Ransomware Defense and Remediation Solutions

Progent's ProSight Active Security Monitoring services feature behavior analysis and AI heuristics from SentinelOne to provide best-in-class defense for endpoints and virtual and physical servers. This modern approach to malware protection is designed to meet the new generation of cyber threats, like crypto-ransomware, which routinely avoid filtering by conventional signature-matching anti-virus technology. Progent is a SentinelOne Partner, reseller, and integrator.

Progent's Active Security Monitoring offers small and medium-sized companies the advantages of the identical anti-virus technology deployed by some of the world's biggest corporations such as Netflix, Citi, and NASDAQ. By providing real-time malware filtering, detection, mitigation, recovery and analysis in a single integrated platform, ProSight Active Security Monitoring lowers total cost of ownership, simplifies administration, and expedites operational continuity. The next-generation endpoint protection (NGEP) incorporated in Progent's ProSight ASM was ranked by Gartner Group as the "most visionary Endpoint Protection Platform (EPP)."

Progent's ASM online services rely on a low-profile agent loaded on every enrolled device in order to form an active cybersecurity matrix that responds to potential malware instantly and orchestrates unified defense that includes:

• Instant protection for Windows, Mac, Linux, iOS and Android devices
• Support for VMs running Hyper-V, vSphere, and Citrix XenServer virtualization systems
• In-depth OS-level monitoring
• Signature-independent heuristics and automation
• Cutting-edge behavioral analysis
• Ability to spot current generation attacks from all vectors
• Automated post-attack containment
• Easy resumption of last safe state following a ransomware attack including Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim
• Instant no-touch immunization throughout the complete matrix of protected devices
• Real-time display of an attack's path throughout your network
• Extensive forensics for determining security gaps
• Centralized browser-based administration console
• Complies with HIPAA and PCI regulations

ProSight Active Security Monitoring and Today's Threat Landscape
Most crypto-ransomware break-ins could have been prevented by current cybersecurity tools. Unfortunately, some attacks will succeed despite the most well-planned defenses. Today's security landscape is too filled with relentless extortionists, including government-sponsored threat actors, for any organization to be entirely safe. Given this reality, ProSight Active Security Monitoring is designed not simply to keep ransomware from breaching your information network, but also to respond promptly to any detected penetration. This includes instant isolation of infected machines, AI-based threat cleanup, fast inoculation of all endpoints by means of local agents, single-click restore to a safe condition and extensive forensics to help you understand how to enhance your security profile to ward off subsequent attacks. By delivering leading-edge protection during all phases of a cyber attack, Progent's ProSight Active Security Monitoring represents a comprehensive platform for dealing with the increasingly dangerous cybersecurity environment and escaping the economic and reputation loss associated with a major security exploit.

Endpoint devices such as PCs, notebooks and smartphones are the most vulnerable and most commonly targeted components of an IT network. ProSight ASM services offer a unified endpoint protection solution to handle the complete lifecycle of a malicious attack including blocking, identification, containment, restoration and analytics. Threats managed by ProSight ASM include:

• File-based malware such as crypto-ransomware, worms, and backdoor assaults
• File-less and memory-based malware with no disk-based indicators
• Document-based malware incorporated in malicious macros and Office and Adobe files
• Phishing email attacks which make up a large portion of cybersecurity breaches
• Browser-delivered assaults incorporated in drive-by downloads, Flash, JavaScript, VBScript, html5, and malicious plug-ins
• Real-time attacks from scripts like PowerShell, Powersploit, and VBS
• Credential-based assaults including credential-dumping, mimikatz and tokens

Next-generation AV products supplement conventional signature matching with behavior analysis. This technique tracks the activity of a possible attack and determines if the activity is normal and safe or unusual and possibly threatening. For example, does the software in question impact an unusually large number of processes? Does it alter the registry? Does it log keystrokes? Basically, behavior analysis concentrates on suspicious activities instead of on a fixed signature, which a hacker can easily get around simply by changing a few bytes of malware code.

Blocking: Prior to the Breach
Zero-day threats are being manufactured quickly enough to swamp the ability of signature-based AV platform providers. The market started to recognize the limitations of signature-matching EPP about a decade ago. Since then the situation has become worse.

ProSight Active Security Monitoring utilizes modern cloud-based anti-virus centers and reputation services from leading providers to stop known threats. This combined with deep file analysis and dynamic blacklisting and whitelisting give Progent's ProSight Active Security Monitoring an advantage over traditional anti-virus solutions. Still, prevention is only the first line of modern AV protection. Sophisticated exploits, file-less and script-dependent assaults routinely evade signature-matching systems. For example, hackers often use a packing tool to camouflage malware code so security researchers and anti-virus software are unable to recognize the attack.

Detection and Response: During the Attack
The second part of the endpoint protection process involves responding to an attack while the malicious code is executing following a break-in. Progent's ASM uses advanced EPP technology to detect malicious activity caused by any threat that penetrates the first wall of defense. In order to compromise information, even file-less threats such as memory-resident assaults perform recognizable actions like as making an executable file with no authorization. Progent's ProSight ASM's low-profile resident agent tracks activity in every protected endpoint device and utilizes modern behavioral threat analysis and deep execution background to recognize new attacks as soon as they start. After an attack is identified, ProSight ASM immediately isolates the affected endpoint device from the grid to minimize the spread. Since the Progent's ASM embedded agent operates independently, endpoints stay protectedd even when they are not connected to the Internet.

Cleanup: After a Break-in
After containing a malware attack, Progent's ProSight ASM starts the recovery phase of protection. When Progent's ProSight Active Security Monitoring is implemented with Windows VSS, modifications to data caused by a cyber assault can be easily returned to a trusted condition with one click. Progent's Active Security Monitoring also records any system-level files and configurations that were changed by the attack and what files were fixed. Any time Progent's Active Security Monitoring uncovers a recent malicious binary, the malware code is tagged and any devices on the grid that are protected by ProSight ASM agents are vaccinated against the latest attack. In addition, the Progent's Active Security Monitoring management console includes extensive forensics like an informative display of the assault's storyline throughout the targeted network from beginning to end. This history of how an assault travelled within the network assists you to evaluate the damage and highlights weaknesses in rules or processes that need to be corrected to prevent future breaches.

Download the ProSight Active Security Monitoring Datasheet
To download a PDF datasheet describing the key features and benefits of Progent's Active Security Monitoring services, click:
ProSight Active Security Monitoring Ransomware Protection Datasheet. (PDF - 89 KB)

Contact Progent about ProSight ASM Services
To find out more information about how Progent can assist your business set up an affordable and efficient crypto-ransomware defense system with ProSight ASM service, call 1-800-462-8800 or see Contact Progent.