Fort Collins 24/7 Emergency Ransomware
Malware Damage Assessment and Recovery Consultants

Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for businesses of all sizes vulnerable to an assault. Different iterations of ransomware like the Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and still inflict harm. Recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with additional unnamed viruses, not only do encryption of online critical data but also infect most accessible system backups. Data synchronized to the cloud can also be ransomed. In a poorly designed data protection solution, this can make automated restoration hopeless and basically sets the network back to zero.

Getting back on-line applications and data following a ransomware event becomes a race against time as the victim tries its best to stop lateral movement, remove the virus, and restore mission-critical operations. Due to the fact that ransomware needs time to move laterally, penetrations are usually sprung at night, when penetrations typically take more time to detect. This multiplies the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent offers an assortment of services for securing enterprises from crypto-ransomware attacks. These include staff education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of next-generation security solutions with AI capabilities from SentinelOne to identify and quarantine new cyber attacks rapidly. Progent also provides the services of seasoned crypto-ransomware recovery consultants with the talent and commitment to restore a breached network as quickly as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware invasion, paying the ransom in cryptocurrency does not guarantee that distant criminals will respond with the needed keys to decrypt any of your information. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to piece back together the critical parts of your Information Technology environment. Absent the availability of complete information backups, this requires a broad complement of IT skills, top notch team management, and the willingness to work non-stop until the task is done.

For two decades, Progent has offered certified expert Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of expertise affords Progent the capability to knowledgably identify important systems and integrate the remaining parts of your Information Technology system after a ransomware event and rebuild them into a functioning system.

Progent's ransomware team utilizes top notch project management applications to orchestrate the complex recovery process. Progent appreciates the importance of acting quickly and together with a client's management and IT team members to assign priority to tasks and to get essential services back on-line as fast as possible.

Customer Story: A Successful Ransomware Virus Restoration
A business sought out Progent after their company was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state criminal gangs, possibly using approaches exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no room for disruption and is one of the most lucrative instances of ransomware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago and has around 500 employees. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the start of the intrusion and were eventually encrypted. The client considered paying the ransom demand (in excess of $200,000) and praying for good luck, but in the end brought in Progent.

Progent worked together with the client to quickly identify and assign priority to the key systems that needed to be recovered to make it possible to resume business operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then initiated setup and hard drive recovery of essential applications. All Exchange Server data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Email Offline Data Files) on various PCs to recover mail data. A not too old off-line backup of the businesses manufacturing systems made it possible to restore these required programs back on-line. Although major work was left to recover totally from the Ryuk damage, essential systems were restored rapidly:

During the following few weeks key milestones in the restoration process were achieved through tight cooperation between Progent consultants and the customer:

• Self-hosted web sites were returned to operation with no loss of information.
• The MailStore Server containing more than four million archived emails was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control capabilities were 100% recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Ninety percent of the user desktops were being used by staff.

Conclusion
A possible business-killing disaster was averted with top-tier professionals, a broad spectrum of technical expertise, and tight collaboration. Although in hindsight the ransomware virus incident detailed here should have been prevented with modern security technology and recognized best practices, team education, and properly executed security procedures for data protection and applying software patches, the fact is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a ransomware virus, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and data disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Fort Collins a variety of remote monitoring and security assessment services to help you to minimize your vulnerability to crypto-ransomware. These services utilize modern machine learning technology to uncover zero-day variants of ransomware that are able to get past traditional signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent handles the daily monitoring and management for you, so your system scales readily without holding you back. For a low and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Entry-level packages include remote monitoring and management, security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to help keep your IT system operating efficiently by tracking the state of critical assets that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your designated IT management personnel and your assigned Progent consultant so any potential problems can be resolved before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by offering tools for performing common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, A/V protection, remote access, standard and custom scripts, resource inventory, endpoint profile reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alarm to your specified IT staff and your assigned Progent consultant so emerging issues can be fixed before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to diagram, track, reconfigure and debug their connectivity appliances such as routers, firewalls, and load balancers plus servers, printers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are always current, copies and displays the configuration information of virtually all devices on your network, monitors performance, and sends alerts when issues are detected. By automating tedious management and troubleshooting processes, WAN Watch can knock hours off common tasks such as making network diagrams, expanding your network, locating appliances that need critical updates, or resolving performance issues. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of in-depth management reporting plug-ins created to work with the top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to produce ProSight Data Protection Services (DPS), a selection of offerings that provide backup-as-a-service. ProSight DPS services automate and monitor your data backup operations and enable transparent backup and fast recovery of important files/folders, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets you protect against data loss resulting from equipment failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading information security companies to provide centralized management and world-class security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with a local gateway appliance to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The cloud filter acts as a first line of defense and keeps the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to external threats and saves system bandwidth and storage. Email Guard's on-premises security gateway appliance provides a further level of inspection for incoming email. For outgoing email, the local security gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, when you log into a protected application and enter your password you are asked to verify your identity on a device that only you possess and that uses a separate network channel. A wide range of devices can be used as this second means of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may register several verification devices. For more information about ProSight Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Help Center managed services allow your information technology team to outsource Call Center services to Progent or divide activity for Help Desk services transparently between your internal network support resources and Progent's extensive pool of certified IT service technicians, engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth extension of your corporate network support staff. End user interaction with the Help Desk, provision of support, problem escalation, ticket generation and updates, performance measurement, and maintenance of the support database are consistent regardless of whether incidents are taken care of by your in-house IT support resources, by Progent's team, or both. Find out more about Progent's outsourced/co-managed Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior analysis tools to defend endpoints and physical and virtual servers against new malware attacks like ransomware and email phishing, which routinely get by traditional signature-matching anti-virus products. Progent ASM services protect on-premises and cloud-based resources and offers a single platform to address the complete malware attack progression including blocking, infiltration detection, mitigation, remediation, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and safeguard data related to your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSLs ,domains or warranties. By updating and managing your IT documentation, you can save up to 50% of time wasted looking for critical information about your IT network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents required for managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT data. Whether you're making enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a flexible and affordable alternative for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT system. In addition to optimizing the protection and reliability of your computer network, Progent's patch management services allow your IT staff to focus on more strategic initiatives and activities that deliver maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host configured and maintained by Progent's IT support professionals. With Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved immediately to a different hardware solution without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based analysis tools to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which easily escape traditional signature-matching anti-virus tools. ProSight ASM protects local and cloud-based resources and provides a single platform to manage the complete threat progression including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services offer economical in-depth security for physical and virtual servers, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint management, and web filtering through leading-edge tools packaged within one agent accessible from a unified control. Progent's data protection and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that meets your company's specific requirements and that allows you demonstrate compliance with legal and industry data security regulations. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent action. Progent's consultants can also assist you to set up and test a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.