Baton Rouge 24-7 Immediate Crypto
Computer Malware Assessment and Remediation Experts

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a modern cyberplague that poses an existential danger for businesses poorly prepared for an attack. Different iterations of ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and continue to inflict damage. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with additional as yet unnamed malware, not only do encryption of online information but also infiltrate any available system protection mechanisms. Information synched to off-site disaster recovery sites can also be encrypted. In a vulnerable environment, this can render automatic recovery hopeless and effectively sets the network back to zero.

Getting back applications and information after a crypto-ransomware outage becomes a sprint against time as the targeted business struggles to contain the damage, clear the crypto-ransomware, and restore business-critical activity. Since ransomware requires time to replicate, assaults are frequently sprung during weekends and nights, when penetrations tend to take longer to recognize. This multiplies the difficulty of quickly marshalling and coordinating an experienced response team.

Progent has a variety of help services for protecting businesses from crypto-ransomware attacks. Among these are user education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of modern security gateways with artificial intelligence technology from SentinelOne to detect and suppress day-zero cyber attacks intelligently. Progent in addition can provide the services of experienced ransomware recovery professionals with the track record and commitment to rebuild a compromised environment as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the needed keys to unencrypt any of your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to re-install the critical elements of your Information Technology environment. Absent access to full system backups, this calls for a broad complement of skill sets, well-coordinated team management, and the capability to work 24x7 until the job is complete.

For two decades, Progent has offered expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of experience affords Progent the skills to efficiently ascertain important systems and re-organize the remaining parts of your IT system after a ransomware attack and rebuild them into a functioning system.

Progent's security team uses best of breed project management tools to orchestrate the complicated recovery process. Progent knows the importance of acting swiftly and in unison with a customer's management and IT team members to prioritize tasks and to put the most important applications back on line as soon as possible.

Client Story: A Successful Ransomware Attack Recovery
A customer engaged Progent after their network system was crashed by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean government sponsored hackers, possibly adopting approaches exposed from the United States NSA organization. Ryuk seeks specific businesses with limited ability to sustain operational disruption and is among the most profitable versions of ransomware malware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk attack had brought down all essential operations and manufacturing processes. Most of the client's data protection had been directly accessible at the time of the intrusion and were encrypted. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but ultimately utilized Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the critical applications that had to be addressed to make it possible to continue business operations:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting/MRP

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then completed rebuilding and hard drive recovery on mission critical systems. All Exchange data and attributes were usable, which facilitated the restore of Exchange. Progent was able to assemble intact OST data files (Microsoft Outlook Off-Line Folder Files) on user desktop computers to recover mail information. A not too old offline backup of the client's accounting/ERP software made it possible to return these essential applications back online. Although major work remained to recover completely from the Ryuk damage, core systems were returned to operations rapidly:

Throughout the next few weeks critical milestones in the restoration project were accomplished through close collaboration between Progent consultants and the client:

• In-house web sites were restored without losing any information.
• The MailStore Server with over 4 million archived emails was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory Control modules were completely restored.
• A new Palo Alto Networks 850 firewall was installed.
• 90% of the user workstations were operational.

Conclusion
A probable business catastrophe was dodged due to dedicated experts, a wide spectrum of subject matter expertise, and tight teamwork. Although in hindsight the crypto-ransomware incident described here should have been identified and stopped with modern cyber security systems and ISO/IEC 27001 best practices, staff training, and well thought out incident response procedures for data protection and proper patching controls, the reality is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware virus, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, removal, and file recovery.

To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Baton Rouge a variety of online monitoring and security evaluation services to help you to reduce your vulnerability to ransomware. These services include next-generation machine learning technology to detect zero-day strains of ransomware that are able to escape detection by traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create advanced network resilience. Progent handles the necessary monitoring and maintenance for you, so your system expands readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Entry-level plans include RMM, security, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to help keep your IT system operating at peak levels by tracking the health of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your designated IT staff and your assigned Progent engineering consultant so that all looming issues can be addressed before they can disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your client-server infrastructure by offering an environment for streamlining common tedious jobs. These can include health checking, patch management, automated remediation, endpoint deployment, backup and recovery, A/V protection, secure remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your designated IT staff and your Progent technical consultant so potential problems can be fixed before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, track, optimize and debug their networking appliances like routers and switches, firewalls, and load balancers plus servers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, WAN Watch ensures that infrastructure topology diagrams are kept current, copies and manages the configuration information of virtually all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating tedious management activities, WAN Watch can knock hours off common tasks like network mapping, expanding your network, locating devices that require critical software patches, or identifying the cause of performance issues. Find out more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth reporting utilities created to integrate with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software companies to produce ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup operations and allow non-disruptive backup and rapid recovery of critical files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss resulting from equipment breakdown, natural calamities, fire, malware such as ransomware, user error, ill-intentioned employees, or software glitches. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of leading information security vendors to deliver web-based management and world-class security for your email traffic. The powerful architecture of Email Guard managed service combines a Cloud Protection Layer with a local gateway device to provide complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter serves as a preliminary barricade and blocks most unwanted email from making it to your network firewall. This decreases your vulnerability to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a further level of analysis for incoming email. For outbound email, the local gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The onsite gateway can also assist Exchange Server to monitor and protect internal email traffic that originates and ends within your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected application and give your password you are requested to confirm your identity on a device that only you have and that uses a separate network channel. A broad range of out-of-band devices can be used as this added means of ID validation including a smartphone or watch, a hardware token, a landline phone, etc. You may register several validation devices. For more information about Duo identity authentication services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Call Center services allow your IT staff to offload Call Center services to Progent or divide activity for support services transparently between your internal network support group and Progent's extensive pool of IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless supplement to your internal support organization. User interaction with the Help Desk, provision of technical assistance, problem escalation, trouble ticket creation and updates, performance measurement, and management of the service database are consistent regardless of whether incidents are resolved by your in-house support resources, by Progent, or both. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior machine learning tools to guard endpoints and servers and VMs against new malware assaults such as ransomware and email phishing, which routinely escape legacy signature-based AV tools. Progent ASM services safeguard local and cloud resources and provides a unified platform to automate the entire malware attack lifecycle including filtering, detection, containment, cleanup, and forensics. Top features include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, update, find and safeguard information related to your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or serial numbers and be warned about impending expirations of SSLs or warranties. By updating and managing your network documentation, you can save up to 50% of time spent searching for critical information about your IT network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you're making improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of all sizes a flexible and cost-effective solution for assessing, testing, scheduling, applying, and tracking updates to your dynamic information network. Besides maximizing the protection and reliability of your computer network, Progent's software/firmware update management services permit your IT team to concentrate on more strategic initiatives and tasks that derive the highest business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected Tier III data center on a fast virtual host set up and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Since the system is virtualized, it can be ported easily to an alternate hosting environment without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's cutting edge behavior analysis tools to defend physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which easily escape legacy signature-based AV products. ProSight Active Security Monitoring safeguards local and cloud resources and offers a unified platform to automate the complete malware attack progression including blocking, identification, containment, cleanup, and post-attack forensics. Key features include single-click rollback with Windows VSS and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth security for physical servers and VMs, workstations, smartphones, and Exchange email. ProSight ESP utilizes contextual security and advanced machine learning for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, device control, and web filtering through cutting-edge technologies incorporated within one agent managed from a unified console. Progent's data protection and virtualization consultants can help you to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you achieve and demonstrate compliance with legal and industry information protection regulations. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent's consultants can also help you to set up and verify a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.