Ransomware Prevention and Restoration Solutions Des Moines

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyber pandemic that represents an extinction-level threat for businesses of all sizes poorly prepared for an attack. Versions of ransomware like the Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and continue to inflict destruction. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus frequent as yet unnamed viruses, not only encrypt on-line critical data but also infiltrate any accessible system protection mechanisms. Files synched to cloud environments can also be ransomed. In a poorly designed system, this can make automatic recovery useless and basically knocks the network back to square one.

Retrieving programs and information after a ransomware outage becomes a race against the clock as the victim tries its best to contain and eradicate the ransomware and to restore mission-critical activity. Due to the fact that crypto-ransomware needs time to move laterally, assaults are often launched on weekends and holidays, when successful attacks in many cases take longer to identify. This compounds the difficulty of promptly marshalling and orchestrating an experienced mitigation team.

Progent makes available a variety of solutions for securing Des Moines organizations from ransomware events. Among these are staff education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security gateways with machine learning technology to rapidly discover and quarantine day-zero cyber threats. Progent in addition can provide the services of veteran ransomware recovery engineers with the track record and commitment to re-deploy a compromised system as urgently as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware event, paying the ransom in cryptocurrency does not ensure that distant criminals will return the needed keys to unencrypt any of your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is well higher than the typical crypto-ransomware demands, which ZDNET estimated to be around $13,000 for small businesses. The other path is to piece back together the mission-critical elements of your Information Technology environment. Without access to full information backups, this requires a broad range of skill sets, professional project management, and the ability to work 24x7 until the recovery project is over.

For two decades, Progent has provided certified expert IT services for businesses across the U.S. and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded top industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of experience affords Progent the ability to quickly ascertain necessary systems and organize the surviving components of your computer network environment following a ransomware attack and configure them into a functioning system.

Progent's security group uses top notch project management systems to coordinate the complicated restoration process. Progent appreciates the importance of working rapidly and in concert with a client's management and IT resources to assign priority to tasks and to get critical systems back on-line as soon as humanly possible.

Customer Story: A Successful Ransomware Intrusion Restoration
A small business engaged Progent after their network system was attacked by the Ryuk ransomware virus. Ryuk is believed to have been deployed by Northern Korean state criminal gangs, suspected of adopting strategies leaked from the U.S. National Security Agency. Ryuk attacks specific companies with little or no ability to sustain disruption and is among the most lucrative iterations of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area with around 500 employees. The Ryuk attack had disabled all company operations and manufacturing capabilities. Most of the client's data protection had been on-line at the start of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom (exceeding $200,000) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked together with the customer to rapidly determine and assign priority to the key systems that needed to be addressed to make it possible to resume business functions:

• Windows Active Directory
• Electronic Messaging
• MRP System

In less than two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then assisted with reinstallations and hard drive recovery of the most important applications. All Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find local OST files (Microsoft Outlook Off-Line Data Files) on team desktop computers and laptops to recover mail data. A recent offline backup of the customer’s accounting/ERP systems made them able to recover these required services back available to users. Although a large amount of work still had to be done to recover totally from the Ryuk attack, core systems were recovered quickly:

During the next couple of weeks important milestones in the recovery process were made in tight cooperation between Progent consultants and the client:

• Internal web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were 100 percent recovered.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the desktops and laptops were operational.

Conclusion
A probable business-killing disaster was dodged with dedicated professionals, a wide array of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware attack described here would have been shut down with up-to-date security systems and recognized best practices, user and IT administrator education, and appropriate security procedures for information protection and proper patching controls, the fact is that government-sponsored hackers from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has extensive experience in crypto-ransomware virus blocking, removal, and information systems disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

File body_ransomware_recovery_contact_city.asp does not exist