Pleasanton 24x7x365 Critical CryptoLocker
Computer Virus Identification and Removal Experts

Crypto-Ransomware : Your Crippling IT Catastrophe
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for businesses of all sizes vulnerable to an attack. Versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for a long time and still cause destruction. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with daily unnamed malware, not only do encryption of online information but also infiltrate all accessible system restores and backups. Files replicated to the cloud can also be held hostage. In a poorly architected data protection solution, this can render automated recovery impossible and effectively knocks the entire system back to zero.

Getting back on-line applications and information following a ransomware outage becomes a race against the clock as the targeted business struggles to stop the spread, remove the crypto-ransomware, and resume business-critical activity. Because crypto-ransomware requires time to replicate, penetrations are often sprung on weekends, when successful attacks may take longer to detect. This multiplies the difficulty of promptly mobilizing and organizing an experienced response team.

Progent has a variety of help services for protecting businesses from ransomware penetrations. Among these are team member education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of next-generation security solutions with AI capabilities from SentinelOne to identify and quarantine new threats automatically. Progent in addition offers the assistance of seasoned crypto-ransomware recovery professionals with the skills and perseverance to reconstruct a breached environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will provide the needed codes to unencrypt any of your information. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to re-install the critical elements of your IT environment. Without the availability of essential system backups, this requires a broad complement of skills, top notch team management, and the capability to work continuously until the job is done.

For two decades, Progent has offered certified expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of expertise affords Progent the skills to efficiently identify critical systems and re-organize the surviving pieces of your network system following a ransomware event and assemble them into a functioning network.

Progent's security team of experts has state-of-the-art project management systems to coordinate the complex recovery process. Progent appreciates the importance of working swiftly and together with a client's management and Information Technology staff to prioritize tasks and to get essential services back on-line as fast as possible.

Client Story: A Successful Ransomware Intrusion Restoration
A small business contacted Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean government sponsored cybercriminals, possibly using approaches leaked from the U.S. NSA organization. Ryuk attacks specific organizations with little or no tolerance for operational disruption and is one of the most profitable versions of crypto-ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago with around 500 workers. The Ryuk event had brought down all company operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the start of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (more than $200,000) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked together with the client to rapidly assess and prioritize the most important applications that needed to be recovered in order to restart business operations:

• Active Directory
• Email
• MRP System

In less than 48 hours, Progent was able to restore Active Directory services to its pre-penetration state. Progent then completed rebuilding and hard drive recovery of essential systems. All Exchange Server schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to locate intact OST data files (Outlook Email Off-Line Folder Files) on various PCs to recover mail data. A not too old off-line backup of the businesses accounting/ERP systems made them able to recover these essential applications back on-line. Although significant work needed to be completed to recover totally from the Ryuk virus, critical systems were restored rapidly:

During the next few weeks important milestones in the restoration project were achieved through tight cooperation between Progent consultants and the customer:

• In-house web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory capabilities were completely recovered.
• A new Palo Alto Networks 850 security appliance was brought online.
• Most of the user desktops were operational.

Conclusion
A potential business-ending disaster was avoided due to hard-working professionals, a broad array of IT skills, and close collaboration. Although in hindsight the crypto-ransomware incident described here could have been identified and stopped with current cyber security technology and ISO/IEC 27001 best practices, user education, and well thought out security procedures for information backup and proper patching controls, the reality is that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has substantial experience in crypto-ransomware virus defense, mitigation, and data restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Pleasanton a portfolio of remote monitoring and security evaluation services to assist you to reduce your vulnerability to ransomware. These services include modern AI capability to detect new variants of crypto-ransomware that are able to get past traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Entry-level plans include RMM, security, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system operating efficiently by tracking the health of critical computers that power your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your designated IT staff and your assigned Progent consultant so that any looming issues can be addressed before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for monitoring and managing your client-server infrastructure by providing an environment for streamlining common tedious jobs. These can include health monitoring, patch management, automated repairs, endpoint configuration, backup and recovery, A/V defense, remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your specified IT staff and your Progent consultant so potential problems can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to diagram, track, optimize and troubleshoot their connectivity appliances such as switches, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Incorporating state-of-the-art RMM technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and generates alerts when issues are detected. By automating tedious network management activities, ProSight WAN Watch can knock hours off ordinary tasks like network mapping, reconfiguring your network, locating devices that require critical software patches, or isolating performance issues. Learn more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time management reporting utilities designed to work with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as spotty support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS services manage and monitor your backup operations and allow non-disruptive backup and fast restoration of critical files/folders, applications, images, plus virtual machines. ProSight DPS lets you avoid data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned employees, or application glitches. Managed backup services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading data security vendors to provide web-based management and world-class security for all your email traffic. The hybrid structure of Progent's Email Guard managed service combines a Cloud Protection Layer with a local security gateway device to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter serves as a preliminary barricade and blocks most threats from making it to your network firewall. This decreases your vulnerability to inbound attacks and conserves network bandwidth and storage space. Email Guard's onsite gateway appliance provides a further level of analysis for incoming email. For outbound email, the onsite security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and protect internal email that stays within your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables one-tap identity verification with iOS, Google Android, and other personal devices. With 2FA, when you sign into a protected online account and give your password you are requested to confirm who you are via a device that only you possess and that is accessed using a separate network channel. A wide selection of out-of-band devices can be used for this second means of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may register multiple verification devices. For more information about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Desk: Call Center Managed Services
  Progent's Call Center managed services enable your information technology staff to offload Help Desk services to Progent or divide responsibilities for Help Desk services transparently between your internal network support team and Progent's extensive roster of certified IT service technicians, engineers and subject matter experts. Progent's Shared Service Desk offers a transparent supplement to your corporate network support resources. End user access to the Service Desk, delivery of support, issue escalation, ticket creation and tracking, efficiency measurement, and maintenance of the service database are cohesive regardless of whether incidents are resolved by your in-house support organization, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/shared Help Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior-based analysis tools to defend endpoint devices and servers and VMs against modern malware assaults such as ransomware and file-less exploits, which routinely get by legacy signature-based AV tools. Progent ASM services safeguard on-premises and cloud-based resources and offers a unified platform to automate the entire threat progression including protection, detection, mitigation, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, retrieve and safeguard information about your network infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be warned about upcoming expirations of SSLs or warranties. By updating and managing your IT documentation, you can eliminate up to half of time spent looking for critical information about your network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're making improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer organizations of all sizes a flexible and cost-effective alternative for assessing, validating, scheduling, implementing, and tracking updates to your dynamic information network. In addition to maximizing the protection and reliability of your computer environment, Progent's software/firmware update management services permit your IT staff to concentrate on more strategic projects and tasks that derive the highest business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual host configured and managed by Progent's IT support professionals. With Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Because the system is virtualized, it can be moved easily to an alternate hosting environment without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's cutting edge behavior analysis tools to defend physical and virtual endpoints against new malware attacks such as ransomware and email phishing, which routinely get by legacy signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud resources and offers a single platform to address the entire malware attack progression including blocking, infiltration detection, containment, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer affordable multi-layer security for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, device control, and web filtering via leading-edge technologies incorporated within one agent managed from a unified console. Progent's data protection and virtualization experts can assist your business to plan and configure a ProSight ESP deployment that addresses your organization's specific requirements and that allows you demonstrate compliance with legal and industry data protection regulations. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent can also help your company to install and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.