Lawrence 24/7 Immediate Ransomware
Infection Assessment and Restoration Support

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an existential threat for businesses unprepared for an assault. Different iterations of ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been running rampant for years and continue to inflict destruction. The latest variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, plus daily unnamed viruses, not only encrypt on-line information but also infiltrate all available system backup. Data synchronized to cloud environments can also be corrupted. In a poorly architected data protection solution, this can render any recovery useless and effectively sets the entire system back to square one.

Getting back on-line programs and information following a crypto-ransomware intrusion becomes a race against time as the victim struggles to contain the damage, eradicate the virus, and restore mission-critical activity. Since ransomware takes time to move laterally, attacks are usually launched during nights and weekends, when attacks in many cases take more time to identify. This multiplies the difficulty of quickly assembling and orchestrating a capable response team.

Progent provides a range of help services for protecting enterprises from crypto-ransomware events. These include team education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of next-generation security appliances with artificial intelligence capabilities from SentinelOne to detect and quarantine zero-day cyber attacks quickly. Progent in addition offers the assistance of seasoned ransomware recovery consultants with the talent and perseverance to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the codes to unencrypt any or all of your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to re-install the mission-critical components of your Information Technology environment. Without the availability of essential information backups, this requires a broad complement of skill sets, well-coordinated project management, and the willingness to work 24x7 until the job is done.

For decades, Progent has made available expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded top certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of expertise affords Progent the ability to quickly ascertain important systems and re-organize the remaining parts of your IT environment following a crypto-ransomware attack and assemble them into an operational network.

Progent's recovery team of experts utilizes best of breed project management applications to orchestrate the complex restoration process. Progent knows the importance of working quickly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to get critical systems back on-line as fast as possible.

Client Story: A Successful Ransomware Virus Response
A customer hired Progent after their company was attacked by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean government sponsored criminal gangs, suspected of using strategies leaked from America's NSA organization. Ryuk goes after specific companies with little or no room for disruption and is one of the most profitable iterations of ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in Chicago and has about 500 employees. The Ryuk event had paralyzed all company operations and manufacturing processes. The majority of the client's data protection had been on-line at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (in excess of two hundred thousand dollars) and hoping for the best, but ultimately called Progent.

Progent worked hand in hand the customer to rapidly identify and assign priority to the critical areas that needed to be addressed in order to resume departmental operations:

• Microsoft Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory to its pre-virus state. Progent then accomplished reinstallations and storage recovery on needed applications. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Email Off-Line Data Files) on staff PCs and laptops to recover email data. A recent off-line backup of the businesses manufacturing systems made it possible to return these essential programs back on-line. Although a large amount of work needed to be completed to recover completely from the Ryuk damage, essential systems were returned to operations quickly:

Throughout the following few weeks key milestones in the recovery project were made in close collaboration between Progent engineers and the customer:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Server exceeding 4 million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoices/AP/AR/Inventory modules were completely restored.
• A new Palo Alto 850 security appliance was brought online.
• Ninety percent of the user PCs were back into operation.

Conclusion
A potential business-killing catastrophe was dodged through the efforts of top-tier professionals, a wide spectrum of technical expertise, and close teamwork. Although in post mortem the ransomware incident described here would have been identified and blocked with current cyber security systems and security best practices, team education, and well thought out security procedures for information backup and proper patching controls, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and information systems restoration.

To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Lawrence a range of remote monitoring and security assessment services to assist you to minimize the threat from crypto-ransomware. These services incorporate next-generation AI technology to detect zero-day variants of ransomware that can evade traditional signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent takes care of the necessary monitoring and management for you, so your system scales smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's full-service IT team can be your complete technology safety net. Basic packages include remote monitoring and management, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to help keep your network operating at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your designated IT management personnel and your Progent engineering consultant so that any looming issues can be addressed before they can impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your client-server infrastructure by providing an environment for streamlining common time-consuming jobs. These can include health checking, update management, automated remediation, endpoint configuration, backup and restore, A/V response, secure remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alarm to your designated IT management staff and your assigned Progent technical consultant so that potential problems can be taken care of before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller organizations to map, monitor, optimize and debug their connectivity appliances like routers and switches, firewalls, and load balancers plus servers, printers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always current, copies and displays the configuration of virtually all devices on your network, tracks performance, and sends alerts when problems are detected. By automating time-consuming management processes, WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that require critical software patches, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time reporting utilities designed to integrate with the industry's leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software providers to create ProSight Data Protection Services (DPS), a family of offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup operations and enable non-disruptive backup and fast restoration of vital files, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss resulting from equipment failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, ill-intentioned insiders, or software bugs. Managed backup services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading data security companies to deliver web-based control and comprehensive protection for your inbound and outbound email. The hybrid structure of Progent's Email Guard combines cloud-based filtering with an on-premises gateway appliance to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The cloud filter serves as a preliminary barricade and blocks most threats from reaching your security perimeter. This decreases your vulnerability to external threats and conserves system bandwidth and storage space. Email Guard's onsite gateway appliance adds a further layer of inspection for incoming email. For outbound email, the onsite security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Exchange Server to track and safeguard internal email traffic that originates and ends inside your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication (2FA). Duo enables one-tap identity verification on iOS, Android, and other out-of-band devices. Using 2FA, when you log into a protected online account and give your password you are asked to verify who you are via a device that only you possess and that is accessed using a separate network channel. A broad selection of out-of-band devices can be used as this second means of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You can designate multiple validation devices. For details about Duo identity validation services, see Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Center: Support Desk Managed Services
  Progent's Help Center services permit your information technology team to outsource Support Desk services to Progent or split responsibilities for Service Desk support transparently between your in-house network support staff and Progent's nationwide pool of IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a smooth extension of your corporate support resources. Client interaction with the Help Desk, delivery of support services, escalation, ticket creation and updates, performance metrics, and management of the service database are consistent regardless of whether issues are taken care of by your corporate IT support organization, by Progent, or by a combination. Read more about Progent's outsourced/shared Help Center services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates cutting edge behavior analysis tools to defend endpoint devices as well as physical and virtual servers against new malware assaults such as ransomware and email phishing, which routinely get by traditional signature-matching AV tools. Progent ASM services safeguard local and cloud resources and offers a single platform to automate the entire malware attack lifecycle including filtering, detection, containment, cleanup, and post-attack forensics. Key capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against new attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and protect information about your network infrastructure, processes, applications, and services. You can instantly find passwords or IP addresses and be warned about impending expirations of SSLs or domains. By updating and organizing your IT documentation, you can save as much as 50% of time thrown away trying to find critical information about your network. ProSight IT Asset Management includes a common repository for holding and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether you're planning improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you need when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and cost-effective alternative for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving information network. In addition to maximizing the protection and functionality of your computer environment, Progent's software/firmware update management services allow your in-house IT team to focus on more strategic projects and tasks that deliver the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system software, and the applications. Since the environment is virtualized, it can be ported immediately to a different hosting solution without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which easily escape legacy signature-matching AV products. ProSight ASM protects on-premises and cloud-based resources and offers a unified platform to manage the complete malware attack progression including blocking, detection, containment, remediation, and post-attack forensics. Key features include one-click rollback with Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable in-depth protection for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge technologies incorporated within a single agent accessible from a unified control. Progent's security and virtualization consultants can assist your business to plan and implement a ProSight ESP deployment that meets your company's specific requirements and that allows you prove compliance with legal and industry information protection standards. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent's consultants can also assist your company to install and verify a backup and restore solution such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.