Colorado Springs 24/7/365 Immediate Ransomware
Computer Malware Assessment and Repair Consultants

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyberplague that poses an enterprise-level danger for businesses unprepared for an attack. Versions of ransomware such as Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for a long time and still cause destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus more as yet unnamed malware, not only encrypt on-line information but also infiltrate any accessible system backups. Files replicated to off-site disaster recovery sites can also be encrypted. In a vulnerable environment, this can make automatic restore operations useless and basically knocks the entire system back to square one.

Recovering programs and information following a ransomware outage becomes a race against the clock as the victim struggles to contain the damage, eradicate the ransomware, and resume business-critical operations. Since ransomware needs time to spread, assaults are usually sprung during nights and weekends, when successful penetrations may take more time to recognize. This multiplies the difficulty of rapidly marshalling and coordinating a qualified response team.

Progent has a range of solutions for securing businesses from ransomware attacks. These include staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of modern security gateways with AI technology from SentinelOne to identify and extinguish day-zero threats automatically. Progent also provides the assistance of seasoned crypto-ransomware recovery engineers with the talent and perseverance to restore a compromised network as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
After a crypto-ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will return the needed codes to unencrypt any of your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to setup from scratch the vital components of your IT environment. Absent access to full information backups, this calls for a wide complement of skills, well-coordinated project management, and the ability to work non-stop until the job is complete.

For decades, Progent has offered certified expert Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP application software. This breadth of expertise provides Progent the ability to rapidly identify necessary systems and re-organize the remaining pieces of your computer network system after a crypto-ransomware attack and rebuild them into an operational network.

Progent's ransomware team uses powerful project management tools to orchestrate the complicated restoration process. Progent appreciates the urgency of acting quickly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to put critical services back online as soon as humanly possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A customer escalated to Progent after their organization was brought down by Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored hackers, suspected of using techniques exposed from America's NSA organization. Ryuk seeks specific businesses with limited room for operational disruption and is among the most profitable incarnations of ransomware viruses. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in the Chicago metro area and has about 500 workers. The Ryuk intrusion had paralyzed all company operations and manufacturing capabilities. Most of the client's data backups had been on-line at the start of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but in the end made the decision to use Progent.

Progent worked with the customer to quickly assess and prioritize the mission critical areas that had to be addressed in order to resume company functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then completed setup and storage recovery on critical servers. All Exchange Server schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to find intact OST data files (Outlook Offline Data Files) on various desktop computers to recover mail information. A recent offline backup of the customer's accounting/MRP software made it possible to restore these required services back online. Although major work was left to recover completely from the Ryuk virus, core services were restored quickly:

During the next few weeks critical milestones in the restoration process were achieved through close cooperation between Progent consultants and the customer:

• Internal web applications were restored without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were fully recovered.
• A new Palo Alto 850 security appliance was set up and programmed.
• Nearly all of the desktop computers were functioning as before the incident.

Conclusion
A probable business-ending disaster was avoided by results-oriented experts, a broad spectrum of IT skills, and close collaboration. Although in post mortem the ransomware penetration described here would have been stopped with current security technology and NIST Cybersecurity Framework best practices, user training, and appropriate incident response procedures for data protection and proper patching controls, the fact is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's team of professionals has a proven track record in ransomware virus blocking, remediation, and information systems recovery.

To read or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Colorado Springs a portfolio of remote monitoring and security assessment services to help you to minimize your vulnerability to ransomware. These services include next-generation artificial intelligence technology to uncover zero-day variants of crypto-ransomware that can evade traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management techniques to help keep your network operating at peak levels by tracking the health of critical computers that power your information system. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your specified IT management staff and your assigned Progent consultant so that all potential problems can be resolved before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your client-server infrastructure by offering an environment for streamlining common tedious jobs. These include health checking, patch management, automated remediation, endpoint configuration, backup and recovery, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alert to your specified IT personnel and your assigned Progent consultant so that emerging problems can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map, track, reconfigure and debug their networking hardware such as routers and switches, firewalls, and access points plus servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that network maps are always current, copies and displays the configuration information of virtually all devices on your network, tracks performance, and generates alerts when issues are detected. By automating tedious management and troubleshooting processes, WAN Watch can cut hours off ordinary tasks like network mapping, reconfiguring your network, locating appliances that need important updates, or isolating performance issues. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth management reporting utilities created to integrate with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software companies to produce ProSight Data Protection Services, a selection of offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup operations and enable transparent backup and rapid recovery of critical files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from hardware failures, natural disasters, fire, malware like ransomware, human mistakes, malicious employees, or software bugs. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading information security companies to deliver web-based management and world-class security for all your email traffic. The powerful architecture of Email Guard combines a Cloud Protection Layer with a local security gateway device to provide advanced protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps most threats from making it to your network firewall. This decreases your vulnerability to external attacks and conserves system bandwidth and storage. Email Guard's on-premises gateway appliance provides a deeper level of analysis for incoming email. For outbound email, the local security gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to defend against password theft by using two-factor authentication. Duo enables single-tap identity confirmation with iOS, Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a protected application and enter your password you are asked to verify who you are via a unit that only you possess and that uses a different network channel. A wide selection of devices can be used for this second means of ID validation including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may designate several verification devices. For details about ProSight Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Call Desk managed services enable your IT team to outsource Support Desk services to Progent or split activity for Help Desk services seamlessly between your in-house network support staff and Progent's extensive roster of IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a transparent supplement to your internal IT support staff. End user interaction with the Help Desk, provision of support, issue escalation, trouble ticket creation and updates, efficiency metrics, and management of the support database are cohesive regardless of whether issues are taken care of by your internal support resources, by Progent, or both. Find out more about Progent's outsourced/shared Service Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior analysis tools to defend endpoints as well as physical and virtual servers against new malware attacks such as ransomware and email phishing, which easily escape traditional signature-matching anti-virus products. Progent Active Security Monitoring services protect local and cloud-based resources and offers a single platform to automate the entire threat progression including blocking, detection, containment, remediation, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, retrieve and protect information about your network infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be warned about upcoming expirations of SSL certificates ,domains or warranties. By updating and managing your IT documentation, you can eliminate as much as 50% of time spent searching for critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of any size a flexible and cost-effective alternative for evaluating, testing, scheduling, implementing, and tracking updates to your ever-evolving IT system. Besides optimizing the protection and reliability of your computer network, Progent's patch management services free up time for your in-house IT team to concentrate on line-of-business projects and tasks that derive maximum business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host set up and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Since the environment is virtualized, it can be ported immediately to a different hardware environment without requiring a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus tools. ProSight ASM safeguards local and cloud-based resources and offers a unified platform to automate the entire threat progression including protection, detection, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer protection for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security assaults from all attack vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint management, and web filtering via cutting-edge tools packaged within a single agent managed from a single control. Progent's data protection and virtualization consultants can assist you to plan and implement a ProSight ESP environment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry data protection regulations. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate action. Progent's consultants can also assist you to install and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can get back in business quickly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.