Columbus 24x7 Immediate Crypto-Ransomware
Infection Identification and Remediation Consultants

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level danger for businesses vulnerable to an assault. Multiple generations of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for a long time and still inflict damage. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus additional unnamed newcomers, not only encrypt online data but also infiltrate any available system backups. Information synched to the cloud can also be held hostage. In a poorly architected data protection solution, it can make any restoration impossible and basically knocks the entire system back to square one.

Retrieving applications and information after a ransomware attack becomes a sprint against time as the victim struggles to stop the spread, clear the ransomware, and restore business-critical activity. Since crypto-ransomware takes time to move laterally, penetrations are usually launched during weekends and nights, when penetrations typically take more time to recognize. This multiplies the difficulty of promptly marshalling and coordinating a capable mitigation team.

Progent offers a variety of services for securing enterprises from crypto-ransomware events. Among these are user education to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of next-generation security gateways with machine learning capabilities from SentinelOne to discover and quarantine zero-day cyber attacks quickly. Progent also can provide the services of veteran ransomware recovery engineers with the track record and perseverance to rebuild a breached environment as urgently as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware event, sending the ransom in cryptocurrency does not guarantee that distant criminals will respond with the needed keys to decrypt all your data. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to piece back together the critical elements of your Information Technology environment. Without the availability of full system backups, this requires a wide range of skill sets, well-coordinated project management, and the capability to work non-stop until the task is finished.

For twenty years, Progent has offered expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have attained high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of expertise gives Progent the capability to efficiently understand important systems and integrate the surviving components of your IT system following a ransomware attack and rebuild them into an operational system.

Progent's ransomware team of experts utilizes best of breed project management tools to orchestrate the complicated restoration process. Progent understands the urgency of acting quickly and in unison with a customer's management and IT staff to assign priority to tasks and to put critical services back on-line as soon as humanly possible.

Case Study: A Successful Crypto-Ransomware Incident Recovery
A customer hired Progent after their company was taken over by Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state sponsored criminal gangs, suspected of using techniques exposed from America's NSA organization. Ryuk goes after specific organizations with little ability to sustain disruption and is one of the most profitable examples of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer located in Chicago with around 500 workers. The Ryuk intrusion had brought down all business operations and manufacturing processes. The majority of the client's data backups had been on-line at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but in the end called Progent.

Progent worked together with the client to rapidly assess and prioritize the mission critical areas that had to be recovered to make it possible to resume departmental functions:

• Active Directory (AD)
• Microsoft Exchange
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then initiated rebuilding and hard drive recovery on key applications. All Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to find intact OST data files (Microsoft Outlook Off-Line Folder Files) on user workstations and laptops in order to recover email data. A not too old off-line backup of the businesses financials/ERP software made them able to recover these vital services back online. Although a lot of work still had to be done to recover fully from the Ryuk event, essential services were returned to operations rapidly:

During the next few weeks key milestones in the restoration process were achieved through close cooperation between Progent team members and the customer:

• Internal web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was brought online and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory Control modules were 100% recovered.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Ninety percent of the user PCs were operational.

Conclusion
A possible business-ending disaster was averted by hard-working experts, a broad range of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware incident described here would have been prevented with current security systems and security best practices, team training, and well thought out incident response procedures for data backup and applying software patches, the fact remains that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, remember that Progent's team of experts has substantial experience in crypto-ransomware virus defense, removal, and data recovery.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Columbus a portfolio of online monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services include next-generation artificial intelligence capability to detect zero-day strains of ransomware that can escape detection by traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent takes care of the necessary monitoring and management for you, so your network scales readily without becoming an obstacle. For a low and predictable monthly price, Progent's full-service IT team can be your complete technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management techniques to keep your IT system running at peak levels by tracking the state of vital assets that power your business network. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your designated IT personnel and your Progent engineering consultant so all looming issues can be resolved before they can impact productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering an environment for streamlining common tedious tasks. These include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, A/V protection, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alarm to your specified IT personnel and your Progent consultant so emerging problems can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to map, track, enhance and debug their networking appliances such as switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, captures and displays the configuration of virtually all devices on your network, tracks performance, and generates alerts when problems are discovered. By automating time-consuming network management activities, WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that need critical software patches, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time management reporting plug-ins designed to integrate with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology providers to create ProSight Data Protection Services, a family of subscription-based management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup operations and allow non-disruptive backup and fast recovery of vital files/folders, apps, images, plus virtual machines. ProSight DPS helps you protect against data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, user error, ill-intentioned insiders, or application glitches. Managed services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of top information security companies to provide web-based management and world-class security for all your email traffic. The hybrid structure of Email Guard integrates cloud-based filtering with a local security gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance adds a further layer of analysis for inbound email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your corporate firewall. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to defend against password theft by using two-factor authentication (2FA). Duo enables single-tap identity confirmation with iOS, Google Android, and other out-of-band devices. Using 2FA, when you sign into a secured application and give your password you are asked to confirm who you are on a unit that only you possess and that uses a different ("out-of-band") network channel. A wide range of devices can be utilized for this added form of authentication including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For details about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Support Center managed services allow your information technology group to offload Call Center services to Progent or divide responsibilities for Help Desk services transparently between your internal network support group and Progent's nationwide roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a smooth extension of your corporate support staff. User interaction with the Help Desk, delivery of support services, problem escalation, ticket generation and tracking, efficiency measurement, and maintenance of the service database are cohesive regardless of whether incidents are taken care of by your internal network support resources, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior machine learning tools to defend endpoints as well as servers and VMs against modern malware attacks like ransomware and email phishing, which routinely escape legacy signature-matching AV tools. Progent ASM services safeguard local and cloud-based resources and provides a single platform to manage the complete malware attack lifecycle including protection, identification, containment, cleanup, and forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and safeguard data related to your network infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be warned automatically about impending expirations of SSLs ,domains or warranties. By updating and organizing your network documentation, you can save up to half of time spent trying to find vital information about your network. ProSight IT Asset Management includes a centralized location for storing and sharing all documents required for managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're planning enhancements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you require as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of any size a flexible and cost-effective solution for assessing, testing, scheduling, implementing, and tracking updates to your dynamic information network. In addition to maximizing the security and reliability of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on more strategic projects and activities that deliver maximum business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure Tier III data center on a fast virtual machine host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Since the system is virtualized, it can be ported easily to a different hardware environment without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which routinely evade legacy signature-matching anti-virus products. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to address the complete threat progression including blocking, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection services deliver economical multi-layer protection for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP provides firewall protection, penetration alerts, endpoint management, and web filtering through cutting-edge technologies incorporated within one agent managed from a unified console. Progent's security and virtualization experts can assist your business to design and implement a ProSight ESP deployment that addresses your organization's specific requirements and that allows you achieve and demonstrate compliance with legal and industry information protection standards. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that require urgent attention. Progent can also help you to set up and verify a backup and restore system like ProSight Data Protection Services so you can recover quickly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.