Adelaide 24-7 Critical Crypto
Computer Virus Assessment and Restoration Help

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Versions of ransomware such as CrySIS, WannaCry, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and still inflict harm. Recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, plus additional unnamed newcomers, not only do encryption of online files but also infect all accessible system backup. Information synchronized to cloud environments can also be encrypted. In a vulnerable environment, this can render automatic recovery useless and effectively sets the entire system back to zero.

Retrieving services and data following a ransomware attack becomes a race against time as the victim fights to stop lateral movement, remove the ransomware, and resume business-critical activity. Since crypto-ransomware requires time to replicate, attacks are usually launched during nights and weekends, when successful attacks typically take more time to discover. This multiplies the difficulty of rapidly marshalling and organizing a knowledgeable mitigation team.

Progent makes available a range of services for securing businesses from ransomware attacks. Among these are user training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of modern security gateways with artificial intelligence capabilities from SentinelOne to discover and extinguish new cyber threats rapidly. Progent in addition can provide the services of experienced ransomware recovery engineers with the skills and perseverance to restore a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a crypto-ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the needed codes to decrypt any or all of your files. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to re-install the essential elements of your IT environment. Absent the availability of full information backups, this requires a wide range of skill sets, well-coordinated team management, and the willingness to work continuously until the recovery project is complete.

For two decades, Progent has offered professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of experience provides Progent the skills to rapidly ascertain necessary systems and re-organize the remaining pieces of your IT environment after a ransomware event and configure them into an operational system.

Progent's ransomware team has best of breed project management applications to coordinate the complex restoration process. Progent knows the urgency of working rapidly and together with a client's management and Information Technology staff to assign priority to tasks and to put key systems back online as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Attack Restoration
A business escalated to Progent after their network system was attacked by Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean government sponsored cybercriminals, possibly using algorithms leaked from America's NSA organization. Ryuk attacks specific companies with limited room for disruption and is among the most lucrative instances of crypto-ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in Chicago with about 500 employees. The Ryuk attack had paralyzed all company operations and manufacturing processes. Most of the client's backups had been online at the start of the attack and were encrypted. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the customer to quickly determine and prioritize the essential applications that had to be addressed to make it possible to resume company operations:

• Microsoft Active Directory
• Microsoft Exchange Email
• Accounting/MRP

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then charged ahead with rebuilding and storage recovery on key applications. All Microsoft Exchange Server data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble local OST data files (Microsoft Outlook Off-Line Folder Files) on user desktop computers to recover mail messages. A recent off-line backup of the client's manufacturing systems made them able to return these required programs back available to users. Although major work was left to recover fully from the Ryuk virus, the most important systems were restored quickly:

During the next couple of weeks key milestones in the restoration project were achieved through close collaboration between Progent team members and the client:

• Internal web applications were restored without losing any information.
• The MailStore Server containing more than 4 million historical emails was brought online and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100% restored.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the desktops and laptops were being used by staff.

Conclusion
A possible business catastrophe was averted by results-oriented experts, a wide range of subject matter expertise, and tight teamwork. Although in post mortem the ransomware attack detailed here should have been blocked with advanced security technology solutions and ISO/IEC 27001 best practices, staff training, and properly executed security procedures for backup and keeping systems up to date with security patches, the reality is that government-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware attack, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, mitigation, and data disaster recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Adelaide a portfolio of online monitoring and security evaluation services to assist you to reduce the threat from ransomware. These services incorporate next-generation AI capability to detect new variants of ransomware that can get past legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network expands easily without holding you back. For a low and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Basic plans include RMM, cybersecurity, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management (RMM) technology to keep your network operating at peak levels by tracking the state of critical assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT management staff and your assigned Progent engineering consultant so any looming issues can be addressed before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your network, server, and desktop devices by offering tools for streamlining common tedious tasks. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and restore, A/V response, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alarm to your specified IT management staff and your assigned Progent technical consultant so emerging issues can be fixed before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map, track, optimize and troubleshoot their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that network diagrams are always updated, captures and displays the configuration information of almost all devices on your network, tracks performance, and sends notices when issues are detected. By automating tedious network management processes, ProSight WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, finding devices that require critical software patches, or isolating performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth management reporting tools created to work with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-through or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup processes and enable transparent backup and rapid restoration of critical files, apps, images, plus VMs. ProSight DPS helps you avoid data loss caused by hardware failures, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned employees, or software bugs. Managed services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security companies to deliver web-based management and comprehensive security for your email traffic. The powerful architecture of Progent's Email Guard integrates a Cloud Protection Layer with an on-premises gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of threats from making it to your network firewall. This reduces your exposure to inbound attacks and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of analysis for inbound email. For outbound email, the onsite security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against password theft through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Google Android, and other out-of-band devices. With 2FA, when you log into a protected online account and give your password you are requested to verify your identity on a unit that only you possess and that uses a separate network channel. A wide range of out-of-band devices can be utilized for this second form of ID validation including a smartphone or watch, a hardware/software token, a landline phone, etc. You can designate multiple validation devices. For details about ProSight Duo identity validation services, see Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Support Desk managed services enable your information technology staff to offload Call Center services to Progent or divide activity for support services seamlessly between your in-house network support team and Progent's extensive roster of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a smooth extension of your internal support organization. User access to the Help Desk, provision of support services, problem escalation, trouble ticket creation and tracking, efficiency measurement, and maintenance of the support database are cohesive whether issues are resolved by your internal IT support staff, by Progent's team, or by a combination. Learn more about Progent's outsourced/co-managed Call Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior-based machine learning tools to guard endpoint devices and physical and virtual servers against new malware attacks like ransomware and email phishing, which routinely get by traditional signature-based AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a unified platform to manage the complete threat progression including blocking, identification, containment, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and safeguard data related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about impending expirations of SSLs or domains. By cleaning up and organizing your network documentation, you can eliminate up to half of time thrown away searching for vital information about your IT network. ProSight IT Asset Management includes a common repository for storing and sharing all documents related to managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're making improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of all sizes a versatile and cost-effective alternative for assessing, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT system. Besides maximizing the protection and functionality of your computer environment, Progent's software/firmware update management services permit your IT staff to focus on more strategic projects and tasks that derive the highest business value from your network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual host configured and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the customer owns the data, the OS platforms, and the applications. Since the environment is virtualized, it can be moved easily to an alternate hardware environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a single platform to address the entire malware attack progression including filtering, infiltration detection, mitigation, cleanup, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer economical multi-layer security for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP offers two-way firewall protection, penetration alarms, endpoint control, and web filtering through cutting-edge technologies packaged within one agent accessible from a single control. Progent's data protection and virtualization consultants can help your business to plan and configure a ProSight ESP environment that meets your organization's unique needs and that helps you prove compliance with government and industry data protection standards. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that require immediate attention. Progent can also help your company to install and test a backup and disaster recovery system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange email filtering.