Jacksonville 24/7 Urgent Crypto
Malware Assessment and Restoration Experts

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become an escalating cyberplague that presents an enterprise-level threat for businesses of all sizes poorly prepared for an attack. Different iterations of crypto-ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and still inflict destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, plus daily as yet unnamed newcomers, not only encrypt on-line critical data but also infect most configured system backup. Files synchronized to the cloud can also be corrupted. In a poorly designed system, this can make automatic restore operations hopeless and basically knocks the datacenter back to zero.

Getting back on-line applications and information after a crypto-ransomware outage becomes a race against time as the targeted business tries its best to stop lateral movement, cleanup the ransomware, and resume business-critical operations. Because ransomware takes time to spread, penetrations are frequently sprung on weekends, when successful attacks typically take longer to discover. This compounds the difficulty of quickly marshalling and coordinating a knowledgeable mitigation team.

Progent offers a variety of services for protecting organizations from crypto-ransomware events. These include user education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of next-generation security gateways with artificial intelligence capabilities from SentinelOne to detect and disable day-zero threats rapidly. Progent also offers the assistance of expert crypto-ransomware recovery engineers with the talent and perseverance to rebuild a breached environment as soon as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware event, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the needed keys to decipher any or all of your files. Kaspersky estimated that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to re-install the mission-critical parts of your Information Technology environment. Absent the availability of full system backups, this calls for a broad range of IT skills, well-coordinated project management, and the ability to work non-stop until the recovery project is finished.

For decades, Progent has provided professional IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP application software. This breadth of expertise provides Progent the ability to efficiently understand critical systems and integrate the remaining components of your computer network system after a crypto-ransomware penetration and configure them into an operational system.

Progent's ransomware group uses best of breed project management applications to coordinate the sophisticated restoration process. Progent understands the urgency of acting rapidly and in unison with a client's management and Information Technology resources to prioritize tasks and to put key services back on line as fast as possible.

Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A business contacted Progent after their network was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored hackers, possibly adopting algorithms leaked from the U.S. National Security Agency. Ryuk seeks specific companies with little or no room for operational disruption and is one of the most lucrative examples of ransomware malware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago with about 500 staff members. The Ryuk attack had brought down all business operations and manufacturing capabilities. Most of the client's information backups had been on-line at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (exceeding $200K) and wishfully thinking for good luck, but in the end reached out to Progent.

Progent worked together with the customer to rapidly identify and prioritize the essential systems that had to be addressed to make it possible to continue business operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

Within 2 days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then assisted with reinstallations and hard drive recovery of needed systems. All Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Folder Files) on user desktop computers to recover email messages. A not too old off-line backup of the customer's accounting/MRP systems made it possible to restore these essential services back online. Although a lot of work needed to be completed to recover fully from the Ryuk damage, core systems were recovered rapidly:

Throughout the following couple of weeks important milestones in the recovery process were made in close cooperation between Progent consultants and the customer:

• In-house web sites were brought back up without losing any data.
• The MailStore Server exceeding four million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory modules were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Most of the desktops and laptops were being used by staff.

Conclusion
A possible enterprise-killing disaster was dodged by dedicated professionals, a broad range of knowledge, and tight collaboration. Although in retrospect the crypto-ransomware attack described here should have been blocked with advanced security solutions and security best practices, user and IT administrator education, and appropriate security procedures for data backup and proper patching controls, the fact is that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's team of experts has proven experience in crypto-ransomware virus defense, cleanup, and information systems restoration.

