Irvine 24/7 Immediate Ransomware
Infection Damage Assessment and Removal Experts

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyber pandemic that represents an existential danger for organizations poorly prepared for an assault. Versions of ransomware like the Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for years and still inflict harm. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as daily as yet unnamed newcomers, not only encrypt on-line critical data but also infect all available system restores and backups. Files synched to the cloud can also be corrupted. In a poorly designed data protection solution, this can make any restoration impossible and basically knocks the network back to zero.

Getting back online applications and data following a crypto-ransomware event becomes a sprint against the clock as the victim tries its best to contain the damage, eradicate the virus, and resume enterprise-critical activity. Since crypto-ransomware needs time to spread, penetrations are usually sprung on weekends, when attacks typically take more time to discover. This compounds the difficulty of promptly mobilizing and organizing a capable mitigation team.

Progent offers a range of support services for protecting businesses from ransomware events. Among these are user training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of next-generation security solutions with machine learning capabilities from SentinelOne to detect and disable zero-day cyber attacks intelligently. Progent in addition offers the assistance of expert crypto-ransomware recovery engineers with the track record and commitment to rebuild a compromised environment as urgently as possible.

Progent's Ransomware Recovery Help
After a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed codes to unencrypt any of your data. Kaspersky ascertained that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to setup from scratch the vital elements of your IT environment. Without access to complete information backups, this requires a wide range of skill sets, professional project management, and the ability to work 24x7 until the task is complete.

For twenty years, Progent has provided expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of expertise provides Progent the capability to rapidly determine important systems and organize the surviving pieces of your Information Technology system following a ransomware attack and rebuild them into an operational system.

Progent's recovery team uses state-of-the-art project management applications to orchestrate the complicated recovery process. Progent understands the urgency of acting rapidly and in unison with a client's management and IT team members to assign priority to tasks and to put key applications back on line as fast as possible.

Client Case Study: A Successful Ransomware Virus Response
A business escalated to Progent after their network system was penetrated by the Ryuk ransomware virus. Ryuk is thought to have been launched by Northern Korean government sponsored criminal gangs, possibly adopting algorithms leaked from the United States NSA organization. Ryuk targets specific organizations with limited room for disruption and is one of the most lucrative incarnations of ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in Chicago and has about 500 staff members. The Ryuk attack had disabled all business operations and manufacturing capabilities. The majority of the client's data backups had been online at the beginning of the attack and were encrypted. The client was actively seeking loans for paying the ransom (more than $200,000) and praying for good luck, but in the end engaged Progent.

Progent worked together with the customer to quickly get our arms around and prioritize the mission critical elements that needed to be restored to make it possible to resume departmental functions:

• Microsoft Active Directory
• Electronic Mail
• MRP System

Within two days, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then assisted with reinstallations and hard drive recovery of needed systems. All Exchange ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on staff desktop computers and laptops in order to recover email data. A recent offline backup of the businesses financials/ERP systems made them able to return these vital programs back online. Although a lot of work remained to recover totally from the Ryuk virus, critical systems were restored quickly:

Throughout the next few weeks important milestones in the restoration project were completed in tight cooperation between Progent team members and the customer:

• In-house web sites were restored with no loss of information.
• The MailStore Server containing more than four million historical messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory Control modules were fully recovered.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Ninety percent of the user desktops were fully operational.

Conclusion
A possible business-killing catastrophe was avoided through the efforts of top-tier experts, a broad range of knowledge, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident detailed here could have been identified and blocked with current cyber security technology and best practices, team training, and appropriate security procedures for information backup and applying software patches, the fact is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, cleanup, and file restoration.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Irvine a range of online monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services utilize next-generation AI capability to detect new strains of crypto-ransomware that can evade traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management (RMM) technology to help keep your network operating at peak levels by checking the state of vital computers that drive your information system. When ProSight LAN Watch detects an issue, an alarm is sent immediately to your specified IT management personnel and your Progent consultant so that any potential problems can be addressed before they can impact your network. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing an environment for performing common time-consuming tasks. These can include health checking, patch management, automated repairs, endpoint deployment, backup and restore, anti-virus response, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alert to your designated IT management personnel and your Progent consultant so emerging issues can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to diagram, track, optimize and troubleshoot their connectivity hardware such as routers and switches, firewalls, and access points as well as servers, client computers and other devices. Using cutting-edge RMM technology, ProSight WAN Watch ensures that network maps are always current, copies and manages the configuration of virtually all devices on your network, monitors performance, and sends alerts when issues are detected. By automating time-consuming management processes, WAN Watch can cut hours off common chores such as making network diagrams, expanding your network, locating appliances that need important software patches, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth reporting plug-ins created to integrate with the leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as spotty support follow-up or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup software providers to create ProSight Data Protection Services, a portfolio of management offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup operations and enable non-disruptive backup and fast restoration of important files/folders, apps, system images, plus virtual machines. ProSight DPS helps you protect against data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks like ransomware, user error, malicious insiders, or software glitches. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top data security vendors to provide web-based management and comprehensive protection for all your inbound and outbound email. The hybrid structure of Progent's Email Guard managed service combines cloud-based filtering with an on-premises gateway appliance to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This reduces your vulnerability to inbound attacks and conserves system bandwidth and storage. Email Guard's onsite security gateway appliance provides a deeper layer of inspection for incoming email. For outgoing email, the local gateway offers anti-virus and anti-spam protection, DLP, and email encryption. The local gateway can also help Exchange Server to monitor and protect internal email that stays inside your security perimeter. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication. Duo enables single-tap identity confirmation on Apple iOS, Android, and other personal devices. With Duo 2FA, when you sign into a protected online account and enter your password you are asked to confirm your identity via a device that only you have and that is accessed using a different network channel. A wide range of out-of-band devices can be utilized as this second means of authentication such as a smartphone or wearable, a hardware token, a landline telephone, etc. You may designate several verification devices. To learn more about Duo identity authentication services, refer to Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Desk: Call Center Managed Services
  Progent's Call Center services enable your IT team to offload Help Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support resources and Progent's extensive roster of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent extension of your in-house IT support organization. End user interaction with the Service Desk, provision of technical assistance, escalation, ticket creation and updates, performance measurement, and management of the service database are consistent whether incidents are resolved by your internal IT support staff, by Progent, or by a combination. Find out more about Progent's outsourced/shared Service Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior machine learning tools to guard endpoint devices and servers and VMs against new malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-matching AV products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to manage the entire malware attack lifecycle including protection, identification, mitigation, remediation, and forensics. Top capabilities include single-click rollback with Windows VSS and real-time system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and safeguard information about your IT infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be warned about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can save up to half of time thrown away trying to find vital information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're making enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you need the instant you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your dynamic IT system. Besides maximizing the protection and functionality of your IT environment, Progent's patch management services free up time for your IT staff to concentrate on more strategic initiatives and tasks that derive maximum business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual host set up and managed by Progent's network support experts. Under the ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the apps. Because the environment is virtualized, it can be ported immediately to an alternate hosting solution without requiring a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoints against modern malware assaults like ransomware and email phishing, which routinely escape traditional signature-matching AV tools. ProSight Active Security Monitoring safeguards local and cloud resources and provides a single platform to manage the complete threat lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer economical multi-layer protection for physical servers and virtual machines, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint management, and web filtering through cutting-edge tools incorporated within one agent managed from a single console. Progent's security and virtualization experts can assist you to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you demonstrate compliance with legal and industry information security regulations. Progent will assist you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent can also help your company to install and verify a backup and restore system like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.