24x7 Bakersfield Immediate Crypto
Computer Malware Damage Assessment and Repair Consultants

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyberplague that represents an extinction-level danger for businesses unprepared for an attack. Versions of crypto-ransomware such as Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and still inflict damage. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, along with frequent as yet unnamed viruses, not only encrypt on-line files but also infiltrate all configured system backups. Files replicated to the cloud can also be held hostage. In a poorly designed data protection solution, it can make any restore operations useless and basically knocks the entire system back to square one.

Recovering programs and data following a ransomware outage becomes a race against the clock as the targeted organization tries its best to contain, remove the virus, and restore mission-critical activity. Due to the fact that ransomware requires time to move laterally, attacks are usually sprung on weekends and holidays, when penetrations are likely to take longer to discover. This multiplies the difficulty of quickly assembling and coordinating a knowledgeable mitigation team.

Progent has a variety of services for securing enterprises from ransomware events. These include team member education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of the latest generation security gateways with artificial intelligence capabilities from SentinelOne to identify and extinguish zero-day cyber attacks intelligently. Progent also offers the assistance of experienced ransomware recovery consultants with the talent and commitment to restore a breached environment as soon as possible.

Progent's Ransomware Restoration Services
After a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the keys to decipher any or all of your information. Kaspersky estimated that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to piece back together the essential parts of your Information Technology environment. Absent the availability of essential system backups, this calls for a wide range of skill sets, top notch project management, and the willingness to work non-stop until the recovery project is complete.

For decades, Progent has provided certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of experience affords Progent the skills to knowledgably identify critical systems and integrate the remaining pieces of your network system after a ransomware attack and assemble them into an operational system.

Progent's security team of experts has powerful project management systems to orchestrate the sophisticated restoration process. Progent understands the urgency of acting quickly and together with a client's management and Information Technology staff to assign priority to tasks and to get critical systems back on-line as fast as possible.

Case Study: A Successful Crypto-Ransomware Incident Recovery
A small business hired Progent after their company was taken over by the Ryuk ransomware virus. Ryuk is believed to have been created by Northern Korean state sponsored hackers, possibly adopting strategies exposed from America's National Security Agency. Ryuk targets specific organizations with little room for operational disruption and is among the most profitable incarnations of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in Chicago with around 500 staff members. The Ryuk attack had paralyzed all business operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the start of the intrusion and were destroyed. The client considered paying the ransom (more than two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly determine and assign priority to the key elements that had to be addressed to make it possible to restart company operations:

• Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then accomplished setup and storage recovery of critical systems. All Exchange Server ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to assemble local OST data files (Microsoft Outlook Off-Line Folder Files) on various PCs to recover email messages. A recent offline backup of the businesses accounting/MRP systems made it possible to restore these required programs back online for users. Although a large amount of work needed to be completed to recover fully from the Ryuk virus, essential services were restored rapidly:

During the next couple of weeks important milestones in the restoration process were accomplished through close collaboration between Progent consultants and the client:

• In-house web sites were brought back up with no loss of data.
• The MailStore Server exceeding 4 million historical messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory capabilities were 100 percent recovered.
• A new Palo Alto 850 security appliance was brought on-line.
• Nearly all of the user workstations were being used by staff.

Conclusion
A likely company-ending disaster was dodged through the efforts of hard-working professionals, a wide spectrum of subject matter expertise, and close collaboration. Although in hindsight the ransomware penetration detailed here would have been prevented with current cyber security technology and NIST Cybersecurity Framework best practices, team training, and well designed security procedures for backup and applying software patches, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incursion, remember that Progent's roster of professionals has proven experience in ransomware virus defense, cleanup, and file disaster recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Bakersfield a variety of online monitoring and security evaluation services to help you to reduce your vulnerability to ransomware. These services incorporate next-generation machine learning capability to uncover zero-day strains of ransomware that can escape detection by legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the daily monitoring and management for you, so your system expands smoothly without becoming an obstacle. For an affordable and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your network running efficiently by checking the state of vital computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your specified IT personnel and your Progent engineering consultant so that any potential issues can be addressed before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These can include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your specified IT staff and your Progent consultant so that emerging problems can be taken care of before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller organizations to map out, monitor, reconfigure and troubleshoot their connectivity hardware such as routers, firewalls, and wireless controllers as well as servers, endpoints and other devices. Incorporating state-of-the-art RMM technology, WAN Watch makes sure that network maps are always current, copies and manages the configuration information of almost all devices on your network, tracks performance, and sends alerts when issues are detected. By automating complex management and troubleshooting activities, WAN Watch can cut hours off common tasks such as making network diagrams, expanding your network, locating appliances that need critical updates, or resolving performance problems. Learn more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth management reporting plug-ins created to integrate with the top ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology companies to produce ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup processes and allow transparent backup and fast restoration of critical files, apps, system images, and virtual machines. ProSight DPS helps your business recover from data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, human error, ill-intentioned insiders, or software bugs. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading data security companies to provide centralized management and comprehensive security for all your email traffic. The hybrid structure of Progent's Email Guard integrates a Cloud Protection Layer with an on-premises gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. The Cloud Protection Layer serves as a first line of defense and keeps most threats from reaching your security perimeter. This reduces your exposure to external attacks and saves network bandwidth and storage. Email Guard's on-premises security gateway device adds a further layer of inspection for incoming email. For outbound email, the local gateway provides AV and anti-spam filtering, DLP, and email encryption. The local gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that stays inside your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo technology to protect against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a secured online account and give your password you are asked to confirm your identity on a device that only you possess and that is accessed using a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized as this second form of ID validation including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You can register multiple verification devices. For more information about ProSight Duo identity authentication services, see Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Call Center services enable your information technology group to offload Help Desk services to Progent or divide activity for Help Desk services seamlessly between your in-house network support team and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a smooth supplement to your core IT support group. Client access to the Help Desk, delivery of technical assistance, issue escalation, ticket creation and updates, efficiency metrics, and management of the service database are consistent regardless of whether issues are resolved by your internal network support group, by Progent, or both. Find out more about Progent's outsourced/co-managed Call Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes next generation behavior-based machine learning tools to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which easily escape traditional signature-matching AV tools. Progent ASM services protect on-premises and cloud resources and offers a unified platform to manage the complete malware attack lifecycle including filtering, identification, mitigation, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and protect data about your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or domains. By cleaning up and managing your network documentation, you can eliminate as much as half of time spent looking for vital information about your IT network. ProSight IT Asset Management features a common location for storing and sharing all documents related to managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're planning improvements, performing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the data you require the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide organizations of any size a versatile and cost-effective solution for assessing, validating, scheduling, applying, and documenting software and firmware updates to your dynamic information system. In addition to maximizing the protection and reliability of your computer environment, Progent's patch management services permit your in-house IT team to focus on more strategic initiatives and tasks that derive maximum business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a protected Tier III data center on a fast virtual machine host set up and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the applications. Because the environment is virtualized, it can be moved easily to a different hardware environment without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior machine learning tools to defend physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which routinely escape legacy signature-matching AV products. ProSight ASM protects on-premises and cloud resources and offers a unified platform to address the complete threat lifecycle including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection managed services offer affordable in-depth security for physical and virtual servers, desktops, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alerts, device management, and web filtering via cutting-edge technologies incorporated within one agent accessible from a single control. Progent's security and virtualization consultants can assist you to plan and implement a ProSight ESP environment that meets your company's unique requirements and that allows you achieve and demonstrate compliance with legal and industry data security regulations. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also help your company to set up and test a backup and restore solution such as ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange filtering.