimeter. For more information, see Email Guard spam and content filtering.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for smaller businesses to map, track, enhance and troubleshoot their networking appliances such as routers and switches, firewalls, and load balancers as well as servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are kept updated, captures and displays the configuration of almost all devices connected to your network, tracks performance, and sends alerts when problems are discovered. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off ordinary chores like network mapping, reconfiguring your network, locating devices that need critical updates, or isolating performance problems. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management techniques to help keep your network running at peak levels by tracking the state of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your specified IT staff and your Progent consultant so that all looming problems can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support professionals. Under the ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Because the system is virtualized, it can be moved immediately to a different hosting solution without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and safeguard information about your network infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can eliminate as much as 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and collaborating on all documents related to managing your business network such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're making improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior analysis tools to guard endpoint devices as well as physical and virtual servers against new malware assaults like ransomware and email phishing, which easily escape legacy signature-based anti-virus products. Progent ASM services safeguard local and cloud resources and offers a unified platform to automate the entire threat progression including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and recovery services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Help Center managed services enable your information technology staff to offload Help Desk services to Progent or split activity for Help Desk services transparently between your internal support team and Progent's nationwide pool of IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a smooth supplement to your internal IT support staff. End user interaction with the Help Desk, delivery of support services, problem escalation, trouble ticket creation and tracking, efficiency metrics, and management of the support database are consistent regardless of whether incidents are taken care of by your in-house support organization, by Progent's team, or both. Find out more about Progent's outsourced/shared Help Desk services.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of all sizes a versatile and cost-effective alternative for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your dynamic information system. In addition to maximizing the protection and reliability of your IT network, Progent's patch management services free up time for your IT team to concentrate on more strategic projects and activities that deliver the highest business value from your information network. Read more about Progent's patch management services.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication (2FA). Duo enables single-tap identity verification on iOS, Google Android, and other personal devices. With 2FA, when you log into a secured application and give your password you are asked to confirm who you are on a unit that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized for this second means of authentication such as a smartphone or watch, a hardware/software token, a landline phone, etc. You can designate multiple validation devices. To learn more about Duo identity validation services, refer to Cisco Duo MFA two-factor authentication services for access security.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth management reporting plug-ins designed to integrate with the leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.