24/7 Brisbane Critical Crypto
Virus Assessment and Remediation Experts

Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyber pandemic that represents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different versions of ransomware like the Dharma, WannaCry, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and still cause havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, plus frequent unnamed viruses, not only do encryption of online information but also infiltrate all configured system backups. Data synched to cloud environments can also be ransomed. In a poorly designed environment, this can render automated restore operations hopeless and basically sets the network back to square one.

Retrieving applications and information following a ransomware intrusion becomes a race against time as the targeted business fights to stop lateral movement, cleanup the ransomware, and restore mission-critical activity. Because crypto-ransomware requires time to replicate, penetrations are frequently sprung on weekends, when attacks in many cases take longer to notice. This multiplies the difficulty of quickly mobilizing and coordinating a qualified mitigation team.

Progent provides a range of help services for securing organizations from crypto-ransomware events. These include user training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of next-generation security appliances with artificial intelligence technology from SentinelOne to discover and suppress new cyber threats rapidly. Progent also offers the assistance of veteran ransomware recovery engineers with the talent and commitment to reconstruct a compromised system as urgently as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed keys to unencrypt all your data. Kaspersky ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to setup from scratch the mission-critical parts of your IT environment. Without access to complete system backups, this calls for a broad range of IT skills, professional team management, and the ability to work non-stop until the task is over.

For decades, Progent has provided professional IT services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained advanced certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of expertise provides Progent the ability to knowledgably determine important systems and re-organize the remaining pieces of your network system following a ransomware attack and assemble them into a functioning system.

Progent's security team of experts has top notch project management systems to orchestrate the complicated restoration process. Progent knows the urgency of working rapidly and together with a client's management and IT team members to prioritize tasks and to get key applications back online as soon as possible.

Client Story: A Successful Crypto-Ransomware Attack Response
A business engaged Progent after their company was attacked by the Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean government sponsored cybercriminals, possibly using techniques exposed from America's NSA organization. Ryuk targets specific organizations with little or no room for disruption and is one of the most lucrative instances of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area and has around 500 employees. The Ryuk intrusion had frozen all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the beginning of the intrusion and were destroyed. The client considered paying the ransom demand (exceeding $200,000) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked together with the client to rapidly determine and prioritize the essential elements that needed to be recovered in order to restart departmental operations:

• Microsoft Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to restore Active Directory to its pre-attack state. Progent then assisted with rebuilding and hard drive recovery on critical servers. All Exchange data and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to collect intact OST files (Microsoft Outlook Offline Data Files) on various desktop computers to recover mail data. A not too old offline backup of the businesses financials/MRP systems made it possible to return these vital applications back online. Although major work was left to recover totally from the Ryuk attack, critical services were recovered rapidly:

Throughout the next few weeks key milestones in the restoration project were made through close collaboration between Progent engineers and the client:

• In-house web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory modules were 100 percent operational.
• A new Palo Alto 850 security appliance was brought online.
• 90% of the user workstations were being used by staff.

Conclusion
A probable business extinction catastrophe was averted through the efforts of top-tier experts, a broad spectrum of subject matter expertise, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware attack detailed here could have been identified and prevented with advanced security technology solutions and security best practices, team training, and well thought out security procedures for information backup and proper patching controls, the fact remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, cleanup, and information systems recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Brisbane a variety of online monitoring and security assessment services to assist you to minimize the threat from ransomware. These services incorporate next-generation machine learning capability to uncover new strains of crypto-ransomware that can get past legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network expands easily without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management, security, automatic monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management technology to help keep your network operating at peak levels by checking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your specified IT personnel and your assigned Progent consultant so that any looming issues can be addressed before they can impact your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering tools for streamlining common tedious tasks. These can include health checking, update management, automated repairs, endpoint setup, backup and recovery, A/V response, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your specified IT personnel and your assigned Progent technical consultant so that emerging problems can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, monitor, enhance and troubleshoot their connectivity hardware like switches, firewalls, and load balancers plus servers, client computers and other devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and displays the configuration information of almost all devices on your network, monitors performance, and generates alerts when potential issues are discovered. By automating time-consuming management activities, ProSight WAN Watch can knock hours off common tasks such as network mapping, reconfiguring your network, finding appliances that need critical software patches, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting utilities designed to work with the industry's leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as spotty support follow-through or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore technology providers to create ProSight Data Protection Services, a portfolio of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS products automate and track your backup processes and enable non-disruptive backup and rapid restoration of vital files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss caused by hardware breakdown, natural calamities, fire, malware like ransomware, user mistakes, ill-intentioned insiders, or software glitches. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top data security companies to provide web-based management and world-class security for your inbound and outbound email. The hybrid structure of Progent's Email Guard combines cloud-based filtering with an on-premises gateway device to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This reduces your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further layer of analysis for incoming email. For outbound email, the on-premises gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends inside your security perimeter. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo technology to protect against password theft by using two-factor authentication (2FA). Duo enables single-tap identity verification on iOS, Google Android, and other personal devices. Using Duo 2FA, when you sign into a protected online account and give your password you are requested to verify your identity via a device that only you possess and that is accessed using a different network channel. A wide range of out-of-band devices can be used for this second means of authentication such as a smartphone or watch, a hardware/software token, a landline telephone, etc. You can register several verification devices. To find out more about ProSight Duo two-factor identity validation services, visit Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Center: Call Center Managed Services
  Progent's Help Desk managed services allow your information technology team to offload Help Desk services to Progent or divide responsibilities for support services seamlessly between your in-house support resources and Progent's extensive pool of IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a smooth extension of your internal network support staff. Client access to the Service Desk, delivery of support services, escalation, ticket creation and tracking, efficiency measurement, and management of the service database are cohesive regardless of whether incidents are taken care of by your core IT support organization, by Progent, or both. Read more about Progent's outsourced/co-managed Help Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior machine learning technology to guard endpoints and physical and virtual servers against new malware attacks like ransomware and email phishing, which easily evade traditional signature-based anti-virus products. Progent ASM services safeguard on-premises and cloud-based resources and provides a single platform to automate the complete malware attack progression including protection, detection, containment, remediation, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, retrieve and protect data about your network infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or warranties. By updating and organizing your network documentation, you can save up to 50% of time spent looking for critical information about your IT network. ProSight IT Asset Management features a centralized location for holding and sharing all documents required for managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're making improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management provide businesses of all sizes a versatile and affordable solution for assessing, validating, scheduling, applying, and tracking software and firmware updates to your dynamic information network. In addition to maximizing the security and functionality of your IT network, Progent's patch management services free up time for your in-house IT team to concentrate on more strategic projects and tasks that deliver maximum business value from your information network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host configured and managed by Progent's network support experts. With the ProSight Virtual Hosting model, the customer owns the data, the OS software, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware solution without requiring a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which easily get by legacy signature-matching AV products. ProSight ASM protects on-premises and cloud resources and offers a single platform to address the complete threat lifecycle including protection, identification, containment, cleanup, and forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer security for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, device control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a unified console. Progent's data protection and virtualization experts can help you to design and configure a ProSight ESP deployment that addresses your organization's unique needs and that helps you prove compliance with government and industry data protection standards. Progent will assist you define and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require immediate action. Progent can also assist your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.