Bakersfield 24x7 Immediate Crypto-Ransomware
Computer Malware Damage Assessment and Removal Consultants

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyberplague that presents an extinction-level danger for businesses poorly prepared for an attack. Different versions of crypto-ransomware such as CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and still inflict damage. The latest variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with additional unnamed malware, not only do encryption of online data but also infect all available system protection. Files synched to off-site disaster recovery sites can also be ransomed. In a poorly architected system, this can make any restoration useless and basically sets the network back to zero.

Restoring services and information following a ransomware event becomes a race against time as the targeted organization tries its best to stop the spread, clear the ransomware, and resume business-critical operations. Since crypto-ransomware requires time to replicate, assaults are usually sprung on weekends, when successful penetrations in many cases take longer to discover. This multiplies the difficulty of promptly assembling and organizing a knowledgeable mitigation team.

Progent provides a range of help services for protecting organizations from ransomware attacks. Among these are user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security solutions with machine learning capabilities from SentinelOne to discover and disable day-zero threats automatically. Progent also provides the assistance of experienced crypto-ransomware recovery professionals with the talent and perseverance to restore a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will provide the needed keys to unencrypt any of your information. Kaspersky ascertained that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to re-install the key parts of your Information Technology environment. Absent access to essential information backups, this calls for a broad range of skills, well-coordinated team management, and the ability to work 24x7 until the task is done.

For two decades, Progent has offered expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP application software. This breadth of experience gives Progent the capability to efficiently ascertain critical systems and consolidate the surviving parts of your Information Technology system after a ransomware attack and rebuild them into a functioning system.

Progent's ransomware team has best of breed project management tools to coordinate the sophisticated recovery process. Progent knows the importance of acting rapidly and in unison with a customer's management and Information Technology resources to prioritize tasks and to get key applications back on-line as fast as possible.

Client Story: A Successful Ransomware Attack Response
A business engaged Progent after their network system was penetrated by Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state sponsored hackers, possibly adopting approaches exposed from the United States NSA organization. Ryuk targets specific organizations with limited tolerance for disruption and is one of the most profitable versions of ransomware malware. Major victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with about 500 workers. The Ryuk event had frozen all business operations and manufacturing processes. The majority of the client's data backups had been online at the time of the intrusion and were damaged. The client considered paying the ransom demand (more than $200,000) and praying for the best, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly identify and assign priority to the critical systems that had to be addressed in order to continue business operations:

• Active Directory (AD)
• Microsoft Exchange
• MRP System

Within two days, Progent was able to recover Active Directory to its pre-attack state. Progent then accomplished rebuilding and hard drive recovery of mission critical servers. All Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on user PCs in order to recover mail messages. A not too old offline backup of the businesses manufacturing software made them able to recover these essential programs back on-line. Although significant work still had to be done to recover fully from the Ryuk attack, core systems were restored quickly:

Over the next couple of weeks critical milestones in the recovery project were accomplished in close collaboration between Progent engineers and the customer:

• Internal web sites were brought back up with no loss of information.
• The MailStore Server containing more than 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were fully functional.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the user workstations were operational.

Conclusion
A potential business catastrophe was dodged with dedicated experts, a broad array of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus incident detailed here would have been stopped with advanced cyber security solutions and recognized best practices, user and IT administrator education, and properly executed security procedures for data protection and proper patching controls, the reality remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware penetration, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, removal, and file recovery.

To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Bakersfield a portfolio of online monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services include modern machine learning capability to detect zero-day variants of crypto-ransomware that are able to escape detection by legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management technology to help keep your network running efficiently by tracking the health of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT management personnel and your assigned Progent engineering consultant so any potential issues can be resolved before they have a chance to impact productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your client-server infrastructure by offering an environment for performing common tedious jobs. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alarm to your designated IT management staff and your assigned Progent consultant so that potential problems can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller businesses to map, track, reconfigure and troubleshoot their networking appliances such as routers, firewalls, and load balancers plus servers, printers, endpoints and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always updated, copies and displays the configuration of virtually all devices on your network, monitors performance, and sends alerts when issues are detected. By automating complex management and troubleshooting activities, WAN Watch can cut hours off ordinary chores such as making network diagrams, expanding your network, locating appliances that need important software patches, or resolving performance problems. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time reporting tools designed to work with the leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup software providers to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your data backup operations and allow non-disruptive backup and fast recovery of vital files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user mistakes, malicious insiders, or software bugs. Managed services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top information security companies to deliver web-based control and comprehensive security for all your email traffic. The hybrid structure of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway device to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter serves as a first line of defense and keeps most unwanted email from making it to your network firewall. This reduces your vulnerability to external threats and saves system bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a deeper level of analysis for incoming email. For outgoing email, the onsite security gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also assist Exchange Server to track and safeguard internal email that stays within your security perimeter. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables single-tap identity verification with Apple iOS, Android, and other out-of-band devices. With Duo 2FA, when you sign into a secured application and give your password you are asked to confirm your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be used for this added form of ID validation such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You may designate several validation devices. To find out more about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Support Desk Managed Services
  Progent's Call Center managed services enable your IT group to outsource Help Desk services to Progent or divide responsibilities for support services transparently between your in-house support group and Progent's nationwide roster of IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk provides a seamless extension of your corporate network support group. Client access to the Help Desk, provision of support, escalation, ticket creation and updates, performance metrics, and maintenance of the service database are consistent regardless of whether issues are taken care of by your core support resources, by Progent's team, or both. Find out more about Progent's outsourced/shared Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based analysis tools to defend endpoints as well as physical and virtual servers against new malware attacks like ransomware and email phishing, which routinely escape traditional signature-matching anti-virus products. Progent ASM services safeguard local and cloud-based resources and offers a single platform to automate the complete threat progression including protection, detection, containment, cleanup, and forensics. Top features include single-click rollback using Windows VSS and real-time system-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, retrieve and safeguard data about your network infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be warned about upcoming expirations of SSL certificates or domains. By updating and organizing your IT documentation, you can eliminate as much as 50% of time spent trying to find critical information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you require as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of all sizes a flexible and affordable solution for assessing, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT system. In addition to maximizing the protection and reliability of your IT network, Progent's patch management services allow your IT team to concentrate on more strategic initiatives and activities that derive the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the applications. Since the system is virtualized, it can be moved easily to a different hosting solution without requiring a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily get by traditional signature-based anti-virus tools. ProSight ASM safeguards local and cloud-based resources and provides a unified platform to automate the entire malware attack lifecycle including blocking, identification, mitigation, cleanup, and forensics. Key capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer protection for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and responding to security assaults from all vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint management, and web filtering through cutting-edge technologies incorporated within one agent accessible from a single control. Progent's data protection and virtualization experts can help your business to plan and implement a ProSight ESP environment that meets your organization's specific needs and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will assist you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require urgent attention. Progent can also help you to set up and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.