Monterey 24x7x365 Urgent Crypto
Computer Malware Detection and Recovery Consulting

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an existential danger for organizations unprepared for an assault. Multiple generations of crypto-ransomware such as CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause damage. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, as well as daily as yet unnamed viruses, not only encrypt on-line information but also infiltrate any accessible system backups. Information synched to off-site disaster recovery sites can also be encrypted. In a poorly designed data protection solution, this can make automatic recovery hopeless and effectively sets the entire system back to square one.

Getting back programs and information after a ransomware attack becomes a sprint against the clock as the victim tries its best to contain, clear the virus, and resume enterprise-critical operations. Since ransomware requires time to replicate, attacks are often sprung on weekends and holidays, when successful penetrations tend to take longer to notice. This multiplies the difficulty of quickly marshalling and orchestrating a capable mitigation team.

Progent offers a range of services for protecting enterprises from ransomware attacks. These include team training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of modern security gateways with artificial intelligence capabilities from SentinelOne to detect and quarantine new threats rapidly. Progent also provides the services of veteran crypto-ransomware recovery consultants with the track record and perseverance to rebuild a breached network as soon as possible.

Progent's Ransomware Recovery Services
After a crypto-ransomware attack, even paying the ransom in cryptocurrency does not ensure that merciless criminals will return the keys to unencrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to setup from scratch the mission-critical parts of your Information Technology environment. Without the availability of full information backups, this calls for a broad range of skill sets, professional team management, and the willingness to work non-stop until the recovery project is completed.

For decades, Progent has made available certified expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have earned advanced certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP software solutions. This breadth of expertise gives Progent the skills to efficiently ascertain necessary systems and re-organize the remaining pieces of your IT environment after a ransomware event and configure them into an operational system.

Progent's recovery team deploys powerful project management applications to coordinate the complex restoration process. Progent knows the urgency of acting quickly and together with a customer's management and Information Technology staff to prioritize tasks and to put key systems back on-line as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A small business hired Progent after their organization was crashed by the Ryuk ransomware. Ryuk is thought to have been deployed by Northern Korean state sponsored cybercriminals, suspected of using approaches leaked from the U.S. National Security Agency. Ryuk targets specific companies with little ability to sustain disruption and is one of the most profitable incarnations of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago and has around 500 staff members. The Ryuk intrusion had frozen all company operations and manufacturing capabilities. The majority of the client's backups had been on-line at the time of the attack and were damaged. The client was pursuing financing for paying the ransom (more than $200,000) and hoping for good luck, but in the end utilized Progent.

Progent worked hand in hand the client to rapidly assess and prioritize the most important systems that needed to be addressed to make it possible to continue company operations:

• Microsoft Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

Within 2 days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then initiated rebuilding and hard drive recovery of critical servers. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find local OST data files (Outlook Offline Data Files) on team PCs in order to recover mail data. A not too old offline backup of the businesses accounting/MRP software made them able to return these vital programs back available to users. Although a lot of work was left to recover fully from the Ryuk virus, core systems were restored rapidly:

Throughout the next month important milestones in the restoration process were achieved through tight collaboration between Progent team members and the client:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Exchange Server with over four million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control capabilities were completely restored.
• A new Palo Alto 850 security appliance was installed and configured.
• Ninety percent of the user PCs were being used by staff.

Conclusion
A probable enterprise-killing disaster was evaded with top-tier experts, a wide array of technical expertise, and close collaboration. Although in post mortem the crypto-ransomware virus penetration described here would have been disabled with current cyber security systems and best practices, user and IT administrator education, and appropriate incident response procedures for information backup and proper patching controls, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of experts has a proven track record in ransomware virus blocking, mitigation, and data restoration.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Monterey a portfolio of online monitoring and security evaluation services to assist you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation artificial intelligence capability to uncover new strains of ransomware that are able to escape detection by traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management (RMM) technology to help keep your IT system operating at peak levels by tracking the state of vital assets that drive your business network. When ProSight LAN Watch detects a problem, an alert is sent automatically to your specified IT management staff and your Progent engineering consultant so that all looming issues can be addressed before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your network, server, and desktop devices by offering tools for streamlining common tedious tasks. These include health monitoring, update management, automated remediation, endpoint configuration, backup and recovery, A/V response, remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your designated IT management staff and your assigned Progent technical consultant so emerging issues can be taken care of before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for smaller businesses to map out, track, optimize and debug their connectivity hardware like routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and manages the configuration information of virtually all devices connected to your network, tracks performance, and sends notices when issues are discovered. By automating time-consuming management activities, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that require critical updates, or resolving performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth reporting tools designed to work with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software providers to create ProSight Data Protection Services (DPS), a family of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your backup processes and allow transparent backup and fast restoration of critical files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business recover from data loss resulting from equipment breakdown, natural disasters, fire, malware such as ransomware, user mistakes, malicious employees, or application glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top data security companies to provide centralized management and comprehensive protection for your email traffic. The hybrid structure of Email Guard managed service integrates a Cloud Protection Layer with a local security gateway device to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne threats. The Cloud Protection Layer acts as a first line of defense and keeps the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to external attacks and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper level of analysis for incoming email. For outbound email, the on-premises gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Exchange Server to track and safeguard internal email traffic that stays inside your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo cloud technology to defend against password theft by using two-factor authentication (2FA). Duo supports single-tap identity verification with Apple iOS, Android, and other personal devices. Using Duo 2FA, when you sign into a protected online account and enter your password you are asked to verify your identity on a unit that only you possess and that uses a different ("out-of-band") network channel. A wide selection of devices can be used for this added means of authentication including a smartphone or watch, a hardware token, a landline phone, etc. You can designate several validation devices. For more information about ProSight Duo two-factor identity validation services, go to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Call Desk managed services enable your IT group to outsource Support Desk services to Progent or divide activity for Help Desk services transparently between your internal network support group and Progent's nationwide pool of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless extension of your internal support staff. User access to the Service Desk, delivery of technical assistance, escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the support database are cohesive regardless of whether incidents are taken care of by your internal IT support organization, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior machine learning tools to guard endpoints as well as servers and VMs against modern malware assaults like ransomware and email phishing, which routinely escape traditional signature-matching AV tools. Progent ASM services protect local and cloud-based resources and offers a single platform to address the complete malware attack lifecycle including blocking, detection, mitigation, remediation, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, retrieve and protect data about your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or domains. By updating and managing your network documentation, you can eliminate as much as half of time spent trying to find critical information about your IT network. ProSight IT Asset Management features a common repository for storing and sharing all documents related to managing your business network such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT information. Whether you're planning enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you need as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of any size a versatile and affordable alternative for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving IT system. Besides maximizing the protection and functionality of your computer network, Progent's patch management services permit your in-house IT team to focus on line-of-business initiatives and tasks that deliver maximum business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS software, and the applications. Since the system is virtualized, it can be moved easily to a different hardware solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's cutting edge behavior analysis tools to defend physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely escape legacy signature-matching anti-virus tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a unified platform to manage the entire threat progression including filtering, identification, mitigation, remediation, and forensics. Key features include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services offer economical in-depth security for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP delivers firewall protection, intrusion alarms, device control, and web filtering through cutting-edge technologies incorporated within a single agent accessible from a unified console. Progent's data protection and virtualization experts can help you to design and implement a ProSight ESP environment that addresses your organization's unique needs and that allows you demonstrate compliance with government and industry information security standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that require immediate action. Progent can also assist your company to set up and test a backup and restore solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.