Palo Alto 24/7/365 Critical Crypto
Computer Virus Damage Assessment and Repair Services

Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for organizations vulnerable to an attack. Different versions of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for a long time and continue to cause harm. The latest variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus daily unnamed viruses, not only encrypt online data files but also infiltrate all available system backup. Data synchronized to the cloud can also be ransomed. In a vulnerable data protection solution, it can render automated restore operations hopeless and basically knocks the entire system back to square one.

Getting back applications and information following a ransomware event becomes a sprint against time as the targeted business struggles to contain the damage, cleanup the ransomware, and resume mission-critical operations. Because ransomware takes time to move laterally, penetrations are often launched at night, when penetrations in many cases take longer to discover. This multiplies the difficulty of rapidly assembling and organizing a qualified mitigation team.

Progent provides a variety of help services for securing businesses from ransomware attacks. These include team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with installation of modern security solutions with AI technology from SentinelOne to detect and disable day-zero threats rapidly. Progent in addition provides the assistance of veteran crypto-ransomware recovery consultants with the track record and perseverance to restore a breached environment as urgently as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will provide the keys to decrypt all your files. Kaspersky estimated that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to re-install the critical elements of your IT environment. Absent the availability of full data backups, this calls for a wide complement of IT skills, top notch team management, and the ability to work continuously until the job is over.

For twenty years, Progent has provided professional Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned high-level certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably ascertain critical systems and organize the remaining components of your computer network environment following a ransomware event and configure them into a functioning network.

Progent's recovery team uses powerful project management applications to orchestrate the complicated recovery process. Progent appreciates the importance of working quickly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put essential services back online as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Incident Response
A business escalated to Progent after their network was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state hackers, suspected of adopting approaches leaked from the U.S. National Security Agency. Ryuk seeks specific organizations with little or no tolerance for disruption and is among the most lucrative versions of ransomware malware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area with around 500 employees. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. Most of the client's backups had been online at the time of the attack and were encrypted. The client was taking steps for paying the ransom (more than $200,000) and wishfully thinking for good luck, but ultimately called Progent.

Progent worked together with the customer to quickly assess and assign priority to the mission critical systems that had to be addressed in order to continue business functions:

• Active Directory (AD)
• Email
• MRP System

Within 2 days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then helped perform rebuilding and storage recovery of needed applications. All Exchange Server ties and attributes were usable, which accelerated the restore of Exchange. Progent was able to collect non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on team desktop computers and laptops in order to recover mail messages. A recent offline backup of the businesses manufacturing software made them able to recover these required applications back on-line. Although major work still had to be done to recover completely from the Ryuk event, essential systems were recovered rapidly:

Throughout the following couple of weeks key milestones in the restoration process were completed in close cooperation between Progent consultants and the client:

• Internal web sites were restored with no loss of information.
• The MailStore Exchange Server exceeding 4 million archived emails was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100% operational.
• A new Palo Alto 850 firewall was deployed.
• 90% of the user PCs were functioning as before the incident.

Conclusion
A probable company-ending catastrophe was evaded due to results-oriented experts, a broad range of subject matter expertise, and close collaboration. Although in hindsight the crypto-ransomware incident described here should have been prevented with modern security systems and security best practices, user and IT administrator education, and well designed security procedures for data protection and proper patching controls, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, mitigation, and data disaster recovery.

To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Palo Alto a variety of remote monitoring and security evaluation services to assist you to reduce your vulnerability to crypto-ransomware. These services include modern artificial intelligence technology to uncover zero-day strains of crypto-ransomware that are able to escape detection by legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the necessary monitoring and management for you, so your system expands smoothly without holding you back. For an affordable and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include RMM, security, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management (RMM) technology to help keep your IT system operating at peak levels by tracking the health of vital computers that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your specified IT management staff and your Progent consultant so all looming issues can be addressed before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for managing your client-server infrastructure by providing an environment for streamlining common tedious jobs. These can include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your specified IT management personnel and your Progent technical consultant so emerging issues can be fixed before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map, monitor, enhance and troubleshoot their networking hardware such as routers, firewalls, and load balancers as well as servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network diagrams are kept current, copies and displays the configuration information of virtually all devices connected to your network, tracks performance, and sends notices when potential issues are detected. By automating time-consuming management processes, WAN Watch can cut hours off ordinary tasks such as making network diagrams, reconfiguring your network, finding devices that need important updates, or resolving performance problems. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time management reporting tools created to integrate with the industry's leading ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software providers to create ProSight Data Protection Services, a family of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup processes and allow non-disruptive backup and fast recovery of critical files, applications, system images, plus virtual machines. ProSight DPS helps you avoid data loss resulting from hardware failures, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned employees, or application bugs. Managed services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top information security companies to provide web-based control and comprehensive security for all your email traffic. The powerful architecture of Email Guard managed service combines cloud-based filtering with an on-premises security gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based threats. The cloud filter serves as a preliminary barricade and keeps the vast majority of threats from reaching your network firewall. This decreases your vulnerability to inbound threats and saves network bandwidth and storage. Email Guard's onsite gateway device adds a further layer of analysis for inbound email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that stays inside your corporate firewall. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation on iOS, Google Android, and other personal devices. Using 2FA, when you log into a protected online account and give your password you are asked to verify who you are on a device that only you have and that uses a separate network channel. A wide range of devices can be used as this added form of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can designate several verification devices. For details about ProSight Duo two-factor identity validation services, visit Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Support Desk services permit your information technology team to outsource Help Desk services to Progent or split activity for Service Desk support seamlessly between your internal support team and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a seamless supplement to your corporate IT support resources. End user access to the Help Desk, provision of support, escalation, trouble ticket generation and updates, efficiency measurement, and management of the support database are cohesive whether incidents are resolved by your corporate support staff, by Progent's team, or both. Read more about Progent's outsourced/shared Help Center services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes next generation behavior-based analysis tools to guard endpoints and physical and virtual servers against new malware assaults such as ransomware and email phishing, which easily escape traditional signature-matching anti-virus products. Progent Active Security Monitoring services safeguard local and cloud resources and provides a unified platform to address the complete malware attack lifecycle including blocking, identification, mitigation, cleanup, and forensics. Key capabilities include one-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and protect data related to your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as 50% of time spent looking for critical information about your network. ProSight IT Asset Management features a common location for holding and sharing all documents related to managing your business network such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're making enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management offer businesses of all sizes a versatile and affordable solution for assessing, validating, scheduling, applying, and tracking software and firmware updates to your dynamic IT network. Besides optimizing the security and functionality of your computer environment, Progent's software/firmware update management services free up time for your in-house IT staff to concentrate on line-of-business initiatives and activities that derive the highest business value from your information network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host configured and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the applications. Because the system is virtualized, it can be moved immediately to a different hardware solution without requiring a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based analysis technology to defend physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-based anti-virus tools. ProSight ASM protects local and cloud resources and provides a unified platform to address the entire malware attack progression including protection, infiltration detection, containment, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable multi-layer protection for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for continuously monitoring and responding to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, device control, and web filtering via cutting-edge technologies packaged within one agent accessible from a single console. Progent's data protection and virtualization consultants can help you to plan and configure a ProSight ESP environment that addresses your organization's unique requirements and that allows you prove compliance with government and industry data protection standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent's consultants can also assist you to install and test a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.