24-7 Fort Lauderdale Critical Crypto
Computer Malware Identification and Recovery Consultants

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyber pandemic that represents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Different versions of crypto-ransomware such as Dharma, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for a long time and still inflict havoc. Recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as more as yet unnamed newcomers, not only do encryption of on-line critical data but also infiltrate most configured system protection mechanisms. Information replicated to cloud environments can also be held hostage. In a poorly designed environment, this can render automated recovery hopeless and basically knocks the network back to square one.

Recovering applications and data following a ransomware intrusion becomes a sprint against time as the targeted organization fights to contain, remove the ransomware, and resume enterprise-critical operations. Because ransomware requires time to move laterally, assaults are often launched during nights and weekends, when attacks typically take longer to identify. This compounds the difficulty of promptly marshalling and organizing a knowledgeable response team.

Progent makes available a variety of solutions for protecting organizations from ransomware attacks. Among these are team member education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security solutions with machine learning capabilities from SentinelOne to identify and suppress new cyber attacks quickly. Progent in addition offers the assistance of veteran crypto-ransomware recovery engineers with the track record and commitment to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the keys to unencrypt all your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to re-install the key parts of your Information Technology environment. Absent the availability of complete data backups, this requires a broad range of IT skills, top notch project management, and the ability to work non-stop until the task is completed.

For two decades, Progent has offered certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP application software. This breadth of experience gives Progent the ability to quickly understand important systems and organize the remaining parts of your IT system after a crypto-ransomware attack and assemble them into an operational network.

Progent's ransomware team utilizes top notch project management applications to coordinate the complicated restoration process. Progent appreciates the urgency of working rapidly and together with a customer's management and IT staff to assign priority to tasks and to get the most important services back on-line as fast as possible.

Business Case Study: A Successful Ransomware Incident Response
A customer contacted Progent after their company was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state sponsored hackers, suspected of adopting approaches exposed from the U.S. National Security Agency. Ryuk targets specific organizations with little tolerance for operational disruption and is among the most profitable instances of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in Chicago and has about 500 staff members. The Ryuk event had shut down all business operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked with the client to quickly assess and assign priority to the critical systems that needed to be recovered to make it possible to continue departmental operations:

• Active Directory
• Exchange Server
• MRP System

In less than 2 days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery on critical servers. All Exchange Server data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to locate local OST data files (Outlook Email Off-Line Folder Files) on team PCs and laptops in order to recover email data. A recent offline backup of the customer's accounting/ERP software made it possible to recover these required applications back on-line. Although significant work was left to recover completely from the Ryuk virus, critical systems were recovered rapidly:

During the following few weeks key milestones in the recovery project were achieved through tight cooperation between Progent consultants and the customer:

• In-house web applications were restored without losing any information.
• The MailStore Server with over 4 million historical emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the user workstations were being used by staff.

Conclusion
A likely business-killing disaster was averted due to results-oriented professionals, a broad array of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware attack described here would have been shut down with modern cyber security solutions and recognized best practices, user training, and well thought out security procedures for data backup and keeping systems up to date with security patches, the fact is that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incident, remember that Progent's roster of experts has proven experience in ransomware virus defense, mitigation, and information systems recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Fort Lauderdale a variety of online monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services utilize modern AI capability to uncover zero-day variants of ransomware that are able to escape detection by traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent takes care of the necessary monitoring and management for you, so your network scales easily without holding you back. For a low and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Basic plans include remote monitoring and management, cybersecurity, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your IT system operating at peak levels by checking the state of critical computers that power your business network. When ProSight LAN Watch detects a problem, an alarm is sent immediately to your designated IT management personnel and your assigned Progent consultant so any potential issues can be addressed before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your client-server infrastructure by offering an environment for performing common tedious tasks. These include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, anti-virus defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alarm to your designated IT staff and your Progent consultant so potential issues can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for smaller businesses to map, monitor, optimize and troubleshoot their networking appliances such as routers, firewalls, and wireless controllers as well as servers, printers, client computers and other devices. Incorporating cutting-edge RMM technology, WAN Watch makes sure that infrastructure topology maps are always updated, copies and manages the configuration information of virtually all devices on your network, tracks performance, and sends notices when potential issues are detected. By automating complex management activities, ProSight WAN Watch can cut hours off ordinary tasks like network mapping, expanding your network, finding devices that require important updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting plug-ins created to work with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services, a family of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup operations and allow non-disruptive backup and rapid recovery of vital files/folders, applications, images, and virtual machines. ProSight DPS lets your business protect against data loss caused by hardware failures, natural calamities, fire, cyber attacks like ransomware, human mistakes, ill-intentioned insiders, or application bugs. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security vendors to deliver centralized management and world-class security for your inbound and outbound email. The powerful structure of Progent's Email Guard combines a Cloud Protection Layer with an on-premises security gateway device to offer advanced protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. Email Guard's cloud filter serves as a first line of defense and keeps most threats from reaching your security perimeter. This decreases your exposure to external attacks and conserves system bandwidth and storage. Email Guard's on-premises security gateway device provides a further level of inspection for inbound email. For outgoing email, the onsite security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to protect against password theft by using two-factor authentication. Duo supports one-tap identity confirmation with iOS, Android, and other personal devices. With Duo 2FA, whenever you log into a protected application and give your password you are asked to confirm who you are on a unit that only you have and that is accessed using a different ("out-of-band") network channel. A wide selection of out-of-band devices can be utilized as this added means of ID validation such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You can register several validation devices. For more information about ProSight Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Support Desk services enable your information technology staff to outsource Call Center services to Progent or split responsibilities for Help Desk services seamlessly between your internal support group and Progent's extensive roster of IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent extension of your in-house support organization. Client access to the Service Desk, delivery of technical assistance, escalation, trouble ticket creation and updates, efficiency measurement, and maintenance of the support database are consistent regardless of whether incidents are resolved by your core IT support staff, by Progent's team, or a mix of the two. Read more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that incorporates cutting edge behavior-based machine learning tools to guard endpoints as well as physical and virtual servers against modern malware assaults such as ransomware and email phishing, which easily evade traditional signature-based AV tools. Progent Active Security Monitoring services safeguard local and cloud resources and provides a unified platform to address the entire threat progression including protection, identification, containment, cleanup, and post-attack forensics. Key features include single-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, update, retrieve and safeguard data about your network infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates or warranties. By updating and organizing your IT infrastructure documentation, you can save up to half of time thrown away searching for critical information about your network. ProSight IT Asset Management features a common location for storing and collaborating on all documents required for managing your business network such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT information. Whether you're making improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and cost-effective solution for evaluating, testing, scheduling, applying, and documenting updates to your ever-evolving IT network. Besides optimizing the protection and functionality of your IT network, Progent's software/firmware update management services permit your IT staff to concentrate on more strategic initiatives and tasks that deliver the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support professionals. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Since the system is virtualized, it can be ported immediately to a different hosting environment without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which easily evade traditional signature-based AV tools. ProSight ASM safeguards on-premises and cloud resources and offers a unified platform to manage the entire malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver ultra-affordable in-depth security for physical servers and virtual machines, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge tools packaged within one agent managed from a single console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP environment that meets your company's specific requirements and that allows you demonstrate compliance with legal and industry data protection regulations. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require immediate action. Progent can also assist you to set up and verify a backup and restore solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.