Sioux Falls 24/7/365 Immediate Crypto-Ransomware
Infection Detection and Recovery Help

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyber pandemic that poses an extinction-level threat for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for years and continue to cause damage. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with daily as yet unnamed malware, not only encrypt on-line critical data but also infiltrate any configured system protection. Files replicated to the cloud can also be corrupted. In a poorly designed environment, this can make any restoration impossible and basically sets the entire system back to zero.

Retrieving programs and data after a ransomware outage becomes a race against time as the targeted business fights to contain the damage, eradicate the ransomware, and resume business-critical operations. Due to the fact that ransomware needs time to replicate, assaults are usually launched during weekends and nights, when successful attacks typically take longer to identify. This multiplies the difficulty of quickly marshalling and coordinating an experienced mitigation team.

Progent offers an assortment of services for securing organizations from crypto-ransomware attacks. Among these are team education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of next-generation security gateways with AI capabilities from SentinelOne to identify and extinguish day-zero cyber attacks rapidly. Progent in addition can provide the assistance of experienced crypto-ransomware recovery engineers with the talent and commitment to reconstruct a compromised environment as quickly as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will return the codes to decipher all your data. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to re-install the key parts of your Information Technology environment. Absent access to essential system backups, this requires a broad complement of skills, well-coordinated project management, and the willingness to work continuously until the task is over.

For decades, Progent has made available certified expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP software solutions. This breadth of experience affords Progent the ability to rapidly determine necessary systems and integrate the remaining pieces of your computer network environment following a ransomware attack and assemble them into an operational system.

Progent's recovery team of experts has powerful project management systems to coordinate the sophisticated restoration process. Progent knows the importance of working rapidly and in concert with a client's management and Information Technology staff to assign priority to tasks and to get critical services back on-line as fast as humanly possible.

Business Case Study: A Successful Ransomware Attack Recovery
A client sought out Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean state hackers, possibly using algorithms leaked from the U.S. National Security Agency. Ryuk attacks specific organizations with little or no room for operational disruption and is one of the most lucrative versions of ransomware viruses. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in Chicago with around 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing processes. The majority of the client's system backups had been on-line at the time of the intrusion and were destroyed. The client was taking steps for paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately reached out to Progent.

Progent worked with the client to rapidly determine and assign priority to the essential areas that needed to be restored to make it possible to restart business functions:

• Microsoft Active Directory
• Exchange Server
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then charged ahead with rebuilding and hard drive recovery of mission critical servers. All Exchange Server data and attributes were intact, which facilitated the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Off-Line Data Files) on team desktop computers and laptops to recover mail data. A not too old off-line backup of the businesses accounting/MRP software made them able to recover these required applications back online. Although a lot of work remained to recover totally from the Ryuk event, critical services were returned to operations rapidly:

During the next few weeks key milestones in the recovery process were completed through tight cooperation between Progent engineers and the client:

• Internal web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was spun up and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory Control modules were completely functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• Ninety percent of the user desktops and notebooks were fully operational.

Conclusion
A probable business-killing catastrophe was evaded due to dedicated experts, a wide spectrum of knowledge, and tight teamwork. Although upon completion of forensics the crypto-ransomware attack detailed here would have been identified and disabled with advanced cyber security solutions and ISO/IEC 27001 best practices, user education, and properly executed incident response procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, remediation, and information systems recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Sioux Falls a range of remote monitoring and security assessment services to assist you to reduce your vulnerability to ransomware. These services include modern machine learning capability to uncover new strains of ransomware that are able to escape detection by traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the necessary monitoring and management for you, so your network scales easily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include RMM, security, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to help keep your network running efficiently by tracking the state of vital computers that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your designated IT management personnel and your assigned Progent engineering consultant so all looming issues can be resolved before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for monitoring and managing your client-server infrastructure by offering an environment for performing common tedious tasks. These include health monitoring, patch management, automated repairs, endpoint configuration, backup and recovery, A/V protection, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alert to your specified IT management staff and your Progent technical consultant so that potential issues can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized organizations to diagram, monitor, reconfigure and debug their networking appliances such as routers, firewalls, and access points as well as servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network maps are always current, copies and displays the configuration information of virtually all devices connected to your network, monitors performance, and sends notices when potential issues are detected. By automating time-consuming management activities, ProSight WAN Watch can knock hours off ordinary chores such as making network diagrams, reconfiguring your network, locating appliances that require important software patches, or resolving performance issues. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth reporting utilities created to integrate with the industry's top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like inconsistent support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services, a selection of subscription-based offerings that provide backup-as-a-service. ProSight DPS services manage and track your backup operations and allow non-disruptive backup and rapid recovery of important files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business avoid data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, ill-intentioned insiders, or software glitches. Managed backup services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading information security companies to deliver web-based management and world-class protection for your email traffic. The powerful architecture of Email Guard managed service integrates a Cloud Protection Layer with a local security gateway device to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to external attacks and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance provides a deeper layer of analysis for incoming email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite gateway can also assist Exchange Server to track and safeguard internal email that originates and ends within your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication. Duo supports one-tap identity confirmation with iOS, Google Android, and other personal devices. Using Duo 2FA, when you log into a protected application and enter your password you are requested to confirm who you are on a device that only you possess and that uses a different ("out-of-band") network channel. A broad selection of devices can be utilized for this added form of authentication including a smartphone or watch, a hardware/software token, a landline phone, etc. You can register several validation devices. To learn more about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Desk: Help Desk Managed Services
  Progent's Call Center services enable your information technology group to outsource Help Desk services to Progent or divide responsibilities for support services seamlessly between your in-house support staff and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a transparent supplement to your corporate IT support organization. Client interaction with the Help Desk, provision of support services, escalation, ticket generation and tracking, performance measurement, and management of the service database are consistent whether incidents are taken care of by your corporate support organization, by Progent, or by a combination. Read more about Progent's outsourced/shared Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior-based machine learning technology to defend endpoints as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which routinely get by legacy signature-matching anti-virus tools. Progent ASM services protect local and cloud-based resources and provides a single platform to automate the entire malware attack lifecycle including protection, identification, containment, cleanup, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and safeguard information related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be warned about impending expirations of SSLs ,domains or warranties. By updating and managing your network documentation, you can eliminate up to 50% of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're planning improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and affordable solution for assessing, testing, scheduling, applying, and tracking updates to your dynamic information network. Besides maximizing the security and reliability of your computer network, Progent's software/firmware update management services permit your IT team to concentrate on line-of-business initiatives and tasks that derive the highest business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected Tier III data center on a fast virtual host set up and maintained by Progent's IT support experts. Under the ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be moved immediately to a different hosting environment without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which easily escape legacy signature-matching AV products. ProSight ASM safeguards on-premises and cloud-based resources and offers a single platform to automate the complete malware attack progression including blocking, detection, containment, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection services deliver ultra-affordable in-depth protection for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and responding to cyber assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge tools incorporated within a single agent managed from a unified control. Progent's security and virtualization consultants can help you to plan and configure a ProSight ESP deployment that addresses your organization's unique requirements and that helps you achieve and demonstrate compliance with legal and industry data security regulations. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require immediate attention. Progent's consultants can also assist you to set up and verify a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.