Omaha 24x7x365 Urgent CryptoLocker
Virus Detection and Repair Support

Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become a modern cyberplague that poses an existential threat for businesses unprepared for an attack. Different versions of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for many years and still cause havoc. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus frequent unnamed viruses, not only do encryption of online data but also infect most accessible system protection mechanisms. Data synchronized to cloud environments can also be held hostage. In a poorly architected data protection solution, this can render automatic restoration impossible and effectively knocks the network back to square one.

Getting back online programs and data after a ransomware outage becomes a race against the clock as the targeted business fights to contain, eradicate the virus, and resume mission-critical operations. Since ransomware needs time to replicate, penetrations are usually launched during weekends and nights, when successful attacks may take longer to identify. This multiplies the difficulty of quickly mobilizing and orchestrating a qualified response team.

Progent has a range of support services for securing organizations from ransomware attacks. These include staff training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of the latest generation security appliances with machine learning technology from SentinelOne to discover and suppress day-zero cyber threats automatically. Progent also provides the assistance of seasoned ransomware recovery engineers with the talent and perseverance to reconstruct a compromised network as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a crypto-ransomware attack, sending the ransom in cryptocurrency does not ensure that merciless criminals will respond with the keys to decrypt any or all of your information. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to piece back together the essential parts of your Information Technology environment. Without the availability of essential data backups, this requires a wide complement of skill sets, top notch project management, and the ability to work 24x7 until the job is completed.

For decades, Progent has provided professional IT services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of experience affords Progent the skills to knowledgably ascertain necessary systems and integrate the remaining pieces of your computer network system after a ransomware penetration and configure them into a functioning system.

Progent's security team of experts uses top notch project management applications to orchestrate the sophisticated recovery process. Progent understands the urgency of acting quickly and in concert with a customer's management and IT resources to prioritize tasks and to put essential applications back online as soon as possible.

Customer Case Study: A Successful Ransomware Intrusion Restoration
A customer engaged Progent after their network was brought down by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state sponsored hackers, suspected of using algorithms exposed from the U.S. NSA organization. Ryuk goes after specific companies with little tolerance for operational disruption and is one of the most profitable instances of ransomware malware. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago with around 500 staff members. The Ryuk attack had frozen all business operations and manufacturing capabilities. The majority of the client's system backups had been online at the time of the attack and were damaged. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and hoping for the best, but ultimately utilized Progent.

Progent worked with the client to rapidly determine and assign priority to the most important elements that had to be recovered to make it possible to resume company functions:

• Active Directory (AD)
• Electronic Mail
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then assisted with reinstallations and hard drive recovery of essential applications. All Exchange Server ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to find intact OST files (Outlook Off-Line Folder Files) on staff PCs and laptops in order to recover mail data. A recent offline backup of the customer's financials/ERP software made it possible to recover these vital programs back on-line. Although significant work remained to recover totally from the Ryuk damage, essential services were returned to operations quickly:

During the next few weeks key milestones in the restoration project were achieved through tight collaboration between Progent engineers and the customer:

• In-house web sites were restored without losing any data.
• The MailStore Exchange Server with over 4 million historical emails was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 security appliance was brought on-line.
• Most of the user desktops and notebooks were being used by staff.

Conclusion
A possible business catastrophe was averted due to top-tier professionals, a broad range of technical expertise, and close collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here could have been identified and blocked with advanced security systems and ISO/IEC 27001 best practices, user and IT administrator training, and well thought out incident response procedures for information backup and keeping systems up to date with security patches, the reality remains that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, removal, and data disaster recovery.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Omaha a portfolio of remote monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services include next-generation machine learning technology to detect zero-day strains of crypto-ransomware that can get past legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management technology to keep your IT system running efficiently by checking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your designated IT management staff and your assigned Progent engineering consultant so that all looming issues can be resolved before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious jobs. These include health monitoring, update management, automated remediation, endpoint setup, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your specified IT management staff and your Progent technical consultant so that emerging problems can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to map out, track, optimize and troubleshoot their networking appliances like routers, firewalls, and access points plus servers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are always updated, captures and displays the configuration of virtually all devices on your network, tracks performance, and sends alerts when potential issues are discovered. By automating tedious management processes, WAN Watch can knock hours off ordinary tasks such as making network diagrams, expanding your network, locating appliances that need critical updates, or identifying the cause of performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time reporting utilities created to integrate with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup/restore technology companies to produce ProSight Data Protection Services (DPS), a family of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your backup processes and allow non-disruptive backup and rapid recovery of vital files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss caused by hardware failures, natural disasters, fire, malware such as ransomware, user error, ill-intentioned employees, or application glitches. Managed services available in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide web-based management and comprehensive security for your email traffic. The hybrid architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway device to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter serves as a preliminary barricade and blocks most threats from reaching your network firewall. This decreases your exposure to inbound threats and conserves system bandwidth and storage. Email Guard's onsite security gateway appliance provides a further layer of analysis for inbound email. For outbound email, the local gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo technology to protect against password theft through the use of two-factor authentication. Duo enables one-tap identity verification with iOS, Google Android, and other out-of-band devices. Using Duo 2FA, when you sign into a protected online account and enter your password you are asked to verify your identity on a device that only you have and that is accessed using a different network channel. A broad range of out-of-band devices can be utilized as this added form of ID validation such as a smartphone or watch, a hardware/software token, a landline phone, etc. You may register several validation devices. For more information about Duo two-factor identity validation services, visit Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Help Center managed services allow your IT staff to outsource Help Desk services to Progent or divide activity for support services seamlessly between your in-house support team and Progent's nationwide pool of IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a smooth extension of your corporate network support resources. Client access to the Help Desk, delivery of support services, problem escalation, ticket generation and tracking, performance metrics, and maintenance of the service database are cohesive regardless of whether issues are taken care of by your core network support staff, by Progent, or a mix of the two. Read more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates cutting edge behavior machine learning technology to defend endpoints as well as physical and virtual servers against new malware assaults such as ransomware and file-less exploits, which routinely escape legacy signature-matching AV products. Progent ASM services safeguard on-premises and cloud-based resources and offers a single platform to manage the entire threat progression including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and protect information about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or domains. By updating and managing your network documentation, you can save up to half of time thrown away trying to find critical information about your network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of any size a versatile and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information system. In addition to maximizing the protection and reliability of your computer environment, Progent's software/firmware update management services permit your IT team to focus on more strategic projects and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and maintained by Progent's IT support experts. With the ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the apps. Since the system is virtualized, it can be ported easily to a different hardware solution without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior analysis technology to defend physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which easily get by legacy signature-based AV products. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a unified platform to automate the complete threat lifecycle including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable multi-layer protection for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to cyber assaults from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alerts, endpoint management, and web filtering via cutting-edge tools packaged within a single agent accessible from a single console. Progent's security and virtualization experts can assist you to design and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you demonstrate compliance with legal and industry data security standards. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for immediate attention. Progent's consultants can also assist your company to set up and verify a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.