Orlando 24-Hour Emergency Crypto
Infection Identification and Removal Experts

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that presents an extinction-level threat for businesses of all sizes vulnerable to an attack. Different versions of ransomware like the Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been circulating for years and continue to cause destruction. Newer strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as daily unnamed viruses, not only do encryption of online files but also infect any configured system protection. Data synchronized to off-site disaster recovery sites can also be corrupted. In a poorly architected system, it can render automated recovery hopeless and effectively sets the entire system back to square one.

Restoring services and information after a ransomware outage becomes a sprint against time as the targeted business tries its best to stop the spread, cleanup the ransomware, and restore business-critical activity. Due to the fact that ransomware takes time to move laterally, attacks are usually sprung during nights and weekends, when penetrations tend to take more time to notice. This multiplies the difficulty of promptly assembling and coordinating a capable response team.

Progent offers a range of solutions for protecting organizations from ransomware attacks. These include user education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security gateways with AI technology from SentinelOne to identify and disable zero-day threats automatically. Progent also can provide the services of expert ransomware recovery engineers with the skills and perseverance to rebuild a compromised system as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the codes to unencrypt any of your information. Kaspersky ascertained that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to piece back together the vital elements of your Information Technology environment. Without the availability of complete information backups, this calls for a broad range of skill sets, professional team management, and the capability to work continuously until the recovery project is over.

For two decades, Progent has offered professional IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned advanced certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of expertise gives Progent the capability to knowledgably ascertain necessary systems and re-organize the remaining pieces of your network system following a ransomware attack and rebuild them into an operational network.

Progent's recovery group utilizes top notch project management applications to coordinate the complex recovery process. Progent knows the importance of acting quickly and in unison with a customer's management and IT resources to prioritize tasks and to get the most important applications back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Virus Recovery
A client contacted Progent after their network system was brought down by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored hackers, possibly adopting technology leaked from the United States National Security Agency. Ryuk seeks specific businesses with limited room for disruption and is among the most profitable versions of ransomware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago with about 500 employees. The Ryuk event had disabled all company operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the time of the attack and were eventually encrypted. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked together with the client to quickly get our arms around and assign priority to the essential systems that had to be restored in order to resume company operations:

• Windows Active Directory
• E-Mail
• Accounting and Manufacturing Software

In less than two days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then completed rebuilding and storage recovery on essential servers. All Microsoft Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect local OST data files (Outlook Off-Line Data Files) on staff PCs and laptops to recover email messages. A recent off-line backup of the businesses manufacturing software made them able to restore these required programs back available to users. Although a large amount of work still had to be done to recover fully from the Ryuk damage, critical services were restored quickly:

Over the following month key milestones in the restoration process were achieved in close collaboration between Progent team members and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Exchange Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory functions were fully operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was evaded through the efforts of dedicated professionals, a wide array of knowledge, and tight teamwork. Although in hindsight the crypto-ransomware attack detailed here should have been shut down with advanced cyber security solutions and best practices, user and IT administrator training, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, removal, and data recovery.

To read or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Orlando a portfolio of online monitoring and security evaluation services designed to assist you to reduce your vulnerability to ransomware. These services incorporate next-generation AI capability to detect zero-day strains of ransomware that are able to escape detection by traditional signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the daily monitoring and maintenance for you, so your network scales easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Basic packages include remote monitoring and management, security, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to help keep your IT system running efficiently by checking the health of vital assets that power your business network. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT management staff and your assigned Progent consultant so that all potential problems can be resolved before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious tasks. These can include health checking, patch management, automated repairs, endpoint setup, backup and restore, anti-virus response, remote access, built-in and custom scripts, asset inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your designated IT staff and your Progent consultant so that potential issues can be taken care of before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized organizations to map, track, optimize and troubleshoot their networking hardware such as switches, firewalls, and load balancers as well as servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are kept updated, copies and manages the configuration of almost all devices on your network, tracks performance, and generates notices when potential issues are detected. By automating complex management processes, WAN Watch can knock hours off common tasks such as making network diagrams, expanding your network, locating devices that require important updates, or resolving performance issues. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth management reporting utilities designed to work with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup software providers to produce ProSight Data Protection Services, a family of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup processes and enable non-disruptive backup and fast restoration of vital files, applications, system images, and VMs. ProSight DPS lets your business avoid data loss caused by equipment breakdown, natural calamities, fire, malware such as ransomware, human error, ill-intentioned employees, or application bugs. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of leading information security companies to provide centralized management and comprehensive security for your inbound and outbound email. The powerful structure of Progent's Email Guard combines a Cloud Protection Layer with a local gateway appliance to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based malware. The Cloud Protection Layer serves as a first line of defense and blocks the vast majority of threats from reaching your network firewall. This reduces your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's on-premises security gateway device adds a deeper layer of inspection for incoming email. For outbound email, the onsite gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays within your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With 2FA, when you sign into a secured online account and enter your password you are requested to confirm your identity on a unit that only you have and that uses a separate network channel. A broad selection of devices can be utilized as this added means of ID validation including an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may designate several validation devices. For more information about ProSight Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Call Desk services allow your IT staff to outsource Help Desk services to Progent or split activity for support services transparently between your internal support team and Progent's nationwide roster of IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent supplement to your corporate network support staff. Client access to the Service Desk, provision of support services, escalation, trouble ticket generation and updates, performance measurement, and maintenance of the service database are consistent regardless of whether incidents are resolved by your corporate support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates cutting edge behavior analysis tools to defend endpoints as well as servers and VMs against new malware assaults such as ransomware and file-less exploits, which routinely get by traditional signature-based anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud resources and offers a unified platform to automate the complete threat lifecycle including blocking, identification, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows VSS and real-time system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and safeguard information about your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or domains. By cleaning up and organizing your IT infrastructure documentation, you can save as much as half of time spent searching for critical information about your network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents related to managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're making enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you require as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a flexible and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting updates to your dynamic information system. Besides maximizing the security and functionality of your IT network, Progent's patch management services free up time for your IT staff to focus on more strategic projects and tasks that derive the highest business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host set up and managed by Progent's network support professionals. Under the ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved easily to a different hosting solution without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based machine learning tools to defend physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which easily escape legacy signature-matching AV tools. ProSight ASM safeguards on-premises and cloud resources and provides a single platform to address the complete threat progression including protection, identification, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver ultra-affordable in-depth security for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint control, and web filtering through cutting-edge tools packaged within a single agent accessible from a unified console. Progent's data protection and virtualization experts can assist your business to design and configure a ProSight ESP deployment that addresses your organization's specific needs and that helps you prove compliance with legal and industry information protection regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require immediate action. Progent's consultants can also assist you to install and test a backup and restore system such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.