Tulsa 24x7x365 Urgent Crypto
Virus Identification and Restoration Services

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses unprepared for an assault. Different versions of ransomware like the CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and still inflict damage. The latest variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as additional unnamed viruses, not only encrypt on-line information but also infiltrate most configured system protection mechanisms. Information synched to cloud environments can also be corrupted. In a poorly architected data protection solution, this can make any recovery impossible and effectively knocks the datacenter back to square one.

Restoring programs and information after a crypto-ransomware intrusion becomes a sprint against the clock as the victim struggles to contain the damage, cleanup the virus, and restore mission-critical activity. Because ransomware takes time to move laterally, attacks are frequently sprung during weekends and nights, when penetrations are likely to take more time to identify. This multiplies the difficulty of rapidly mobilizing and organizing an experienced response team.

Progent provides a variety of support services for securing businesses from crypto-ransomware events. Among these are team member training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security appliances with AI capabilities from SentinelOne to identify and disable new cyber threats rapidly. Progent in addition offers the services of veteran ransomware recovery professionals with the talent and commitment to reconstruct a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
After a ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that cyber criminals will return the codes to decipher any or all of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to piece back together the essential parts of your IT environment. Absent the availability of essential information backups, this requires a broad range of skill sets, well-coordinated team management, and the willingness to work continuously until the job is completed.

For decades, Progent has offered expert IT services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained top certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of expertise affords Progent the skills to efficiently identify important systems and consolidate the remaining components of your Information Technology system after a ransomware penetration and configure them into an operational network.

Progent's security team has powerful project management applications to orchestrate the complicated recovery process. Progent understands the urgency of acting quickly and in concert with a client's management and Information Technology resources to prioritize tasks and to get the most important applications back on line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Virus Response
A customer engaged Progent after their network system was brought down by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state sponsored criminal gangs, suspected of adopting approaches exposed from the United States National Security Agency. Ryuk goes after specific organizations with little or no ability to sustain disruption and is among the most profitable versions of crypto-ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area and has around 500 staff members. The Ryuk event had paralyzed all essential operations and manufacturing processes. Most of the client's data protection had been on-line at the time of the attack and were eventually encrypted. The client considered paying the ransom demand (exceeding $200,000) and praying for the best, but ultimately brought in Progent.

Progent worked with the customer to quickly assess and assign priority to the key services that had to be restored in order to continue departmental operations:

• Active Directory
• Electronic Messaging
• Accounting/MRP

Within 48 hours, Progent was able to restore Active Directory to its pre-intrusion state. Progent then charged ahead with setup and storage recovery on needed applications. All Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to assemble non-encrypted OST data files (Microsoft Outlook Offline Data Files) on user PCs in order to recover email messages. A recent offline backup of the client's financials/MRP systems made them able to return these essential applications back online for users. Although major work was left to recover totally from the Ryuk event, core systems were recovered quickly:

Over the next month key milestones in the restoration project were achieved through tight cooperation between Progent consultants and the customer:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory capabilities were 100 percent functional.
• A new Palo Alto 850 security appliance was set up and programmed.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A likely business catastrophe was evaded with dedicated professionals, a broad range of IT skills, and tight teamwork. Although in hindsight the crypto-ransomware penetration described here would have been stopped with modern security solutions and recognized best practices, staff education, and well designed incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's team of professionals has a proven track record in ransomware virus blocking, cleanup, and information systems recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Tulsa a variety of remote monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services incorporate next-generation machine learning capability to uncover new variants of ransomware that are able to get past traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands readily without holding you back. For a low and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Basic packages include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system operating at peak levels by tracking the health of vital computers that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your specified IT management staff and your Progent consultant so all looming problems can be addressed before they can impact your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for managing your network, server, and desktop devices by providing tools for performing common time-consuming jobs. These include health checking, update management, automated repairs, endpoint configuration, backup and restore, A/V response, secure remote access, built-in and custom scripts, asset inventory, endpoint status reports, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alarm to your designated IT personnel and your Progent consultant so potential problems can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to diagram, monitor, enhance and debug their connectivity hardware such as routers and switches, firewalls, and wireless controllers as well as servers, printers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always current, captures and displays the configuration information of almost all devices on your network, monitors performance, and sends notices when issues are detected. By automating time-consuming network management processes, WAN Watch can knock hours off common chores like making network diagrams, expanding your network, finding devices that need important software patches, or resolving performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time management reporting plug-ins designed to work with the industry's top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with leading backup software companies to create ProSight Data Protection Services, a selection of subscription-based management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup operations and allow transparent backup and fast recovery of vital files/folders, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss caused by equipment failures, natural disasters, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed backup services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security vendors to deliver centralized management and world-class security for your email traffic. The powerful architecture of Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to provide complete protection against spam, viruses, Dos Attacks, DHAs, and other email-based threats. The cloud filter serves as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This reduces your vulnerability to external threats and saves network bandwidth and storage space. Email Guard's on-premises security gateway device provides a deeper layer of analysis for inbound email. For outbound email, the local security gateway offers anti-virus and anti-spam protection, DLP, and email encryption. The onsite gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication. Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you log into a secured online account and give your password you are asked to confirm who you are via a device that only you possess and that is accessed using a separate network channel. A wide range of out-of-band devices can be utilized for this second form of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You may register several validation devices. To learn more about ProSight Duo identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Support Desk Managed Services
  Progent's Help Center services allow your IT group to offload Call Center services to Progent or divide responsibilities for support services transparently between your in-house network support group and Progent's extensive pool of IT service technicians, engineers and subject matter experts. Progent's Shared Help Desk Service provides a seamless extension of your internal network support organization. Client interaction with the Service Desk, delivery of technical assistance, problem escalation, ticket generation and tracking, efficiency metrics, and maintenance of the service database are cohesive regardless of whether issues are taken care of by your in-house IT support group, by Progent's team, or both. Find out more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior analysis technology to defend endpoints and servers and VMs against modern malware assaults such as ransomware and email phishing, which routinely escape traditional signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a unified platform to automate the complete malware attack lifecycle including blocking, detection, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and protect data related to your network infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSL certificates or domains. By cleaning up and organizing your IT infrastructure documentation, you can save as much as half of time thrown away trying to find critical information about your IT network. ProSight IT Asset Management includes a common repository for storing and sharing all documents required for managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making improvements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide businesses of all sizes a flexible and cost-effective alternative for assessing, testing, scheduling, implementing, and documenting updates to your ever-evolving IT network. In addition to maximizing the protection and functionality of your computer environment, Progent's patch management services permit your IT staff to concentrate on line-of-business projects and tasks that deliver maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS platforms, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hardware environment without requiring a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-matching AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to automate the entire malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection services offer economical in-depth protection for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP delivers firewall protection, intrusion alarms, device control, and web filtering through leading-edge technologies incorporated within one agent accessible from a unified control. Progent's data protection and virtualization experts can help your business to design and configure a ProSight ESP deployment that addresses your company's specific requirements and that allows you prove compliance with government and industry data security standards. Progent will assist you define and implement security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require immediate attention. Progent's consultants can also assist you to set up and test a backup and restore solution such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange filtering.