Barra da Tijuca 24-Hour Emergency Ransomware
Computer Malware Detection and Repair Consulting

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for businesses poorly prepared for an attack. Different iterations of crypto-ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and still inflict destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus more as yet unnamed newcomers, not only do encryption of online data files but also infect most accessible system restores and backups. Files replicated to cloud environments can also be ransomed. In a poorly architected data protection solution, it can make any restoration impossible and basically sets the datacenter back to zero.

Getting back programs and data following a ransomware attack becomes a sprint against the clock as the targeted organization tries its best to stop lateral movement and cleanup the virus and to resume enterprise-critical activity. Because ransomware takes time to move laterally, assaults are frequently launched at night, when attacks in many cases take longer to discover. This compounds the difficulty of rapidly mobilizing and organizing a qualified mitigation team.

Progent offers an assortment of support services for securing organizations from ransomware events. Among these are team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of next-generation security gateways with artificial intelligence technology from SentinelOne to discover and suppress day-zero threats intelligently. Progent in addition can provide the services of expert ransomware recovery consultants with the talent and commitment to reconstruct a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
After a ransomware penetration, sending the ransom demands in Bitcoin cryptocurrency does not provide any assurance that cyber hackers will return the needed codes to decipher any of your files. Kaspersky ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the typical ransomware demands, which ZDNET estimates to be around $13,000. The other path is to re-install the key elements of your Information Technology environment. Without the availability of essential system backups, this requires a broad complement of skills, top notch team management, and the ability to work continuously until the job is done.

For two decades, Progent has made available certified expert Information Technology services for companies in Barra da Tijuca and across the United States and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-renowned certifications including CISM, CISSP, CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of experience gives Progent the capability to rapidly understand critical systems and re-organize the surviving pieces of your network environment after a crypto-ransomware attack and configure them into an operational network.

Progent's ransomware team of experts uses state-of-the-art project management applications to coordinate the sophisticated recovery process. Progent appreciates the importance of working quickly and in unison with a customer's management and IT team members to prioritize tasks and to get key systems back on-line as fast as possible.

Business Case Study: A Successful Ransomware Penetration Restoration
A business contacted Progent after their network was brought down by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state hackers, possibly using strategies exposed from the United States National Security Agency. Ryuk seeks specific businesses with little tolerance for operational disruption and is among the most profitable iterations of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business headquartered in the Chicago metro area with about 500 employees. The Ryuk attack had shut down all business operations and manufacturing processes. The majority of the client's backups had been online at the beginning of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked together with the client to rapidly determine and prioritize the most important services that needed to be addressed to make it possible to resume departmental operations:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

In less than 2 days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery of essential servers. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to collect local OST files (Microsoft Outlook Off-Line Folder Files) on team desktop computers in order to recover mail information. A recent off-line backup of the businesses accounting/ERP systems made it possible to recover these essential applications back on-line. Although a large amount of work remained to recover fully from the Ryuk attack, core services were restored rapidly:

Throughout the following couple of weeks important milestones in the restoration process were achieved through tight cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory Control modules were completely restored.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the user desktops and notebooks were fully operational.

Conclusion
A probable business extinction catastrophe was dodged with results-oriented experts, a broad range of technical expertise, and close collaboration. Although in hindsight the ransomware virus attack described here should have been blocked with current security technology and ISO/IEC 27001 best practices, user and IT administrator training, and appropriate security procedures for information protection and applying software patches, the reality is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, cleanup, and data recovery.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Barra da Tijuca a variety of remote monitoring and security assessment services to help you to minimize your vulnerability to ransomware. These services include next-generation artificial intelligence technology to detect new variants of ransomware that can get past traditional signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily evade legacy signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a single platform to manage the entire malware attack lifecycle including blocking, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection services deliver affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP offers firewall protection, penetration alarms, device management, and web filtering via cutting-edge technologies packaged within a single agent accessible from a unified control. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP deployment that addresses your organization's unique requirements and that helps you achieve and demonstrate compliance with legal and industry information protection regulations. Progent will help you define and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that call for urgent action. Progent can also help you to set up and test a backup and restore system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology providers to produce ProSight Data Protection Services (DPS), a family of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your backup processes and allow transparent backup and rapid restoration of important files/folders, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss resulting from hardware breakdown, natural disasters, fire, malware like ransomware, user mistakes, malicious insiders, or software bugs. Managed backup services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading data security vendors to deliver web-based control and comprehensive security for your email traffic. The powerful structure of Email Guard combines cloud-based filtering with a local security gateway appliance to provide advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter serves as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This decreases your vulnerability to external attacks and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance provides a deeper layer of analysis for incoming email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map out, track, reconfigure and debug their connectivity appliances like switches, firewalls, and load balancers as well as servers, printers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network maps are kept current, copies and displays the configuration information of virtually all devices connected to your network, tracks performance, and sends alerts when issues are discovered. By automating tedious management processes, WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating appliances that need important updates, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management techniques to keep your IT system operating efficiently by tracking the state of critical computers that drive your information system. When ProSight LAN Watch detects a problem, an alarm is sent immediately to your designated IT management personnel and your assigned Progent consultant so that all potential problems can be addressed before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected Tier III data center on a high-performance virtual machine host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be moved immediately to a different hardware solution without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, retrieve and protect data about your network infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be alerted automatically about impending expirations of SSL certificates ,domains or warranties. By updating and organizing your IT infrastructure documentation, you can eliminate up to 50% of time spent trying to find vital information about your network. ProSight IT Asset Management features a common repository for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're planning improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require when you need it. Find out more about ProSight IT Asset Management service.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior-based machine learning tools to defend endpoints as well as servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely escape legacy signature-matching AV tools. Progent Active Security Monitoring services protect local and cloud resources and offers a unified platform to manage the entire malware attack lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows VSS and real-time network-wide immunization against new threats. Find out more about Progent's ransomware protection and recovery services.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Call Desk managed services enable your IT group to offload Support Desk services to Progent or split responsibilities for Service Desk support seamlessly between your internal network support resources and Progent's extensive pool of certified IT support engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent extension of your internal support staff. User access to the Service Desk, delivery of support, escalation, ticket creation and updates, performance measurement, and management of the service database are cohesive whether incidents are taken care of by your core network support staff, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Help Desk services.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide businesses of all sizes a flexible and affordable solution for evaluating, testing, scheduling, implementing, and documenting updates to your dynamic IT network. In addition to maximizing the security and reliability of your computer environment, Progent's patch management services allow your in-house IT team to concentrate on more strategic initiatives and tasks that derive maximum business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication (2FA). Duo enables single-tap identity verification on iOS, Android, and other personal devices. With Duo 2FA, when you log into a secured application and give your password you are requested to verify your identity on a unit that only you have and that uses a different ("out-of-band") network channel. A wide range of out-of-band devices can be used for this second form of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may register several validation devices. For more information about ProSight Duo identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of in-depth management reporting utilities designed to work with the industry's top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like inconsistent support follow-through or machines with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.