Colorado Springs 24-7 Emergency Crypto
Computer Virus Damage Assessment and Restoration Help

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses vulnerable to an assault. Versions of ransomware like the Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and continue to cause harm. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus frequent unnamed newcomers, not only do encryption of online data but also infect any configured system backup. Information synchronized to the cloud can also be ransomed. In a poorly architected system, this can render any restoration impossible and basically sets the datacenter back to zero.

Retrieving services and information after a ransomware attack becomes a race against the clock as the targeted business struggles to contain, clear the ransomware, and resume enterprise-critical activity. Since crypto-ransomware needs time to move laterally, assaults are frequently sprung on weekends and holidays, when successful penetrations are likely to take more time to identify. This compounds the difficulty of promptly assembling and coordinating a capable response team.

Progent provides a variety of solutions for securing organizations from crypto-ransomware penetrations. Among these are staff education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security gateways with machine learning technology from SentinelOne to detect and extinguish zero-day threats quickly. Progent in addition can provide the services of experienced ransomware recovery engineers with the talent and commitment to re-deploy a breached system as rapidly as possible.

Progent's Ransomware Restoration Help
Following a crypto-ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that distant criminals will provide the codes to decrypt any of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to re-install the mission-critical parts of your Information Technology environment. Without the availability of essential system backups, this requires a broad complement of skills, top notch team management, and the capability to work non-stop until the recovery project is done.

For twenty years, Progent has made available professional Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded top certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience gives Progent the capability to efficiently identify important systems and integrate the remaining parts of your network environment after a ransomware penetration and assemble them into an operational network.

Progent's security team of experts has powerful project management systems to orchestrate the complex recovery process. Progent knows the urgency of acting quickly and in concert with a customer's management and IT resources to assign priority to tasks and to put essential systems back on line as soon as humanly possible.

Case Study: A Successful Ransomware Intrusion Recovery
A customer contacted Progent after their organization was brought down by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state hackers, suspected of using algorithms exposed from the United States National Security Agency. Ryuk goes after specific businesses with little tolerance for disruption and is among the most lucrative examples of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in Chicago with around 500 workers. The Ryuk intrusion had brought down all business operations and manufacturing processes. The majority of the client's system backups had been online at the time of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked hand in hand the client to quickly get our arms around and assign priority to the essential elements that had to be restored to make it possible to restart company functions:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than two days, Progent was able to re-build Active Directory to its pre-penetration state. Progent then completed rebuilding and storage recovery on mission critical systems. All Exchange schema and attributes were intact, which facilitated the restore of Exchange. Progent was also able to find local OST data files (Microsoft Outlook Offline Data Files) on various PCs in order to recover email information. A recent off-line backup of the customer's financials/ERP systems made it possible to return these essential applications back available to users. Although major work was left to recover completely from the Ryuk damage, the most important services were returned to operations quickly:

Throughout the next couple of weeks critical milestones in the recovery process were accomplished through tight collaboration between Progent consultants and the customer:

• In-house web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were fully operational.
• A new Palo Alto Networks 850 firewall was set up.
• 90% of the user desktops were being used by staff.

Conclusion
A potential business extinction disaster was averted due to results-oriented experts, a broad array of subject matter expertise, and tight collaboration. Although in post mortem the ransomware virus penetration described here should have been stopped with modern security systems and recognized best practices, user and IT administrator training, and appropriate security procedures for information backup and keeping systems up to date with security patches, the reality remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and information systems restoration.

To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Colorado Springs a portfolio of online monitoring and security evaluation services to help you to minimize the threat from crypto-ransomware. These services include modern artificial intelligence capability to detect new variants of ransomware that can get past traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent takes care of the necessary monitoring and management for you, so your system scales readily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Entry-level plans include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management technology to keep your network running efficiently by tracking the state of vital computers that power your information system. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your designated IT management staff and your assigned Progent consultant so any potential problems can be resolved before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your network, server, and desktop devices by offering an environment for performing common time-consuming tasks. These can include health monitoring, update management, automated remediation, endpoint configuration, backup and recovery, anti-virus response, secure remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your designated IT management staff and your Progent consultant so emerging problems can be fixed before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller businesses to map out, track, enhance and debug their connectivity hardware like routers, firewalls, and load balancers plus servers, client computers and other devices. Using state-of-the-art RMM technology, WAN Watch ensures that network diagrams are always updated, captures and displays the configuration of almost all devices connected to your network, monitors performance, and generates alerts when potential issues are detected. By automating complex management and troubleshooting processes, ProSight WAN Watch can knock hours off ordinary chores like network mapping, reconfiguring your network, locating devices that require important software patches, or isolating performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of in-depth management reporting tools designed to work with the leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with advanced backup software companies to produce ProSight Data Protection Services, a family of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup operations and enable transparent backup and fast restoration of critical files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks like ransomware, user mistakes, malicious employees, or application glitches. Managed backup services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading information security vendors to provide web-based management and comprehensive security for all your email traffic. The powerful architecture of Email Guard managed service combines cloud-based filtering with an on-premises gateway appliance to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of threats from making it to your network firewall. This decreases your vulnerability to inbound attacks and conserves system bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of analysis for inbound email. For outgoing email, the local gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity verification on iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected application and give your password you are asked to confirm your identity via a unit that only you possess and that uses a different network channel. A broad selection of devices can be used as this second means of authentication such as a smartphone or wearable, a hardware token, a landline telephone, etc. You may designate several validation devices. To learn more about ProSight Duo two-factor identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Call Center Managed Services
  Progent's Help Desk services enable your IT group to outsource Call Center services to Progent or split activity for support services seamlessly between your in-house network support group and Progent's extensive roster of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a smooth supplement to your internal network support group. User interaction with the Service Desk, delivery of support services, escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the support database are cohesive whether incidents are resolved by your in-house support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Service Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior-based analysis technology to guard endpoints as well as physical and virtual servers against modern malware attacks like ransomware and email phishing, which easily escape traditional signature-matching AV tools. Progent Active Security Monitoring services protect local and cloud resources and provides a single platform to automate the complete malware attack lifecycle including blocking, infiltration detection, mitigation, cleanup, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and safeguard data related to your network infrastructure, processes, applications, and services. You can instantly find passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates ,domains or warranties. By updating and managing your IT documentation, you can save up to 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management features a common location for storing and sharing all documents related to managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're planning enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of any size a versatile and affordable alternative for evaluating, testing, scheduling, implementing, and documenting updates to your dynamic IT network. Besides optimizing the security and reliability of your IT environment, Progent's software/firmware update management services allow your IT staff to concentrate on more strategic initiatives and activities that derive the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support experts. Under the ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the apps. Since the environment is virtualized, it can be ported easily to a different hosting solution without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior machine learning technology to defend physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely get by legacy signature-matching AV tools. ProSight ASM safeguards local and cloud resources and provides a single platform to automate the entire threat lifecycle including filtering, identification, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services offer economical multi-layer security for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alarms, endpoint management, and web filtering via cutting-edge technologies packaged within one agent managed from a single control. Progent's security and virtualization consultants can help your business to plan and implement a ProSight ESP environment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with legal and industry information protection standards. Progent will help you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for urgent attention. Progent's consultants can also help your company to set up and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.