Vitória 24x7x365 Critical Crypto-Ransomware
Virus Detection and Recovery Services

Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an existential danger for organizations unprepared for an attack. Versions of ransomware like the Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and still inflict damage. Recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with more as yet unnamed newcomers, not only encrypt online files but also infiltrate any accessible system protection mechanisms. Files synchronized to the cloud can also be corrupted. In a poorly architected data protection solution, this can render any restoration impossible and basically sets the network back to zero.

Restoring applications and data following a ransomware attack becomes a race against the clock as the targeted business fights to contain the damage and cleanup the virus and to restore business-critical activity. Due to the fact that ransomware takes time to move laterally, assaults are often launched during nights and weekends, when successful penetrations typically take longer to uncover. This multiplies the difficulty of quickly marshalling and coordinating a capable mitigation team.

Progent has a range of help services for protecting businesses from ransomware events. These include staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of the latest generation security gateways with AI technology from SentinelOne to discover and quarantine day-zero threats quickly. Progent in addition can provide the services of experienced ransomware recovery professionals with the track record and commitment to re-deploy a breached environment as soon as possible.

Progent's Ransomware Recovery Services
After a crypto-ransomware attack, paying the ransom in Bitcoin cryptocurrency does not provide any assurance that cyber hackers will return the keys to decipher all your information. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is well higher than the typical ransomware demands, which ZDNET averages to be in the range of $13,000. The fallback is to re-install the mission-critical elements of your Information Technology environment. Without access to full information backups, this calls for a broad complement of skill sets, well-coordinated team management, and the willingness to work non-stop until the job is done.

For twenty years, Progent has offered certified expert IT services for companies in Vitória and across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded top industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distros of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, and SANS GIAC. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of expertise affords Progent the skills to rapidly understand important systems and integrate the remaining pieces of your network system after a crypto-ransomware penetration and configure them into a functioning network.

Progent's recovery team has state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the importance of acting quickly and in concert with a customer's management and IT resources to assign priority to tasks and to put key systems back online as fast as possible.

Client Story: A Successful Crypto-Ransomware Virus Response
A small business escalated to Progent after their network was attacked by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state hackers, possibly using techniques exposed from the United States National Security Agency. Ryuk goes after specific organizations with limited ability to sustain operational disruption and is among the most lucrative iterations of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area with around 500 workers. The Ryuk event had frozen all company operations and manufacturing capabilities. The majority of the client's information backups had been online at the start of the intrusion and were eventually encrypted. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked with the client to rapidly determine and assign priority to the mission critical systems that needed to be addressed in order to continue business operations:

• Windows Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Active Directory to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery on needed servers. All Microsoft Exchange Server data and attributes were usable, which facilitated the restore of Exchange. Progent was able to find local OST files (Outlook Email Off-Line Folder Files) on team PCs and laptops in order to recover email data. A not too old off-line backup of the customer's accounting software made them able to recover these essential applications back online. Although a lot of work still had to be done to recover completely from the Ryuk damage, essential systems were returned to operations rapidly:

During the next month important milestones in the restoration project were made in close collaboration between Progent team members and the client:

• Internal web sites were restored without losing any information.
• The MailStore Microsoft Exchange Server with over four million archived emails was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control functions were completely functional.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A likely business-killing catastrophe was avoided by hard-working experts, a wide spectrum of knowledge, and tight teamwork. Although in retrospect the ransomware virus penetration detailed here should have been identified and blocked with advanced cyber security technology and ISO/IEC 27001 best practices, team training, and appropriate incident response procedures for data protection and proper patching controls, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of experts has a proven track record in ransomware virus defense, remediation, and file restoration.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Vitória a range of remote monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services incorporate next-generation machine learning capability to detect zero-day strains of ransomware that are able to evade traditional signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which easily evade traditional signature-matching AV products. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a unified platform to address the entire threat lifecycle including blocking, identification, containment, remediation, and forensics. Key features include single-click rollback using Windows VSS and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver ultra-affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to cyber assaults from all attack vectors. ProSight ESP provides firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge technologies packaged within a single agent accessible from a single control. Progent's security and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that meets your company's specific requirements and that allows you demonstrate compliance with legal and industry data protection regulations. Progent will help you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for immediate attention. Progent's consultants can also assist your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to create ProSight Data Protection Services, a selection of management offerings that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and enable transparent backup and fast restoration of critical files, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss caused by hardware failures, natural calamities, fire, malware such as ransomware, user error, malicious insiders, or application glitches. Managed services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading information security companies to provide centralized control and world-class protection for your inbound and outbound email. The hybrid structure of Progent's Email Guard combines a Cloud Protection Layer with a local gateway appliance to provide complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne threats. The cloud filter acts as a first line of defense and blocks most threats from making it to your security perimeter. This decreases your vulnerability to inbound threats and saves network bandwidth and storage. Email Guard's on-premises security gateway device adds a deeper layer of analysis for incoming email. For outgoing email, the on-premises gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also assist Exchange Server to track and protect internal email that stays within your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller businesses to diagram, monitor, enhance and troubleshoot their connectivity hardware like routers, firewalls, and wireless controllers plus servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and sends alerts when issues are discovered. By automating complex management activities, ProSight WAN Watch can knock hours off common chores such as making network diagrams, reconfiguring your network, locating appliances that need important software patches, or isolating performance issues. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) technology to help keep your network running efficiently by tracking the state of vital computers that drive your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your designated IT staff and your Progent engineering consultant so that all potential issues can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host set up and maintained by Progent's network support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the applications. Since the system is virtualized, it can be ported immediately to an alternate hosting solution without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and safeguard data about your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs or warranties. By updating and organizing your IT documentation, you can save up to half of time spent trying to find critical information about your network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents related to managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're planning enhancements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior-based machine learning tools to guard endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which routinely escape legacy signature-based AV products. Progent Active Security Monitoring services protect on-premises and cloud-based resources and provides a single platform to manage the complete malware attack progression including filtering, detection, containment, remediation, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Find out more about Progent's ransomware defense and recovery services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Support Desk services allow your information technology staff to offload Support Desk services to Progent or divide activity for Service Desk support transparently between your internal support staff and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a smooth extension of your internal support group. User interaction with the Help Desk, provision of support services, escalation, ticket generation and updates, performance metrics, and maintenance of the service database are cohesive regardless of whether issues are taken care of by your corporate IT support group, by Progent's team, or both. Learn more about Progent's outsourced/co-managed Service Desk services.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide businesses of all sizes a versatile and affordable alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your dynamic IT network. Besides maximizing the security and reliability of your computer environment, Progent's patch management services free up time for your in-house IT team to focus on more strategic initiatives and tasks that deliver maximum business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you log into a protected application and give your password you are asked to verify who you are on a device that only you have and that uses a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used for this added form of authentication such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can designate several validation devices. For details about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication services for access security.