Ransomware : Your Worst IT Catastrophe
Ransomware has become a too-frequent cyberplague that poses an existential threat for organizations vulnerable to an attack. Versions of ransomware such as CrySIS, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, plus daily unnamed viruses, not only encrypt online critical data but also infect all configured system restores and backups. Files synchronized to the cloud can also be ransomed. In a poorly architected system, it can render automatic restore operations impossible and basically knocks the datacenter back to square one.
Getting back applications and data after a ransomware event becomes a sprint against the clock as the targeted organization struggles to contain, remove the crypto-ransomware, and resume enterprise-critical activity. Since ransomware requires time to spread, assaults are often sprung during weekends and nights, when attacks typically take longer to detect. This multiplies the difficulty of rapidly marshalling and coordinating an experienced mitigation team.
Progent offers a variety of services for securing businesses from crypto-ransomware events. These include staff training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of the latest generation security gateways with AI technology from SentinelOne to detect and disable new cyber threats automatically. Progent in addition offers the assistance of veteran ransomware recovery professionals with the skills and perseverance to re-deploy a breached system as rapidly as possible.
Progent's Ransomware Restoration Services
After a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will provide the needed codes to decrypt all your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to re-install the key parts of your Information Technology environment. Without access to essential system backups, this requires a wide complement of IT skills, professional team management, and the capability to work 24x7 until the task is over.
For twenty years, Progent has made available certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial management and ERP software solutions. This breadth of expertise affords Progent the ability to efficiently identify important systems and integrate the surviving parts of your IT environment after a ransomware attack and assemble them into an operational system.
Progent's security group utilizes powerful project management systems to coordinate the complex restoration process. Progent understands the urgency of working quickly and in unison with a client's management and IT resources to assign priority to tasks and to get essential systems back online as fast as humanly possible.
Case Study: A Successful Crypto-Ransomware Attack Restoration
A business hired Progent after their company was taken over by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored hackers, possibly adopting strategies exposed from the U.S. National Security Agency. Ryuk targets specific companies with limited ability to sustain disruption and is one of the most profitable versions of ransomware viruses. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area with around 500 staff members. The Ryuk penetration had shut down all business operations and manufacturing capabilities. The majority of the client's backups had been online at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.
"I can't tell you enough in regards to the care Progent gave us during the most fearful period of (our) company's existence. We most likely would have paid the criminal gangs if not for the confidence the Progent team gave us. The fact that you were able to get our messaging and critical applications back on-line faster than five days was earth shattering. Each expert I worked with or e-mailed at Progent was amazingly focused on getting our company operational and was working non-stop to bail us out."
Progent worked with the customer to rapidly identify and prioritize the key systems that had to be recovered in order to resume departmental operations:
- Microsoft Active Directory
- Microsoft Exchange Server
- MRP System
To begin, Progent followed Anti-virus penetration mitigation industry best practices by stopping lateral movement and removing active viruses. Progent then started the work of rebuilding Active Directory, the heart of enterprise environments built upon Microsoft Windows Server technology. Microsoft Exchange Server messaging will not function without Active Directory, and the customer's MRP system leveraged Microsoft SQL, which needs Windows AD for authentication to the database.
Within two days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then assisted with rebuilding and storage recovery of needed servers. All Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to find intact OST files (Microsoft Outlook Off-Line Folder Files) on user desktop computers in order to recover mail messages. A recent off-line backup of the businesses accounting software made them able to return these vital services back online. Although significant work was left to recover fully from the Ryuk event, the most important services were returned to operations rapidly:
"For the most part, the production manufacturing operation never missed a beat and we made all customer deliverables."
Over the next few weeks important milestones in the recovery project were completed in close cooperation between Progent consultants and the client:
- In-house web applications were restored with no loss of data.
- The MailStore Exchange Server containing more than 4 million historical messages was brought online and accessible to users.
- CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory modules were fully recovered.
- A new Palo Alto Networks 850 security appliance was set up and programmed.
- 90% of the user desktops were back into operation.
"So much of what was accomplished during the initial response is mostly a blur for me, but I will not forget the countless hours all of you put in to give us our company back. I've entrusted Progent for the past 10 years, possibly more, and each time I needed help Progent has impressed me and delivered. This situation was a Herculean accomplishment."
Conclusion
A potential business catastrophe was avoided by results-oriented professionals, a broad array of technical expertise, and tight collaboration. Although in post mortem the crypto-ransomware penetration detailed here would have been shut down with advanced cyber security technology and ISO/IEC 27001 best practices, user education, and well thought out incident response procedures for backup and applying software patches, the reality is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's roster of experts has proven experience in ransomware virus blocking, mitigation, and file disaster recovery.
"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were contributing), I'm grateful for allowing me to get some sleep after we made it over the most critical parts. All of you did an impressive effort, and if anyone is around the Chicago area, dinner is on me!"
