24x7x365 Beverly Hills Immediate CryptoLocker
Infection Identification and Removal Services

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an extinction-level threat for businesses vulnerable to an assault. Versions of ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict havoc. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as more as yet unnamed viruses, not only encrypt on-line data but also infect all accessible system restores and backups. Data replicated to off-site disaster recovery sites can also be held hostage. In a vulnerable environment, this can render any recovery hopeless and effectively sets the network back to zero.

Recovering programs and information following a crypto-ransomware intrusion becomes a sprint against time as the victim tries its best to stop the spread, eradicate the ransomware, and resume business-critical operations. Since ransomware takes time to spread, penetrations are frequently sprung on weekends, when successful penetrations in many cases take longer to discover. This multiplies the difficulty of quickly marshalling and coordinating an experienced mitigation team.

Progent provides a range of support services for protecting enterprises from ransomware attacks. These include user training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of the latest generation security appliances with machine learning technology from SentinelOne to identify and quarantine zero-day cyber threats automatically. Progent in addition provides the services of expert ransomware recovery consultants with the talent and commitment to restore a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
After a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will respond with the needed keys to unencrypt all your information. Kaspersky determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to re-install the essential elements of your IT environment. Absent access to full data backups, this requires a broad complement of IT skills, professional team management, and the willingness to work non-stop until the task is finished.

For twenty years, Progent has made available expert IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of experience provides Progent the ability to rapidly determine necessary systems and consolidate the remaining parts of your computer network environment after a ransomware attack and rebuild them into an operational network.

Progent's recovery group deploys top notch project management systems to orchestrate the complex restoration process. Progent understands the importance of acting quickly and together with a customer's management and IT resources to prioritize tasks and to put critical systems back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Attack Response
A customer escalated to Progent after their network system was brought down by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored criminal gangs, suspected of adopting techniques exposed from America's NSA organization. Ryuk targets specific businesses with limited tolerance for operational disruption and is one of the most lucrative versions of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area and has about 500 workers. The Ryuk attack had frozen all company operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and wishfully thinking for the best, but ultimately called Progent.

Progent worked together with the customer to quickly assess and assign priority to the mission critical systems that needed to be restored to make it possible to restart company functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then performed setup and storage recovery on key servers. All Exchange ties and attributes were intact, which facilitated the restore of Exchange. Progent was able to find local OST data files (Microsoft Outlook Offline Data Files) on staff workstations to recover mail information. A not too old offline backup of the businesses financials/MRP software made them able to return these required services back online for users. Although significant work needed to be completed to recover fully from the Ryuk attack, core services were returned to operations quickly:

Over the next few weeks critical milestones in the restoration process were made in close cooperation between Progent engineers and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Server containing more than four million historical emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory modules were completely recovered.
• A new Palo Alto 850 security appliance was deployed.
• Most of the desktop computers were fully operational.

Conclusion
A possible company-ending disaster was evaded by top-tier professionals, a wide array of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware virus incident detailed here should have been prevented with up-to-date cyber security solutions and recognized best practices, user and IT administrator education, and well thought out security procedures for data backup and applying software patches, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, remediation, and data restoration.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Beverly Hills a variety of remote monitoring and security evaluation services designed to help you to minimize the threat from ransomware. These services include next-generation AI capability to uncover new strains of ransomware that are able to get past traditional signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the daily monitoring and maintenance for you, so your network expands readily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, security, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management technology to help keep your network operating efficiently by checking the state of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your designated IT staff and your assigned Progent engineering consultant so all potential problems can be resolved before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your client-server infrastructure by offering tools for performing common tedious tasks. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, A/V response, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your designated IT staff and your assigned Progent consultant so that emerging problems can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, monitor, enhance and debug their connectivity hardware like routers, firewalls, and access points as well as servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology diagrams are always current, captures and displays the configuration of virtually all devices on your network, monitors performance, and generates notices when problems are discovered. By automating tedious management activities, WAN Watch can knock hours off ordinary chores such as making network diagrams, expanding your network, locating devices that need critical software patches, or isolating performance problems. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time and in-depth reporting utilities created to work with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology providers to create ProSight Data Protection Services, a selection of management offerings that deliver backup-as-a-service. ProSight DPS services automate and monitor your backup processes and allow non-disruptive backup and fast restoration of critical files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you protect against data loss caused by hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, user mistakes, malicious employees, or application glitches. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security vendors to provide web-based management and comprehensive protection for your inbound and outbound email. The powerful architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps most unwanted email from making it to your security perimeter. This reduces your vulnerability to external attacks and saves network bandwidth and storage space. Email Guard's on-premises gateway device provides a deeper level of analysis for inbound email. For outbound email, the local security gateway provides AV and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also help Exchange Server to monitor and protect internal email that stays within your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo enables one-tap identity verification on Apple iOS, Android, and other personal devices. With Duo 2FA, when you log into a protected application and enter your password you are requested to verify who you are via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be used as this added form of authentication such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may designate several validation devices. To find out more about Duo two-factor identity validation services, visit Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Center: Help Desk Managed Services
  Progent's Support Center managed services enable your information technology group to offload Help Desk services to Progent or divide activity for Service Desk support transparently between your internal network support staff and Progent's extensive pool of IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a transparent supplement to your corporate IT support organization. User interaction with the Service Desk, delivery of support, escalation, trouble ticket generation and tracking, efficiency metrics, and management of the support database are consistent whether issues are resolved by your core network support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Service Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates next generation behavior-based analysis tools to guard endpoints as well as physical and virtual servers against new malware assaults like ransomware and file-less exploits, which easily escape legacy signature-matching anti-virus tools. Progent ASM services protect local and cloud resources and provides a single platform to address the entire threat lifecycle including blocking, detection, mitigation, remediation, and forensics. Key capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, find and safeguard data related to your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or domains. By cleaning up and managing your network documentation, you can eliminate as much as 50% of time spent looking for vital information about your IT network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of any size a versatile and cost-effective alternative for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information system. Besides optimizing the security and reliability of your IT environment, Progent's patch management services permit your in-house IT team to concentrate on line-of-business initiatives and tasks that deliver the highest business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the operating system platforms, and the apps. Because the system is virtualized, it can be moved easily to an alternate hosting solution without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which routinely escape legacy signature-matching AV products. ProSight ASM safeguards on-premises and cloud resources and offers a unified platform to address the complete threat progression including blocking, identification, containment, remediation, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable multi-layer protection for physical servers and VMs, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP provides firewall protection, penetration alarms, endpoint management, and web filtering through leading-edge technologies packaged within one agent managed from a unified control. Progent's data protection and virtualization experts can help your business to plan and implement a ProSight ESP deployment that addresses your company's unique needs and that allows you demonstrate compliance with legal and industry information protection standards. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that require immediate attention. Progent's consultants can also help you to install and verify a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.