Kansas City 24x7x365 Emergency Crypto-Ransomware
Infection Damage Assessment and Removal Support

Ransomware : Your Feared IT Catastrophe
Ransomware has become an escalating cyber pandemic that represents an extinction-level threat for organizations vulnerable to an assault. Versions of ransomware like the Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and continue to inflict damage. The latest versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as daily as yet unnamed newcomers, not only do encryption of on-line critical data but also infiltrate most available system protection. Files synched to the cloud can also be held hostage. In a poorly architected system, it can make automated restore operations hopeless and basically sets the datacenter back to zero.

Getting back online applications and data following a ransomware event becomes a sprint against the clock as the targeted business tries its best to stop the spread, cleanup the ransomware, and restore mission-critical operations. Since ransomware requires time to move laterally, penetrations are frequently sprung during weekends and nights, when successful penetrations tend to take more time to identify. This compounds the difficulty of promptly mobilizing and coordinating an experienced response team.

Progent provides an assortment of solutions for protecting enterprises from crypto-ransomware penetrations. Among these are user education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of next-generation security appliances with machine learning capabilities from SentinelOne to identify and quarantine day-zero threats intelligently. Progent also provides the services of seasoned ransomware recovery consultants with the talent and perseverance to rebuild a breached system as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
Soon after a crypto-ransomware invasion, sending the ransom in cryptocurrency does not guarantee that cyber criminals will provide the keys to decipher any of your files. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to re-install the essential components of your IT environment. Absent the availability of full data backups, this requires a broad range of IT skills, well-coordinated team management, and the capability to work 24x7 until the recovery project is over.

For two decades, Progent has offered professional IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise affords Progent the skills to knowledgably determine important systems and organize the surviving components of your network environment after a ransomware attack and rebuild them into an operational network.

Progent's security group deploys powerful project management tools to coordinate the complex recovery process. Progent understands the urgency of working rapidly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get essential systems back on line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Response
A small business hired Progent after their network was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean government sponsored criminal gangs, suspected of adopting algorithms leaked from the United States National Security Agency. Ryuk attacks specific organizations with limited room for operational disruption and is one of the most profitable iterations of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and praying for the best, but ultimately engaged Progent.

Progent worked with the client to quickly assess and prioritize the critical services that needed to be addressed to make it possible to continue company functions:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than 2 days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery on key applications. All Microsoft Exchange Server schema and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to find local OST data files (Outlook Email Offline Data Files) on various workstations and laptops to recover mail data. A not too old offline backup of the businesses accounting/MRP software made them able to return these essential services back servicing users. Although significant work needed to be completed to recover completely from the Ryuk damage, the most important services were restored quickly:

Over the next couple of weeks critical milestones in the recovery project were accomplished in tight cooperation between Progent team members and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Exchange Server with over four million historical emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/AP/AR/Inventory modules were completely restored.
• A new Palo Alto 850 firewall was set up.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A probable business extinction disaster was dodged by results-oriented experts, a wide array of technical expertise, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware attack described here could have been identified and prevented with modern cyber security technology and best practices, user and IT administrator training, and properly executed security procedures for information backup and keeping systems up to date with security patches, the fact is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, cleanup, and data restoration.

To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Kansas City a variety of remote monitoring and security evaluation services designed to help you to minimize your vulnerability to ransomware. These services include modern AI technology to uncover new strains of ransomware that are able to evade legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to create advanced network resilience. Progent handles the daily monitoring and maintenance for you, so your system expands smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Basic packages include RMM, cybersecurity, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management technology to keep your IT system operating at peak levels by checking the health of vital assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your designated IT management personnel and your Progent consultant so any potential issues can be resolved before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your network, server, and desktop devices by providing an environment for streamlining common tedious jobs. These can include health checking, patch management, automated repairs, endpoint setup, backup and recovery, A/V response, remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your designated IT staff and your Progent consultant so potential problems can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller businesses to map out, track, optimize and debug their networking appliances such as routers, firewalls, and load balancers plus servers, endpoints and other devices. Using cutting-edge RMM technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, captures and manages the configuration of almost all devices on your network, monitors performance, and sends alerts when potential issues are detected. By automating tedious management and troubleshooting activities, WAN Watch can cut hours off common tasks like making network diagrams, expanding your network, locating appliances that need important software patches, or isolating performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth management reporting tools designed to work with the top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup/restore technology providers to create ProSight Data Protection Services, a family of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup processes and enable non-disruptive backup and rapid recovery of critical files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss caused by hardware failures, natural calamities, fire, malware such as ransomware, user mistakes, malicious insiders, or software bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of top information security companies to deliver web-based control and comprehensive security for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard combines cloud-based filtering with an on-premises gateway appliance to offer complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from making it to your network firewall. This reduces your exposure to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a deeper level of analysis for inbound email. For outbound email, the local security gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and safeguard internal email that originates and ends within your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to protect against password theft by using two-factor authentication (2FA). Duo supports one-tap identity verification on Apple iOS, Google Android, and other personal devices. With 2FA, when you log into a protected application and give your password you are requested to verify who you are on a device that only you have and that uses a different network channel. A broad range of out-of-band devices can be used for this second form of authentication such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can register several verification devices. To find out more about Duo identity validation services, see Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Call Center services allow your information technology group to outsource Support Desk services to Progent or split responsibilities for Help Desk services transparently between your internal network support group and Progent's nationwide pool of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent extension of your core network support team. Client access to the Help Desk, provision of technical assistance, problem escalation, ticket generation and updates, efficiency measurement, and management of the support database are cohesive regardless of whether incidents are taken care of by your internal network support staff, by Progent, or both. Find out more about Progent's outsourced/co-managed Service Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior machine learning tools to guard endpoint devices as well as physical and virtual servers against modern malware assaults like ransomware and email phishing, which easily evade traditional signature-matching anti-virus products. Progent ASM services protect local and cloud resources and provides a single platform to automate the entire threat lifecycle including protection, detection, mitigation, remediation, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and safeguard information related to your network infrastructure, processes, applications, and services. You can instantly find passwords or IP addresses and be warned about upcoming expirations of SSLs or domains. By cleaning up and organizing your network documentation, you can eliminate up to half of time thrown away looking for critical information about your network. ProSight IT Asset Management features a common repository for storing and sharing all documents related to managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're making enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you require as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and cost-effective alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving information network. In addition to maximizing the protection and functionality of your IT environment, Progent's patch management services permit your in-house IT team to focus on line-of-business initiatives and tasks that deliver the highest business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support experts. With Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS platforms, and the applications. Because the system is virtualized, it can be moved immediately to a different hardware environment without requiring a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior analysis tools to defend physical and virtual endpoints against new malware assaults such as ransomware and email phishing, which easily evade traditional signature-based anti-virus tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to address the complete malware attack progression including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Top features include one-click rollback with Windows VSS and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver affordable multi-layer security for physical servers and VMs, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to cyber threats from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge tools packaged within one agent managed from a unified control. Progent's security and virtualization experts can assist your business to design and configure a ProSight ESP deployment that addresses your organization's unique requirements and that allows you demonstrate compliance with legal and industry data security standards. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that require immediate action. Progent's consultants can also help your company to install and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.