São José dos Campos 24x7 Urgent Crypto
Virus Detection and Restoration Help

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyber pandemic that presents an existential danger for businesses of all sizes poorly prepared for an assault. Different versions of crypto-ransomware such as CrySIS, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for years and still cause damage. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus more unnamed malware, not only do encryption of online critical data but also infiltrate most configured system protection mechanisms. Data replicated to cloud environments can also be corrupted. In a vulnerable system, this can make automatic recovery useless and effectively sets the datacenter back to zero.

Getting back online applications and data following a ransomware attack becomes a race against the clock as the victim struggles to stop lateral movement, cleanup the ransomware, and resume business-critical activity. Due to the fact that crypto-ransomware needs time to move laterally, attacks are usually launched during nights and weekends, when penetrations are likely to take more time to identify. This compounds the difficulty of rapidly assembling and coordinating an experienced mitigation team.

Progent has a range of support services for protecting enterprises from ransomware events. Among these are staff training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security gateways with artificial intelligence technology from SentinelOne to identify and suppress day-zero cyber threats quickly. Progent also offers the services of expert ransomware recovery professionals with the track record and commitment to re-deploy a breached environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
Following a ransomware event, sending the ransom in cryptocurrency does not ensure that criminal gangs will respond with the needed codes to decrypt any of your information. Kaspersky Labs determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to re-install the key components of your Information Technology environment. Without the availability of complete information backups, this calls for a wide complement of IT skills, well-coordinated project management, and the ability to work non-stop until the recovery project is done.

For decades, Progent has offered expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained high-level certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of experience gives Progent the capability to knowledgably determine necessary systems and re-organize the remaining components of your network system after a ransomware attack and rebuild them into a functioning network.

Progent's ransomware group deploys best of breed project management applications to coordinate the sophisticated recovery process. Progent understands the urgency of acting rapidly and together with a client's management and Information Technology resources to prioritize tasks and to put the most important applications back online as soon as humanly possible.

Customer Story: A Successful Ransomware Incident Recovery
A customer contacted Progent after their network system was attacked by the Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state cybercriminals, suspected of using algorithms leaked from the United States National Security Agency. Ryuk targets specific companies with little or no ability to sustain operational disruption and is one of the most lucrative versions of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in Chicago with about 500 staff members. The Ryuk event had shut down all company operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the intrusion and were destroyed. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end brought in Progent.

Progent worked with the client to quickly understand and assign priority to the key applications that had to be restored in order to resume departmental operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then assisted with rebuilding and storage recovery of critical systems. All Exchange Server ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to locate local OST files (Outlook Email Off-Line Data Files) on team workstations and laptops in order to recover email messages. A not too old off-line backup of the businesses manufacturing software made it possible to return these required programs back servicing users. Although a lot of work was left to recover totally from the Ryuk virus, the most important systems were restored quickly:

Throughout the next few weeks important milestones in the recovery project were made in close collaboration between Progent engineers and the client:

• Internal web applications were brought back up without losing any data.
• The MailStore Exchange Server exceeding four million archived emails was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory functions were fully operational.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Nearly all of the user PCs were being used by staff.

Conclusion
A likely business-ending catastrophe was evaded by dedicated professionals, a broad array of knowledge, and close teamwork. Although in post mortem the ransomware penetration detailed here should have been prevented with current security systems and NIST Cybersecurity Framework best practices, staff training, and appropriate security procedures for information backup and proper patching controls, the fact remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incident, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus defense, remediation, and data restoration.

To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in São José dos Campos a variety of remote monitoring and security assessment services to assist you to minimize your vulnerability to crypto-ransomware. These services utilize modern machine learning capability to detect new strains of ransomware that are able to escape detection by traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent takes care of the daily monitoring and management for you, so your network scales easily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your complete technology safety net. Entry-level packages include RMM, security, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) technology to help keep your IT system operating at peak levels by tracking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your designated IT personnel and your assigned Progent engineering consultant so all potential problems can be resolved before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering tools for performing common tedious tasks. These can include health checking, patch management, automated remediation, endpoint setup, backup and restore, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it transmits an alarm to your designated IT management personnel and your Progent consultant so potential issues can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to diagram, track, reconfigure and debug their networking appliances like routers, firewalls, and access points as well as servers, client computers and other devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and displays the configuration information of virtually all devices on your network, tracks performance, and generates alerts when issues are detected. By automating complex network management processes, ProSight WAN Watch can cut hours off common tasks such as making network diagrams, expanding your network, finding devices that require critical software patches, or identifying the cause of performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth management reporting tools designed to integrate with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues such as inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services, a family of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup operations and enable transparent backup and rapid recovery of vital files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you recover from data loss caused by hardware failures, natural calamities, fire, malware such as ransomware, human error, malicious employees, or software glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to deliver web-based control and comprehensive protection for all your email traffic. The hybrid structure of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway appliance to provide complete defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. Email Guard's cloud filter acts as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This decreases your exposure to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a further layer of inspection for inbound email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication. Duo enables one-tap identity verification with Apple iOS, Google Android, and other personal devices. With Duo 2FA, whenever you log into a secured online account and enter your password you are asked to confirm your identity via a device that only you have and that is accessed using a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized for this added means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may register several verification devices. To find out more about ProSight Duo identity validation services, refer to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Center: Help Desk Managed Services
  Progent's Call Desk managed services allow your IT team to outsource Help Desk services to Progent or split responsibilities for Service Desk support seamlessly between your in-house support staff and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent extension of your internal IT support organization. End user access to the Service Desk, provision of support services, issue escalation, ticket creation and updates, performance metrics, and maintenance of the support database are consistent regardless of whether issues are resolved by your in-house support resources, by Progent's team, or a mix of the two. Read more about Progent's outsourced/shared Call Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior machine learning technology to defend endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-based anti-virus tools. Progent ASM services safeguard local and cloud-based resources and provides a single platform to automate the entire threat lifecycle including filtering, infiltration detection, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, retrieve and safeguard data related to your network infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or warranties. By updating and organizing your network documentation, you can eliminate as much as 50% of time spent trying to find critical information about your IT network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents related to managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're making improvements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you require the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of all sizes a versatile and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic information system. In addition to optimizing the security and reliability of your IT environment, Progent's software/firmware update management services allow your IT staff to concentrate on line-of-business projects and tasks that deliver the highest business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the apps. Since the environment is virtualized, it can be moved easily to a different hosting environment without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely evade legacy signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a unified platform to manage the complete threat progression including blocking, infiltration detection, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver economical in-depth protection for physical servers and VMs, desktops, smartphones, and Exchange email. ProSight ESP utilizes contextual security and advanced machine learning for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge tools packaged within a single agent accessible from a single console. Progent's data protection and virtualization experts can assist you to plan and implement a ProSight ESP deployment that addresses your company's unique requirements and that helps you achieve and demonstrate compliance with legal and industry data protection regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that require immediate attention. Progent's consultants can also help you to set up and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.