24/7/365 Lubbock Immediate Crypto Computer Virus Assessment and Restoration Services

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that represents an extinction-level threat for organizations unprepared for an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and still inflict destruction. The latest versions of crypto-ransomware like Ryuk and Hermes, plus more as yet unnamed newcomers, not only do encryption of on-line files but also infect many available system backups. Files replicated to off-site disaster recovery sites can also be ransomed. In a poorly designed environment, this can make automatic recovery useless and basically sets the network back to square one.

Restoring services and information after a ransomware intrusion becomes a sprint against time as the targeted organization tries its best to contain the damage and cleanup the virus and to restore mission-critical operations. Because ransomware requires time to spread, penetrations are often sprung during nights and weekends, when successful penetrations tend to take longer to discover. This multiplies the difficulty of promptly assembling and organizing an experienced mitigation team.

Progent offers a range of help services for securing organizations from ransomware attacks. These include team member training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of the latest generation security appliances with artificial intelligence technology to intelligently discover and suppress day-zero cyber attacks. Progent also offers the assistance of veteran ransomware recovery professionals with the skills and commitment to rebuild a breached system as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware attack, even paying the ransom in Bitcoin cryptocurrency does not guarantee that distant criminals will provide the keys to decrypt any or all of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is significantly above the average ransomware demands, which ZDNET determined to be approximately $13,000. The other path is to setup from scratch the key components of your IT environment. Without access to full system backups, this calls for a broad range of skills, top notch project management, and the ability to work non-stop until the job is finished.

For decades, Progent has provided professional Information Technology services for companies in Lubbock and across the U.S. and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has expertise in accounting and ERP application software. This breadth of experience gives Progent the skills to rapidly determine important systems and integrate the surviving components of your IT environment following a ransomware event and rebuild them into an operational network.

Progent's recovery team utilizes top notch project management applications to coordinate the complicated recovery process. Progent understands the urgency of working swiftly and in concert with a client's management and Information Technology resources to assign priority to tasks and to put key services back online as soon as possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A client escalated to Progent after their network system was brought down by the Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean state cybercriminals, possibly adopting technology exposed from the U.S. NSA organization. Ryuk attacks specific companies with limited ability to sustain disruption and is among the most lucrative examples of crypto-ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business headquartered in the Chicago metro area and has about 500 workers. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. Most of the client's system backups had been online at the beginning of the attack and were encrypted. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately utilized Progent.

Progent worked with the client to quickly understand and prioritize the mission critical systems that needed to be restored to make it possible to restart business operations:

• Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-virus state. Progent then assisted with rebuilding and hard drive recovery on mission critical servers. All Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to collect local OST data files (Outlook Off-Line Folder Files) on staff PCs and laptops in order to recover email data. A recent offline backup of the businesses financials/MRP systems made them able to restore these required applications back on-line. Although a lot of work still had to be done to recover fully from the Ryuk virus, critical systems were restored quickly:

Throughout the following couple of weeks important milestones in the restoration process were made through close collaboration between Progent team members and the client:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over 4 million archived emails was brought online and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were 100% functional.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the user desktops were operational.

Conclusion
A probable business-ending disaster was averted through the efforts of dedicated professionals, a wide spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware virus penetration described here would have been identified and blocked with current security technology and recognized best practices, user training, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's team of experts has substantial experience in ransomware virus defense, removal, and information systems restoration.

To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Lubbock a variety of online monitoring and security evaluation services designed to help you to reduce your vulnerability to ransomware. These services include modern machine learning technology to detect new strains of ransomware that can escape detection by legacy signature-based security solutions.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates next generation behavior machine learning tools to defend physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-matching AV tools. ProSight ASM protects on-premises and cloud-based resources and provides a single platform to manage the complete malware attack progression including blocking, detection, mitigation, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer economical multi-layer protection for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint control, and web filtering through leading-edge tools packaged within a single agent managed from a single console. Progent's security and virtualization experts can help you to design and configure a ProSight ESP deployment that meets your company's unique requirements and that helps you achieve and demonstrate compliance with government and industry data security regulations. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also help you to set up and test a backup and restore solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.

• ProSight Data Protection Services: Managed Backup and Recovery
  ProSight Data Protection Services provide small and mid-sized organizations an affordable end-to-end solution for secure backup/disaster recovery. For a low monthly cost, ProSight Data Protection Services automates your backup processes and enables fast restoration of vital data, applications and VMs that have become lost or corrupted due to component breakdowns, software glitches, disasters, human error, or malware attacks such as ransomware. ProSight Data Protection Services can help you protect, retrieve and restore files, folders, applications, system images, as well as Microsoft Hyper-V and VMware virtual machine images. Critical data can be backed up on the cloud, to an on-promises device, or mirrored to both. Progent's backup and recovery consultants can deliver advanced support to configure ProSight Data Protection Services to to comply with government and industry regulatory standards like HIPAA, FINRA, and PCI and, whenever needed, can assist you to restore your critical information. Find out more about ProSight Data Protection Services Managed Cloud Backup and Recovery.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security companies to deliver web-based control and world-class security for all your email traffic. The powerful structure of Email Guard combines a Cloud Protection Layer with a local security gateway device to provide complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. The cloud filter acts as a preliminary barricade and blocks most unwanted email from making it to your security perimeter. This reduces your exposure to inbound attacks and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance adds a further layer of inspection for incoming email. For outgoing email, the local gateway offers AV and anti-spam protection, DLP, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your corporate firewall. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Management
  Progent’s ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map, track, enhance and troubleshoot their connectivity hardware like switches, firewalls, and load balancers as well as servers, printers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network maps are always updated, copies and manages the configuration information of virtually all devices connected to your network, tracks performance, and sends alerts when problems are discovered. By automating time-consuming management processes, WAN Watch can cut hours off common tasks such as making network diagrams, reconfiguring your network, locating devices that require critical software patches, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent’s server and desktop monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system running efficiently by checking the health of vital computers that drive your business network. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your designated IT management staff and your Progent engineering consultant so all looming issues can be addressed before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a secure Tier III data center on a fast virtual host configured and maintained by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS platforms, and the apps. Because the environment is virtualized, it can be ported easily to a different hosting solution without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be warned about impending expirations of SSLs or domains. By updating and managing your IT documentation, you can save up to 50% of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you’re making improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you need the instant you need it. Read more about ProSight IT Asset Management service.