Ransomware Defense and Cleanup Expertise

Progent's ProSight Active Security Monitoring services feature advanced machine learning technology from SentinelOne to offer best-in-class defense for all endpoints as well as servers. This approach to malware protection is designed to meet the latest wave of cyber attacks, like ransomware, which routinely evade filtering by legacy signature-matching anti-virus (AV) techniques. Progent is a SentinelOne Partner, dealer, and integrator.

ProSight ASM gives small and medium-sized companies the advantages of the same anti-virus technology deployed by some of the world's biggest enterprises such as Netflix, Citi, and NASDAQ. By delivering in-line malware filtering, classification, mitigation, restoration and forensics in one integrated platform, ProSight Active Security Monitoring cuts total cost of ownership, simplifies management, and promotes rapid operational continuity. The next-generation endpoint protection (NGEP) incorporated in ProSight ASM was ranked by Gartner Group as the industry's "most visionary Endpoint Protection Platform (EPP)."

Progent's ProSight ASM services utilize a small-footprint software agent running on every enrolled device to create a dynamic cybersecurity matrix that reacts to suspected malware instantly and orchestrates cohesive defense that includes:

• Instant protection for Windows, macOS, Linux, Apple iOS and Google Android machines
• Protection for virtual machines running Windows Hyper-V, VMware vSphere, and Citrix XenServer virtualization systems
• Deep operating system-level monitoring
• Signature-independent heuristics and extensive automation
• Modern behavioral analysis
• Detection of new generation attacks from all vectors
• Automated after-attack containment
• Single-click resumption of most recent safe state following a ransomware attack including Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim
• Immediate no-touch vaccination across the entire grid of protected machines
• Immediate display of an assault's progress throughout your network
• Comprehensive forensics for recognizing vulnerabilities
• Centralized web-accessible administration tool
• Compliant with HIPAA and PCI regulations

ProSight ASM and the Current Threat Environment
The vast majority of ransomware breaches could have been prevented by modern cybersecurity tools. But inevitably, some assaults will succeed despite the most well-planned protective measures. The modern cybersecurity environment is too crowded with relentless bad actors, including government-sponsored hackers, for any enterprise to be entirely safe. Given this reality, Progent's Active Security Monitoring is intended not simply to prevent ransomware from establishing a foothold on your information network, but also to respond promptly to any breach. This includes instant quarantine of infected devices, automatic threat cleanup, fast immunization of all machines via embedded agents, one-click rollback to a safe state and comprehensive forensics to help you understand how to bolster your security defense to ward off subsequent attacks. By providing leading-edge protection during all facets of a cyber assault, Progent's ProSight Active Security Monitoring represents an end-to-end solution for dealing with today's increasingly dangerous security environment and escaping the economic and reputation loss associated with a serious security breach.

Endpoints like PCs, notebooks and smartphones are the most susceptible and most typically attacked elements of a network. Progent's ASM services offer a unified endpoint protection (EPP) platform to manage the complete lifecycle of a malicious attack including filtering, identification, containment, cleanup and forensics. Malware attacks recognized by Progent's ProSight ASM include:

• File-dependent attacks like ransomware, trojans, and payload-based attacks
• File-less and memory-only attacks without disk-resident indicators
• Document-carried attacks incorporated within macros and Microsoft Office and Adobe files
• Phishing and spear phishing email attacks which make up a high percentage of security breaches)
• Web browser-based attacks embedded in drive-by downloads, Flash, JavaScript, VBScript, html5, and malicious plug-ins
• Real-time assaults based on scripts like PowerShell, Powersploit, and VBScript
• Credential-oriented assaults including credential-scraping, and mimikatz

Next-generation anti-virus tools reinforce conventional signature-based detection with behavior monitoring. This technology examines the actions of a possible threat and decides if the activity is typical and innocuous or abnormal and potentially dangerous. For example, does the software under observation impact an unusually large number of processes? Does it alter the registry? Does it log keystrokes? Essentially, behavior analysis concentrates on suspicious actions rather than on a fixed digital signature, which a hacker can easily nullify just by modifying a few bytes of malware code.

Blocking: Before the Breach
Novel malware attacks are being developed fast enough to swamp the capacity of signature-based AV labs. The market started to acknowledge the shortcomings of signature-matching EPP about a decade ago. Since that time things have become worse.

Progent's ASM uses intelligent cloud-based anti-virus labs and whitelisting/blacklisting services from leading providers to stop recognized threats. This combined with deep file inspection and dynamic blacklisting and whitelisting give Progent's ProSight ASM an edge over old-school anti-virus solutions. Still, prevention is only the initial stage of next-generation AV defense. Sophisticated attacks, file-less and script-dependent assaults routinely evade signature-matching defenses. For example, cyber criminals often use a packing tool to compress malware code so cybersecurity researchers and anti-virus software can't recognize the threat.

Detection and Response: During the Attack
The next phase of the EPP process involves reacting to a cyber attack while the malicious code is running following a break-in. Progent's Active Security Monitoring utilizes next-generation endpoint protection technology to detect malicious activity resulting from any threat that penetrates the first wall of defense. To compromise data, even file-less threats like memory-based malware perform red-flag behaviors like as making an executable file without authorization. Progent's ASM's compact resident software agent monitors activity in each enrolled endpoint and uses modern behavioral threat analysis and full activity background to recognize new assaults immediately after they start. When an attack is identified, Progent's ProSight ASM at once isolates the infected endpoint device from the network to contain the impact. Because the Progent's Active Security Monitoring software agent operates independently, endpoint devices stay protectedd even if they are detached from the Internet.

Remediation: After a Break-in
After containing an attack, ProSight Active Security Monitoring begins the restoration phase of protection. When Progent's ASM is integrated with Microsoft Windows VSS, changes to data caused by a malware assault can be quickly rolled back to a trusted state with a single click. Progent's ProSight ASM also records all system-level files and configurations that were modified by the malware and what files were restored. When ProSight ASM detects a new malicious binary, the malware code is tagged and any devices on the network that are protected by agents are inoculated against the new assault. Also, the Progent's ASM management console includes extensive forensics such as an intuitive display of the attack's storyline across the targeted network from start to finish. This history of how an assault progressed through the network helps you to assess the impact and brings to light gaps in rules or processes that should be corrected to avoid future breaches.

Download the ProSight Active Security Monitoring Datasheet
To download a PDF datasheet describing the key features and benefits of Progent's Active Security Monitoring services, click:
Progent's ProSight ASM Ransomware Protection Datasheet. (PDF - 89 KB)

Contact Progent about ProSight ASM Services
To find out more information about ways Progent can help your business create an economical and efficient crypto-ransomware defense system with Progent's Active Security Monitoring service, call 1-800-462-8800 or see Contact Progent.