Boise 24-7 Critical Crypto
Computer Malware Detection and Remediation Services

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyberplague that poses an extinction-level danger for organizations vulnerable to an attack. Versions of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, plus more unnamed viruses, not only encrypt on-line critical data but also infect any available system protection. Information synchronized to cloud environments can also be ransomed. In a vulnerable environment, this can make automatic recovery hopeless and effectively sets the entire system back to square one.

Retrieving services and information after a ransomware intrusion becomes a race against the clock as the targeted organization tries its best to stop lateral movement, eradicate the ransomware, and restore business-critical operations. Since ransomware needs time to spread, assaults are usually sprung on weekends and holidays, when attacks tend to take more time to detect. This compounds the difficulty of rapidly marshalling and organizing a knowledgeable mitigation team.

Progent makes available a range of help services for protecting organizations from ransomware penetrations. Among these are team education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of modern security solutions with AI technology from SentinelOne to detect and extinguish new threats rapidly. Progent in addition provides the services of veteran ransomware recovery engineers with the talent and commitment to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Services
Following a ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will return the keys to unencrypt all your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to setup from scratch the vital components of your IT environment. Without access to essential information backups, this calls for a broad range of skill sets, professional project management, and the ability to work 24x7 until the recovery project is over.

For twenty years, Progent has offered professional Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned high-level certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP applications. This breadth of experience affords Progent the capability to rapidly identify important systems and consolidate the remaining parts of your Information Technology system after a ransomware attack and rebuild them into an operational system.

Progent's ransomware team of experts deploys state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent understands the importance of acting quickly and in unison with a client's management and Information Technology team members to prioritize tasks and to put key services back online as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Virus Restoration
A small business escalated to Progent after their organization was crashed by Ryuk ransomware. Ryuk is thought to have been created by North Korean state sponsored hackers, possibly using techniques exposed from the U.S. National Security Agency. Ryuk goes after specific businesses with little tolerance for operational disruption and is one of the most profitable instances of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area with about 500 workers. The Ryuk attack had paralyzed all essential operations and manufacturing capabilities. Most of the client's data backups had been on-line at the beginning of the intrusion and were destroyed. The client was evaluating paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked together with the customer to quickly determine and assign priority to the critical areas that had to be restored to make it possible to resume business operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting/MRP

In less than two days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then performed setup and hard drive recovery on mission critical servers. All Exchange ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Off-Line Data Files) on user workstations and laptops to recover email information. A not too old off-line backup of the customer's accounting/ERP systems made them able to recover these vital programs back online. Although major work needed to be completed to recover fully from the Ryuk damage, core services were returned to operations quickly:

Throughout the following month critical milestones in the restoration project were achieved in tight collaboration between Progent consultants and the client:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Exchange Server containing more than four million historical emails was brought online and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory Control functions were 100 percent restored.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Ninety percent of the user desktops were fully operational.

Conclusion
A likely business-ending disaster was dodged due to results-oriented experts, a broad spectrum of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus penetration described here should have been identified and blocked with advanced security systems and best practices, user and IT administrator education, and appropriate incident response procedures for backup and applying software patches, the fact remains that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware incident, remember that Progent's roster of professionals has proven experience in ransomware virus blocking, removal, and data recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Boise a portfolio of remote monitoring and security assessment services to help you to reduce the threat from crypto-ransomware. These services include next-generation artificial intelligence capability to uncover new variants of ransomware that can escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales readily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include RMM, cybersecurity, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your network operating efficiently by checking the state of vital computers that drive your business network. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your designated IT management personnel and your Progent engineering consultant so that all looming issues can be resolved before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for managing your client-server infrastructure by offering an environment for performing common tedious tasks. These include health monitoring, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus response, remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alarm to your specified IT personnel and your Progent consultant so that potential problems can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to diagram, track, enhance and troubleshoot their connectivity appliances like switches, firewalls, and access points plus servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are kept current, copies and manages the configuration of almost all devices connected to your network, monitors performance, and sends notices when issues are detected. By automating tedious management and troubleshooting activities, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, finding devices that need important software patches, or isolating performance problems. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time and in-depth reporting tools created to integrate with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues such as spotty support follow-through or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software providers to produce ProSight Data Protection Services, a selection of offerings that provide backup-as-a-service. ProSight DPS products automate and track your data backup processes and allow non-disruptive backup and rapid recovery of important files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business recover from data loss caused by equipment breakdown, natural disasters, fire, cyber attacks like ransomware, user mistakes, malicious employees, or application bugs. Managed backup services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading data security vendors to provide web-based management and world-class protection for all your inbound and outbound email. The hybrid architecture of Email Guard managed service integrates cloud-based filtering with an on-premises gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, DHAs, and other email-borne malware. Email Guard's cloud filter acts as a preliminary barricade and blocks the vast majority of unwanted email from reaching your security perimeter. This reduces your exposure to external threats and conserves network bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of inspection for inbound email. For outgoing email, the local gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The onsite gateway can also help Exchange Server to track and protect internal email that originates and ends within your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication. Duo supports one-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, when you sign into a protected application and give your password you are requested to verify your identity on a unit that only you possess and that is accessed using a separate network channel. A broad selection of out-of-band devices can be used for this second form of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You can designate multiple validation devices. For more information about Duo identity validation services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Center: Help Desk Managed Services
  Progent's Support Desk services allow your information technology staff to offload Help Desk services to Progent or split responsibilities for support services seamlessly between your internal network support resources and Progent's extensive roster of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a seamless supplement to your corporate network support group. Client interaction with the Service Desk, delivery of support services, problem escalation, ticket generation and tracking, efficiency metrics, and maintenance of the support database are consistent regardless of whether incidents are resolved by your core network support resources, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Call Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior machine learning technology to defend endpoint devices as well as servers and VMs against new malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-matching AV tools. Progent Active Security Monitoring services protect on-premises and cloud-based resources and provides a single platform to manage the entire threat progression including blocking, detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and safeguard data related to your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and organizing your IT infrastructure documentation, you can eliminate up to half of time thrown away looking for vital information about your IT network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're planning improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of all sizes a versatile and affordable solution for assessing, validating, scheduling, implementing, and documenting software and firmware updates to your dynamic IT network. In addition to maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services permit your in-house IT team to focus on line-of-business initiatives and tasks that derive the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual host set up and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Because the system is virtualized, it can be moved immediately to an alternate hosting solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which routinely evade legacy signature-matching AV products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a unified platform to address the complete threat lifecycle including protection, identification, mitigation, remediation, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver economical multi-layer protection for physical and virtual servers, desktops, smartphones, and Exchange email. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, device control, and web filtering via leading-edge tools packaged within one agent managed from a unified control. Progent's security and virtualization experts can help your business to design and implement a ProSight ESP deployment that meets your organization's specific requirements and that allows you prove compliance with legal and industry information security standards. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent's consultants can also assist your company to install and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange email filtering.