Madison 24-7 Immediate CryptoLocker
Virus Damage Assessment and Repair Consulting

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyberplague that poses an enterprise-level threat for organizations vulnerable to an attack. Versions of ransomware such as CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for years and continue to inflict havoc. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, plus frequent unnamed newcomers, not only encrypt online data but also infect all configured system protection. Data synchronized to the cloud can also be corrupted. In a poorly architected environment, this can make any recovery hopeless and basically sets the network back to zero.

Getting back on-line programs and data after a ransomware intrusion becomes a race against time as the targeted business fights to contain, eradicate the virus, and restore enterprise-critical operations. Because ransomware needs time to move laterally, attacks are usually sprung at night, when successful penetrations typically take longer to notice. This multiplies the difficulty of rapidly assembling and coordinating an experienced response team.

Progent has an assortment of solutions for securing enterprises from ransomware penetrations. These include team training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security solutions with AI technology from SentinelOne to identify and quarantine day-zero cyber threats quickly. Progent in addition offers the assistance of seasoned crypto-ransomware recovery consultants with the talent and commitment to restore a breached network as soon as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware penetration, sending the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the needed keys to decipher all your files. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to re-install the essential parts of your Information Technology environment. Absent the availability of essential system backups, this calls for a wide complement of skill sets, top notch team management, and the capability to work continuously until the job is complete.

For decades, Progent has made available professional Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly identify critical systems and organize the remaining pieces of your IT system following a ransomware attack and rebuild them into an operational system.

Progent's security group uses best of breed project management applications to orchestrate the complicated recovery process. Progent understands the importance of acting rapidly and in concert with a client's management and IT staff to prioritize tasks and to put essential systems back on-line as soon as possible.

Case Study: A Successful Ransomware Penetration Restoration
A client sought out Progent after their company was brought down by the Ryuk ransomware. Ryuk is believed to have been developed by Northern Korean government sponsored hackers, suspected of adopting strategies leaked from America's National Security Agency. Ryuk seeks specific companies with limited tolerance for disruption and is one of the most lucrative examples of crypto-ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in Chicago and has around 500 employees. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's information backups had been online at the start of the intrusion and were damaged. The client was pursuing financing for paying the ransom (in excess of $200K) and hoping for good luck, but ultimately brought in Progent.

Progent worked together with the client to quickly get our arms around and assign priority to the critical elements that needed to be recovered in order to resume departmental functions:

• Windows Active Directory
• Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then charged ahead with setup and storage recovery on the most important applications. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Off-Line Data Files) on user PCs and laptops to recover mail messages. A not too old off-line backup of the client's financials/ERP systems made them able to restore these essential services back servicing users. Although a large amount of work remained to recover fully from the Ryuk event, essential systems were restored quickly:

Throughout the following month important milestones in the restoration process were completed through tight collaboration between Progent consultants and the customer:

• Internal web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• 90% of the user desktops were fully operational.

Conclusion
A possible company-ending catastrophe was averted due to top-tier experts, a broad spectrum of technical expertise, and close teamwork. Although upon completion of forensics the ransomware penetration described here could have been identified and disabled with up-to-date cyber security systems and NIST Cybersecurity Framework best practices, user training, and properly executed security procedures for information backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, cleanup, and data restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Madison a variety of online monitoring and security evaluation services designed to help you to reduce the threat from ransomware. These services incorporate modern artificial intelligence technology to uncover new variants of ransomware that can get past legacy signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which easily evade legacy signature-based AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and offers a unified platform to address the complete threat lifecycle including blocking, detection, containment, remediation, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable in-depth protection for physical servers and VMs, desktops, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, device control, and web filtering via cutting-edge tools packaged within a single agent accessible from a unified control. Progent's security and virtualization consultants can help you to design and implement a ProSight ESP deployment that addresses your company's unique requirements and that helps you prove compliance with legal and industry information protection standards. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require urgent attention. Progent can also assist you to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and monitor your backup processes and allow non-disruptive backup and rapid recovery of critical files, apps, images, and VMs. ProSight DPS helps you protect against data loss caused by hardware breakdown, natural calamities, fire, malware like ransomware, user error, malicious employees, or software bugs. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top data security vendors to deliver centralized management and comprehensive security for your inbound and outbound email. The powerful architecture of Progent's Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and keeps the vast majority of threats from making it to your network firewall. This decreases your vulnerability to inbound threats and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a deeper level of analysis for inbound email. For outbound email, the onsite security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that stays within your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to map out, monitor, optimize and troubleshoot their connectivity hardware such as routers, firewalls, and load balancers as well as servers, endpoints and other devices. Incorporating cutting-edge RMM technology, WAN Watch ensures that infrastructure topology diagrams are always updated, captures and manages the configuration of virtually all devices connected to your network, monitors performance, and sends alerts when problems are discovered. By automating complex network management processes, ProSight WAN Watch can knock hours off ordinary tasks like network mapping, expanding your network, locating devices that need critical software patches, or isolating performance problems. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management technology to keep your IT system running at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your designated IT management staff and your assigned Progent engineering consultant so that all looming issues can be addressed before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual machine host set up and maintained by Progent's IT support experts. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS platforms, and the applications. Since the environment is virtualized, it can be ported easily to an alternate hardware environment without requiring a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and protect information about your network infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs or domains. By updating and managing your IT documentation, you can save as much as half of time spent trying to find critical information about your network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're planning improvements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Find out more about ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior-based analysis technology to guard endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-based AV products. Progent ASM services safeguard on-premises and cloud resources and provides a unified platform to automate the complete malware attack lifecycle including filtering, infiltration detection, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Help Center services allow your IT team to outsource Support Desk services to Progent or divide activity for Help Desk services transparently between your in-house support team and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a smooth supplement to your internal support team. End user interaction with the Help Desk, provision of support services, escalation, trouble ticket generation and updates, performance metrics, and maintenance of the support database are cohesive regardless of whether incidents are taken care of by your corporate support staff, by Progent, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Center services.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer businesses of any size a versatile and affordable solution for evaluating, validating, scheduling, applying, and tracking software and firmware updates to your dynamic information system. Besides optimizing the protection and functionality of your IT network, Progent's software/firmware update management services allow your IT staff to concentrate on more strategic initiatives and tasks that deliver the highest business value from your information network. Find out more about Progent's patch management support services.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication. Duo enables single-tap identity confirmation on iOS, Android, and other personal devices. Using Duo 2FA, when you sign into a secured application and give your password you are asked to verify your identity via a device that only you have and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You can designate multiple verification devices. To find out more about Duo identity authentication services, visit Duo MFA two-factor authentication services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth management reporting utilities created to integrate with the leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as inconsistent support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.