Desktop Support Expertise

Progent's ProSight Active Security Monitoring (ASM) services include behavior analysis heuristics from SentinelOne to provide best-in-class defense for all endpoints and virtual and physical servers. This approach to malware defense addresses the new wave of cyber threats, such as crypto-ransomware, which routinely avoid detection by conventional signature-based anti-virus techniques. Progent is a SentinelOne Partner, dealer, and integrator.

Progent's ProSight Active Security Monitoring gives small and mid-sized businesses the benefits of the same anti-virus tools implemented by some of the world's largest enterprises including Walmart, Citi, and Salesforce. By providing real-time malware blocking, identification, mitigation, restoration and forensics in one integrated platform, Progent's ProSight Active Security Monitoring lowers TCO, streamlines administration, and expedites recovery. The next-generation endpoint protection (NGEP) built into in Progent's ProSight Active Security Monitoring was listed by Gartner Group as the industry's "most visionary Endpoint Protection Platform."

Progent's Active Security Monitoring remote services rely on a low-profile agent running on each protected device in order to form an active security grid that reacts to suspected attacks in real time and sets into play unified protection featuring:

• Instant protection for Microsoft Windows, macOS, Linux, iOS and Android machines
• Support for VMs powered by Hyper-V, VMware vSphere, and Citrix XenServer virtualization systems
• In-depth OS-level monitoring
• Signature-independent heuristics and automation
• Modern behavioral analysis
• Detection of new generation threats from all sources
• Automated after-attack containment
• Easy resumption of most recent safe state following a crypto-ransomware assault including Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor
• Instant no-touch vaccination throughout the complete matrix of enrolled devices
• Immediate visualization of an assault's path across your system
• Extensive forensics for identifying security gaps
• Centralized browser-based management console
• Compliant with HIPAA and PCI

Progent's ASM and Today's Cybersecurity Environment
Over 97% of ransomware break-ins could have been blocked by current security tools. But inevitably, some attacks will succeed despite the best defenses. The modern security environment is too crowded with relentless extortionists, including state-funded hackers, for any enterprise to be impregnable. Given this reality, Progent's ProSight Active Security Monitoring is designed not simply to keep ransomware from gaining access to your network, but also to respond powerfully to any detected penetration. This entails immediate isolation of infected machines, automatic threat removal, fast inoculation of all endpoints via local agent software, single-click rollback to a safe condition and comprehensive forensic analysis to show you how to enhance your cybersecurity defense to foil future assaults. By delivering leading-edge protection during all phases of a malware attack, ProSight ASM offers a comprehensive platform for dealing with the increasingly dire cybersecurity environment and escaping the economic and public image loss associated with a serious cybersecurity breach.

Endpoints such as PCs, laptops and smartphones are the most susceptible and most typically targeted elements of an IT network. Progent's ProSight Active Security Monitoring services offer a unified endpoint protection solution to manage the full lifecycle of a malicious attack including blocking, identification, containment, restoration and forensics. Threats recognized by ProSight Active Security Monitoring include:

• File-based attacks such as crypto-ransomware, worms, and payload-based assaults
• File-less and memory-only attacks without disk-resident indicators
• Document-carried malware embedded in macros and Office and Adobe files
• Phishing email attacks which make up a high percentage of security breaches
• Browser-delivered assaults incorporated in drive-by downloads, Java, JavaScript, VBS, html5, and malicious plug-ins
• Real-time assaults based on scripts like PowerShell, Powersploit, and VBS
• Credential-oriented assaults including credential-dumping, and mimikatz

Next-generation AV tools reinforce traditional signature-based detection with behavior monitoring. This technique tracks the actions of a potential threat and determines if the activity is typical and innocuous or unusual and potentially dangerous. For instance, does the software in question affect an unusually large number of processes? Does it alter the registry? Does it save keystrokes? Essentially, behavior monitoring concentrates on suspicious activities rather than on a fixed signature, which an attacker can quickly get around simply by changing a few bytes of malware code.

Prevention: Prior to the Breach
Zero-day malware attacks are being created quickly enough to overwhelm the ability of signature-style AV labs. The industry started to acknowledge the limitations of signature-matching EPP about a decade ago. Since that time things have become more serious.

Progent's ProSight ASM utilizes intelligent cloud-hosted AV centers and reputation services from major vendors to block recognized threats. This combined with deep file analysis and shared blacklisting and whitelisting give Progent's Active Security Monitoring an edge over old-school AV solutions. Still, prevention is only the initial phase of modern AV protection. Sophisticated exploits, file-less and script-dependent assaults routinely slip by signature-matching systems. For example, adversaries often employ a so-called packing tool to encrypt a malicious file's format so security labs and anti-virus software are unable to detect the threat.

Recognition and Reaction: During the Assault
The second part of the endpoint protection process involves responding to a cyber attack while the malware code is running after a breach. Progent's Active Security Monitoring uses next-generation endpoint protection techniques to detect malicious activity resulting from any attack that breaks through the first wall of protection. In order to modify information, even file-free threats such as memory-resident malware perform red-flag actions such as creating an executable file without authorization. ProSight ASM's compact embedded software agent tracks activity in each protected endpoint device and utilizes modern behavioral threat analysis and deep activity context to recognize new attacks as soon as they start. When an assault is identified, ProSight Active Security Monitoring immediately isolates the infected endpoint device from the network to contain the damage. Since the ProSight ASM embedded agent runs independently, endpoints remain secured even when they are disconnected from the Internet.

Cleanup: After a Break-in
After isolating a malware attack, Progent's ProSight ASM starts the cleanup process. When Progent's ASM is integrated with Windows Volume Shadow Copy Service (Windows VSS), modifications to data caused by a malware assault can be automatically returned to a safe state with one click. Progent's ProSight ASM also logs all system files and configurations that were altered by the malware and what files were fixed. When Progent's ProSight Active Security Monitoring detects a new malicious binary, the code is flagged and all devices on the grid that are secured by ASM agents are immunized against the new assault. Also, the ProSight Active Security Monitoring management tool includes comprehensive forensics like an informative visualization of the assault's storyline across the targeted network from beginning to end. This audit trail of how an attack progressed through the network assists you to evaluate the impact and uncovers shortcomings in rules or processes that should be corrected to prevent later breaches.

Download the ProSight Active Security Monitoring Datasheet
To download or read a PDF datasheet about the major features and benefits of Progent's ProSight Active Security Monitoring services, click:
Progent's Active Security Monitoring Ransomware Protection Services Datasheet. (PDF - 89 KB)

Contact Progent about ProSight ASM Services
To learn more about how Progent can assist you set up an affordable and efficient crypto-ransomware protection system with Progent's ASM service, call 1-800-462-8800 or visit Contact Progent.