24-Hour Lawrence Immediate Ransomware
Computer Malware Assessment and Remediation Experts

Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that represents an extinction-level danger for organizations unprepared for an attack. Versions of ransomware like the CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict harm. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, along with additional as yet unnamed malware, not only do encryption of on-line data files but also infect all accessible system protection mechanisms. Information synched to cloud environments can also be held hostage. In a poorly architected environment, this can render automatic restore operations impossible and basically knocks the datacenter back to zero.

Getting back online programs and information following a ransomware intrusion becomes a sprint against time as the victim fights to stop the spread, remove the ransomware, and restore business-critical operations. Because ransomware takes time to spread, assaults are frequently sprung at night, when successful penetrations in many cases take longer to notice. This compounds the difficulty of rapidly assembling and orchestrating a capable response team.

Progent provides a range of services for securing enterprises from ransomware events. Among these are staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of the latest generation security appliances with machine learning technology from SentinelOne to identify and extinguish day-zero cyber threats automatically. Progent also can provide the services of veteran ransomware recovery engineers with the track record and perseverance to reconstruct a breached network as quickly as possible.

Progent's Ransomware Recovery Services
Following a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed keys to unencrypt any or all of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to setup from scratch the key elements of your Information Technology environment. Absent the availability of essential system backups, this calls for a wide complement of IT skills, professional project management, and the ability to work non-stop until the task is complete.

For decades, Progent has made available professional IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of experience gives Progent the capability to efficiently determine necessary systems and organize the surviving parts of your network environment following a ransomware event and configure them into a functioning network.

Progent's security group uses best of breed project management applications to coordinate the complicated recovery process. Progent knows the importance of working swiftly and in concert with a client's management and IT team members to prioritize tasks and to put the most important systems back on line as soon as humanly possible.

Case Study: A Successful Crypto-Ransomware Virus Restoration
A small business contacted Progent after their organization was crashed by the Ryuk crypto-ransomware. Ryuk is generally considered to have been deployed by North Korean government sponsored hackers, possibly adopting technology exposed from the United States NSA organization. Ryuk seeks specific organizations with little or no tolerance for disruption and is among the most lucrative instances of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago with about 500 workers. The Ryuk attack had frozen all business operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the time of the intrusion and were damaged. The client was evaluating paying the ransom (more than $200K) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked together with the client to quickly determine and assign priority to the essential systems that had to be restored in order to restart departmental functions:

• Microsoft Active Directory
• Exchange Server
• Financials/MRP

Within 48 hours, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then performed reinstallations and hard drive recovery on the most important applications. All Exchange Server data and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to find non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on staff PCs to recover email data. A recent offline backup of the customer's accounting/MRP software made them able to restore these vital services back online. Although major work needed to be completed to recover completely from the Ryuk attack, essential systems were recovered rapidly:

Throughout the next month critical milestones in the restoration project were achieved through tight cooperation between Progent team members and the client:

• In-house web applications were brought back up without losing any information.
• The MailStore Exchange Server containing more than 4 million historical emails was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were completely functional.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Nearly all of the user desktops and notebooks were being used by staff.

Conclusion
A probable enterprise-killing disaster was avoided with top-tier experts, a broad spectrum of IT skills, and tight teamwork. Although in hindsight the ransomware incident described here could have been identified and blocked with up-to-date cyber security technology and ISO/IEC 27001 best practices, user education, and properly executed incident response procedures for backup and proper patching controls, the reality is that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of professionals has a proven track record in ransomware virus defense, cleanup, and data recovery.

To read or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Lawrence a portfolio of online monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services include modern AI technology to uncover new variants of ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management technology to keep your IT system operating efficiently by tracking the state of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your designated IT staff and your assigned Progent consultant so any looming issues can be addressed before they can impact productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common time-consuming tasks. These can include health checking, update management, automated remediation, endpoint deployment, backup and restore, A/V response, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your designated IT management staff and your Progent consultant so potential issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for smaller businesses to map, monitor, optimize and troubleshoot their networking appliances such as switches, firewalls, and access points plus servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology maps are kept current, copies and displays the configuration information of almost all devices on your network, monitors performance, and generates notices when issues are detected. By automating tedious network management activities, ProSight WAN Watch can knock hours off ordinary tasks like network mapping, expanding your network, locating devices that need critical updates, or isolating performance problems. Learn more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time reporting utilities designed to integrate with the leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a family of subscription-based offerings that provide backup-as-a-service. ProSight DPS services manage and track your backup processes and enable transparent backup and rapid restoration of critical files/folders, apps, images, plus VMs. ProSight DPS helps you recover from data loss resulting from hardware breakdown, natural calamities, fire, malware like ransomware, user error, malicious employees, or software glitches. Managed services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading data security companies to provide web-based control and comprehensive security for your email traffic. The hybrid structure of Progent's Email Guard combines cloud-based filtering with a local gateway appliance to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based threats. The Cloud Protection Layer serves as a preliminary barricade and blocks most threats from making it to your security perimeter. This reduces your vulnerability to external threats and conserves system bandwidth and storage. Email Guard's on-premises gateway device adds a further layer of inspection for inbound email. For outgoing email, the local gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email traffic that stays within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you log into a secured application and enter your password you are requested to confirm your identity via a device that only you possess and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be used for this added means of ID validation such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may designate several verification devices. For details about Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Call Center managed services allow your information technology team to outsource Help Desk services to Progent or divide activity for Service Desk support transparently between your internal network support group and Progent's nationwide roster of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a smooth supplement to your corporate IT support staff. User access to the Help Desk, provision of support services, escalation, trouble ticket creation and updates, performance measurement, and management of the service database are consistent regardless of whether issues are resolved by your internal support resources, by Progent, or both. Learn more about Progent's outsourced/co-managed Help Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior-based machine learning tools to guard endpoints and servers and VMs against modern malware attacks like ransomware and email phishing, which easily get by traditional signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud resources and provides a single platform to manage the complete malware attack lifecycle including blocking, detection, containment, remediation, and forensics. Top features include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and safeguard information related to your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be warned automatically about impending expirations of SSL certificates or domains. By updating and managing your IT infrastructure documentation, you can save up to 50% of time thrown away looking for critical information about your network. ProSight IT Asset Management features a centralized location for holding and sharing all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT information. Whether you're planning enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management provide businesses of any size a flexible and cost-effective solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your dynamic information system. Besides optimizing the security and reliability of your IT network, Progent's software/firmware update management services free up time for your IT staff to concentrate on more strategic initiatives and tasks that derive the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host set up and maintained by Progent's network support professionals. Under the ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be ported easily to a different hosting solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely get by traditional signature-matching AV products. ProSight ASM protects on-premises and cloud resources and offers a single platform to manage the entire threat progression including filtering, identification, mitigation, remediation, and forensics. Top capabilities include one-click rollback with Windows VSS and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services deliver ultra-affordable multi-layer protection for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber threats from all vectors. ProSight ESP delivers firewall protection, penetration alarms, device management, and web filtering via leading-edge tools incorporated within one agent managed from a unified console. Progent's security and virtualization experts can help you to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you achieve and demonstrate compliance with government and industry data security regulations. Progent will assist you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require urgent attention. Progent can also assist your company to install and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.