Spokane 24x7x365 Emergency Crypto
Computer Virus Damage Assessment and Repair Support

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyberplague that poses an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware such as Dharma, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for years and still cause havoc. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, as well as additional unnamed malware, not only do encryption of on-line information but also infect most accessible system restores and backups. Data replicated to off-site disaster recovery sites can also be ransomed. In a vulnerable data protection solution, this can render automated restoration useless and effectively knocks the entire system back to square one.

Getting back online programs and data after a ransomware outage becomes a race against the clock as the targeted organization tries its best to contain the damage, eradicate the virus, and restore enterprise-critical operations. Due to the fact that ransomware takes time to move laterally, penetrations are often sprung during nights and weekends, when attacks may take more time to discover. This compounds the difficulty of quickly mobilizing and coordinating a knowledgeable mitigation team.

Progent provides a variety of support services for securing enterprises from ransomware events. Among these are team training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security appliances with artificial intelligence capabilities from SentinelOne to identify and disable day-zero threats automatically. Progent in addition can provide the services of experienced ransomware recovery consultants with the talent and perseverance to re-deploy a compromised environment as soon as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the keys to unencrypt all your information. Kaspersky estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the key parts of your Information Technology environment. Without the availability of essential data backups, this calls for a wide range of skills, top notch team management, and the ability to work continuously until the task is done.

For twenty years, Progent has provided certified expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained top certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of experience provides Progent the ability to quickly understand important systems and integrate the remaining components of your IT environment following a ransomware event and assemble them into a functioning network.

Progent's recovery group uses powerful project management applications to coordinate the sophisticated recovery process. Progent knows the importance of acting rapidly and together with a customer's management and Information Technology team members to prioritize tasks and to put critical services back on-line as fast as humanly possible.

Customer Story: A Successful Ransomware Virus Restoration
A business engaged Progent after their network was crashed by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean government sponsored hackers, suspected of using algorithms leaked from the United States NSA organization. Ryuk attacks specific companies with little tolerance for operational disruption and is one of the most lucrative incarnations of ransomware viruses. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago and has around 500 workers. The Ryuk intrusion had shut down all business operations and manufacturing processes. Most of the client's backups had been on-line at the start of the intrusion and were damaged. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked hand in hand the client to quickly assess and prioritize the critical areas that needed to be addressed in order to continue company operations:

• Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then performed setup and hard drive recovery on the most important systems. All Exchange Server data and attributes were intact, which accelerated the restore of Exchange. Progent was also able to collect local OST data files (Outlook Email Offline Data Files) on user PCs in order to recover email information. A not too old off-line backup of the businesses financials/MRP software made it possible to return these essential programs back online. Although major work needed to be completed to recover totally from the Ryuk damage, critical systems were recovered rapidly:

During the following few weeks important milestones in the recovery project were made in tight cooperation between Progent engineers and the client:

• Internal web sites were returned to operation without losing any data.
• The MailStore Exchange Server containing more than four million historical messages was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were 100 percent operational.
• A new Palo Alto 850 security appliance was installed.
• 90% of the user desktops were back into operation.

Conclusion
A likely enterprise-killing catastrophe was dodged by dedicated experts, a broad array of subject matter expertise, and close teamwork. Although in hindsight the ransomware incident described here could have been identified and blocked with current security technology and NIST Cybersecurity Framework best practices, user education, and well designed security procedures for information protection and proper patching controls, the reality is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, remember that Progent's roster of professionals has substantial experience in ransomware virus defense, remediation, and information systems recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Spokane a range of remote monitoring and security evaluation services to assist you to reduce your vulnerability to ransomware. These services utilize next-generation artificial intelligence technology to detect new strains of ransomware that are able to get past traditional signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management techniques to keep your IT system operating at peak levels by checking the health of vital computers that power your business network. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT management personnel and your Progent engineering consultant so that all potential issues can be addressed before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by offering tools for performing common tedious jobs. These can include health monitoring, update management, automated repairs, endpoint setup, backup and recovery, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alarm to your designated IT management staff and your assigned Progent technical consultant so that emerging issues can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller businesses to map, track, enhance and debug their connectivity appliances like switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are always updated, captures and displays the configuration information of virtually all devices on your network, tracks performance, and generates notices when potential issues are detected. By automating time-consuming network management processes, ProSight WAN Watch can cut hours off common tasks like making network diagrams, reconfiguring your network, locating appliances that need important updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth reporting plug-ins designed to work with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services, a selection of management offerings that deliver backup-as-a-service. ProSight DPS products automate and monitor your data backup operations and allow non-disruptive backup and fast restoration of vital files/folders, applications, system images, plus virtual machines. ProSight DPS helps your business protect against data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious employees, or software bugs. Managed backup services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to provide web-based management and world-class protection for your email traffic. The hybrid structure of Email Guard managed service integrates a Cloud Protection Layer with a local gateway device to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The cloud filter acts as a preliminary barricade and blocks the vast majority of threats from reaching your network firewall. This reduces your exposure to inbound attacks and conserves network bandwidth and storage space. Email Guard's onsite gateway device adds a deeper level of analysis for inbound email. For outbound email, the on-premises gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that stays inside your security perimeter. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication. Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you sign into a secured application and enter your password you are requested to confirm your identity on a unit that only you have and that uses a different ("out-of-band") network channel. A wide range of devices can be used for this added form of ID validation such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may register multiple verification devices. For more information about Duo two-factor identity validation services, go to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Desk: Call Center Managed Services
  Progent's Help Center services allow your IT staff to outsource Support Desk services to Progent or split responsibilities for support services seamlessly between your in-house support group and Progent's extensive pool of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a smooth supplement to your core support group. Client access to the Service Desk, delivery of support services, escalation, ticket generation and tracking, performance measurement, and management of the support database are consistent whether issues are resolved by your corporate IT support staff, by Progent, or by a combination. Read more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior machine learning tools to defend endpoints as well as physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-based anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud resources and provides a unified platform to automate the complete threat lifecycle including blocking, infiltration detection, containment, cleanup, and forensics. Top capabilities include single-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard information about your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs ,domains or warranties. By cleaning up and organizing your IT infrastructure documentation, you can save up to half of time wasted searching for vital information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and collaborating on all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're making improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you need when you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of all sizes a versatile and cost-effective solution for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving information network. In addition to optimizing the security and reliability of your IT network, Progent's patch management services permit your in-house IT staff to concentrate on more strategic projects and tasks that derive maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual host set up and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS platforms, and the applications. Since the system is virtualized, it can be ported easily to an alternate hardware solution without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based analysis technology to guard physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which easily escape traditional signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to manage the entire threat progression including blocking, detection, containment, remediation, and forensics. Top features include single-click rollback with Windows VSS and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver ultra-affordable in-depth protection for physical servers and VMs, workstations, smartphones, and Exchange Server. ProSight ESP utilizes adaptive security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alarms, device management, and web filtering via cutting-edge technologies incorporated within one agent managed from a single control. Progent's security and virtualization experts can help you to plan and implement a ProSight ESP deployment that meets your company's unique needs and that helps you demonstrate compliance with legal and industry data protection standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that require urgent attention. Progent can also assist your company to install and test a backup and disaster recovery system like ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.