Vancouver 24x7x365 Critical Crypto
Computer Virus Damage Assessment and Restoration Support

Ransomware : Your Worst IT Disaster
Ransomware has become a too-frequent cyberplague that poses an enterprise-level threat for businesses vulnerable to an attack. Versions of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to inflict havoc. Recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus frequent as yet unnamed viruses, not only encrypt on-line information but also infect many accessible system backup. Data synched to the cloud can also be encrypted. In a poorly designed data protection solution, this can render any restore operations impossible and effectively sets the entire system back to zero.

Getting back applications and information following a ransomware event becomes a race against time as the victim fights to stop lateral movement, clear the ransomware, and restore business-critical activity. Since crypto-ransomware needs time to spread, assaults are usually sprung during weekends and nights, when successful penetrations typically take more time to uncover. This multiplies the difficulty of promptly assembling and orchestrating an experienced mitigation team.

Progent makes available a range of support services for securing organizations from ransomware attacks. Among these are staff education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of the latest generation security gateways with machine learning technology from SentinelOne to discover and extinguish new threats quickly. Progent also provides the assistance of expert ransomware recovery professionals with the track record and perseverance to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware invasion, sending the ransom in cryptocurrency does not guarantee that cyber criminals will provide the codes to decipher all your files. Kaspersky determined that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to piece back together the key components of your Information Technology environment. Absent the availability of essential system backups, this requires a broad range of skill sets, top notch team management, and the willingness to work 24x7 until the task is done.

For twenty years, Progent has made available professional IT services for businesses across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of expertise gives Progent the ability to efficiently identify necessary systems and integrate the surviving parts of your Information Technology environment after a ransomware penetration and assemble them into a functioning system.

Progent's ransomware group has best of breed project management tools to coordinate the sophisticated recovery process. Progent knows the importance of acting swiftly and in unison with a client's management and Information Technology team members to prioritize tasks and to put critical services back on-line as fast as possible.

Case Study: A Successful Ransomware Penetration Restoration
A business sought out Progent after their organization was brought down by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state criminal gangs, suspected of using approaches leaked from the U.S. NSA organization. Ryuk attacks specific organizations with limited tolerance for operational disruption and is among the most profitable incarnations of ransomware viruses. Major organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago and has about 500 staff members. The Ryuk intrusion had shut down all business operations and manufacturing processes. Most of the client's data protection had been on-line at the beginning of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of $200,000) and hoping for good luck, but in the end reached out to Progent.

Progent worked together with the client to rapidly get our arms around and prioritize the critical elements that needed to be restored in order to resume company operations:

• Active Directory (AD)
• Email
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Active Directory to its pre-penetration state. Progent then charged ahead with reinstallations and hard drive recovery of critical systems. All Exchange data and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to locate intact OST data files (Outlook Off-Line Folder Files) on staff workstations and laptops to recover email information. A recent off-line backup of the customer's financials/MRP systems made it possible to return these essential applications back on-line. Although significant work remained to recover completely from the Ryuk virus, core systems were restored quickly:

Over the next couple of weeks important milestones in the restoration project were accomplished in close cooperation between Progent team members and the client:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Server containing more than four million historical messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory functions were completely operational.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Most of the user PCs were operational.

Conclusion
A possible business disaster was evaded due to hard-working experts, a wide range of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware attack detailed here could have been stopped with advanced cyber security technology and recognized best practices, user and IT administrator training, and appropriate security procedures for backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, remediation, and data restoration.

To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Vancouver a portfolio of online monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services incorporate next-generation machine learning capability to uncover new strains of ransomware that can escape detection by traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create advanced network resilience. Progent handles the necessary monitoring and maintenance for you, so your network expands smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Basic packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system running efficiently by checking the state of vital assets that power your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT staff and your assigned Progent consultant so all potential problems can be resolved before they can impact your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your specified IT management staff and your assigned Progent consultant so that potential issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, optimize and troubleshoot their connectivity appliances such as switches, firewalls, and load balancers plus servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept updated, copies and displays the configuration of almost all devices on your network, tracks performance, and generates notices when issues are discovered. By automating tedious management and troubleshooting processes, WAN Watch can cut hours off common tasks such as network mapping, reconfiguring your network, finding appliances that need critical updates, or identifying the cause of performance problems. Learn more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth management reporting tools created to work with the leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as inconsistent support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology companies to produce ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup processes and enable transparent backup and rapid restoration of important files, apps, images, and virtual machines. ProSight DPS lets you recover from data loss resulting from hardware breakdown, natural disasters, fire, malware such as ransomware, user error, ill-intentioned insiders, or software bugs. Managed services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide centralized control and comprehensive protection for your email traffic. The hybrid structure of Progent's Email Guard managed service combines cloud-based filtering with a local gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper layer of inspection for incoming email. For outgoing email, the local gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication. Duo enables single-tap identity verification on iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you log into a secured application and enter your password you are requested to confirm who you are on a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of devices can be utilized as this added form of authentication such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You can register several validation devices. To learn more about ProSight Duo identity validation services, visit Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Support Desk managed services enable your IT staff to offload Support Desk services to Progent or divide responsibilities for Service Desk support transparently between your internal support resources and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a smooth supplement to your corporate support organization. End user interaction with the Help Desk, provision of support services, problem escalation, trouble ticket generation and updates, performance measurement, and maintenance of the service database are consistent whether incidents are taken care of by your core support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior analysis technology to guard endpoints and physical and virtual servers against new malware assaults such as ransomware and email phishing, which easily escape legacy signature-matching anti-virus tools. Progent ASM services safeguard local and cloud-based resources and offers a unified platform to address the complete malware attack progression including protection, infiltration detection, containment, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and safeguard data about your network infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be alerted about upcoming expirations of SSLs or domains. By updating and organizing your IT infrastructure documentation, you can save up to 50% of time thrown away searching for vital information about your network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of any size a versatile and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting software and firmware updates to your dynamic information network. Besides maximizing the protection and reliability of your IT network, Progent's software/firmware update management services permit your IT staff to focus on more strategic initiatives and tasks that deliver maximum business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected fault tolerant data center on a fast virtual machine host set up and maintained by Progent's IT support experts. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Because the system is virtualized, it can be moved immediately to a different hardware environment without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior analysis technology to defend physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which easily get by traditional signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a unified platform to manage the entire malware attack progression including filtering, detection, mitigation, remediation, and forensics. Top features include single-click rollback using Windows VSS and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services offer affordable in-depth protection for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, endpoint control, and web filtering via cutting-edge technologies packaged within a single agent managed from a single console. Progent's security and virtualization experts can assist you to plan and implement a ProSight ESP environment that addresses your organization's specific requirements and that allows you demonstrate compliance with government and industry information security regulations. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that call for immediate attention. Progent's consultants can also assist you to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.