24-7 Cheyenne Critical Crypto
Malware Damage Assessment and Recovery Help

Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyberplague that presents an existential threat for organizations vulnerable to an attack. Different versions of ransomware like the CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause harm. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with additional as yet unnamed viruses, not only encrypt online files but also infiltrate any available system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be ransomed. In a poorly architected system, this can make any restoration impossible and basically knocks the entire system back to square one.

Retrieving services and data after a ransomware event becomes a sprint against time as the victim struggles to contain, cleanup the crypto-ransomware, and restore enterprise-critical activity. Since ransomware takes time to replicate, penetrations are usually launched during weekends and nights, when attacks are likely to take longer to notice. This multiplies the difficulty of rapidly marshalling and orchestrating a knowledgeable response team.

Progent has a variety of support services for securing organizations from ransomware attacks. Among these are team member education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of modern security gateways with artificial intelligence capabilities from SentinelOne to discover and extinguish new threats intelligently. Progent in addition can provide the services of expert ransomware recovery professionals with the track record and perseverance to re-deploy a breached network as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not ensure that cyber hackers will return the needed codes to decrypt any or all of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the key elements of your Information Technology environment. Absent access to essential data backups, this requires a broad complement of skill sets, top notch project management, and the capability to work non-stop until the job is complete.

For decades, Progent has offered certified expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned top certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP application software. This breadth of experience gives Progent the capability to quickly identify critical systems and integrate the surviving parts of your Information Technology system after a crypto-ransomware penetration and configure them into a functioning network.

Progent's ransomware group deploys top notch project management tools to orchestrate the complex restoration process. Progent knows the importance of acting swiftly and in unison with a client's management and Information Technology team members to prioritize tasks and to get essential services back online as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Incident Recovery
A business sought out Progent after their network system was penetrated by the Ryuk crypto-ransomware. Ryuk is believed to have been launched by Northern Korean government sponsored cybercriminals, possibly using technology exposed from America's NSA organization. Ryuk attacks specific organizations with little tolerance for disruption and is among the most profitable examples of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in Chicago with about 500 workers. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's data protection had been online at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but in the end called Progent.

Progent worked hand in hand the customer to quickly get our arms around and prioritize the mission critical systems that needed to be addressed to make it possible to resume company operations:

• Windows Active Directory
• Email
• Financials/MRP

In less than 48 hours, Progent was able to restore Active Directory to its pre-virus state. Progent then charged ahead with reinstallations and hard drive recovery of critical servers. All Exchange data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to collect intact OST data files (Microsoft Outlook Off-Line Folder Files) on team PCs in order to recover mail messages. A recent offline backup of the client's accounting/MRP software made it possible to restore these essential applications back available to users. Although major work was left to recover fully from the Ryuk attack, essential systems were restored quickly:

Over the next couple of weeks key milestones in the recovery project were completed in tight cooperation between Progent team members and the customer:

• Internal web sites were restored with no loss of information.
• The MailStore Server exceeding 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were completely restored.
• A new Palo Alto 850 security appliance was installed.
• Most of the desktop computers were fully operational.

Conclusion
A likely business-ending disaster was avoided through the efforts of dedicated professionals, a wide array of technical expertise, and close teamwork. Although upon completion of forensics the ransomware attack detailed here should have been disabled with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well designed incident response procedures for data backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, removal, and file restoration.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Cheyenne a range of remote monitoring and security evaluation services to assist you to reduce your vulnerability to ransomware. These services utilize next-generation machine learning technology to detect zero-day variants of ransomware that can evade legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent takes care of the daily monitoring and management for you, so your system expands smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, automatic monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your IT system running efficiently by tracking the state of vital assets that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your designated IT management staff and your assigned Progent consultant so that any looming problems can be resolved before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for managing your client-server infrastructure by providing an environment for performing common tedious tasks. These can include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, A/V defense, secure remote access, standard and custom scripts, resource inventory, endpoint profile reports, and debugging support. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alarm to your designated IT staff and your assigned Progent consultant so that emerging issues can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map out, monitor, optimize and troubleshoot their networking appliances such as routers, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Using cutting-edge RMM technology, WAN Watch makes sure that network diagrams are always current, captures and displays the configuration of virtually all devices on your network, monitors performance, and generates alerts when problems are discovered. By automating complex network management activities, WAN Watch can cut hours off ordinary tasks such as network mapping, expanding your network, finding devices that need critical updates, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth reporting utilities designed to work with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology companies to create ProSight Data Protection Services, a portfolio of management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup processes and enable transparent backup and rapid recovery of vital files, apps, images, plus VMs. ProSight DPS lets your business avoid data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, user mistakes, malicious employees, or application bugs. Managed backup services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of leading information security companies to deliver web-based control and comprehensive protection for all your inbound and outbound email. The hybrid architecture of Email Guard integrates a Cloud Protection Layer with a local security gateway appliance to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne malware. The cloud filter serves as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This decreases your exposure to external threats and saves system bandwidth and storage space. Email Guard's onsite security gateway device adds a further level of analysis for inbound email. For outgoing email, the local gateway provides AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to track and safeguard internal email that originates and ends inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to protect against password theft through the use of two-factor authentication (2FA). Duo enables one-tap identity verification with Apple iOS, Android, and other out-of-band devices. With 2FA, when you sign into a protected online account and enter your password you are asked to confirm your identity via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be used for this second form of ID validation such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can designate multiple verification devices. For details about Duo identity validation services, see Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Desk: Support Desk Managed Services
  Progent's Call Desk managed services allow your IT group to outsource Support Desk services to Progent or split activity for support services seamlessly between your in-house network support group and Progent's nationwide pool of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a smooth supplement to your in-house network support group. End user access to the Help Desk, provision of support services, escalation, ticket generation and tracking, performance measurement, and maintenance of the service database are consistent regardless of whether issues are resolved by your internal network support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Call Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior analysis tools to defend endpoints and physical and virtual servers against modern malware assaults such as ransomware and email phishing, which routinely evade legacy signature-based anti-virus products. Progent ASM services protect on-premises and cloud resources and provides a unified platform to address the entire malware attack lifecycle including filtering, detection, containment, remediation, and forensics. Top capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and safeguard information about your network infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can save as much as 50% of time wasted trying to find vital information about your network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents related to managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of all sizes a flexible and affordable solution for evaluating, testing, scheduling, implementing, and documenting software and firmware updates to your dynamic information network. Besides optimizing the protection and functionality of your IT environment, Progent's software/firmware update management services allow your IT team to focus on more strategic initiatives and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual host set up and maintained by Progent's network support experts. With the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which routinely evade legacy signature-based anti-virus products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a unified platform to manage the entire malware attack lifecycle including blocking, detection, containment, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering via cutting-edge technologies packaged within one agent accessible from a unified control. Progent's data protection and virtualization experts can assist your business to plan and implement a ProSight ESP environment that meets your company's specific needs and that helps you demonstrate compliance with government and industry information security regulations. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for immediate action. Progent's consultants can also help your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.