Santa Rosa 24/7 Critical Crypto-Ransomware
Computer Virus Assessment and Removal Help

Crypto-Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that poses an enterprise-level threat for businesses unprepared for an assault. Versions of ransomware like the CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for years and continue to cause damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with additional unnamed viruses, not only do encryption of on-line information but also infect many accessible system restores and backups. Information synchronized to the cloud can also be encrypted. In a poorly designed data protection solution, this can render automatic restore operations hopeless and effectively knocks the entire system back to square one.

Recovering services and data after a crypto-ransomware outage becomes a sprint against the clock as the targeted business struggles to stop lateral movement, cleanup the virus, and restore mission-critical activity. Because ransomware needs time to spread, attacks are frequently launched during weekends and nights, when attacks tend to take longer to discover. This multiplies the difficulty of rapidly marshalling and orchestrating a capable response team.

Progent offers an assortment of services for securing businesses from ransomware events. Among these are team training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of the latest generation security appliances with AI technology from SentinelOne to discover and disable new threats quickly. Progent also provides the assistance of seasoned ransomware recovery consultants with the skills and perseverance to rebuild a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
Following a ransomware penetration, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to decrypt any or all of your files. Kaspersky estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the essential parts of your IT environment. Absent the availability of complete data backups, this requires a broad range of skills, professional team management, and the ability to work continuously until the task is done.

For twenty years, Progent has made available expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained high-level certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of expertise provides Progent the ability to quickly ascertain critical systems and integrate the surviving components of your computer network system after a ransomware event and rebuild them into a functioning network.

Progent's security team has best of breed project management tools to orchestrate the complicated recovery process. Progent understands the importance of working quickly and together with a customer's management and IT team members to assign priority to tasks and to put key applications back on line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Attack Recovery
A business sought out Progent after their company was penetrated by Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean state sponsored hackers, suspected of adopting algorithms leaked from the U.S. NSA organization. Ryuk attacks specific organizations with little or no ability to sustain operational disruption and is one of the most lucrative versions of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in Chicago and has about 500 workers. The Ryuk intrusion had shut down all essential operations and manufacturing processes. Most of the client's information backups had been on-line at the start of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to quickly get our arms around and prioritize the mission critical applications that needed to be restored in order to continue business operations:

• Active Directory
• Exchange Server
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Active Directory to its pre-virus state. Progent then completed rebuilding and hard drive recovery on mission critical applications. All Exchange ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to locate local OST files (Outlook Offline Data Files) on user workstations and laptops to recover mail messages. A not too old off-line backup of the client's financials/ERP systems made it possible to recover these essential applications back online for users. Although major work still had to be done to recover totally from the Ryuk damage, the most important systems were recovered rapidly:

Throughout the following couple of weeks key milestones in the recovery process were accomplished in close cooperation between Progent team members and the customer:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was restored to operations and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory modules were 100% recovered.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Ninety percent of the desktop computers were being used by staff.

Conclusion
A potential business-ending catastrophe was averted due to dedicated professionals, a broad spectrum of knowledge, and close collaboration. Although in retrospect the ransomware virus attack described here would have been shut down with up-to-date cyber security technology solutions and best practices, team education, and well thought out security procedures for information protection and proper patching controls, the reality remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware incursion, remember that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, removal, and information systems recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Santa Rosa a portfolio of remote monitoring and security assessment services to help you to minimize the threat from crypto-ransomware. These services utilize modern machine learning capability to uncover new variants of crypto-ransomware that can get past traditional signature-based security products.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management technology to keep your IT system operating efficiently by tracking the health of vital computers that power your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your specified IT staff and your assigned Progent consultant so all looming problems can be addressed before they can disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing an environment for streamlining common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your designated IT personnel and your Progent technical consultant so that potential issues can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to map, track, enhance and troubleshoot their connectivity appliances such as routers, firewalls, and access points as well as servers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network maps are kept current, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and sends notices when issues are detected. By automating tedious management processes, ProSight WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, finding appliances that need important updates, or resolving performance problems. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time management reporting utilities designed to work with the industry's leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup technology providers to create ProSight Data Protection Services, a family of offerings that deliver backup-as-a-service. ProSight DPS products manage and track your data backup processes and allow transparent backup and fast restoration of important files/folders, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks like ransomware, user error, malicious employees, or application glitches. Managed services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading data security companies to provide web-based control and comprehensive security for all your email traffic. The hybrid structure of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne threats. The cloud filter serves as a first line of defense and keeps the vast majority of unwanted email from reaching your security perimeter. This reduces your vulnerability to external threats and conserves network bandwidth and storage. Email Guard's on-premises gateway device provides a deeper layer of inspection for inbound email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email that stays within your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication. Duo supports one-tap identity confirmation with Apple iOS, Google Android, and other personal devices. With Duo 2FA, whenever you sign into a protected online account and give your password you are requested to confirm your identity via a device that only you have and that uses a different network channel. A wide range of devices can be utilized as this added means of authentication such as a smartphone or wearable, a hardware/software token, a landline phone, etc. You may register several validation devices. For details about ProSight Duo two-factor identity validation services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Help Center services allow your IT staff to offload Support Desk services to Progent or divide responsibilities for Service Desk support seamlessly between your in-house support resources and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a smooth supplement to your internal support team. User access to the Service Desk, provision of support services, issue escalation, trouble ticket generation and updates, efficiency metrics, and management of the support database are consistent regardless of whether issues are taken care of by your internal network support staff, by Progent's team, or both. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior analysis technology to guard endpoint devices as well as physical and virtual servers against modern malware assaults like ransomware and email phishing, which routinely escape legacy signature-based AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a unified platform to automate the complete malware attack progression including filtering, detection, mitigation, remediation, and forensics. Key features include one-click rollback with Windows VSS and real-time network-wide immunization against new attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard data related to your network infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your IT documentation, you can eliminate as much as 50% of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're planning improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you require when you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a flexible and cost-effective solution for evaluating, validating, scheduling, implementing, and tracking updates to your dynamic information system. In addition to maximizing the security and functionality of your computer environment, Progent's patch management services free up time for your in-house IT team to focus on line-of-business projects and tasks that derive maximum business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure Tier III data center on a fast virtual machine host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved immediately to a different hosting solution without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoints against new malware attacks like ransomware and email phishing, which easily evade traditional signature-based AV tools. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a single platform to manage the complete malware attack lifecycle including protection, detection, containment, cleanup, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver affordable in-depth protection for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP delivers firewall protection, intrusion alerts, device control, and web filtering via cutting-edge technologies packaged within one agent managed from a single control. Progent's security and virtualization consultants can help your business to design and implement a ProSight ESP deployment that meets your company's unique requirements and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that require urgent action. Progent's consultants can also assist you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange filtering.