Santa Cruz 24/7/365 Critical Crypto-Ransomware
Computer Virus Damage Assessment and Restoration Experts

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that presents an extinction-level danger for businesses vulnerable to an assault. Different versions of ransomware like the Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict damage. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with daily unnamed viruses, not only do encryption of online critical data but also infiltrate many available system restores and backups. Information synched to cloud environments can also be ransomed. In a poorly architected data protection solution, this can make automated recovery hopeless and effectively sets the datacenter back to zero.

Getting back programs and data following a crypto-ransomware event becomes a race against time as the targeted business struggles to stop the spread, eradicate the virus, and resume business-critical operations. Since ransomware needs time to spread, assaults are frequently sprung during weekends and nights, when successful penetrations typically take longer to uncover. This compounds the difficulty of promptly assembling and organizing a capable response team.

Progent makes available a range of solutions for securing enterprises from ransomware events. These include team education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of next-generation security solutions with AI capabilities from SentinelOne to discover and extinguish new cyber attacks rapidly. Progent in addition provides the assistance of experienced ransomware recovery engineers with the talent and commitment to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware event, sending the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the keys to decipher any or all of your files. Kaspersky determined that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to piece back together the essential components of your IT environment. Without access to full information backups, this calls for a wide complement of IT skills, well-coordinated project management, and the ability to work continuously until the job is over.

For decades, Progent has made available professional Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise affords Progent the ability to efficiently determine critical systems and integrate the remaining parts of your IT system after a crypto-ransomware event and assemble them into a functioning network.

Progent's security team has top notch project management tools to coordinate the complicated recovery process. Progent understands the importance of acting rapidly and together with a client's management and Information Technology staff to assign priority to tasks and to get critical applications back on-line as soon as possible.

Client Story: A Successful Ransomware Intrusion Restoration
A small business engaged Progent after their company was attacked by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean government sponsored cybercriminals, possibly adopting technology leaked from the United States National Security Agency. Ryuk attacks specific organizations with limited ability to sustain operational disruption and is among the most profitable incarnations of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk attack had brought down all company operations and manufacturing processes. Most of the client's backups had been on-line at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom (in excess of $200K) and praying for the best, but in the end reached out to Progent.

Progent worked together with the client to rapidly assess and prioritize the critical elements that needed to be addressed to make it possible to restart departmental functions:

• Active Directory
• Email
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then performed reinstallations and hard drive recovery of critical systems. All Exchange Server data and attributes were intact, which greatly helped the restore of Exchange. Progent was able to collect non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on various PCs in order to recover email information. A not too old off-line backup of the businesses accounting/MRP systems made it possible to return these vital services back available to users. Although major work remained to recover completely from the Ryuk virus, essential services were returned to operations rapidly:

During the following few weeks critical milestones in the recovery process were accomplished through close collaboration between Progent engineers and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Server with over four million historical messages was brought online and available for users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory Control functions were 100 percent operational.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the user desktops and notebooks were back into operation.

Conclusion
A possible business extinction disaster was averted by hard-working professionals, a wide spectrum of knowledge, and tight teamwork. Although in hindsight the crypto-ransomware incident described here could have been prevented with modern security solutions and security best practices, user and IT administrator education, and well designed security procedures for information protection and keeping systems up to date with security patches, the reality remains that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, removal, and file disaster recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Santa Cruz a range of online monitoring and security assessment services to help you to minimize your vulnerability to crypto-ransomware. These services utilize next-generation AI technology to detect new variants of crypto-ransomware that can escape detection by traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) technology to keep your IT system running efficiently by checking the health of critical computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your designated IT staff and your assigned Progent engineering consultant so any potential problems can be addressed before they have a chance to disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These can include health checking, update management, automated repairs, endpoint configuration, backup and restore, anti-virus protection, secure remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alarm to your designated IT staff and your assigned Progent consultant so potential issues can be fixed before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, track, enhance and troubleshoot their connectivity appliances like switches, firewalls, and access points plus servers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology diagrams are always updated, copies and displays the configuration of almost all devices connected to your network, tracks performance, and generates notices when problems are discovered. By automating time-consuming network management processes, ProSight WAN Watch can cut hours off ordinary tasks like making network diagrams, reconfiguring your network, finding appliances that require important updates, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of in-depth reporting plug-ins designed to integrate with the industry's top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-through or machines with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup operations and allow transparent backup and fast restoration of critical files/folders, applications, images, plus VMs. ProSight DPS helps your business recover from data loss caused by hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, user error, ill-intentioned insiders, or application glitches. Managed services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading information security companies to provide centralized management and comprehensive protection for all your email traffic. The hybrid architecture of Email Guard combines a Cloud Protection Layer with a local gateway appliance to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks most unwanted email from making it to your network firewall. This reduces your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's on-premises gateway device provides a further level of inspection for inbound email. For outbound email, the on-premises gateway provides AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Exchange Server to monitor and safeguard internal email traffic that originates and ends within your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo technology to protect against password theft by using two-factor authentication. Duo enables single-tap identity verification on Apple iOS, Android, and other out-of-band devices. Using Duo 2FA, when you log into a protected application and enter your password you are requested to confirm your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A wide range of out-of-band devices can be used for this second means of authentication such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may register multiple verification devices. To find out more about ProSight Duo identity authentication services, see Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Call Desk: Support Desk Managed Services
  Progent's Support Desk services allow your IT staff to outsource Support Desk services to Progent or divide responsibilities for support services transparently between your internal support group and Progent's nationwide pool of IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent extension of your in-house support staff. End user access to the Help Desk, provision of technical assistance, problem escalation, trouble ticket creation and updates, efficiency measurement, and management of the service database are consistent regardless of whether issues are resolved by your internal IT support resources, by Progent, or both. Read more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes cutting edge behavior-based machine learning tools to guard endpoints as well as servers and VMs against new malware assaults like ransomware and email phishing, which routinely get by traditional signature-matching AV products. Progent ASM services safeguard on-premises and cloud resources and offers a unified platform to address the complete threat lifecycle including filtering, identification, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and protect information about your network infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By updating and organizing your network documentation, you can eliminate up to 50% of time thrown away trying to find vital information about your network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your business network such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're making enhancements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a versatile and cost-effective alternative for evaluating, testing, scheduling, implementing, and documenting updates to your ever-evolving information system. In addition to optimizing the security and functionality of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on line-of-business projects and tasks that derive maximum business value from your information network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and maintained by Progent's IT support professionals. With Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the applications. Since the environment is virtualized, it can be moved immediately to an alternate hosting environment without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely escape traditional signature-based AV products. ProSight ASM safeguards on-premises and cloud-based resources and offers a unified platform to automate the complete malware attack progression including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable in-depth security for physical and virtual servers, desktops, smartphones, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to security threats from all vectors. ProSight ESP delivers firewall protection, intrusion alarms, endpoint management, and web filtering through leading-edge tools packaged within a single agent managed from a unified console. Progent's data protection and virtualization experts can assist you to plan and implement a ProSight ESP deployment that addresses your company's unique needs and that helps you prove compliance with legal and industry information security standards. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require urgent action. Progent can also help your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.