Saddle Brook 24/7/365 Immediate Crypto
Malware Assessment and Remediation Experts

Crypto-Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a modern cyberplague that presents an enterprise-level danger for businesses vulnerable to an attack. Different versions of ransomware like the Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for years and continue to cause harm. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus daily as yet unnamed newcomers, not only do encryption of on-line data but also infiltrate most configured system restores and backups. Files synchronized to the cloud can also be corrupted. In a poorly designed system, this can render automated restore operations useless and basically sets the datacenter back to square one.

Getting back programs and data following a ransomware event becomes a race against the clock as the targeted business tries its best to stop the spread, clear the ransomware, and resume enterprise-critical activity. Because ransomware takes time to spread, assaults are usually launched on weekends, when successful penetrations tend to take longer to detect. This compounds the difficulty of quickly assembling and orchestrating a capable response team.

Progent has an assortment of help services for protecting organizations from ransomware attacks. These include staff education to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of next-generation security gateways with artificial intelligence technology from SentinelOne to detect and extinguish day-zero cyber threats automatically. Progent also offers the assistance of veteran ransomware recovery engineers with the talent and perseverance to restore a compromised environment as quickly as possible.

Progent's Ransomware Recovery Help
Following a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that cyber criminals will return the needed codes to unencrypt any or all of your data. Kaspersky estimated that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to setup from scratch the critical elements of your Information Technology environment. Absent access to essential information backups, this calls for a broad complement of skills, professional team management, and the willingness to work non-stop until the task is completed.

For twenty years, Progent has made available professional IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience provides Progent the capability to efficiently ascertain critical systems and consolidate the remaining parts of your IT environment following a ransomware event and rebuild them into an operational system.

Progent's ransomware team of experts utilizes best of breed project management applications to coordinate the complicated restoration process. Progent understands the importance of acting rapidly and together with a client's management and IT team members to assign priority to tasks and to get key services back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Attack Recovery
A customer hired Progent after their network was brought down by the Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean state sponsored hackers, suspected of using algorithms leaked from the United States National Security Agency. Ryuk seeks specific organizations with limited room for disruption and is one of the most profitable examples of ransomware malware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago with around 500 staff members. The Ryuk intrusion had disabled all business operations and manufacturing processes. The majority of the client's backups had been online at the time of the intrusion and were eventually encrypted. The client considered paying the ransom (exceeding $200K) and hoping for the best, but in the end brought in Progent.

Progent worked together with the client to quickly understand and prioritize the essential elements that needed to be addressed in order to restart business functions:

• Microsoft Active Directory
• Microsoft Exchange Email
• Financials/MRP

Within two days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then completed rebuilding and storage recovery on critical systems. All Microsoft Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Offline Data Files) on user PCs and laptops to recover mail messages. A recent off-line backup of the businesses financials/ERP software made it possible to return these required programs back online for users. Although a lot of work was left to recover completely from the Ryuk attack, critical services were recovered rapidly:

Over the following few weeks key milestones in the restoration project were achieved through tight cooperation between Progent engineers and the customer:

• In-house web sites were returned to operation without losing any information.
• The MailStore Server containing more than 4 million historical messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were completely operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the user workstations were fully operational.

Conclusion
A likely company-ending catastrophe was avoided with dedicated experts, a broad array of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware attack detailed here could have been identified and stopped with current cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and appropriate incident response procedures for information backup and applying software patches, the reality remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incursion, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, cleanup, and file disaster recovery.

To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Saddle Brook a range of remote monitoring and security evaluation services designed to help you to reduce your vulnerability to crypto-ransomware. These services utilize modern artificial intelligence technology to detect zero-day variants of ransomware that can evade legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network scales easily without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Entry-level packages include RMM, cybersecurity, monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management technology to help keep your network running efficiently by checking the health of vital computers that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your specified IT management personnel and your assigned Progent engineering consultant so that all looming issues can be addressed before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious jobs. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your designated IT staff and your assigned Progent technical consultant so emerging issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized organizations to map out, track, optimize and debug their connectivity hardware such as switches, firewalls, and access points as well as servers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and manages the configuration information of almost all devices on your network, tracks performance, and generates alerts when problems are discovered. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can knock hours off common chores like network mapping, expanding your network, locating appliances that need important software patches, or resolving performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time management reporting tools created to integrate with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup software companies to produce ProSight Data Protection Services (DPS), a selection of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your backup processes and allow non-disruptive backup and fast restoration of important files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business avoid data loss resulting from equipment failures, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned employees, or application glitches. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of leading data security vendors to deliver centralized control and world-class protection for all your email traffic. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from reaching your security perimeter. This reduces your vulnerability to external threats and saves system bandwidth and storage. Email Guard's on-premises security gateway appliance adds a further level of analysis for inbound email. For outbound email, the local gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables single-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you sign into a protected application and enter your password you are asked to confirm your identity on a device that only you possess and that is accessed using a different network channel. A wide selection of out-of-band devices can be used for this second form of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You can register multiple verification devices. To find out more about Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Call Desk services permit your IT staff to outsource Support Desk services to Progent or divide activity for Service Desk support seamlessly between your internal network support staff and Progent's extensive pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent supplement to your core network support team. User interaction with the Help Desk, provision of support, issue escalation, trouble ticket creation and updates, performance metrics, and management of the support database are cohesive regardless of whether incidents are resolved by your corporate support group, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Service Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes next generation behavior analysis technology to defend endpoints and physical and virtual servers against new malware assaults like ransomware and email phishing, which easily get by legacy signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a unified platform to manage the entire threat progression including filtering, detection, mitigation, remediation, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new attacks. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and safeguard data related to your network infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates ,domains or warranties. By updating and organizing your IT documentation, you can save up to half of time wasted trying to find vital information about your IT network. ProSight IT Asset Management features a centralized location for storing and sharing all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're making enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you need when you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer businesses of any size a versatile and affordable alternative for assessing, validating, scheduling, applying, and documenting updates to your dynamic IT system. Besides maximizing the protection and reliability of your IT network, Progent's patch management services permit your in-house IT team to focus on line-of-business projects and activities that deliver the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host set up and maintained by Progent's IT support professionals. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the applications. Because the environment is virtualized, it can be ported immediately to an alternate hardware environment without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-based anti-virus products. ProSight ASM safeguards on-premises and cloud-based resources and provides a unified platform to manage the entire threat lifecycle including blocking, identification, containment, remediation, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver economical multi-layer protection for physical servers and VMs, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP delivers firewall protection, penetration alerts, device control, and web filtering via cutting-edge technologies incorporated within one agent managed from a unified console. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP environment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry information protection standards. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require immediate attention. Progent can also help you to set up and verify a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.