24-7 Lubbock Critical Crypto
Malware Detection and Restoration Consulting

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyberplague that poses an existential threat for organizations vulnerable to an attack. Different iterations of ransomware like the CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and continue to inflict havoc. Modern strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with more unnamed newcomers, not only do encryption of online critical data but also infect many configured system backup. Information replicated to cloud environments can also be ransomed. In a poorly designed data protection solution, it can render automatic restore operations impossible and basically sets the network back to zero.

Restoring applications and information following a ransomware intrusion becomes a sprint against time as the victim struggles to stop the spread, eradicate the crypto-ransomware, and restore enterprise-critical operations. Due to the fact that ransomware needs time to move laterally, attacks are frequently sprung at night, when successful penetrations in many cases take longer to discover. This multiplies the difficulty of promptly mobilizing and organizing a qualified mitigation team.

Progent has a range of help services for protecting enterprises from crypto-ransomware penetrations. These include team member education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security solutions with machine learning technology from SentinelOne to identify and disable new cyber attacks intelligently. Progent in addition offers the assistance of veteran ransomware recovery professionals with the skills and perseverance to rebuild a breached environment as soon as possible.

Progent's Crypto-Ransomware Recovery Services
Soon after a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not ensure that cyber hackers will provide the needed codes to decipher all your files. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The other path is to re-install the critical elements of your IT environment. Absent access to essential data backups, this calls for a wide range of skill sets, professional team management, and the capability to work 24x7 until the recovery project is complete.

For two decades, Progent has offered certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of expertise affords Progent the skills to knowledgably identify necessary systems and integrate the surviving pieces of your Information Technology system following a ransomware penetration and assemble them into a functioning network.

Progent's recovery group utilizes best of breed project management systems to orchestrate the sophisticated restoration process. Progent understands the urgency of working quickly and in concert with a customer's management and Information Technology staff to prioritize tasks and to get critical systems back on line as soon as possible.

Customer Story: A Successful Ransomware Attack Response
A small business engaged Progent after their network was attacked by Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean government sponsored hackers, suspected of adopting approaches exposed from America's National Security Agency. Ryuk goes after specific organizations with limited room for operational disruption and is among the most lucrative instances of crypto-ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area with around 500 staff members. The Ryuk penetration had shut down all essential operations and manufacturing processes. The majority of the client's data protection had been on-line at the time of the attack and were destroyed. The client was actively seeking loans for paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked with the customer to rapidly determine and assign priority to the key elements that had to be recovered in order to continue departmental operations:

• Windows Active Directory
• Microsoft Exchange
• Accounting/MRP

In less than 2 days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and hard drive recovery on the most important systems. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to collect intact OST data files (Outlook Email Offline Folder Files) on user desktop computers to recover mail information. A recent off-line backup of the businesses manufacturing systems made it possible to recover these required programs back on-line. Although a large amount of work remained to recover totally from the Ryuk virus, critical services were returned to operations rapidly:

During the following couple of weeks important milestones in the recovery project were achieved in close cooperation between Progent consultants and the customer:

• Internal web sites were brought back up without losing any data.
• The MailStore Server exceeding four million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were completely recovered.
• A new Palo Alto 850 firewall was set up.
• 90% of the user PCs were operational.

Conclusion
A possible enterprise-killing catastrophe was evaded by top-tier professionals, a wide spectrum of knowledge, and tight collaboration. Although in retrospect the ransomware penetration described here would have been shut down with current security technology and ISO/IEC 27001 best practices, staff education, and well designed security procedures for information backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's team of experts has a proven track record in ransomware virus blocking, remediation, and data disaster recovery.

To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Lubbock a portfolio of online monitoring and security assessment services designed to assist you to reduce the threat from crypto-ransomware. These services utilize modern artificial intelligence capability to detect zero-day variants of ransomware that are able to evade traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management technology to keep your IT system operating at peak levels by checking the state of critical assets that power your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted immediately to your specified IT personnel and your Progent engineering consultant so that any looming issues can be resolved before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your network, server, and desktop devices by providing tools for streamlining common tedious jobs. These can include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, anti-virus defense, secure remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your specified IT management personnel and your assigned Progent consultant so emerging issues can be taken care of before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, monitor, optimize and troubleshoot their networking hardware like switches, firewalls, and access points as well as servers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology maps are kept current, captures and displays the configuration of virtually all devices on your network, tracks performance, and generates alerts when issues are discovered. By automating tedious management and troubleshooting activities, ProSight WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating appliances that need critical software patches, or identifying the cause of performance issues. Find out more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time management reporting tools designed to work with the top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup technology providers to produce ProSight Data Protection Services, a selection of offerings that provide backup-as-a-service. ProSight DPS services manage and track your backup operations and allow transparent backup and fast recovery of vital files/folders, applications, system images, and VMs. ProSight DPS helps you recover from data loss resulting from hardware breakdown, natural calamities, fire, malware like ransomware, human error, ill-intentioned insiders, or application glitches. Managed services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of leading data security vendors to deliver web-based management and comprehensive protection for your inbound and outbound email. The powerful structure of Progent's Email Guard managed service combines cloud-based filtering with an on-premises gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based malware. Email Guard's cloud filter acts as a first line of defense and keeps the vast majority of threats from reaching your security perimeter. This reduces your exposure to external attacks and conserves system bandwidth and storage. Email Guard's on-premises gateway device adds a deeper level of analysis for inbound email. For outbound email, the on-premises gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that originates and ends inside your corporate firewall. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication. Duo supports one-tap identity verification on Apple iOS, Android, and other personal devices. With Duo 2FA, when you log into a secured online account and give your password you are requested to verify your identity via a device that only you possess and that uses a separate network channel. A wide selection of devices can be utilized as this added means of ID validation such as a smartphone or watch, a hardware/software token, a landline phone, etc. You can designate multiple verification devices. To find out more about Duo two-factor identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Help Desk services allow your information technology team to offload Call Center services to Progent or split activity for support services transparently between your in-house support resources and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts. Progent's Shared Service Desk offers a seamless extension of your internal support staff. Client access to the Help Desk, provision of support, issue escalation, trouble ticket generation and updates, efficiency metrics, and management of the support database are consistent regardless of whether incidents are resolved by your core support group, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Help Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior-based machine learning tools to defend endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and email phishing, which routinely evade traditional signature-matching AV products. Progent ASM services safeguard on-premises and cloud-based resources and offers a single platform to automate the complete malware attack lifecycle including protection, infiltration detection, containment, remediation, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSLs or warranties. By updating and managing your network documentation, you can save up to 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're making improvements, performing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide organizations of all sizes a versatile and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic information network. Besides maximizing the protection and functionality of your IT network, Progent's patch management services allow your in-house IT team to focus on line-of-business projects and activities that derive the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the apps. Because the system is virtualized, it can be moved immediately to a different hardware solution without a lengthy and difficult configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based machine learning tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-based AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a single platform to address the complete malware attack lifecycle including filtering, infiltration detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services offer affordable multi-layer security for physical servers and VMs, workstations, smartphones, and Exchange email. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to cyber threats from all vectors. ProSight ESP provides firewall protection, intrusion alarms, device control, and web filtering through leading-edge technologies incorporated within one agent accessible from a single control. Progent's security and virtualization experts can help you to design and implement a ProSight ESP deployment that addresses your company's unique needs and that helps you prove compliance with legal and industry information security standards. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that call for immediate attention. Progent can also assist you to install and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.