Fort Worth 24/7 Urgent Crypto-Ransomware
Malware Assessment and Removal Experts

Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that represents an enterprise-level threat for businesses unprepared for an assault. Versions of ransomware like the Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to cause havoc. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, along with more unnamed malware, not only do encryption of on-line data but also infect most available system protection. Data synchronized to cloud environments can also be encrypted. In a vulnerable data protection solution, this can render automatic restoration impossible and basically knocks the network back to zero.

Recovering applications and data following a ransomware event becomes a race against the clock as the targeted business fights to stop the spread, clear the virus, and resume business-critical operations. Because ransomware requires time to replicate, assaults are often launched on weekends, when penetrations typically take more time to notice. This compounds the difficulty of promptly mobilizing and coordinating a knowledgeable mitigation team.

Progent provides an assortment of support services for protecting enterprises from crypto-ransomware penetrations. Among these are team education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security solutions with machine learning capabilities from SentinelOne to discover and extinguish zero-day cyber threats intelligently. Progent also offers the services of experienced ransomware recovery engineers with the talent and perseverance to restore a breached network as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber hackers will provide the codes to unencrypt any of your information. Kaspersky estimated that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to setup from scratch the vital elements of your IT environment. Absent the availability of complete information backups, this requires a broad complement of skill sets, well-coordinated team management, and the capability to work non-stop until the job is complete.

For twenty years, Progent has made available certified expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of expertise provides Progent the skills to knowledgably determine critical systems and re-organize the remaining components of your IT environment after a ransomware event and configure them into an operational network.

Progent's security group utilizes top notch project management systems to coordinate the sophisticated restoration process. Progent appreciates the importance of working quickly and together with a customer's management and IT team members to prioritize tasks and to put critical systems back on line as soon as humanly possible.

Customer Story: A Successful Ransomware Attack Response
A business sought out Progent after their network was attacked by Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state sponsored cybercriminals, suspected of using techniques leaked from the U.S. NSA organization. Ryuk goes after specific businesses with little or no tolerance for disruption and is one of the most profitable examples of ransomware malware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area with around 500 staff members. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's data backups had been online at the start of the intrusion and were damaged. The client considered paying the ransom (exceeding $200K) and wishfully thinking for good luck, but in the end called Progent.

Progent worked hand in hand the client to rapidly get our arms around and prioritize the most important services that had to be recovered in order to continue departmental operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

In less than 48 hours, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then charged ahead with rebuilding and hard drive recovery on key applications. All Exchange ties and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Offline Folder Files) on staff desktop computers to recover email messages. A recent offline backup of the customer's accounting software made them able to restore these essential programs back servicing users. Although major work still had to be done to recover fully from the Ryuk attack, the most important services were returned to operations quickly:

During the following month key milestones in the recovery project were made through close cooperation between Progent engineers and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was brought online and available for users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control capabilities were 100% functional.
• A new Palo Alto 850 security appliance was brought on-line.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A possible company-ending catastrophe was avoided by results-oriented professionals, a wide array of IT skills, and tight collaboration. Although in retrospect the ransomware attack detailed here would have been shut down with up-to-date cyber security systems and best practices, staff training, and well thought out security procedures for information backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, mitigation, and information systems recovery.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Fort Worth a portfolio of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to crypto-ransomware. These services incorporate modern AI technology to uncover new variants of ransomware that can get past legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent takes care of the necessary monitoring and management for you, so your system expands readily without holding you back. For a low and predictable monthly price, Progent's full-service IT team can be your complete technology safety net. Basic plans include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to help keep your network running efficiently by tracking the state of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alert is sent automatically to your specified IT management personnel and your assigned Progent consultant so that any looming issues can be resolved before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing tools for streamlining common tedious tasks. These include health monitoring, update management, automated remediation, endpoint deployment, backup and recovery, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your specified IT management staff and your Progent technical consultant so that potential problems can be taken care of before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map out, track, optimize and debug their connectivity appliances like routers, firewalls, and access points plus servers, client computers and other devices. Using state-of-the-art RMM technology, WAN Watch ensures that network maps are kept updated, captures and manages the configuration of almost all devices on your network, tracks performance, and sends alerts when problems are detected. By automating tedious network management processes, ProSight WAN Watch can knock hours off common tasks like network mapping, reconfiguring your network, locating appliances that require critical updates, or isolating performance problems. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth management reporting plug-ins created to work with the industry's top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues such as inconsistent support follow-through or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services (DPS), a portfolio of offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup processes and enable non-disruptive backup and rapid recovery of critical files, apps, images, and virtual machines. ProSight DPS lets your business recover from data loss caused by hardware failures, natural calamities, fire, malware like ransomware, human mistakes, malicious employees, or software bugs. Managed backup services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of leading data security vendors to provide centralized management and comprehensive security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway appliance to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a first line of defense and keeps the vast majority of threats from making it to your security perimeter. This decreases your vulnerability to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises gateway device provides a further layer of analysis for inbound email. For outbound email, the onsite gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Exchange Server to track and protect internal email traffic that originates and ends inside your corporate firewall. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo supports single-tap identity verification on Apple iOS, Android, and other personal devices. Using Duo 2FA, when you sign into a secured application and give your password you are asked to verify your identity via a unit that only you have and that uses a separate network channel. A wide range of out-of-band devices can be used for this added form of authentication such as a smartphone or wearable, a hardware/software token, a landline phone, etc. You may designate several verification devices. For more information about ProSight Duo identity validation services, go to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Call Desk services enable your IT team to offload Support Desk services to Progent or divide activity for Help Desk services transparently between your internal support group and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk provides a smooth extension of your corporate network support group. Client interaction with the Service Desk, delivery of support services, problem escalation, trouble ticket creation and tracking, performance metrics, and management of the support database are consistent regardless of whether issues are taken care of by your internal network support group, by Progent, or by a combination. Learn more about Progent's outsourced/shared Service Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based analysis technology to guard endpoint devices and servers and VMs against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-matching AV products. Progent ASM services protect on-premises and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including protection, identification, mitigation, cleanup, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and safeguard information related to your network infrastructure, procedures, applications, and services. You can quickly find passwords or IP addresses and be alerted about impending expirations of SSLs ,domains or warranties. By cleaning up and organizing your network documentation, you can eliminate as much as half of time wasted looking for vital information about your IT network. ProSight IT Asset Management includes a common location for holding and sharing all documents required for managing your business network such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're planning improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the data you need when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of all sizes a flexible and affordable alternative for assessing, validating, scheduling, implementing, and documenting updates to your ever-evolving IT system. In addition to maximizing the security and functionality of your IT environment, Progent's software/firmware update management services allow your in-house IT staff to focus on line-of-business initiatives and activities that derive the highest business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual host set up and maintained by Progent's IT support experts. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the apps. Since the system is virtualized, it can be moved easily to a different hosting environment without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which routinely get by traditional signature-matching anti-virus tools. ProSight ASM protects local and cloud resources and offers a single platform to address the complete malware attack progression including protection, detection, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver economical in-depth protection for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge tools incorporated within a single agent managed from a single control. Progent's security and virtualization experts can help your business to design and configure a ProSight ESP deployment that addresses your company's specific needs and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require immediate attention. Progent's consultants can also help your company to install and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange filtering.