Sacramento 24x7 Emergency Ransomware
Infection Detection and Recovery Consultants

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that represents an existential threat for organizations vulnerable to an assault. Multiple generations of ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for many years and still inflict damage. Newer strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with additional as yet unnamed malware, not only encrypt online information but also infiltrate any configured system backups. Data synched to off-site disaster recovery sites can also be corrupted. In a vulnerable system, this can make automated recovery hopeless and basically sets the datacenter back to square one.

Getting back online applications and information following a crypto-ransomware outage becomes a sprint against the clock as the targeted business tries its best to stop lateral movement, eradicate the virus, and resume business-critical operations. Since crypto-ransomware takes time to spread, attacks are frequently launched at night, when penetrations in many cases take longer to uncover. This compounds the difficulty of rapidly marshalling and orchestrating a knowledgeable response team.

Progent makes available an assortment of help services for protecting businesses from ransomware penetrations. Among these are staff education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of next-generation security solutions with artificial intelligence technology from SentinelOne to discover and extinguish new cyber attacks quickly. Progent in addition provides the services of expert crypto-ransomware recovery engineers with the skills and perseverance to reconstruct a compromised environment as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the keys to unencrypt all your information. Kaspersky determined that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to piece back together the key parts of your IT environment. Absent the availability of essential system backups, this requires a wide range of skills, well-coordinated team management, and the willingness to work 24x7 until the recovery project is completed.

For two decades, Progent has made available professional IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of expertise provides Progent the skills to quickly determine critical systems and consolidate the surviving components of your Information Technology environment following a ransomware penetration and assemble them into a functioning system.

Progent's security team of experts utilizes top notch project management tools to orchestrate the complicated recovery process. Progent appreciates the importance of working quickly and in concert with a customer's management and Information Technology staff to prioritize tasks and to get key services back on-line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Incident Response
A business sought out Progent after their network was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored hackers, possibly adopting technology leaked from the U.S. NSA organization. Ryuk attacks specific businesses with little tolerance for operational disruption and is one of the most profitable versions of crypto-ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago with about 500 staff members. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the time of the attack and were eventually encrypted. The client was taking steps for paying the ransom (exceeding $200K) and hoping for the best, but in the end engaged Progent.

Progent worked hand in hand the client to quickly get our arms around and assign priority to the critical systems that needed to be addressed in order to restart company operations:

• Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within 48 hours, Progent was able to recover Active Directory services to its pre-attack state. Progent then assisted with rebuilding and storage recovery on needed systems. All Exchange Server schema and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to find local OST data files (Microsoft Outlook Off-Line Data Files) on staff PCs to recover mail information. A not too old offline backup of the customer's manufacturing systems made them able to restore these required applications back servicing users. Although major work needed to be completed to recover completely from the Ryuk virus, critical services were restored rapidly:

Throughout the next few weeks key milestones in the recovery process were achieved through close collaboration between Progent team members and the client:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Server containing more than four million historical messages was spun up and available for users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory modules were 100% recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Nearly all of the user desktops and notebooks were back into operation.

Conclusion
A probable business-ending disaster was avoided by top-tier professionals, a broad array of IT skills, and close collaboration. Although upon completion of forensics the ransomware attack described here would have been shut down with up-to-date cyber security technology and best practices, staff education, and well thought out security procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's roster of professionals has substantial experience in ransomware virus defense, removal, and information systems recovery.

To read or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Sacramento a range of remote monitoring and security assessment services to assist you to minimize the threat from crypto-ransomware. These services incorporate modern machine learning technology to uncover zero-day variants of crypto-ransomware that can evade traditional signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the daily monitoring and maintenance for you, so your network expands easily without holding you back. For a low and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Entry-level plans include remote monitoring and management (RMM), cybersecurity, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management technology to keep your IT system operating at peak levels by tracking the state of critical assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your designated IT management personnel and your assigned Progent consultant so that all looming problems can be resolved before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your client-server infrastructure by offering tools for performing common tedious jobs. These include health monitoring, update management, automated remediation, endpoint setup, backup and restore, anti-virus protection, remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alert to your designated IT personnel and your assigned Progent technical consultant so that potential issues can be taken care of before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map out, track, reconfigure and troubleshoot their connectivity hardware such as switches, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that network maps are always current, captures and manages the configuration of almost all devices on your network, tracks performance, and sends notices when potential issues are detected. By automating complex network management activities, ProSight WAN Watch can knock hours off ordinary tasks like network mapping, expanding your network, locating appliances that require critical software patches, or identifying the cause of performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of in-depth reporting tools designed to work with the industry's leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-through or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with leading backup software companies to create ProSight Data Protection Services (DPS), a portfolio of offerings that provide backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup operations and allow non-disruptive backup and rapid restoration of critical files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, human error, ill-intentioned employees, or software glitches. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading information security companies to deliver web-based control and world-class protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates cloud-based filtering with a local gateway device to offer complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of threats from reaching your network firewall. This reduces your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a further level of analysis for incoming email. For outbound email, the on-premises security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With 2FA, whenever you log into a secured application and enter your password you are asked to confirm your identity on a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You may designate several validation devices. For more information about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Support Center managed services allow your information technology group to outsource Call Center services to Progent or divide responsibilities for Help Desk services transparently between your internal support group and Progent's extensive roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a smooth extension of your core support staff. User access to the Service Desk, provision of support services, issue escalation, trouble ticket creation and updates, performance measurement, and management of the service database are consistent whether issues are resolved by your corporate support resources, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Help Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior machine learning technology to guard endpoints and physical and virtual servers against modern malware assaults such as ransomware and email phishing, which easily get by legacy signature-based anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a unified platform to manage the complete threat progression including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and safeguard information about your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time spent trying to find critical information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents required for managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're planning enhancements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic information network. Besides optimizing the protection and functionality of your computer network, Progent's software/firmware update management services permit your in-house IT team to concentrate on more strategic projects and tasks that deliver the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host configured and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported easily to a different hardware solution without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoints against modern malware assaults like ransomware and email phishing, which routinely get by traditional signature-matching AV products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a single platform to address the entire malware attack lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth protection for physical servers and VMs, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP delivers firewall protection, penetration alarms, device control, and web filtering through cutting-edge technologies incorporated within one agent managed from a single console. Progent's security and virtualization consultants can assist your business to design and implement a ProSight ESP deployment that addresses your organization's specific needs and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent's consultants can also assist your company to set up and test a backup and restore system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange email filtering.