Vacaville 24x7x365 Critical Crypto
Virus Damage Assessment and Repair Consultants

Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses of all sizes poorly prepared for an attack. Different versions of ransomware such as Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and still inflict destruction. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, plus more as yet unnamed malware, not only do encryption of online information but also infect all available system protection mechanisms. Files synched to off-site disaster recovery sites can also be corrupted. In a vulnerable environment, this can render any recovery useless and effectively sets the entire system back to zero.

Recovering services and data following a ransomware event becomes a race against the clock as the victim tries its best to stop lateral movement, cleanup the ransomware, and resume mission-critical activity. Because ransomware needs time to spread, assaults are usually sprung on weekends, when penetrations tend to take more time to discover. This multiplies the difficulty of quickly marshalling and orchestrating a capable response team.

Progent provides a range of services for protecting organizations from ransomware events. Among these are user education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of the latest generation security appliances with artificial intelligence capabilities from SentinelOne to discover and quarantine zero-day cyber attacks automatically. Progent in addition offers the assistance of expert ransomware recovery professionals with the talent and perseverance to restore a compromised environment as quickly as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware penetration, sending the ransom in cryptocurrency does not guarantee that cyber criminals will provide the codes to decrypt any or all of your information. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to piece back together the key components of your Information Technology environment. Absent the availability of full system backups, this requires a wide range of skill sets, top notch project management, and the willingness to work continuously until the job is complete.

For twenty years, Progent has offered professional IT services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned high-level certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise provides Progent the skills to rapidly understand critical systems and consolidate the surviving components of your IT environment after a ransomware event and configure them into a functioning system.

Progent's ransomware group utilizes top notch project management applications to orchestrate the complex restoration process. Progent understands the urgency of acting swiftly and in concert with a customer's management and Information Technology resources to prioritize tasks and to put essential applications back on line as fast as possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A small business hired Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored hackers, possibly using strategies leaked from the United States National Security Agency. Ryuk attacks specific organizations with little tolerance for disruption and is one of the most lucrative instances of ransomware viruses. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago and has about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. Most of the client's backups had been online at the start of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked together with the customer to rapidly get our arms around and prioritize the key applications that had to be recovered to make it possible to restart company operations:

• Windows Active Directory
• Email
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then helped perform reinstallations and hard drive recovery on essential servers. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Offline Folder Files) on staff workstations and laptops in order to recover mail information. A recent offline backup of the businesses accounting systems made it possible to restore these required services back available to users. Although significant work needed to be completed to recover totally from the Ryuk event, the most important services were returned to operations quickly:

Over the following month critical milestones in the recovery process were achieved in tight cooperation between Progent consultants and the customer:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived emails was brought online and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control functions were 100% recovered.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the user PCs were back into operation.

Conclusion
A potential business-killing disaster was evaded with dedicated professionals, a wide array of IT skills, and tight teamwork. Although upon completion of forensics the ransomware penetration described here should have been prevented with current cyber security technology and ISO/IEC 27001 best practices, user training, and well thought out security procedures for information protection and applying software patches, the reality is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, remediation, and file disaster recovery.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Vacaville a variety of online monitoring and security assessment services designed to help you to reduce your vulnerability to ransomware. These services incorporate modern AI capability to uncover zero-day variants of crypto-ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management (RMM) techniques to help keep your IT system operating efficiently by checking the health of vital assets that power your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your specified IT management staff and your assigned Progent consultant so that all looming issues can be addressed before they can impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your network, server, and desktop devices by offering tools for streamlining common tedious jobs. These include health checking, update management, automated remediation, endpoint deployment, backup and recovery, A/V protection, secure remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alarm to your specified IT personnel and your Progent consultant so emerging problems can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map, monitor, reconfigure and debug their networking appliances such as switches, firewalls, and load balancers plus servers, printers, client computers and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch makes sure that network maps are kept current, captures and displays the configuration of almost all devices connected to your network, tracks performance, and sends alerts when problems are discovered. By automating complex management and troubleshooting processes, WAN Watch can cut hours off common tasks like network mapping, reconfiguring your network, finding devices that require important software patches, or isolating performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time reporting tools designed to integrate with the top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software companies to produce ProSight Data Protection Services (DPS), a family of management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup operations and allow non-disruptive backup and fast recovery of important files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from hardware failures, natural calamities, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned employees, or software glitches. Managed services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top data security companies to deliver centralized management and world-class protection for all your email traffic. The hybrid structure of Email Guard combines cloud-based filtering with an on-premises gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's cloud filter serves as a first line of defense and keeps most threats from reaching your network firewall. This decreases your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's onsite security gateway appliance provides a deeper level of inspection for incoming email. For outgoing email, the on-premises gateway provides AV and anti-spam protection, DLP, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays within your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication (2FA). Duo enables one-tap identity confirmation with Apple iOS, Google Android, and other personal devices. With Duo 2FA, whenever you sign into a protected application and enter your password you are asked to verify your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A wide selection of devices can be used as this added means of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For more information about Duo identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Help Desk managed services enable your IT group to offload Call Center services to Progent or split activity for Service Desk support seamlessly between your in-house support group and Progent's nationwide pool of IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless supplement to your in-house support group. User interaction with the Service Desk, delivery of support services, problem escalation, ticket generation and tracking, efficiency measurement, and management of the service database are cohesive whether incidents are taken care of by your core support organization, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Call Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based analysis tools to guard endpoint devices and servers and VMs against modern malware attacks like ransomware and file-less exploits, which easily get by traditional signature-matching AV products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to address the entire malware attack lifecycle including filtering, detection, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard data about your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be warned about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your network documentation, you can eliminate up to half of time spent trying to find critical information about your network. ProSight IT Asset Management includes a common repository for holding and collaborating on all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're planning improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a flexible and affordable solution for evaluating, testing, scheduling, implementing, and tracking updates to your ever-evolving IT system. Besides optimizing the protection and functionality of your IT network, Progent's patch management services allow your IT team to focus on line-of-business projects and tasks that derive the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host set up and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the apps. Because the environment is virtualized, it can be ported immediately to an alternate hosting environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which easily get by traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a unified platform to address the complete threat lifecycle including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback using Windows VSS and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable multi-layer security for physical and virtual servers, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint control, and web filtering through cutting-edge tools incorporated within one agent accessible from a unified console. Progent's security and virtualization consultants can help you to design and configure a ProSight ESP environment that meets your organization's specific requirements and that allows you demonstrate compliance with legal and industry information protection regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent can also help you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange email filtering.