24x7x365 Curitiba Critical Ransomware
Malware Detection and Remediation Consulting

Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become an escalating cyber pandemic that represents an enterprise-level danger for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware like the Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for years and still inflict harm. The latest variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as additional as yet unnamed newcomers, not only do encryption of online critical data but also infiltrate most configured system protection. Information synchronized to the cloud can also be ransomed. In a poorly designed data protection solution, it can render automated recovery impossible and effectively sets the entire system back to square one.

Getting back on-line programs and information following a ransomware attack becomes a race against time as the victim fights to stop the spread and remove the ransomware and to restore business-critical operations. Because crypto-ransomware takes time to spread, attacks are usually sprung during weekends and nights, when penetrations may take more time to discover. This compounds the difficulty of quickly marshalling and organizing a qualified response team.

Progent offers a range of services for securing enterprises from ransomware penetrations. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security appliances with machine learning technology to quickly detect and suppress new cyber attacks. Progent also provides the assistance of seasoned ransomware recovery consultants with the skills and perseverance to rebuild a breached environment as rapidly as possible.

Progent's Ransomware Restoration Services
Following a ransomware attack, sending the ransom demands in Bitcoin cryptocurrency does not ensure that merciless criminals will provide the needed keys to unencrypt all your data. Kaspersky ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly above the usual ransomware demands, which ZDNET averages to be around $13,000. The other path is to setup from scratch the essential parts of your IT environment. Absent access to full data backups, this requires a broad complement of IT skills, professional team management, and the capability to work 24x7 until the recovery project is finished.

For decades, Progent has provided professional IT services for companies in Curitiba and across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (See Progent's certifications). Progent also has expertise with financial systems and ERP applications. This breadth of experience affords Progent the ability to quickly understand necessary systems and integrate the remaining pieces of your Information Technology environment after a ransomware attack and rebuild them into an operational network.

Progent's recovery team has top notch project management systems to coordinate the complicated recovery process. Progent knows the urgency of acting rapidly and together with a customer’s management and IT staff to prioritize tasks and to put the most important systems back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Penetration Restoration
A client escalated to Progent after their network was crashed by the Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state sponsored cybercriminals, suspected of adopting approaches exposed from the United States NSA organization. Ryuk attacks specific businesses with limited tolerance for operational disruption and is among the most profitable versions of ransomware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in Chicago with around 500 employees. The Ryuk intrusion had shut down all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly understand and assign priority to the essential areas that had to be addressed in order to resume departmental operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then charged ahead with setup and storage recovery on the most important servers. All Exchange ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to locate intact OST data files (Outlook Off-Line Folder Files) on staff desktop computers and laptops to recover email information. A recent offline backup of the customer’s accounting/ERP systems made it possible to restore these required programs back on-line. Although significant work was left to recover fully from the Ryuk attack, the most important systems were recovered rapidly:

During the next couple of weeks critical milestones in the recovery project were achieved in close collaboration between Progent team members and the client:

• Internal web applications were restored with no loss of data.
• The MailStore Exchange Server containing more than four million archived emails was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were fully operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Ninety percent of the user PCs were back into operation.

Conclusion
A likely business extinction catastrophe was dodged through the efforts of hard-working experts, a broad spectrum of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here could have been shut down with current cyber security solutions and security best practices, staff training, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, removal, and information systems disaster recovery.

To read or download a PDF version of this customer story, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Curitiba a portfolio of remote monitoring and security assessment services designed to assist you to minimize the threat from crypto-ransomware. These services utilize modern machine learning capability to uncover zero-day strains of ransomware that can evade traditional signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes next generation behavior machine learning technology to defend physical and virtual endpoints against modern malware assaults like ransomware and email phishing, which routinely get by traditional signature-matching anti-virus products. ProSight ASM protects on-premises and cloud-based resources and provides a unified platform to address the complete threat progression including filtering, identification, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, device control, and web filtering through cutting-edge technologies packaged within a single agent managed from a unified control. Progent's security and virtualization consultants can assist you to design and configure a ProSight ESP environment that meets your organization's specific requirements and that helps you achieve and demonstrate compliance with legal and industry data protection standards. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require urgent action. Progent's consultants can also assist your company to set up and test a backup and restore solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with leading backup software companies to produce ProSight Data Protection Services, a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and enable non-disruptive backup and fast restoration of critical files, apps, images, and virtual machines. ProSight DPS lets your business avoid data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, human error, malicious insiders, or software glitches. Managed services available in the ProSight Data Protection Services portfolio include ProSight Ataro VM Backup, ProSight Ataro Office 365 Total Backup, ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top information security companies to deliver centralized management and comprehensive security for your email traffic. The powerful structure of Progent's Email Guard managed service integrates cloud-based filtering with an on-premises gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This decreases your exposure to external threats and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further level of analysis for inbound email. For outbound email, the on-premises gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The local gateway can also help Exchange Server to monitor and safeguard internal email that originates and ends inside your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent’s ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller organizations to map, track, reconfigure and debug their networking appliances like switches, firewalls, and access points plus servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are always updated, copies and manages the configuration of almost all devices connected to your network, monitors performance, and sends notices when issues are discovered. By automating tedious network management activities, WAN Watch can cut hours off common tasks like network mapping, expanding your network, locating devices that need important updates, or resolving performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent’s server and desktop remote monitoring managed service that uses advanced remote monitoring and management technology to keep your network running at peak levels by tracking the health of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT management staff and your assigned Progent consultant so that all looming issues can be resolved before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved easily to a different hardware solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and protect data about your network infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSLs ,domains or warranties. By cleaning up and organizing your network documentation, you can save up to half of time spent trying to find critical information about your network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you’re planning improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes next generation behavior machine learning technology to defend endpoint devices as well as servers and VMs against new malware attacks such as ransomware and email phishing, which easily escape traditional signature-matching anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud resources and offers a unified platform to automate the complete malware attack progression including filtering, infiltration detection, mitigation, remediation, and forensics. Key features include single-click rollback with Windows VSS and real-time network-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Call Desk managed services permit your information technology team to outsource Help Desk services to Progent or divide activity for Help Desk services seamlessly between your in-house support group and Progent's nationwide roster of IT support technicians, engineers and subject matter experts (SBEs). Progent's Co-managed Help Desk Service offers a seamless supplement to your internal IT support staff. User access to the Service Desk, delivery of support services, escalation, ticket generation and updates, efficiency metrics, and management of the support database are consistent whether issues are taken care of by your internal network support organization, by Progent, or by a combination. Learn more about Progent's outsourced/co-managed Call Center services.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide organizations of any size a versatile and affordable alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving IT network. Besides optimizing the security and functionality of your IT environment, Progent's patch management services free up time for your IT staff to concentrate on more strategic initiatives and tasks that deliver the highest business value from your network. Learn more about Progent's patch management support services.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication. Duo enables single-tap identity verification on iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you log into a secured application and give your password you are asked to verify who you are on a unit that only you have and that uses a separate network channel. A wide selection of out-of-band devices can be used as this second means of ID validation such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You can designate several validation devices. To find out more about Duo identity authentication services, see Duo MFA two-factor authentication services for access security.