24x7x365 Porto Alegre Critical Crypto
Virus Assessment and Restoration Consulting

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that poses an extinction-level danger for organizations unprepared for an attack. Different versions of ransomware like the Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and still inflict damage. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as frequent as yet unnamed viruses, not only do encryption of on-line data files but also infiltrate many accessible system protection. Data synchronized to the cloud can also be held hostage. In a vulnerable data protection solution, this can make any restoration hopeless and basically knocks the entire system back to zero.

Getting back on-line programs and data after a ransomware outage becomes a race against the clock as the targeted organization tries its best to contain, clear the virus, and restore mission-critical operations. Since ransomware takes time to replicate, assaults are usually sprung on weekends, when successful attacks may take more time to recognize. This multiplies the difficulty of quickly marshalling and coordinating a knowledgeable mitigation team.

Progent makes available a range of support services for protecting organizations from ransomware penetrations. Among these are team education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with machine learning technology from SentinelOne to detect and extinguish zero-day threats rapidly. Progent in addition offers the assistance of experienced ransomware recovery engineers with the talent and perseverance to restore a compromised system as urgently as possible.

Progent's Ransomware Recovery Support Services
Soon after a ransomware attack, even paying the ransom in cryptocurrency does not ensure that merciless criminals will provide the needed keys to unencrypt all your data. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to setup from scratch the essential parts of your IT environment. Absent the availability of complete data backups, this requires a wide range of skill sets, well-coordinated project management, and the capability to work 24x7 until the task is completed.

For twenty years, Progent has provided certified expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded top certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of expertise gives Progent the skills to quickly understand necessary systems and consolidate the surviving parts of your IT system following a crypto-ransomware event and rebuild them into an operational network.

Progent's recovery team has best of breed project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of working swiftly and in unison with a client's management and Information Technology team members to prioritize tasks and to put essential services back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Virus Response
A business escalated to Progent after their organization was taken over by Ryuk ransomware. Ryuk is thought to have been created by Northern Korean government sponsored criminal gangs, possibly using algorithms leaked from the United States National Security Agency. Ryuk attacks specific businesses with limited room for disruption and is among the most profitable instances of ransomware malware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been online at the beginning of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (more than $200K) and praying for good luck, but in the end engaged Progent.

Progent worked together with the client to quickly get our arms around and assign priority to the key elements that had to be restored in order to continue departmental functions:

• Active Directory (AD)
• Electronic Mail
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then initiated reinstallations and storage recovery on the most important systems. All Exchange data and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to collect local OST data files (Microsoft Outlook Off-Line Folder Files) on user workstations to recover mail information. A not too old off-line backup of the businesses financials/MRP systems made them able to recover these vital programs back available to users. Although a large amount of work still had to be done to recover fully from the Ryuk attack, the most important systems were recovered rapidly:

Throughout the next few weeks key milestones in the restoration project were completed in close cooperation between Progent consultants and the client:

• Internal web sites were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory capabilities were 100% operational.
• A new Palo Alto 850 firewall was installed.
• 90% of the user workstations were back into operation.

Conclusion
A potential business extinction catastrophe was dodged through the efforts of hard-working experts, a wide range of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware virus incident described here would have been stopped with advanced security solutions and best practices, user and IT administrator education, and properly executed security procedures for information backup and applying software patches, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and file restoration.

To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Porto Alegre a portfolio of online monitoring and security assessment services to help you to minimize your vulnerability to crypto-ransomware. These services include next-generation AI technology to uncover zero-day variants of ransomware that can escape detection by traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management technology to help keep your IT system operating at peak levels by checking the health of vital assets that power your business network. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your specified IT management personnel and your Progent engineering consultant so any looming problems can be resolved before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering an environment for performing common time-consuming jobs. These include health monitoring, patch management, automated repairs, endpoint deployment, backup and recovery, anti-virus defense, secure remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT staff and your Progent consultant so that potential issues can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for smaller organizations to map out, monitor, reconfigure and debug their networking hardware like switches, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology diagrams are kept current, copies and displays the configuration of almost all devices connected to your network, monitors performance, and sends alerts when problems are detected. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off common tasks such as network mapping, expanding your network, finding devices that require critical updates, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time management reporting utilities designed to work with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with advanced backup/restore software providers to create ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services automate and monitor your data backup operations and enable transparent backup and fast recovery of vital files/folders, apps, images, plus virtual machines. ProSight DPS lets you avoid data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, user error, ill-intentioned employees, or application bugs. Managed services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top information security companies to deliver web-based control and world-class protection for your email traffic. The hybrid structure of Progent's Email Guard managed service combines cloud-based filtering with an on-premises gateway appliance to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's cloud filter acts as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This decreases your exposure to external attacks and conserves network bandwidth and storage. Email Guard's onsite gateway appliance provides a further layer of inspection for incoming email. For outbound email, the local gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also assist Exchange Server to monitor and safeguard internal email that originates and ends inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity verification with Apple iOS, Android, and other personal devices. With 2FA, when you log into a protected application and give your password you are requested to confirm who you are via a unit that only you possess and that is accessed using a separate network channel. A broad range of out-of-band devices can be used as this added means of ID validation such as an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You can register several validation devices. To learn more about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Help Desk Managed Services
  Progent's Help Desk managed services permit your IT team to offload Support Desk services to Progent or split responsibilities for Help Desk services seamlessly between your in-house network support resources and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a seamless extension of your corporate IT support staff. Client interaction with the Service Desk, delivery of support services, issue escalation, ticket generation and updates, efficiency measurement, and maintenance of the support database are cohesive whether incidents are resolved by your internal IT support resources, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Service Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior-based analysis technology to defend endpoint devices and physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-based AV tools. Progent ASM services protect local and cloud resources and offers a unified platform to automate the entire threat lifecycle including protection, identification, containment, cleanup, and forensics. Key capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and safeguard data about your IT infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be alerted automatically about impending expirations of SSLs ,domains or warranties. By cleaning up and organizing your IT infrastructure documentation, you can save as much as 50% of time thrown away searching for critical information about your IT network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and relating IT information. Whether you're planning improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you require the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of any size a versatile and cost-effective alternative for assessing, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT system. Besides optimizing the security and functionality of your computer environment, Progent's patch management services free up time for your in-house IT staff to focus on more strategic projects and activities that derive maximum business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Because the environment is virtualized, it can be ported easily to an alternate hardware environment without requiring a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based analysis technology to guard physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which routinely escape legacy signature-matching anti-virus products. ProSight Active Security Monitoring safeguards local and cloud resources and provides a unified platform to manage the entire malware attack progression including filtering, detection, containment, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP provides firewall protection, intrusion alerts, endpoint control, and web filtering via leading-edge tools incorporated within one agent managed from a single control. Progent's data protection and virtualization experts can assist you to design and implement a ProSight ESP environment that meets your organization's unique needs and that helps you prove compliance with government and industry information protection standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that require immediate action. Progent's consultants can also help your company to install and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.