Guarulhos 24/7/365 Immediate Crypto
Infection Identification and Recovery Consultants

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that represents an existential danger for organizations vulnerable to an attack. Versions of ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to cause destruction. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with frequent unnamed malware, not only encrypt online information but also infect most accessible system protection mechanisms. Files synchronized to off-site disaster recovery sites can also be held hostage. In a poorly designed system, it can render automated restoration hopeless and basically knocks the network back to square one.

Recovering programs and data after a crypto-ransomware attack becomes a sprint against the clock as the targeted organization struggles to contain, eradicate the ransomware, and resume business-critical activity. Due to the fact that crypto-ransomware requires time to spread, assaults are frequently sprung during nights and weekends, when attacks may take more time to recognize. This multiplies the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent makes available an assortment of solutions for securing businesses from crypto-ransomware events. These include team training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security appliances with machine learning technology from SentinelOne to discover and quarantine day-zero cyber threats intelligently. Progent in addition can provide the assistance of expert ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the keys to decipher any of your data. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to re-install the critical parts of your Information Technology environment. Absent the availability of full information backups, this requires a wide complement of skills, well-coordinated team management, and the ability to work continuously until the recovery project is finished.

For decades, Progent has provided expert IT services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of experience provides Progent the skills to quickly determine necessary systems and integrate the surviving components of your network system after a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's ransomware team of experts has best of breed project management tools to coordinate the complicated recovery process. Progent understands the urgency of working quickly and in unison with a customer's management and Information Technology staff to prioritize tasks and to put the most important services back on-line as fast as possible.

Customer Case Study: A Successful Ransomware Attack Response
A business engaged Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, suspected of using technology leaked from the U.S. NSA organization. Ryuk goes after specific companies with little or no tolerance for operational disruption and is one of the most profitable incarnations of ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in Chicago and has about 500 employees. The Ryuk intrusion had frozen all company operations and manufacturing processes. The majority of the client's system backups had been online at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and praying for the best, but ultimately utilized Progent.

Progent worked hand in hand the customer to rapidly determine and prioritize the mission critical services that had to be addressed to make it possible to restart company functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then performed setup and storage recovery of essential systems. All Exchange Server ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Off-Line Data Files) on staff workstations and laptops in order to recover mail information. A recent offline backup of the customer's accounting/MRP software made them able to return these essential services back on-line. Although major work remained to recover fully from the Ryuk event, critical services were returned to operations quickly:

Throughout the next few weeks important milestones in the recovery project were completed in close cooperation between Progent engineers and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were fully functional.
• A new Palo Alto 850 firewall was deployed.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A probable business extinction catastrophe was evaded by dedicated experts, a broad array of subject matter expertise, and tight teamwork. Although in hindsight the ransomware virus incident described here would have been blocked with current cyber security technology solutions and recognized best practices, user and IT administrator training, and properly executed security procedures for data backup and keeping systems up to date with security patches, the reality is that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware attack, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus defense, mitigation, and file recovery.

To read or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Guarulhos a range of online monitoring and security evaluation services to help you to reduce your vulnerability to crypto-ransomware. These services include next-generation artificial intelligence technology to uncover zero-day variants of crypto-ransomware that are able to escape detection by traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system operating at peak levels by checking the health of vital assets that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your designated IT personnel and your Progent engineering consultant so that any potential problems can be addressed before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your client-server infrastructure by offering an environment for streamlining common time-consuming jobs. These can include health monitoring, update management, automated remediation, endpoint configuration, backup and restore, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your specified IT staff and your assigned Progent technical consultant so potential problems can be fixed before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized businesses to map out, monitor, enhance and troubleshoot their connectivity appliances such as routers and switches, firewalls, and load balancers plus servers, printers, endpoints and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always current, copies and manages the configuration of almost all devices on your network, tracks performance, and sends notices when problems are detected. By automating complex management processes, WAN Watch can knock hours off common chores such as network mapping, expanding your network, locating devices that need critical software patches, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time management reporting utilities designed to integrate with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-up or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup technology companies to create ProSight Data Protection Services, a portfolio of management outsourcing plans that deliver backup-as-a-service. ProSight DPS services automate and monitor your backup operations and allow non-disruptive backup and rapid restoration of critical files, applications, system images, and VMs. ProSight DPS helps you avoid data loss resulting from equipment failures, natural calamities, fire, cyber attacks such as ransomware, user error, malicious employees, or software glitches. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top information security companies to deliver web-based control and comprehensive protection for your inbound and outbound email. The powerful structure of Email Guard managed service integrates a Cloud Protection Layer with a local gateway device to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The cloud filter acts as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This reduces your exposure to inbound threats and saves network bandwidth and storage. Email Guard's onsite gateway device adds a deeper level of analysis for inbound email. For outgoing email, the onsite gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The local security gateway can also help Exchange Server to track and safeguard internal email traffic that originates and ends within your security perimeter. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity verification with iOS, Google Android, and other personal devices. With 2FA, when you log into a protected online account and enter your password you are requested to confirm who you are via a unit that only you possess and that is accessed using a different network channel. A broad range of devices can be utilized as this added form of ID validation such as a smartphone or wearable, a hardware token, a landline phone, etc. You may register several verification devices. To learn more about ProSight Duo identity validation services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Call Desk services allow your information technology staff to outsource Support Desk services to Progent or split activity for Service Desk support transparently between your internal support staff and Progent's nationwide roster of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a seamless extension of your core support resources. User interaction with the Help Desk, provision of support services, escalation, trouble ticket generation and tracking, performance measurement, and management of the service database are cohesive whether incidents are taken care of by your core IT support staff, by Progent, or by a combination. Find out more about Progent's outsourced/shared Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates next generation behavior analysis technology to defend endpoints and servers and VMs against modern malware assaults like ransomware and email phishing, which easily escape legacy signature-matching AV products. Progent ASM services safeguard on-premises and cloud resources and offers a single platform to address the complete malware attack progression including filtering, identification, containment, cleanup, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and protect data related to your network infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be warned about impending expirations of SSL certificates or domains. By updating and organizing your IT infrastructure documentation, you can eliminate up to 50% of time wasted looking for vital information about your IT network. ProSight IT Asset Management includes a common location for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of any size a flexible and affordable alternative for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your dynamic information system. In addition to maximizing the protection and reliability of your IT network, Progent's patch management services allow your in-house IT staff to focus on line-of-business projects and tasks that derive maximum business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual machine host configured and managed by Progent's network support professionals. Under the ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system platforms, and the applications. Since the system is virtualized, it can be moved easily to a different hosting solution without requiring a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based AV products. ProSight ASM protects on-premises and cloud resources and offers a unified platform to address the entire malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer economical in-depth protection for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP delivers firewall protection, penetration alarms, device management, and web filtering through cutting-edge technologies packaged within a single agent managed from a unified control. Progent's data protection and virtualization experts can help you to design and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you achieve and demonstrate compliance with government and industry information protection regulations. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require urgent attention. Progent can also assist your company to set up and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover quickly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.