Ransomware Prevention and Recovery Consulting Orlando

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyberplague that poses an existential threat for organizations vulnerable to an assault. Different iterations of ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to cause destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus daily unnamed viruses, not only perform encryption of on-line critical data but also infect many configured system protection. Data replicated to the cloud can also be ransomed. In a vulnerable system, it can make automated restoration hopeless and basically sets the entire system back to square one.

Restoring services and data after a ransomware event becomes a race against the clock as the targeted business struggles to contain the damage, remove the crypto-ransomware, and restore mission-critical operations. Since ransomware requires time to spread across a targeted network, assaults are usually sprung on weekends, when attacks tend to take more time to notice. This multiplies the difficulty of quickly marshalling and orchestrating a knowledgeable response team.

Progent provides an assortment of help services for securing Orlando businesses from crypto-ransomware events. These include user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to identify and suppress zero-day modern malware assaults. Progent also offers the assistance of seasoned crypto-ransomware recovery engineers with the talent and commitment to reconstruct a breached network as rapidly as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware event, sending the ransom in cryptocurrency does not guarantee that criminal gangs will return the needed codes to decrypt any of your information. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to setup from scratch the essential parts of your Information Technology environment. Without the availability of complete data backups, this requires a wide complement of IT skills, professional team management, and the willingness to work continuously until the task is completed.

For decades, Progent has provided expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of expertise affords Progent the skills to rapidly determine important systems and re-organize the remaining pieces of your IT system after a ransomware event and rebuild them into an operational system.

Progent's security team of experts uses best of breed project management applications to coordinate the complicated restoration process. Progent understands the importance of working quickly and in concert with a customer's management and IT staff to assign priority to tasks and to get essential systems back on-line as fast as possible.

Customer Story: A Successful Ransomware Virus Recovery
A customer hired Progent after their organization was brought down by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored cybercriminals, suspected of adopting approaches leaked from the U.S. NSA organization. Ryuk attacks specific organizations with little or no room for operational disruption and is among the most lucrative instances of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer located in the Chicago metro area with about 500 employees. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the time of the intrusion and were encrypted. The client considered paying the ransom (exceeding $200,000) and wishfully thinking for the best, but in the end reached out to Progent.

Progent worked together with the customer to quickly understand and prioritize the key elements that had to be restored to make it possible to resume business functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then initiated reinstallations and storage recovery on the most important servers. All Exchange Server data and attributes were intact, which facilitated the restore of Exchange. Progent was also able to locate local OST files (Microsoft Outlook Off-Line Data Files) on staff workstations and laptops to recover email information. A recent offline backup of the client's accounting systems made them able to restore these required applications back servicing users. Although a lot of work needed to be completed to recover totally from the Ryuk virus, essential services were returned to operations quickly:

Over the next few weeks key milestones in the recovery process were completed through close cooperation between Progent consultants and the client:

• Internal web sites were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was spun up and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Nearly all of the desktops and laptops were functioning as before the incident.

Conclusion
A likely business-killing catastrophe was dodged through the efforts of results-oriented professionals, a wide spectrum of subject matter expertise, and close collaboration. Although in post mortem the ransomware penetration described here could have been identified and disabled with modern cyber security technology solutions and ISO/IEC 27001 best practices, user education, and appropriate incident response procedures for information backup and proper patching controls, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, cleanup, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Orlando
For ransomware cleanup consulting services in the Orlando area, phone Progent at 800-462-8800 or go to Contact Progent.