24-7 Toronto Immediate Ransomware
Malware Detection and Recovery Support

Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become an escalating cyberplague that poses an enterprise-level danger for organizations vulnerable to an attack. Different versions of ransomware like the Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to cause destruction. The latest versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as frequent as yet unnamed malware, not only do encryption of online critical data but also infect all configured system backups. Data replicated to off-site disaster recovery sites can also be held hostage. In a vulnerable system, this can render automatic recovery useless and basically sets the datacenter back to square one.

Getting back online applications and data following a ransomware outage becomes a race against time as the targeted organization tries its best to stop the spread, remove the ransomware, and restore mission-critical activity. Since ransomware requires time to spread, assaults are usually sprung during weekends and nights, when successful penetrations are likely to take more time to identify. This multiplies the difficulty of promptly marshalling and organizing a capable mitigation team.

Progent provides an assortment of support services for securing enterprises from ransomware events. Among these are staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security gateways with AI technology from SentinelOne to discover and disable zero-day threats intelligently. Progent in addition can provide the assistance of seasoned crypto-ransomware recovery engineers with the track record and commitment to restore a compromised environment as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware event, sending the ransom in cryptocurrency does not guarantee that cyber hackers will return the codes to decrypt any or all of your data. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to re-install the vital elements of your IT environment. Absent the availability of full information backups, this calls for a wide range of skills, well-coordinated team management, and the ability to work non-stop until the job is finished.

For decades, Progent has provided certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of experience gives Progent the skills to knowledgably identify necessary systems and re-organize the surviving parts of your IT system following a crypto-ransomware event and rebuild them into a functioning network.

Progent's recovery team uses top notch project management systems to orchestrate the complicated recovery process. Progent appreciates the importance of working rapidly and together with a customer's management and Information Technology staff to prioritize tasks and to put critical applications back on line as fast as possible.

Client Case Study: A Successful Ransomware Virus Response
A small business contacted Progent after their network was crashed by the Ryuk ransomware. Ryuk is believed to have been developed by Northern Korean state hackers, suspected of using approaches exposed from America's NSA organization. Ryuk goes after specific organizations with little room for disruption and is one of the most lucrative examples of ransomware viruses. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer based in Chicago with around 500 staff members. The Ryuk attack had paralyzed all essential operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and hoping for the best, but in the end reached out to Progent.

Progent worked hand in hand the client to quickly understand and prioritize the most important services that had to be addressed in order to resume company operations:

• Microsoft Active Directory
• Microsoft Exchange
• Financials/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then assisted with reinstallations and hard drive recovery of critical systems. All Exchange data and attributes were intact, which greatly helped the restore of Exchange. Progent was able to collect local OST files (Outlook Offline Folder Files) on various desktop computers and laptops to recover mail data. A not too old offline backup of the customer's accounting systems made it possible to restore these essential programs back servicing users. Although major work needed to be completed to recover completely from the Ryuk virus, core systems were restored rapidly:

Over the next couple of weeks important milestones in the recovery process were accomplished through tight cooperation between Progent consultants and the customer:

• Internal web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory capabilities were fully restored.
• A new Palo Alto Networks 850 firewall was set up.
• Ninety percent of the desktop computers were operational.

Conclusion
A probable company-ending catastrophe was avoided with results-oriented experts, a wide range of IT skills, and close collaboration. Although in retrospect the ransomware virus attack described here should have been identified and disabled with up-to-date cyber security solutions and recognized best practices, team training, and well designed security procedures for information protection and applying software patches, the reality is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, cleanup, and file restoration.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Toronto a portfolio of remote monitoring and security assessment services to assist you to minimize the threat from ransomware. These services incorporate next-generation machine learning capability to detect new strains of ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic packages include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to help keep your IT system operating efficiently by checking the state of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your designated IT management staff and your Progent consultant so that all looming problems can be addressed before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by offering an environment for performing common tedious tasks. These can include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, A/V protection, remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your specified IT management personnel and your Progent consultant so that potential issues can be fixed before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, track, optimize and troubleshoot their connectivity appliances like switches, firewalls, and load balancers as well as servers, endpoints and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that network diagrams are kept current, captures and manages the configuration information of virtually all devices connected to your network, monitors performance, and generates alerts when problems are discovered. By automating time-consuming network management activities, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that need important software patches, or isolating performance bottlenecks. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time reporting tools created to work with the industry's top ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-through or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services (DPS), a family of offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and enable non-disruptive backup and rapid restoration of vital files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS lets you recover from data loss caused by equipment failures, natural calamities, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned employees, or application bugs. Managed backup services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top data security vendors to deliver web-based control and world-class security for all your inbound and outbound email. The powerful architecture of Email Guard combines cloud-based filtering with a local gateway device to provide advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This decreases your exposure to external threats and saves system bandwidth and storage. Email Guard's on-premises security gateway device provides a deeper layer of inspection for inbound email. For outgoing email, the local gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also assist Exchange Server to monitor and protect internal email that stays within your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports one-tap identity confirmation on iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you log into a secured application and enter your password you are asked to confirm your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized for this second means of ID validation including a smartphone or watch, a hardware token, a landline phone, etc. You may register multiple verification devices. For more information about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Call Desk services enable your information technology staff to outsource Support Desk services to Progent or split activity for Help Desk services seamlessly between your in-house support team and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a seamless supplement to your corporate IT support organization. End user access to the Help Desk, delivery of technical assistance, issue escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the service database are consistent whether incidents are resolved by your internal support organization, by Progent, or both. Learn more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior-based machine learning technology to guard endpoint devices as well as servers and VMs against new malware assaults like ransomware and file-less exploits, which easily escape traditional signature-based AV tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a unified platform to automate the complete threat progression including filtering, detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and safeguard information about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs ,domains or warranties. By cleaning up and organizing your IT infrastructure documentation, you can save as much as half of time wasted trying to find critical information about your network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're making improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of any size a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and documenting updates to your dynamic information system. Besides optimizing the protection and functionality of your computer network, Progent's patch management services permit your in-house IT staff to concentrate on line-of-business projects and tasks that deliver the highest business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host configured and maintained by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the OS software, and the apps. Since the system is virtualized, it can be moved immediately to an alternate hardware solution without requiring a lengthy and technically risky configuration process. With ProSight Virtual Hosting, you are not tied one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoints against new malware assaults like ransomware and email phishing, which routinely escape traditional signature-based AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and offers a single platform to address the entire malware attack lifecycle including filtering, identification, containment, cleanup, and forensics. Top features include single-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer security for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP offers firewall protection, penetration alerts, device control, and web filtering via leading-edge tools packaged within one agent managed from a unified console. Progent's data protection and virtualization consultants can help you to design and implement a ProSight ESP environment that meets your company's specific needs and that allows you achieve and demonstrate compliance with government and industry information protection regulations. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require urgent action. Progent can also help your company to install and verify a backup and disaster recovery system like ProSight Data Protection Services so you can get back in business quickly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.