Fremont 24-7 Critical Crypto
Computer Malware Damage Assessment and Restoration Experts

Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level threat for businesses of all sizes poorly prepared for an assault. Different versions of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and still inflict destruction. The latest versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, plus daily as yet unnamed newcomers, not only do encryption of on-line data but also infect any available system protection. Files synched to off-site disaster recovery sites can also be encrypted. In a poorly architected data protection solution, this can make automated restoration hopeless and basically sets the network back to square one.

Getting back online applications and data following a crypto-ransomware outage becomes a sprint against the clock as the victim struggles to stop lateral movement, remove the virus, and restore mission-critical activity. Since crypto-ransomware needs time to replicate, penetrations are frequently sprung on weekends and holidays, when successful penetrations are likely to take longer to recognize. This compounds the difficulty of rapidly assembling and coordinating a qualified response team.

Progent makes available a range of solutions for protecting businesses from ransomware events. These include team training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of modern security solutions with artificial intelligence capabilities from SentinelOne to discover and extinguish new cyber threats automatically. Progent in addition can provide the assistance of veteran ransomware recovery consultants with the skills and commitment to rebuild a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
After a ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the needed keys to decrypt any or all of your information. Kaspersky estimated that seventeen percent of crypto-ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the mission-critical elements of your Information Technology environment. Without access to complete system backups, this requires a wide complement of IT skills, well-coordinated team management, and the ability to work non-stop until the job is completed.

For decades, Progent has provided certified expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned advanced certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the ability to efficiently understand important systems and re-organize the remaining pieces of your network environment following a ransomware event and configure them into a functioning network.

Progent's recovery team of experts has best of breed project management tools to orchestrate the complex restoration process. Progent appreciates the urgency of acting rapidly and in concert with a customer's management and IT staff to prioritize tasks and to put key services back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Incident Recovery
A small business contacted Progent after their network system was attacked by Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored criminal gangs, suspected of using approaches leaked from America's NSA organization. Ryuk targets specific companies with little ability to sustain disruption and is one of the most profitable iterations of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area and has about 500 workers. The Ryuk event had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and hoping for good luck, but in the end reached out to Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the essential services that had to be restored in order to resume departmental operations:

• Windows Active Directory
• Exchange Server
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then charged ahead with reinstallations and storage recovery of the most important systems. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to locate local OST data files (Microsoft Outlook Off-Line Folder Files) on user workstations in order to recover mail data. A not too old offline backup of the businesses accounting software made them able to return these required services back online for users. Although major work was left to recover fully from the Ryuk event, critical systems were recovered quickly:

Throughout the following few weeks important milestones in the recovery process were achieved in close cooperation between Progent team members and the customer:

• In-house web sites were brought back up without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were 100 percent recovered.
• A new Palo Alto 850 firewall was installed.
• Ninety percent of the user desktops were being used by staff.

Conclusion
A likely business-killing catastrophe was evaded with results-oriented experts, a broad range of knowledge, and close teamwork. Although upon completion of forensics the crypto-ransomware virus attack described here should have been identified and blocked with up-to-date cyber security technology solutions and NIST Cybersecurity Framework best practices, team education, and properly executed incident response procedures for data protection and applying software patches, the fact remains that state-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, remember that Progent's team of professionals has proven experience in crypto-ransomware virus defense, cleanup, and file restoration.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Fremont a range of online monitoring and security assessment services designed to assist you to reduce your vulnerability to crypto-ransomware. These services include next-generation machine learning technology to uncover new variants of ransomware that can escape detection by traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the daily monitoring and management for you, so your network scales readily without holding you back. For a low and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Entry-level plans include RMM, cybersecurity, monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management technology to keep your IT system running at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your specified IT staff and your Progent engineering consultant so all looming problems can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based solution for monitoring and managing your network, server, and desktop devices by offering tools for streamlining common time-consuming jobs. These include health checking, update management, automated remediation, endpoint deployment, backup and restore, anti-virus defense, secure remote access, standard and custom scripts, resource inventory, endpoint status reports, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alert to your specified IT staff and your assigned Progent consultant so potential problems can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to map out, track, optimize and debug their networking appliances like routers and switches, firewalls, and wireless controllers plus servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always updated, captures and displays the configuration of almost all devices connected to your network, monitors performance, and generates notices when problems are detected. By automating time-consuming management and troubleshooting activities, WAN Watch can cut hours off common tasks such as network mapping, expanding your network, locating appliances that need important updates, or identifying the cause of performance problems. Learn more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of in-depth management reporting plug-ins designed to integrate with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based offerings that provide backup-as-a-service. ProSight DPS services automate and monitor your backup processes and allow transparent backup and fast recovery of critical files/folders, applications, images, and VMs. ProSight DPS helps you avoid data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, user error, malicious employees, or application bugs. Managed backup services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top data security vendors to deliver web-based management and world-class protection for your email traffic. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The cloud filter serves as a preliminary barricade and blocks most unwanted email from making it to your security perimeter. This reduces your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's on-premises gateway device provides a further layer of analysis for incoming email. For outbound email, the local gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The onsite gateway can also help Exchange Server to track and protect internal email traffic that originates and ends within your security perimeter. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo technology to defend against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity verification on Apple iOS, Android, and other personal devices. With Duo 2FA, when you log into a secured online account and give your password you are asked to verify who you are via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A wide range of devices can be utilized as this second means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may register multiple verification devices. For details about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Help Desk: Call Center Managed Services
  Progent's Help Center services allow your information technology group to outsource Support Desk services to Progent or split activity for support services transparently between your in-house network support group and Progent's nationwide roster of IT support engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent supplement to your in-house support resources. End user interaction with the Help Desk, delivery of technical assistance, escalation, trouble ticket creation and tracking, efficiency measurement, and management of the service database are cohesive regardless of whether incidents are resolved by your in-house support group, by Progent, or both. Read more about Progent's outsourced/co-managed Help Center services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior machine learning technology to defend endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which easily evade traditional signature-matching anti-virus products. Progent ASM services safeguard local and cloud-based resources and offers a single platform to address the complete threat lifecycle including protection, detection, containment, cleanup, and forensics. Top capabilities include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and safeguard information about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be warned about upcoming expirations of SSL certificates or domains. By updating and managing your IT documentation, you can eliminate up to 50% of time wasted looking for critical information about your network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're planning improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable solution for evaluating, validating, scheduling, applying, and documenting updates to your ever-evolving IT network. Besides maximizing the security and reliability of your computer environment, Progent's software/firmware update management services allow your IT staff to concentrate on more strategic projects and tasks that deliver maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host configured and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the client owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved immediately to an alternate hosting solution without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-based AV tools. ProSight ASM safeguards local and cloud resources and provides a single platform to automate the complete threat lifecycle including blocking, identification, mitigation, cleanup, and post-attack forensics. Key features include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver economical multi-layer security for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge technologies packaged within one agent managed from a single control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that addresses your organization's specific requirements and that allows you prove compliance with government and industry data security regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that require immediate action. Progent's consultants can also help you to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.