To read or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Barueri-Alphaville a variety of remote monitoring and security assessment services to help you to reduce the threat from ransomware. These services include modern artificial intelligence technology to detect zero-day variants of crypto-ransomware that can escape detection by legacy signature-based security solutions.
- ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network operating at peak levels by checking the health of critical assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your designated IT management staff and your assigned Progent engineering consultant so that all looming problems can be resolved before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.
- ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for monitoring and managing your client-server infrastructure by offering tools for streamlining common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint setup, backup and recovery, A/V response, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your designated IT management staff and your Progent technical consultant so that potential issues can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.
- ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller businesses to map, monitor, optimize and debug their connectivity hardware like switches, firewalls, and load balancers plus servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that network diagrams are always updated, captures and manages the configuration of almost all devices on your network, tracks performance, and sends notices when potential issues are discovered. By automating complex management processes, ProSight WAN Watch can knock hours off ordinary tasks like making network diagrams, reconfiguring your network, locating appliances that require important software patches, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.
- ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
ProSight Reporting is a growing family of real-time and in-depth management reporting utilities designed to work with the industry's leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.
- ProSight Data Protection Services: Managed Backup and Recovery Services
Progent has worked with leading backup technology companies to produce ProSight Data Protection Services (DPS), a family of offerings that provide backup-as-a-service. ProSight DPS products automate and monitor your backup processes and enable non-disruptive backup and rapid recovery of critical files, apps, system images, and virtual machines. ProSight DPS lets you avoid data loss caused by equipment breakdown, natural disasters, fire, malware like ransomware, user error, ill-intentioned employees, or application bugs. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed backup services are most appropriate for your IT environment.
- ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top data security vendors to provide centralized management and comprehensive protection for all your email traffic. The hybrid architecture of Email Guard combines cloud-based filtering with an on-premises security gateway appliance to offer advanced protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. The cloud filter serves as a first line of defense and blocks most threats from reaching your network firewall. This reduces your vulnerability to external attacks and conserves system bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of inspection for inbound email. For outgoing email, the on-premises gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Exchange Server to track and safeguard internal email traffic that originates and ends within your corporate firewall. For more details, see Email Guard spam and content filtering.
- ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
Progent's Duo authentication services incorporate Cisco's Duo cloud technology to protect against password theft through the use of two-factor authentication. Duo supports one-tap identity confirmation on iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a protected online account and enter your password you are asked to verify your identity via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized as this added means of authentication such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate multiple verification devices. To find out more about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication services.
- Progent's Outsourced/Shared Service Desk: Support Desk Managed Services
Progent's Support Center services allow your IT staff to offload Call Center services to Progent or split responsibilities for support services seamlessly between your in-house network support group and Progent's nationwide pool of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth extension of your core IT support team. Client access to the Service Desk, provision of technical assistance, escalation, trouble ticket generation and updates, performance measurement, and management of the service database are consistent regardless of whether issues are resolved by your internal support staff, by Progent, or by a combination. Find out more about Progent's outsourced/shared Service Desk services.
- Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior machine learning tools to defend endpoint devices and physical and virtual servers against new malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-matching AV tools. Progent ASM services safeguard on-premises and cloud resources and provides a single platform to automate the complete threat progression including protection, infiltration detection, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and recovery services.
- ProSight IT Asset Management: Network Documentation Management
Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard data about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSLs or warranties. By updating and organizing your IT infrastructure documentation, you can eliminate up to 50% of time wasted trying to find critical information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents related to managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you're planning improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you need when you need it. Read more about Progent's ProSight IT Asset Management service.
- Patch Management: Software/Firmware Update Management Services
Progent's support services for patch management offer organizations of all sizes a flexible and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting updates to your dynamic IT system. Besides maximizing the protection and functionality of your computer network, Progent's patch management services allow your in-house IT team to focus on more strategic projects and tasks that deliver maximum business value from your network. Read more about Progent's software/firmware update management support services.
- ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the customer owns the data, the OS software, and the apps. Since the environment is virtualized, it can be moved immediately to a different hardware solution without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more details about ProSight Virtual Hosting services.
- ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which routinely evade traditional signature-based anti-virus products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a unified platform to automate the entire malware attack progression including filtering, detection, mitigation, remediation, and forensics. Key features include single-click rollback using Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.
- ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
ProSight Enhanced Security Protection (ESP) managed services deliver economical multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge tools incorporated within one agent accessible from a single console. Progent's security and virtualization consultants can help your business to plan and configure a ProSight ESP environment that meets your organization's specific requirements and that allows you achieve and demonstrate compliance with government and industry data security standards. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for immediate attention. Progent can also help your company to install and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.
For Barueri-Alphaville 24x7 Ransomware Recovery Experts, call Progent at 800-462-8800 or go to Contact Progent.