Birmingham 24-7 Critical Crypto
Computer Virus Detection and Removal Support

Ransomware : Your Worst IT Disaster
Ransomware has become a too-frequent cyberplague that represents an enterprise-level danger for organizations poorly prepared for an assault. Versions of ransomware such as Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and still inflict havoc. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, along with additional as yet unnamed malware, not only do encryption of online files but also infect many available system backup. Information replicated to cloud environments can also be held hostage. In a vulnerable environment, this can render any restoration impossible and basically sets the datacenter back to zero.

Retrieving applications and information after a ransomware intrusion becomes a sprint against the clock as the victim fights to stop lateral movement, remove the ransomware, and resume enterprise-critical activity. Because ransomware requires time to replicate, penetrations are frequently launched at night, when penetrations are likely to take more time to detect. This compounds the difficulty of rapidly assembling and orchestrating an experienced mitigation team.

Progent has an assortment of help services for protecting enterprises from crypto-ransomware events. Among these are team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security solutions with artificial intelligence capabilities from SentinelOne to identify and disable day-zero cyber threats rapidly. Progent in addition can provide the services of veteran ransomware recovery consultants with the track record and perseverance to rebuild a compromised network as urgently as possible.

Progent's Ransomware Recovery Support Services
Soon after a ransomware penetration, paying the ransom in cryptocurrency does not guarantee that merciless criminals will return the codes to decrypt all your data. Kaspersky estimated that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to setup from scratch the key elements of your IT environment. Without access to complete information backups, this calls for a broad range of skill sets, well-coordinated team management, and the ability to work 24x7 until the recovery project is completed.

For two decades, Progent has offered certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of experience provides Progent the ability to knowledgably determine important systems and integrate the surviving pieces of your network environment after a crypto-ransomware penetration and rebuild them into an operational network.

Progent's recovery team utilizes powerful project management tools to coordinate the complex restoration process. Progent appreciates the urgency of working quickly and together with a client's management and Information Technology staff to assign priority to tasks and to get key services back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Penetration Restoration
A small business escalated to Progent after their organization was brought down by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, suspected of using algorithms leaked from the U.S. NSA organization. Ryuk goes after specific companies with little ability to sustain operational disruption and is among the most profitable iterations of ransomware malware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago with around 500 workers. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of $200K) and hoping for good luck, but in the end brought in Progent.

Progent worked together with the client to rapidly understand and prioritize the most important applications that had to be addressed in order to continue departmental operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

Within two days, Progent was able to recover Active Directory services to its pre-virus state. Progent then completed rebuilding and storage recovery on critical servers. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to find intact OST data files (Outlook Email Off-Line Folder Files) on staff desktop computers in order to recover email information. A not too old off-line backup of the client's financials/MRP software made them able to return these required services back online for users. Although a large amount of work needed to be completed to recover totally from the Ryuk damage, critical systems were returned to operations quickly:

Over the next month key milestones in the restoration process were made in close cooperation between Progent team members and the client:

• Internal web sites were restored with no loss of information.
• The MailStore Server exceeding 4 million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory functions were completely restored.
• A new Palo Alto Networks 850 firewall was deployed.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A possible enterprise-killing catastrophe was dodged with top-tier experts, a wide range of IT skills, and close collaboration. Although in hindsight the ransomware virus penetration detailed here could have been identified and prevented with modern cyber security technology and best practices, user education, and appropriate incident response procedures for data protection and applying software patches, the fact remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's roster of experts has a proven track record in ransomware virus blocking, cleanup, and file disaster recovery.

To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Birmingham a range of remote monitoring and security assessment services designed to assist you to minimize the threat from ransomware. These services utilize next-generation AI technology to uncover new strains of ransomware that can escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent takes care of the necessary monitoring and management for you, so your system scales readily without holding you back. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management technology to keep your network running efficiently by tracking the health of critical computers that power your information system. When ProSight LAN Watch detects an issue, an alert is sent automatically to your specified IT personnel and your assigned Progent engineering consultant so any potential issues can be resolved before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for managing your network, server, and desktop devices by offering an environment for performing common time-consuming tasks. These can include health checking, patch management, automated repairs, endpoint setup, backup and restore, anti-virus protection, secure remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alarm to your designated IT management personnel and your assigned Progent consultant so that emerging problems can be fixed before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for smaller organizations to map out, monitor, optimize and troubleshoot their networking hardware like routers, firewalls, and load balancers plus servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network diagrams are always current, copies and displays the configuration information of almost all devices on your network, tracks performance, and generates alerts when problems are discovered. By automating tedious management and troubleshooting processes, WAN Watch can knock hours off ordinary chores such as network mapping, expanding your network, finding appliances that require critical updates, or isolating performance issues. Learn more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time and in-depth reporting plug-ins created to integrate with the leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-through or endpoints with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services (DPS), a family of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup processes and enable transparent backup and rapid restoration of important files, applications, images, plus virtual machines. ProSight DPS helps your business recover from data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious employees, or application bugs. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security companies to provide web-based management and world-class protection for all your inbound and outbound email. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with an on-premises security gateway device to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of threats from reaching your network firewall. This decreases your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's on-premises gateway device adds a deeper layer of inspection for incoming email. For outbound email, the local security gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Exchange Server to track and safeguard internal email that originates and ends inside your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to protect against password theft by using two-factor authentication. Duo supports one-tap identity confirmation with iOS, Android, and other out-of-band devices. Using Duo 2FA, when you log into a secured online account and enter your password you are requested to verify your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be used as this added form of ID validation including a smartphone or watch, a hardware token, a landline telephone, etc. You can register several verification devices. For details about ProSight Duo two-factor identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Support Desk services allow your IT group to outsource Call Center services to Progent or split responsibilities for Help Desk services seamlessly between your in-house network support staff and Progent's nationwide pool of IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a smooth extension of your corporate IT support staff. User access to the Service Desk, provision of support services, issue escalation, trouble ticket creation and tracking, efficiency metrics, and maintenance of the support database are consistent whether issues are resolved by your corporate network support group, by Progent, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates next generation behavior machine learning tools to guard endpoint devices as well as physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely get by traditional signature-based AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a single platform to address the entire malware attack progression including filtering, identification, containment, remediation, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard information about your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be alerted about impending expirations of SSLs or warranties. By cleaning up and organizing your network documentation, you can eliminate as much as half of time wasted searching for vital information about your IT network. ProSight IT Asset Management includes a common repository for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and affordable alternative for assessing, validating, scheduling, implementing, and documenting updates to your dynamic information network. Besides optimizing the protection and functionality of your IT network, Progent's patch management services free up time for your in-house IT team to concentrate on line-of-business initiatives and activities that deliver maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host configured and maintained by Progent's IT support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved immediately to an alternate hardware environment without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior-based analysis technology to defend physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which routinely get by traditional signature-based AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a unified platform to address the entire threat lifecycle including blocking, detection, containment, cleanup, and post-attack forensics. Top features include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver economical multi-layer protection for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP provides firewall protection, intrusion alarms, device control, and web filtering via leading-edge technologies packaged within a single agent managed from a single console. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP environment that meets your company's specific needs and that helps you achieve and demonstrate compliance with legal and industry information security standards. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for urgent action. Progent can also assist you to install and verify a backup and disaster recovery system like ProSight Data Protection Services so you can get back in business rapidly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange filtering.