Sherman Oaks 24x7x365 Immediate Crypto
Computer Malware Damage Assessment and Remediation Consultants

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that represents an extinction-level danger for businesses vulnerable to an assault. Different versions of crypto-ransomware like the Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for many years and still cause havoc. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with additional as yet unnamed viruses, not only do encryption of on-line information but also infiltrate most configured system protection mechanisms. Files synched to cloud environments can also be held hostage. In a poorly architected system, this can render automatic restoration hopeless and effectively knocks the network back to zero.

Recovering programs and data following a ransomware attack becomes a race against time as the victim struggles to stop lateral movement, cleanup the crypto-ransomware, and restore business-critical operations. Since ransomware takes time to replicate, penetrations are often sprung during nights and weekends, when successful penetrations may take longer to discover. This multiplies the difficulty of promptly mobilizing and orchestrating a qualified mitigation team.

Progent has a variety of services for securing organizations from ransomware attacks. These include user education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with machine learning capabilities from SentinelOne to identify and disable zero-day cyber attacks rapidly. Progent also offers the services of seasoned ransomware recovery consultants with the skills and perseverance to re-deploy a breached network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Subsequent to a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will respond with the needed codes to decrypt all your information. Kaspersky estimated that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The other path is to setup from scratch the vital components of your IT environment. Without the availability of complete data backups, this calls for a wide complement of IT skills, well-coordinated project management, and the capability to work continuously until the task is over.

For two decades, Progent has provided certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained top industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of experience gives Progent the ability to quickly ascertain important systems and organize the remaining components of your computer network environment after a crypto-ransomware penetration and assemble them into an operational system.

Progent's recovery team of experts has top notch project management systems to orchestrate the complex recovery process. Progent understands the importance of working quickly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to get essential systems back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Restoration
A client escalated to Progent after their company was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean state cybercriminals, possibly using approaches leaked from America's National Security Agency. Ryuk seeks specific organizations with little or no ability to sustain operational disruption and is one of the most lucrative incarnations of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area and has around 500 staff members. The Ryuk attack had shut down all essential operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the beginning of the intrusion and were encrypted. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and praying for good luck, but in the end utilized Progent.

Progent worked together with the customer to rapidly determine and prioritize the essential services that needed to be restored in order to restart company functions:

• Microsoft Active Directory
• Microsoft Exchange Email
• Financials/MRP

Within 2 days, Progent was able to restore Active Directory services to its pre-attack state. Progent then performed rebuilding and hard drive recovery of the most important applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was also able to find local OST files (Outlook Email Offline Folder Files) on user PCs in order to recover mail data. A recent off-line backup of the customer's accounting/ERP software made them able to recover these required applications back online. Although a large amount of work still had to be done to recover completely from the Ryuk event, the most important systems were returned to operations rapidly:

Throughout the next month key milestones in the restoration process were made through close collaboration between Progent engineers and the customer:

• Internal web sites were restored without losing any data.
• The MailStore Server containing more than four million historical emails was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory capabilities were 100% restored.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user desktops were back into operation.

Conclusion
A potential business extinction disaster was evaded by dedicated professionals, a wide array of IT skills, and close collaboration. Although in post mortem the ransomware virus penetration detailed here should have been shut down with up-to-date security technology and NIST Cybersecurity Framework best practices, team training, and appropriate incident response procedures for data backup and keeping systems up to date with security patches, the reality is that state-sponsored hackers from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware incident, feel confident that Progent's team of experts has proven experience in ransomware virus defense, remediation, and data recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Sherman Oaks a portfolio of online monitoring and security assessment services to assist you to reduce your vulnerability to ransomware. These services incorporate next-generation machine learning technology to detect zero-day variants of ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent handles the daily monitoring and maintenance for you, so your system expands readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) technology to help keep your IT system running at peak levels by checking the state of critical assets that power your business network. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your specified IT personnel and your assigned Progent consultant so that any potential problems can be resolved before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by providing tools for performing common tedious jobs. These can include health checking, patch management, automated remediation, endpoint configuration, backup and recovery, A/V protection, secure remote access, standard and custom scripts, asset inventory, endpoint status reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alarm to your designated IT management staff and your assigned Progent technical consultant so emerging problems can be fixed before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to map out, monitor, reconfigure and troubleshoot their connectivity hardware such as switches, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always updated, copies and displays the configuration of virtually all devices on your network, monitors performance, and generates alerts when problems are detected. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off common chores like network mapping, expanding your network, locating appliances that need important software patches, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth reporting plug-ins created to work with the top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup operations and allow transparent backup and fast recovery of critical files, apps, system images, plus VMs. ProSight DPS helps you avoid data loss caused by hardware failures, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned employees, or software bugs. Managed services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can assist you to identify which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide web-based control and world-class security for your inbound and outbound email. The powerful architecture of Email Guard managed service integrates a Cloud Protection Layer with a local gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter serves as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This decreases your vulnerability to inbound attacks and saves network bandwidth and storage. Email Guard's onsite security gateway device adds a further layer of analysis for inbound email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and protect internal email that originates and ends inside your corporate firewall. For more information, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication. Duo enables one-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a secured application and give your password you are requested to confirm your identity via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used for this added means of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You can register several verification devices. For details about ProSight Duo identity validation services, see Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Help Center services enable your IT staff to offload Help Desk services to Progent or split activity for Help Desk services transparently between your in-house network support team and Progent's extensive pool of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a smooth extension of your corporate support team. Client access to the Service Desk, provision of support, problem escalation, ticket generation and tracking, efficiency metrics, and management of the service database are cohesive regardless of whether incidents are resolved by your in-house IT support group, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Call Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior analysis tools to guard endpoints as well as servers and VMs against new malware attacks such as ransomware and email phishing, which easily escape traditional signature-matching AV products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a unified platform to address the entire malware attack lifecycle including blocking, detection, containment, remediation, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and safeguard information about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSLs or domains. By updating and organizing your IT documentation, you can eliminate up to 50% of time wasted looking for vital information about your network. ProSight IT Asset Management includes a common location for storing and sharing all documents related to managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making improvements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and affordable solution for evaluating, validating, scheduling, implementing, and documenting updates to your dynamic information system. Besides maximizing the protection and reliability of your IT environment, Progent's software/firmware update management services free up time for your IT team to focus on more strategic projects and activities that deliver maximum business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure Tier III data center on a fast virtual host configured and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Since the environment is virtualized, it can be moved immediately to an alternate hosting environment without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which easily get by legacy signature-matching AV tools. ProSight Active Security Monitoring protects on-premises and cloud resources and offers a single platform to manage the entire threat lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth security for physical servers and VMs, desktops, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP offers firewall protection, penetration alarms, device control, and web filtering via leading-edge tools incorporated within one agent managed from a unified console. Progent's security and virtualization experts can help you to design and configure a ProSight ESP environment that meets your company's specific needs and that helps you prove compliance with legal and industry data protection regulations. Progent will assist you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that require immediate action. Progent can also help you to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.