24x7x365 Grand Rapids Emergency Crypto
Infection Identification and Repair Support

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level threat for businesses of all sizes unprepared for an assault. Different versions of ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and still inflict destruction. Recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus daily as yet unnamed malware, not only encrypt online files but also infect any configured system restores and backups. Data replicated to off-site disaster recovery sites can also be held hostage. In a poorly architected environment, this can render automated restoration impossible and effectively knocks the entire system back to square one.

Getting back on-line applications and information following a ransomware outage becomes a sprint against time as the victim struggles to stop the spread, remove the virus, and resume enterprise-critical activity. Because ransomware takes time to spread, attacks are frequently sprung during nights and weekends, when successful attacks may take longer to discover. This multiplies the difficulty of rapidly assembling and coordinating a qualified response team.

Progent offers a variety of support services for securing businesses from crypto-ransomware events. Among these are staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of next-generation security gateways with machine learning technology from SentinelOne to discover and quarantine zero-day cyber threats intelligently. Progent also can provide the services of expert ransomware recovery engineers with the talent and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware attack, paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the needed codes to decipher any of your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the essential elements of your IT environment. Without the availability of essential system backups, this calls for a broad range of skills, well-coordinated project management, and the willingness to work continuously until the task is complete.

For decades, Progent has offered certified expert Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP applications. This breadth of expertise gives Progent the skills to quickly determine necessary systems and organize the remaining parts of your IT environment following a crypto-ransomware event and configure them into a functioning network.

Progent's recovery team of experts has state-of-the-art project management tools to orchestrate the complex restoration process. Progent appreciates the urgency of acting swiftly and together with a customer's management and IT resources to assign priority to tasks and to get key applications back online as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Restoration
A client escalated to Progent after their company was taken over by the Ryuk ransomware virus. Ryuk is believed to have been created by Northern Korean state sponsored cybercriminals, suspected of adopting approaches leaked from the U.S. National Security Agency. Ryuk targets specific companies with limited tolerance for operational disruption and is one of the most lucrative incarnations of ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer located in Chicago with around 500 workers. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's information backups had been on-line at the time of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the mission critical services that needed to be restored in order to resume company functions:

• Windows Active Directory
• Electronic Mail
• Accounting/MRP

In less than two days, Progent was able to recover Active Directory to its pre-attack state. Progent then helped perform reinstallations and storage recovery on essential applications. All Microsoft Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to locate intact OST files (Microsoft Outlook Offline Data Files) on team desktop computers in order to recover mail messages. A not too old off-line backup of the client's financials/MRP systems made them able to restore these essential applications back servicing users. Although a lot of work still had to be done to recover completely from the Ryuk damage, essential systems were recovered quickly:

During the following few weeks critical milestones in the restoration project were completed through close collaboration between Progent team members and the customer:

• Self-hosted web applications were restored with no loss of information.
• The MailStore Server with over 4 million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were 100% functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• 90% of the desktops and laptops were operational.

Conclusion
A possible business-killing catastrophe was avoided through the efforts of top-tier professionals, a broad array of knowledge, and tight collaboration. Although in hindsight the ransomware virus incident detailed here should have been disabled with up-to-date security systems and best practices, user education, and properly executed security procedures for backup and proper patching controls, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and will continue. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has extensive experience in ransomware virus blocking, cleanup, and file restoration.

To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Grand Rapids a variety of remote monitoring and security evaluation services designed to help you to reduce your vulnerability to ransomware. These services utilize next-generation AI capability to uncover new strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your network expands readily without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Basic packages include remote monitoring and management, security, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) technology to keep your IT system operating efficiently by checking the state of vital computers that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your specified IT staff and your Progent engineering consultant so that all potential issues can be addressed before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for managing your network, server, and desktop devices by offering tools for streamlining common tedious tasks. These include health checking, update management, automated repairs, endpoint deployment, backup and recovery, anti-virus protection, secure remote access, standard and custom scripts, resource inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alarm to your designated IT management staff and your assigned Progent technical consultant so potential problems can be fixed before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map, track, enhance and debug their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other devices. Using cutting-edge RMM technology, ProSight WAN Watch ensures that network diagrams are always current, captures and displays the configuration of virtually all devices connected to your network, tracks performance, and generates alerts when issues are discovered. By automating complex management and troubleshooting activities, WAN Watch can knock hours off common chores like making network diagrams, reconfiguring your network, locating appliances that require critical updates, or identifying the cause of performance problems. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time management reporting tools created to work with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with leading backup/restore technology providers to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and monitor your backup processes and enable non-disruptive backup and rapid recovery of critical files, apps, system images, and VMs. ProSight DPS lets your business avoid data loss resulting from hardware failures, natural calamities, fire, cyber attacks like ransomware, user error, ill-intentioned insiders, or software glitches. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading information security vendors to provide centralized management and comprehensive security for all your inbound and outbound email. The powerful architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to inbound attacks and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance provides a deeper layer of analysis for inbound email. For outbound email, the onsite gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays within your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication. Duo enables single-tap identity verification with iOS, Android, and other out-of-band devices. With 2FA, when you sign into a secured online account and give your password you are requested to confirm your identity via a device that only you have and that is accessed using a different network channel. A broad range of out-of-band devices can be used as this second means of ID validation such as a smartphone or wearable, a hardware token, a landline phone, etc. You may register several verification devices. For details about Duo identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Center: Call Center Managed Services
  Progent's Support Center services enable your IT staff to outsource Help Desk services to Progent or split responsibilities for Service Desk support transparently between your internal network support resources and Progent's nationwide roster of IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a seamless extension of your core IT support resources. User access to the Service Desk, delivery of support services, escalation, trouble ticket generation and updates, efficiency measurement, and maintenance of the support database are consistent regardless of whether issues are taken care of by your corporate network support group, by Progent, or both. Learn more about Progent's outsourced/co-managed Service Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior analysis tools to guard endpoint devices and servers and VMs against modern malware attacks such as ransomware and email phishing, which easily escape legacy signature-based AV products. Progent ASM services protect on-premises and cloud-based resources and offers a unified platform to address the complete threat progression including blocking, detection, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, find and protect information about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be warned automatically about impending expirations of SSLs or warranties. By cleaning up and organizing your network documentation, you can eliminate up to 50% of time spent searching for critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT data. Whether you're planning enhancements, performing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you require as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of any size a versatile and cost-effective solution for evaluating, validating, scheduling, implementing, and tracking updates to your dynamic information system. In addition to maximizing the security and reliability of your IT network, Progent's software/firmware update management services permit your in-house IT team to focus on more strategic initiatives and activities that derive the highest business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS platforms, and the apps. Because the system is virtualized, it can be moved easily to a different hosting environment without requiring a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which routinely escape legacy signature-matching anti-virus tools. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to automate the complete malware attack lifecycle including blocking, detection, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver affordable multi-layer protection for physical servers and virtual machines, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced machine learning for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, device control, and web filtering through cutting-edge tools packaged within a single agent managed from a single console. Progent's data protection and virtualization consultants can help you to design and configure a ProSight ESP environment that meets your organization's unique requirements and that allows you achieve and demonstrate compliance with legal and industry information protection standards. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent attention. Progent can also assist your company to set up and test a backup and restore solution such as ProSight Data Protection Services so you can get back in business quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange filtering.