To review or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Jacksonville a portfolio of remote monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services incorporate next-generation machine learning capability to detect new strains of crypto-ransomware that are able to get past legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your network scales easily without holding you back. For a low and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, automatic monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management technology to help keep your network operating efficiently by checking the health of critical assets that power your business network. When ProSight LAN Watch detects a problem, an alert is sent immediately to your designated IT personnel and your Progent engineering consultant so all potential problems can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your network, server, and desktop devices by offering tools for performing common tedious tasks. These can include health monitoring, update management, automated repairs, endpoint setup, backup and recovery, anti-virus protection, remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alert to your specified IT personnel and your assigned Progent consultant so potential problems can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized businesses to map out, track, optimize and troubleshoot their networking appliances such as routers, firewalls, and wireless controllers as well as servers, endpoints and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that infrastructure topology maps are kept updated, copies and displays the configuration information of virtually all devices connected to your network, monitors performance, and generates alerts when problems are detected. By automating tedious management processes, WAN Watch can cut hours off common chores such as network mapping, expanding your network, finding appliances that need important updates, or isolating performance bottlenecks. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time reporting tools created to integrate with the industry's leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup software companies to produce ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup processes and enable transparent backup and fast restoration of vital files/folders, applications, system images, plus VMs. ProSight DPS lets your business protect against data loss caused by equipment breakdown, natural calamities, fire, malware like ransomware, user error, malicious employees, or software bugs. Managed services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security vendors to deliver centralized management and comprehensive security for your inbound and outbound email. The powerful structure of Progent's Email Guard managed service combines a Cloud Protection Layer with a local security gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's cloud filter acts as a first line of defense and keeps most unwanted email from making it to your security perimeter. This decreases your vulnerability to inbound attacks and saves network bandwidth and storage. Email Guard's on-premises gateway device adds a further layer of analysis for inbound email. For outbound email, the onsite gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that originates and ends within your security perimeter. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity confirmation with iOS, Google Android, and other personal devices. With Duo 2FA, whenever you log into a protected application and enter your password you are requested to verify who you are on a unit that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be used as this added form of authentication such as a smartphone or watch, a hardware token, a landline telephone, etc. You can register several validation devices. To learn more about Duo two-factor identity validation services, visit Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Center: Call Center Managed Services
  Progent's Call Desk managed services enable your information technology group to outsource Support Desk services to Progent or divide activity for Help Desk services transparently between your internal network support resources and Progent's nationwide pool of certified IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a transparent supplement to your in-house support team. User access to the Help Desk, provision of support, problem escalation, ticket generation and tracking, efficiency metrics, and maintenance of the service database are cohesive regardless of whether incidents are resolved by your internal IT support organization, by Progent's team, or both. Learn more about Progent's outsourced/co-managed Call Center services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior-based analysis tools to defend endpoints and servers and VMs against modern malware attacks like ransomware and email phishing, which easily evade traditional signature-matching AV products. Progent Active Security Monitoring services protect local and cloud-based resources and provides a single platform to manage the complete malware attack lifecycle including filtering, detection, containment, cleanup, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, retrieve and protect data related to your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs or domains. By updating and organizing your network documentation, you can save up to half of time spent trying to find critical information about your IT network. ProSight IT Asset Management features a common location for storing and sharing all documents related to managing your business network like recommended procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT information. Whether you're making improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of all sizes a versatile and cost-effective solution for assessing, validating, scheduling, applying, and documenting updates to your dynamic IT network. Besides optimizing the security and functionality of your IT network, Progent's patch management services free up time for your IT team to concentrate on more strategic initiatives and activities that deliver the highest business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the apps. Since the system is virtualized, it can be ported immediately to a different hardware environment without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoints against modern malware assaults like ransomware and email phishing, which routinely evade legacy signature-based AV products. ProSight ASM protects on-premises and cloud resources and provides a single platform to manage the entire threat progression including protection, infiltration detection, mitigation, cleanup, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth security for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers firewall protection, penetration alerts, device management, and web filtering through leading-edge technologies packaged within one agent managed from a single control. Progent's data protection and virtualization experts can assist you to design and configure a ProSight ESP deployment that addresses your company's specific requirements and that allows you prove compliance with government and industry data security standards. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require urgent action. Progent can also help you to set up and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange filtering.