24x7x365 Vacaville Critical Crypto
Infection Damage Assessment and Recovery Support

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyberplague that poses an enterprise-level danger for businesses vulnerable to an attack. Versions of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and still cause harm. Recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as frequent as yet unnamed viruses, not only encrypt online critical data but also infiltrate any available system protection. Data replicated to the cloud can also be held hostage. In a vulnerable system, this can make automated restore operations impossible and effectively knocks the network back to square one.

Restoring services and data after a crypto-ransomware attack becomes a race against time as the targeted organization tries its best to contain, eradicate the ransomware, and resume mission-critical operations. Because crypto-ransomware requires time to move laterally, assaults are frequently sprung during nights and weekends, when successful attacks typically take more time to identify. This multiplies the difficulty of quickly mobilizing and orchestrating a qualified response team.

Progent provides a variety of help services for securing enterprises from ransomware events. Among these are staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of next-generation security appliances with AI capabilities from SentinelOne to detect and extinguish day-zero threats automatically. Progent also can provide the assistance of experienced ransomware recovery consultants with the talent and perseverance to restore a breached system as quickly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed keys to decipher any of your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to piece back together the key parts of your IT environment. Without access to essential information backups, this calls for a broad range of skills, well-coordinated project management, and the willingness to work non-stop until the job is finished.

For two decades, Progent has provided professional IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have attained top certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of experience gives Progent the ability to efficiently determine critical systems and integrate the remaining components of your IT environment following a ransomware penetration and rebuild them into an operational system.

Progent's security team of experts uses state-of-the-art project management applications to orchestrate the complicated restoration process. Progent appreciates the importance of acting rapidly and together with a customer's management and Information Technology staff to assign priority to tasks and to put essential applications back online as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Virus Restoration
A client sought out Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state cybercriminals, possibly adopting strategies leaked from the U.S. NSA organization. Ryuk targets specific organizations with little tolerance for disruption and is one of the most profitable examples of ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in Chicago and has about 500 employees. The Ryuk event had brought down all company operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked with the customer to quickly determine and prioritize the most important elements that needed to be addressed to make it possible to restart business functions:

• Windows Active Directory
• E-Mail
• Financials/MRP

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then completed rebuilding and storage recovery on key applications. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to assemble local OST files (Outlook Email Off-Line Folder Files) on various PCs and laptops in order to recover email data. A recent off-line backup of the customer's financials/MRP systems made it possible to restore these vital applications back on-line. Although a large amount of work still had to be done to recover fully from the Ryuk damage, the most important systems were returned to operations quickly:

During the following couple of weeks critical milestones in the recovery process were made through close cooperation between Progent engineers and the customer:

• Internal web sites were brought back up with no loss of information.
• The MailStore Exchange Server with over four million archived emails was brought online and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory capabilities were 100 percent recovered.
• A new Palo Alto 850 security appliance was deployed.
• Nearly all of the user workstations were back into operation.

Conclusion
A likely business extinction disaster was evaded through the efforts of dedicated professionals, a wide range of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware virus penetration detailed here would have been identified and disabled with advanced security solutions and best practices, staff training, and properly executed incident response procedures for information protection and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's roster of experts has extensive experience in ransomware virus defense, removal, and information systems disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Vacaville a variety of online monitoring and security assessment services to assist you to reduce your vulnerability to ransomware. These services incorporate next-generation AI capability to uncover new variants of ransomware that can evade traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent handles the daily monitoring and maintenance for you, so your network scales easily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your network operating at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your designated IT staff and your Progent consultant so all looming problems can be addressed before they have a chance to disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common time-consuming tasks. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus protection, secure remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alert to your designated IT personnel and your assigned Progent consultant so potential problems can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to map, monitor, enhance and troubleshoot their networking hardware such as switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch ensures that network diagrams are always current, captures and manages the configuration information of virtually all devices connected to your network, monitors performance, and sends notices when problems are discovered. By automating tedious management and troubleshooting activities, WAN Watch can cut hours off ordinary chores like making network diagrams, reconfiguring your network, locating devices that require important updates, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth reporting plug-ins designed to integrate with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services, a portfolio of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services manage and track your data backup operations and allow transparent backup and rapid restoration of important files/folders, applications, system images, plus virtual machines. ProSight DPS helps your business avoid data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, human mistakes, ill-intentioned employees, or application bugs. Managed services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading data security companies to provide web-based control and world-class security for all your email traffic. The hybrid architecture of Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne malware. The Cloud Protection Layer acts as a preliminary barricade and blocks most unwanted email from making it to your network firewall. This decreases your vulnerability to external attacks and saves network bandwidth and storage. Email Guard's onsite security gateway device adds a deeper layer of analysis for incoming email. For outbound email, the on-premises security gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Exchange Server to monitor and safeguard internal email traffic that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Android, and other personal devices. Using Duo 2FA, whenever you log into a secured online account and enter your password you are asked to verify your identity via a unit that only you have and that is accessed using a different network channel. A wide range of out-of-band devices can be utilized for this second form of authentication such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may designate several validation devices. For details about Duo identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Support Desk Managed Services
  Progent's Call Center services enable your information technology staff to outsource Help Desk services to Progent or split responsibilities for Service Desk support seamlessly between your in-house support team and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a smooth extension of your corporate IT support resources. End user interaction with the Help Desk, delivery of support services, problem escalation, ticket creation and updates, performance metrics, and maintenance of the service database are cohesive regardless of whether incidents are resolved by your core IT support organization, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/shared Call Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates cutting edge behavior machine learning tools to defend endpoints and physical and virtual servers against modern malware attacks such as ransomware and email phishing, which routinely escape traditional signature-matching anti-virus products. Progent Active Security Monitoring services protect local and cloud-based resources and provides a unified platform to manage the complete malware attack progression including filtering, infiltration detection, containment, cleanup, and forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and protect data about your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates or domains. By updating and managing your IT documentation, you can eliminate up to half of time spent looking for critical information about your IT network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're planning improvements, performing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and affordable solution for assessing, validating, scheduling, implementing, and documenting updates to your ever-evolving IT system. Besides maximizing the protection and reliability of your computer network, Progent's software/firmware update management services free up time for your in-house IT staff to concentrate on line-of-business initiatives and activities that deliver maximum business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the apps. Because the system is virtualized, it can be moved easily to a different hardware solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which easily get by traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to address the entire malware attack progression including protection, identification, containment, cleanup, and forensics. Top features include one-click rollback with Windows VSS and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer ultra-affordable in-depth security for physical servers and virtual machines, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and reacting to security assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, endpoint management, and web filtering through leading-edge tools packaged within one agent accessible from a unified console. Progent's security and virtualization experts can help your business to plan and configure a ProSight ESP environment that meets your organization's specific needs and that allows you prove compliance with government and industry data security standards. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for immediate attention. Progent can also help you to set up and test a backup and restore system like ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.