24/7/365 San Antonio Emergency Ransomware Infection Damage Assessment and Restoration Consulting

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for businesses of all sizes unprepared for an attack. Versions of crypto-ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict harm. Recent variants of ransomware such as Ryuk and Hermes, as well as more unnamed malware, not only do encryption of online critical data but also infect any accessible system protection mechanisms. Files replicated to the cloud can also be ransomed. In a poorly designed system, this can render any restore operations impossible and basically sets the datacenter back to square one.

Getting back on-line services and data after a ransomware event becomes a sprint against the clock as the victim fights to stop the spread and clear the ransomware and to restore mission-critical operations. Because ransomware requires time to replicate, penetrations are often launched on weekends, when successful attacks tend to take more time to detect. This compounds the difficulty of quickly assembling and orchestrating a capable response team.

Progent offers an assortment of services for securing businesses from ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security appliances with artificial intelligence capabilities to intelligently detect and suppress new threats. Progent in addition provides the assistance of expert ransomware recovery professionals with the talent and commitment to restore a compromised network as urgently as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will respond with the codes to decrypt any or all of your information. Kaspersky estimated that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is greatly higher than the typical ransomware demands, which ZDNET estimates to be approximately $13,000. The fallback is to setup from scratch the mission-critical elements of your Information Technology environment. Without access to essential data backups, this calls for a wide complement of IT skills, professional team management, and the capability to work 24x7 until the job is done.

For twenty years, Progent has offered certified expert Information Technology services for businesses in San Antonio and across the United States and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have earned high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of expertise gives Progent the ability to knowledgably ascertain important systems and organize the remaining parts of your Information Technology system following a crypto-ransomware event and rebuild them into a functioning network.

Progent's security team of experts deploys powerful project management tools to orchestrate the complex restoration process. Progent appreciates the urgency of acting rapidly and in concert with a client's management and IT team members to prioritize tasks and to get critical applications back on line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Recovery
A small business hired Progent after their network system was taken over by the Ryuk crypto-ransomware. Ryuk is believed to have been deployed by North Korean state cybercriminals, possibly using technology exposed from the U.S. NSA organization. Ryuk attacks specific organizations with little or no room for disruption and is among the most profitable instances of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer based in Chicago and has about 500 workers. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's system backups had been on-line at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and praying for good luck, but in the end utilized Progent.

Progent worked hand in hand the client to rapidly determine and assign priority to the key elements that had to be addressed to make it possible to continue business operations:

• Active Directory (AD)
• Email
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Active Directory to its pre-penetration state. Progent then performed rebuilding and hard drive recovery of needed systems. All Exchange schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Offline Folder Files) on staff desktop computers to recover mail information. A recent off-line backup of the client's financials/MRP software made them able to recover these essential services back servicing users. Although significant work needed to be completed to recover fully from the Ryuk attack, core services were returned to operations rapidly:

Over the next few weeks critical milestones in the restoration process were achieved in close cooperation between Progent engineers and the client:

• Internal web applications were brought back up with no loss of information.
• The MailStore Server containing more than four million historical messages was spun up and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were 100% functional.
• A new Palo Alto Networks 850 firewall was deployed.
• 90% of the user workstations were functioning as before the incident.

Conclusion
A likely business-killing disaster was avoided with top-tier experts, a broad spectrum of technical expertise, and close teamwork. Although in retrospect the crypto-ransomware virus attack detailed here would have been identified and blocked with advanced security systems and best practices, user and IT administrator education, and well thought out security procedures for information backup and keeping systems up to date with security patches, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has proven experience in ransomware virus blocking, removal, and information systems recovery.

To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in San Antonio a variety of online monitoring and security evaluation services to help you to reduce the threat from ransomware. These services include modern artificial intelligence technology to detect zero-day variants of ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates cutting edge behavior-based machine learning technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which easily get by traditional signature-matching AV tools. ProSight ASM protects local and cloud-based resources and offers a single platform to address the complete threat progression including blocking, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer protection for physical servers and VMs, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, endpoint management, and web filtering through leading-edge tools incorporated within one agent managed from a unified control. Progent's security and virtualization consultants can assist you to design and implement a ProSight ESP deployment that meets your company's specific needs and that helps you prove compliance with legal and industry data protection standards. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require immediate action. Progent can also help you to install and test a backup and restore solution such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.

• ProSight Data Protection Services: Managed Backup and Recovery
  ProSight Data Protection Services offer small and mid-sized organizations an affordable end-to-end service for secure backup/disaster recovery (BDR). Available at a fixed monthly price, ProSight Data Protection Services automates and monitors your backup activities and allows rapid restoration of vital data, apps and virtual machines that have become lost or corrupted as a result of component breakdowns, software bugs, natural disasters, human error, or malware attacks like ransomware. ProSight Data Protection Services can help you protect, retrieve and restore files, folders, applications, system images, as well as Microsoft Hyper-V and VMware images/. Important data can be backed up on the cloud, to a local device, or mirrored to both. Progent's cloud backup consultants can provide advanced support to set up ProSight DPS to be compliant with regulatory standards such as HIPPA, FINRA, and PCI and, whenever necessary, can assist you to restore your critical information. Find out more about ProSight Data Protection Services Managed Cloud Backup.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading data security companies to deliver centralized management and comprehensive protection for your email traffic. The hybrid structure of Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to offer advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps most unwanted email from reaching your security perimeter. This reduces your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's onsite gateway device provides a further level of analysis for incoming email. For outgoing email, the on-premises gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends within your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent’s ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to diagram, monitor, enhance and debug their connectivity appliances like routers, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are kept updated, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and generates notices when issues are detected. By automating complex management and troubleshooting activities, ProSight WAN Watch can cut hours off ordinary chores such as making network diagrams, reconfiguring your network, locating devices that require important software patches, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent’s server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to keep your network operating at peak levels by tracking the state of vital assets that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your specified IT management staff and your Progent engineering consultant so that all potential issues can be resolved before they can impact your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Because the environment is virtualized, it can be moved easily to a different hardware environment without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and protect data related to your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or serial numbers and be alerted automatically about impending expirations of SSLs or domains. By cleaning up and organizing your IT documentation, you can eliminate up to half of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a common repository for holding and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you’re making improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.