Barueri-Alphaville 24/7 Immediate Crypto
Malware Damage Assessment and Remediation Services

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that represents an extinction-level danger for organizations vulnerable to an assault. Multiple generations of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for a long time and still cause harm. Recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with frequent unnamed malware, not only do encryption of online information but also infect any accessible system backups. Files synched to cloud environments can also be held hostage. In a poorly architected data protection solution, this can make automatic restore operations useless and basically knocks the entire system back to square one.

Retrieving programs and data following a ransomware outage becomes a race against the clock as the victim fights to stop the spread, cleanup the crypto-ransomware, and resume enterprise-critical operations. Due to the fact that crypto-ransomware needs time to move laterally, assaults are usually sprung during weekends and nights, when successful attacks are likely to take longer to discover. This multiplies the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent makes available a range of services for securing organizations from ransomware penetrations. These include user training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security gateways with AI capabilities from SentinelOne to identify and suppress new cyber threats intelligently. Progent also provides the assistance of veteran ransomware recovery professionals with the talent and perseverance to reconstruct a breached environment as soon as possible.

Progent's Ransomware Restoration Help
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not ensure that distant criminals will provide the codes to decipher any of your information. Kaspersky determined that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to piece back together the critical components of your IT environment. Absent access to full information backups, this requires a broad complement of skill sets, well-coordinated team management, and the willingness to work 24x7 until the job is done.

For decades, Progent has made available professional IT services for businesses throughout the US and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of expertise gives Progent the skills to rapidly understand necessary systems and organize the remaining pieces of your computer network system following a ransomware attack and configure them into an operational network.

Progent's security team of experts uses best of breed project management applications to orchestrate the complicated recovery process. Progent appreciates the importance of acting quickly and in unison with a customer's management and Information Technology staff to prioritize tasks and to put critical applications back on line as soon as possible.

Business Case Study: A Successful Ransomware Incident Restoration
A small business sought out Progent after their network system was attacked by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored hackers, possibly using techniques leaked from the U.S. National Security Agency. Ryuk targets specific businesses with limited room for operational disruption and is one of the most profitable iterations of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in the Chicago metro area and has about 500 workers. The Ryuk event had disabled all business operations and manufacturing processes. The majority of the client's system backups had been online at the beginning of the intrusion and were destroyed. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end brought in Progent.

Progent worked together with the client to quickly identify and prioritize the essential systems that had to be recovered to make it possible to restart company functions:

• Microsoft Active Directory
• E-Mail
• MRP System

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished reinstallations and storage recovery of critical applications. All Exchange ties and configuration information were usable, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST files (Outlook Off-Line Folder Files) on various workstations in order to recover email data. A recent off-line backup of the client's financials/ERP systems made them able to restore these required programs back online. Although a large amount of work was left to recover totally from the Ryuk event, critical systems were recovered rapidly:

During the following month important milestones in the restoration project were made through close cooperation between Progent team members and the client:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Server containing more than four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory capabilities were 100% operational.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the user PCs were fully operational.

Conclusion
A probable company-ending catastrophe was evaded by results-oriented professionals, a broad range of technical expertise, and close teamwork. Although in analyzing the event afterwards the ransomware virus attack described here could have been stopped with up-to-date cyber security technology solutions and ISO/IEC 27001 best practices, user and IT administrator education, and well thought out security procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's team of experts has a proven track record in ransomware virus blocking, mitigation, and data restoration.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Barueri-Alphaville a variety of remote monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services incorporate next-generation AI capability to uncover zero-day strains of ransomware that can escape detection by legacy signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based anti-virus tools. ProSight ASM protects local and cloud-based resources and provides a single platform to automate the entire threat lifecycle including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver economical in-depth security for physical servers and virtual machines, workstations, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and reacting to security threats from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, device management, and web filtering via leading-edge tools packaged within one agent accessible from a unified console. Progent's data protection and virtualization consultants can assist you to design and implement a ProSight ESP deployment that addresses your organization's unique needs and that allows you achieve and demonstrate compliance with government and industry information security standards. Progent will assist you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for immediate attention. Progent's consultants can also help your company to install and test a backup and restore solution such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange filtering.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup operations and enable transparent backup and rapid restoration of critical files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business avoid data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, human mistakes, ill-intentioned employees, or application bugs. Managed backup services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top data security vendors to provide web-based management and world-class protection for all your email traffic. The powerful structure of Progent's Email Guard managed service combines cloud-based filtering with a local security gateway appliance to offer complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. The cloud filter acts as a first line of defense and keeps most threats from reaching your security perimeter. This reduces your exposure to external attacks and conserves network bandwidth and storage space. Email Guard's onsite gateway appliance adds a further level of inspection for incoming email. For outgoing email, the onsite security gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local security gateway can also assist Exchange Server to monitor and protect internal email traffic that originates and ends within your corporate firewall. For more information, see ProSight Email Guard spam and content filtering.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for small and mid-sized businesses to map, monitor, optimize and troubleshoot their networking appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Using state-of-the-art RMM technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, captures and displays the configuration of almost all devices on your network, monitors performance, and generates notices when issues are detected. By automating tedious management and troubleshooting activities, WAN Watch can cut hours off ordinary chores like network mapping, reconfiguring your network, locating devices that require important updates, or isolating performance issues. Learn more about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management technology to keep your IT system running at peak levels by checking the health of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your specified IT personnel and your assigned Progent consultant so that any looming issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected Tier III data center on a fast virtual machine host set up and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the apps. Because the environment is virtualized, it can be ported immediately to an alternate hosting environment without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and safeguard data about your network infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your IT documentation, you can eliminate up to 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents related to managing your business network like recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes next generation behavior-based machine learning technology to defend endpoint devices and physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which easily get by legacy signature-matching AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a single platform to address the complete threat progression including filtering, identification, containment, cleanup, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and recovery services.

• Progent's Outsourced/Shared Help Center: Call Center Managed Services
  Progent's Support Center services allow your information technology team to offload Help Desk services to Progent or split responsibilities for Help Desk services seamlessly between your internal support team and Progent's nationwide roster of IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent supplement to your in-house support resources. End user interaction with the Help Desk, provision of support services, problem escalation, ticket generation and updates, efficiency metrics, and maintenance of the service database are cohesive whether incidents are taken care of by your internal IT support organization, by Progent, or both. Find out more about Progent's outsourced/co-managed Help Desk services.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and cost-effective alternative for assessing, validating, scheduling, applying, and tracking updates to your ever-evolving IT network. In addition to optimizing the protection and reliability of your computer network, Progent's patch management services permit your IT staff to focus on line-of-business initiatives and tasks that derive maximum business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation on Apple iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you sign into a secured online account and give your password you are asked to confirm your identity on a device that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized for this added means of ID validation such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can register multiple verification devices. To learn more about Duo two-factor identity authentication services, visit Duo MFA two-factor authentication services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth management reporting plug-ins created to work with the leading ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.