Ransomware Protection and Restoration Solutions San Mateo

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different versions of ransomware like the CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for a long time and still inflict havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus daily as yet unnamed viruses, not only perform encryption of online critical data but also infect many accessible system backups. Data synchronized to the cloud can also be ransomed. In a poorly architected system, it can make automated restoration useless and basically knocks the datacenter back to square one.

Recovering applications and data after a crypto-ransomware event becomes a sprint against time as the victim tries its best to stop the spread, clear the ransomware, and restore mission-critical operations. Due to the fact that ransomware takes time to spread throughout a targeted network, penetrations are often sprung during nights and weekends, when successful penetrations typically take more time to uncover. This multiplies the difficulty of rapidly mobilizing and coordinating a qualified mitigation team.

Progent makes available a variety of services for securing San Mateo enterprises from ransomware events. These include team member education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to discover and extinguish day-zero malware assaults. Progent also provides the services of experienced ransomware recovery engineers with the track record and perseverance to re-deploy a breached network as rapidly as possible.

Progent's Ransomware Recovery Support Services
Soon after a ransomware attack, paying the ransom in cryptocurrency does not guarantee that cyber hackers will return the codes to unencrypt all your data. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the mission-critical elements of your Information Technology environment. Absent access to complete information backups, this calls for a wide range of skill sets, well-coordinated team management, and the ability to work 24x7 until the task is finished.

For two decades, Progent has offered professional IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned high-level certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience affords Progent the skills to quickly determine critical systems and re-organize the remaining parts of your computer network environment following a ransomware attack and assemble them into a functioning system.

Progent's ransomware group has top notch project management tools to orchestrate the complex restoration process. Progent appreciates the urgency of acting quickly and together with a customer's management and Information Technology resources to assign priority to tasks and to get the most important systems back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A small business contacted Progent after their company was brought down by the Ryuk crypto-ransomware. Ryuk is believed to have been deployed by North Korean government sponsored criminal gangs, possibly using approaches leaked from America's National Security Agency. Ryuk targets specific companies with limited tolerance for disruption and is among the most lucrative instances of ransomware viruses. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in the Chicago metro area and has around 500 workers. The Ryuk intrusion had disabled all essential operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the time of the attack and were destroyed. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly assess and assign priority to the mission critical areas that had to be restored to make it possible to restart business operations:

• Active Directory
• Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-virus state. Progent then assisted with reinstallations and storage recovery of the most important systems. All Exchange ties and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to locate non-encrypted OST files (Outlook Off-Line Data Files) on various desktop computers in order to recover email messages. A not too old offline backup of the businesses accounting/ERP software made them able to restore these required programs back online. Although a large amount of work was left to recover totally from the Ryuk damage, critical systems were restored quickly:

During the next month critical milestones in the recovery process were achieved through close cooperation between Progent team members and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Server with over 4 million archived messages was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory functions were 100% operational.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the user PCs were back into operation.

Conclusion
A probable enterprise-killing disaster was dodged by hard-working professionals, a broad spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware virus attack detailed here could have been shut down with current security solutions and best practices, staff training, and appropriate incident response procedures for information backup and proper patching controls, the reality is that state-sponsored hackers from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, cleanup, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in San Mateo
For ransomware system restoration expertise in the San Mateo metro area, phone Progent at 800-462-8800 or go to Contact Progent.