24/7/365 Oxford Emergency Crypto
Computer Virus Damage Assessment and Repair Support

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a too-frequent cyberplague that poses an enterprise-level threat for businesses of all sizes vulnerable to an attack. Multiple generations of crypto-ransomware such as Dharma, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and continue to cause destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as frequent as yet unnamed viruses, not only encrypt on-line data but also infect most available system backup. Information synched to the cloud can also be held hostage. In a poorly designed system, this can make automated restore operations useless and effectively sets the network back to square one.

Getting back on-line services and information following a ransomware outage becomes a sprint against the clock as the victim tries its best to contain, remove the ransomware, and restore business-critical operations. Due to the fact that ransomware requires time to replicate, attacks are often launched on weekends and holidays, when attacks in many cases take longer to recognize. This multiplies the difficulty of quickly assembling and orchestrating an experienced mitigation team.

Progent provides a range of services for protecting businesses from crypto-ransomware events. These include team education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of next-generation security gateways with machine learning capabilities from SentinelOne to discover and disable zero-day cyber threats intelligently. Progent in addition offers the assistance of seasoned ransomware recovery engineers with the track record and perseverance to rebuild a breached network as urgently as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will return the needed codes to decrypt any or all of your data. Kaspersky determined that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to re-install the key parts of your IT environment. Absent access to complete system backups, this calls for a broad range of IT skills, well-coordinated project management, and the ability to work continuously until the job is done.

For decades, Progent has made available professional IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned top industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP software solutions. This breadth of experience gives Progent the skills to rapidly identify critical systems and integrate the surviving parts of your network system after a ransomware attack and rebuild them into an operational network.

Progent's ransomware team utilizes state-of-the-art project management applications to coordinate the sophisticated recovery process. Progent understands the importance of working rapidly and in unison with a client's management and Information Technology resources to assign priority to tasks and to get essential applications back on line as soon as possible.

Client Story: A Successful Ransomware Attack Restoration
A customer escalated to Progent after their network system was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean government sponsored cybercriminals, possibly adopting techniques leaked from the U.S. NSA organization. Ryuk goes after specific businesses with little tolerance for operational disruption and is one of the most profitable examples of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area and has around 500 staff members. The Ryuk penetration had disabled all company operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the beginning of the attack and were eventually encrypted. The client considered paying the ransom (in excess of $200,000) and praying for the best, but ultimately made the decision to use Progent.

Progent worked together with the customer to rapidly identify and assign priority to the mission critical elements that needed to be recovered to make it possible to resume company functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 2 days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then charged ahead with setup and hard drive recovery of mission critical servers. All Exchange Server schema and attributes were usable, which accelerated the restore of Exchange. Progent was also able to locate local OST data files (Outlook Email Off-Line Folder Files) on user workstations to recover mail messages. A not too old offline backup of the client's accounting/ERP systems made it possible to restore these essential applications back online. Although a large amount of work remained to recover fully from the Ryuk damage, core services were returned to operations rapidly:

Throughout the following couple of weeks important milestones in the recovery process were made through tight cooperation between Progent engineers and the client:

• Self-hosted web sites were brought back up without losing any data.
• The MailStore Exchange Server with over four million historical emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory Control functions were completely recovered.
• A new Palo Alto 850 security appliance was installed.
• 90% of the user workstations were fully operational.

Conclusion
A potential business extinction catastrophe was averted by dedicated professionals, a wide range of knowledge, and tight collaboration. Although in post mortem the ransomware penetration detailed here would have been shut down with current cyber security technology and recognized best practices, user and IT administrator training, and appropriate incident response procedures for information backup and proper patching controls, the reality remains that state-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, mitigation, and data disaster recovery.

To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Oxford a variety of online monitoring and security assessment services to help you to reduce the threat from crypto-ransomware. These services utilize next-generation machine learning capability to detect new strains of ransomware that are able to get past traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your network expands readily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Basic packages include remote monitoring and management, security, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your IT system operating efficiently by tracking the health of vital assets that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your designated IT personnel and your Progent engineering consultant so all looming issues can be resolved before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by offering an environment for performing common tedious jobs. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your designated IT management staff and your assigned Progent consultant so emerging problems can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, monitor, optimize and debug their connectivity hardware such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network maps are kept updated, captures and displays the configuration information of almost all devices connected to your network, monitors performance, and generates notices when potential issues are detected. By automating time-consuming management activities, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, locating appliances that need important updates, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of in-depth reporting plug-ins designed to work with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software providers to produce ProSight Data Protection Services, a family of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup processes and enable non-disruptive backup and rapid restoration of important files, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business recover from data loss resulting from hardware failures, natural disasters, fire, cyber attacks such as ransomware, user error, malicious employees, or software glitches. Managed services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading information security companies to provide centralized management and comprehensive security for all your inbound and outbound email. The powerful structure of Email Guard managed service combines cloud-based filtering with an on-premises gateway appliance to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The Cloud Protection Layer serves as a first line of defense and keeps most unwanted email from reaching your network firewall. This reduces your exposure to inbound attacks and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of inspection for inbound email. For outbound email, the local gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also help Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity confirmation on Apple iOS, Google Android, and other personal devices. With 2FA, when you log into a protected online account and enter your password you are asked to confirm who you are via a device that only you have and that is accessed using a separate network channel. A broad selection of devices can be used for this second means of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You may register multiple verification devices. To learn more about Duo identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Center: Call Center Managed Services
  Progent's Call Center managed services permit your information technology team to outsource Help Desk services to Progent or divide responsibilities for Service Desk support transparently between your in-house network support resources and Progent's extensive pool of IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk offers a transparent supplement to your corporate network support organization. User interaction with the Help Desk, provision of support, problem escalation, ticket generation and updates, performance metrics, and management of the support database are consistent whether issues are resolved by your core IT support staff, by Progent, or a mix of the two. Read more about Progent's outsourced/shared Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior analysis tools to guard endpoint devices as well as servers and VMs against modern malware attacks like ransomware and email phishing, which routinely escape traditional signature-matching anti-virus tools. Progent Active Security Monitoring services protect local and cloud-based resources and provides a unified platform to address the complete malware attack progression including filtering, detection, mitigation, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and protect information about your IT infrastructure, procedures, applications, and services. You can instantly find passwords or IP addresses and be alerted about upcoming expirations of SSL certificates ,domains or warranties. By updating and organizing your IT documentation, you can eliminate as much as half of time wasted looking for vital information about your IT network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents related to managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT data. Whether you're planning improvements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of all sizes a flexible and affordable solution for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving information system. Besides maximizing the security and reliability of your IT environment, Progent's patch management services allow your IT staff to concentrate on more strategic initiatives and activities that derive the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host set up and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be ported immediately to an alternate hosting solution without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which routinely get by legacy signature-matching anti-virus tools. ProSight ASM protects on-premises and cloud-based resources and provides a unified platform to manage the complete malware attack progression including blocking, infiltration detection, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable multi-layer protection for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP offers firewall protection, penetration alarms, device control, and web filtering via leading-edge tools incorporated within one agent accessible from a unified control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP environment that meets your organization's unique needs and that allows you achieve and demonstrate compliance with government and industry information security regulations. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that require immediate action. Progent's consultants can also assist your company to set up and test a backup and restore solution like ProSight Data Protection Services so you can get back in business quickly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange email filtering.