24x7x365 Reno Emergency Crypto
Virus Assessment and Restoration Experts

Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become an escalating cyberplague that presents an existential danger for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and still inflict havoc. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus frequent unnamed viruses, not only do encryption of on-line files but also infect all available system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be encrypted. In a poorly architected environment, this can make any restore operations useless and effectively knocks the datacenter back to zero.

Restoring applications and data after a ransomware attack becomes a race against time as the targeted business tries its best to stop lateral movement, cleanup the ransomware, and restore business-critical activity. Due to the fact that ransomware requires time to spread, penetrations are usually launched during nights and weekends, when successful penetrations are likely to take longer to notice. This compounds the difficulty of quickly assembling and orchestrating an experienced response team.

Progent provides a range of services for securing enterprises from crypto-ransomware attacks. These include team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security solutions with artificial intelligence capabilities from SentinelOne to discover and suppress new cyber attacks quickly. Progent in addition can provide the assistance of veteran ransomware recovery consultants with the talent and perseverance to restore a breached network as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Soon after a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the codes to unencrypt all your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to setup from scratch the critical components of your Information Technology environment. Without the availability of essential system backups, this calls for a wide range of skill sets, professional team management, and the capability to work 24x7 until the job is over.

For twenty years, Progent has offered certified expert IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of experience affords Progent the skills to rapidly understand important systems and integrate the remaining pieces of your computer network system following a ransomware event and configure them into a functioning network.

Progent's ransomware team of experts uses powerful project management applications to coordinate the complicated recovery process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and Information Technology resources to prioritize tasks and to get essential services back online as soon as humanly possible.

Customer Story: A Successful Ransomware Attack Restoration
A client escalated to Progent after their network was attacked by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state sponsored cybercriminals, suspected of adopting algorithms exposed from the United States NSA organization. Ryuk attacks specific businesses with limited tolerance for operational disruption and is one of the most lucrative versions of ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago with about 500 employees. The Ryuk penetration had shut down all company operations and manufacturing processes. The majority of the client's data protection had been online at the beginning of the intrusion and were destroyed. The client was pursuing financing for paying the ransom (more than two hundred thousand dollars) and wishfully thinking for the best, but ultimately called Progent.

Progent worked together with the client to rapidly assess and prioritize the critical areas that needed to be addressed in order to continue company operations:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

In less than 48 hours, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then assisted with setup and storage recovery of key applications. All Exchange data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Off-Line Folder Files) on various desktop computers to recover mail information. A not too old off-line backup of the customer's financials/MRP systems made it possible to return these essential services back available to users. Although significant work still had to be done to recover completely from the Ryuk attack, essential services were returned to operations quickly:

Over the next month important milestones in the recovery process were achieved through tight cooperation between Progent engineers and the client:

• In-house web applications were returned to operation without losing any information.
• The MailStore Server containing more than four million historical emails was spun up and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 firewall was installed.
• Most of the user desktops and notebooks were operational.

Conclusion
A likely business catastrophe was averted with hard-working experts, a broad spectrum of technical expertise, and close teamwork. Although upon completion of forensics the crypto-ransomware virus attack described here would have been shut down with modern cyber security technology solutions and best practices, team education, and properly executed security procedures for information protection and proper patching controls, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incursion, remember that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, mitigation, and information systems disaster recovery.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Reno a range of remote monitoring and security assessment services to assist you to reduce your vulnerability to crypto-ransomware. These services include next-generation artificial intelligence capability to detect new variants of ransomware that are able to evade traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Basic packages include RMM, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network running at peak levels by tracking the state of critical assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your specified IT staff and your assigned Progent consultant so any looming issues can be addressed before they can impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These can include health monitoring, update management, automated remediation, endpoint deployment, backup and recovery, A/V protection, secure remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alarm to your designated IT management personnel and your Progent technical consultant so that potential issues can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map, track, optimize and debug their networking appliances such as switches, firewalls, and load balancers plus servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are always updated, copies and displays the configuration information of virtually all devices connected to your network, monitors performance, and generates notices when problems are detected. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can cut hours off ordinary chores like network mapping, reconfiguring your network, finding appliances that need important updates, or identifying the cause of performance problems. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth management reporting utilities created to integrate with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore technology companies to create ProSight Data Protection Services, a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and monitor your data backup operations and allow non-disruptive backup and fast restoration of vital files, apps, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss caused by equipment failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious employees, or application bugs. Managed backup services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top information security vendors to provide centralized control and world-class protection for all your email traffic. The powerful structure of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's cloud filter serves as a preliminary barricade and keeps the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to external threats and saves network bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of analysis for incoming email. For outgoing email, the local security gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays inside your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo supports one-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you log into a protected online account and enter your password you are asked to confirm your identity on a unit that only you possess and that is accessed using a different network channel. A wide selection of devices can be used for this second form of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You may register multiple verification devices. To find out more about ProSight Duo two-factor identity validation services, refer to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Call Center managed services allow your IT group to outsource Support Desk services to Progent or split activity for Service Desk support seamlessly between your in-house support resources and Progent's extensive pool of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless extension of your in-house support team. Client access to the Help Desk, provision of support, issue escalation, trouble ticket creation and tracking, efficiency measurement, and maintenance of the support database are cohesive whether incidents are taken care of by your internal network support organization, by Progent, or by a combination. Find out more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior analysis technology to guard endpoint devices as well as physical and virtual servers against new malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a single platform to address the entire malware attack progression including protection, identification, containment, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against new threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and protect information related to your IT infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about impending expirations of SSL certificates or warranties. By cleaning up and managing your IT documentation, you can eliminate as much as 50% of time wasted trying to find critical information about your network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making improvements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide businesses of all sizes a flexible and affordable solution for assessing, validating, scheduling, applying, and documenting updates to your ever-evolving IT system. In addition to maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT staff to focus on more strategic initiatives and tasks that deliver the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host set up and maintained by Progent's IT support experts. With the ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which easily get by traditional signature-matching anti-virus products. ProSight ASM protects on-premises and cloud resources and offers a unified platform to address the complete threat lifecycle including protection, detection, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer security for physical and virtual servers, desktops, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, device control, and web filtering through cutting-edge tools packaged within a single agent accessible from a unified console. Progent's data protection and virtualization consultants can assist you to design and configure a ProSight ESP environment that meets your company's unique requirements and that allows you achieve and demonstrate compliance with legal and industry information protection regulations. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for immediate action. Progent can also assist your company to install and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.