Long Beach 24x7 Immediate Crypto
Computer Virus Detection and Removal Support

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level danger for businesses of all sizes vulnerable to an attack. Different iterations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for years and still cause damage. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus additional unnamed viruses, not only encrypt on-line critical data but also infiltrate any accessible system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be ransomed. In a vulnerable system, this can make automated recovery hopeless and effectively sets the entire system back to square one.

Getting back services and data following a crypto-ransomware outage becomes a sprint against the clock as the victim struggles to contain, cleanup the crypto-ransomware, and resume business-critical operations. Since crypto-ransomware needs time to replicate, penetrations are usually sprung on weekends, when successful penetrations in many cases take more time to notice. This compounds the difficulty of rapidly marshalling and coordinating an experienced response team.

Progent makes available a range of solutions for securing enterprises from ransomware attacks. Among these are team member training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security solutions with AI technology from SentinelOne to detect and disable day-zero cyber attacks automatically. Progent also offers the assistance of expert ransomware recovery engineers with the skills and perseverance to re-deploy a compromised environment as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will return the keys to decrypt any of your files. Kaspersky estimated that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to re-install the vital parts of your IT environment. Without access to complete data backups, this calls for a wide complement of IT skills, professional project management, and the capability to work non-stop until the task is finished.

For decades, Progent has provided professional IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP application software. This breadth of experience affords Progent the skills to quickly understand important systems and re-organize the remaining parts of your IT system after a ransomware event and rebuild them into a functioning system.

Progent's recovery group has top notch project management systems to coordinate the sophisticated restoration process. Progent understands the urgency of working quickly and together with a client's management and IT team members to prioritize tasks and to get key systems back on-line as soon as possible.

Customer Case Study: A Successful Crypto-Ransomware Incident Restoration
A small business contacted Progent after their network system was taken over by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state hackers, possibly using technology leaked from the United States National Security Agency. Ryuk goes after specific businesses with little ability to sustain operational disruption and is one of the most profitable incarnations of ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area and has about 500 workers. The Ryuk attack had shut down all essential operations and manufacturing processes. Most of the client's backups had been online at the time of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked hand in hand the client to quickly get our arms around and assign priority to the essential elements that needed to be addressed in order to resume company operations:

• Active Directory (AD)
• Electronic Messaging
• Financials/MRP

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then initiated reinstallations and storage recovery of key applications. All Exchange Server ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to collect intact OST files (Outlook Offline Folder Files) on staff desktop computers and laptops to recover mail data. A not too old off-line backup of the businesses financials/ERP software made it possible to recover these required programs back online for users. Although significant work still had to be done to recover totally from the Ryuk attack, the most important systems were returned to operations quickly:

Over the following couple of weeks important milestones in the restoration project were accomplished through close collaboration between Progent team members and the client:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million archived emails was spun up and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory Control capabilities were completely functional.
• A new Palo Alto 850 security appliance was installed.
• Ninety percent of the user workstations were back into operation.

Conclusion
A possible business extinction disaster was dodged with top-tier professionals, a wide array of technical expertise, and tight collaboration. Although in post mortem the crypto-ransomware virus incident described here could have been blocked with advanced security technology and security best practices, user and IT administrator education, and properly executed security procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has a proven track record in ransomware virus blocking, remediation, and data recovery.

To read or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Long Beach a variety of remote monitoring and security evaluation services to help you to minimize your vulnerability to crypto-ransomware. These services include modern AI technology to detect zero-day variants of ransomware that can evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands smoothly without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic plans include RMM, security, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to help keep your network running at peak levels by tracking the health of critical assets that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your designated IT management staff and your assigned Progent engineering consultant so all looming problems can be addressed before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by offering an environment for performing common tedious tasks. These include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your specified IT personnel and your Progent technical consultant so potential issues can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller businesses to map out, monitor, reconfigure and debug their connectivity appliances such as switches, firewalls, and access points plus servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are always current, copies and manages the configuration of almost all devices on your network, monitors performance, and generates notices when issues are detected. By automating complex network management activities, WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating devices that require critical updates, or identifying the cause of performance problems. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of in-depth reporting plug-ins created to work with the leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software providers to create ProSight Data Protection Services (DPS), a family of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup operations and allow transparent backup and fast recovery of important files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss caused by hardware breakdown, natural calamities, fire, malware such as ransomware, human error, ill-intentioned insiders, or application bugs. Managed backup services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top data security vendors to provide centralized control and comprehensive protection for all your inbound and outbound email. The hybrid structure of Progent's Email Guard combines a Cloud Protection Layer with an on-premises gateway device to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your exposure to inbound threats and conserves system bandwidth and storage. Email Guard's on-premises gateway device provides a deeper layer of analysis for incoming email. For outbound email, the on-premises gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to track and safeguard internal email that originates and ends within your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication. Duo enables one-tap identity confirmation with Apple iOS, Android, and other personal devices. With 2FA, when you log into a protected application and enter your password you are asked to confirm who you are via a unit that only you have and that uses a separate network channel. A broad selection of out-of-band devices can be utilized for this second means of authentication including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register several verification devices. To learn more about Duo two-factor identity validation services, visit Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Support Desk managed services enable your IT group to outsource Call Center services to Progent or split activity for support services transparently between your internal support team and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a smooth extension of your core support resources. Client access to the Help Desk, delivery of support services, issue escalation, trouble ticket generation and updates, efficiency metrics, and maintenance of the support database are cohesive regardless of whether issues are resolved by your corporate IT support resources, by Progent, or by a combination. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based analysis tools to defend endpoint devices and physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which easily get by traditional signature-based anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud resources and offers a unified platform to automate the complete malware attack progression including blocking, infiltration detection, mitigation, cleanup, and forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and protect information about your IT infrastructure, processes, business apps, and services. You can instantly find passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or domains. By cleaning up and managing your network documentation, you can save as much as 50% of time spent searching for critical information about your IT network. ProSight IT Asset Management features a common location for holding and collaborating on all documents required for managing your business network such as standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require when you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information system. Besides maximizing the security and functionality of your computer environment, Progent's patch management services free up time for your in-house IT team to concentrate on line-of-business projects and tasks that derive the highest business value from your network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host set up and maintained by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the OS software, and the apps. Since the system is virtualized, it can be ported immediately to an alternate hosting environment without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which easily evade legacy signature-based AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a unified platform to address the entire threat progression including blocking, infiltration detection, mitigation, cleanup, and forensics. Top capabilities include single-click rollback with Windows VSS and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection services offer affordable in-depth security for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint management, and web filtering via cutting-edge technologies incorporated within one agent managed from a single control. Progent's data protection and virtualization consultants can help you to design and implement a ProSight ESP environment that addresses your organization's unique needs and that helps you prove compliance with government and industry data security standards. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require immediate action. Progent's consultants can also help your company to install and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.