24/7 West Palm Beach Critical CryptoLocker
Virus Assessment and Removal Experts

Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyber pandemic that poses an enterprise-level threat for businesses vulnerable to an attack. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict damage. The latest strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, as well as additional unnamed viruses, not only encrypt on-line data files but also infiltrate all configured system backup. Files replicated to the cloud can also be ransomed. In a vulnerable environment, it can render any recovery useless and basically knocks the entire system back to zero.

Getting back online programs and information after a ransomware outage becomes a sprint against time as the targeted organization tries its best to stop the spread, cleanup the ransomware, and restore mission-critical operations. Since crypto-ransomware takes time to spread, penetrations are frequently launched during weekends and nights, when successful penetrations may take more time to discover. This compounds the difficulty of quickly mobilizing and coordinating a qualified mitigation team.

Progent provides a range of help services for protecting businesses from ransomware events. These include user education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of modern security solutions with artificial intelligence capabilities from SentinelOne to identify and suppress new cyber attacks automatically. Progent in addition can provide the services of experienced ransomware recovery engineers with the track record and commitment to reconstruct a compromised system as soon as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware attack, sending the ransom in cryptocurrency does not guarantee that cyber criminals will return the needed keys to decrypt any or all of your files. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to re-install the mission-critical parts of your IT environment. Without access to complete data backups, this requires a wide complement of IT skills, well-coordinated project management, and the ability to work continuously until the recovery project is finished.

For two decades, Progent has made available certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned top industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to efficiently understand necessary systems and organize the surviving parts of your Information Technology system after a ransomware penetration and rebuild them into an operational system.

Progent's security group uses best of breed project management tools to orchestrate the complex recovery process. Progent understands the urgency of working rapidly and in concert with a client's management and Information Technology staff to assign priority to tasks and to get key applications back on line as soon as humanly possible.

Client Story: A Successful Ransomware Penetration Response
A customer sought out Progent after their network system was brought down by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored cybercriminals, possibly using approaches exposed from the United States NSA organization. Ryuk targets specific organizations with little room for disruption and is one of the most lucrative versions of ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in Chicago with about 500 staff members. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the time of the attack and were damaged. The client was taking steps for paying the ransom demand (exceeding $200,000) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the customer to quickly identify and prioritize the critical services that needed to be recovered to make it possible to resume business operations:

• Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Active Directory to its pre-attack state. Progent then initiated reinstallations and hard drive recovery on needed systems. All Exchange Server schema and attributes were usable, which accelerated the restore of Exchange. Progent was able to collect non-encrypted OST files (Outlook Offline Data Files) on staff desktop computers and laptops to recover mail data. A not too old off-line backup of the client's manufacturing software made it possible to restore these essential services back online for users. Although significant work needed to be completed to recover totally from the Ryuk virus, critical services were restored quickly:

Throughout the next few weeks important milestones in the restoration process were achieved in close collaboration between Progent team members and the client:

• In-house web sites were restored without losing any data.
• The MailStore Server containing more than 4 million archived messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were completely recovered.
• A new Palo Alto 850 security appliance was brought on-line.
• Nearly all of the desktop computers were operational.

Conclusion
A potential enterprise-killing disaster was evaded through the efforts of dedicated professionals, a wide spectrum of technical expertise, and tight collaboration. Although in post mortem the crypto-ransomware virus incident detailed here should have been identified and blocked with up-to-date cyber security technology and ISO/IEC 27001 best practices, user training, and well designed incident response procedures for information backup and applying software patches, the reality is that state-sponsored hackers from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, mitigation, and information systems recovery.

To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in West Palm Beach a range of online monitoring and security evaluation services designed to assist you to reduce your vulnerability to crypto-ransomware. These services include modern machine learning capability to detect new strains of ransomware that are able to get past traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the necessary monitoring and management for you, so your network scales readily without holding you back. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Basic plans include RMM, cybersecurity, automatic monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management techniques to help keep your IT system operating efficiently by checking the state of critical assets that drive your information system. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your specified IT personnel and your Progent engineering consultant so that all looming problems can be addressed before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These can include health checking, update management, automated repairs, endpoint setup, backup and restore, A/V protection, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your specified IT staff and your assigned Progent consultant so emerging problems can be taken care of before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized organizations to map, monitor, enhance and troubleshoot their networking hardware like switches, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch ensures that network diagrams are always current, copies and displays the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when potential issues are detected. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can knock hours off common tasks like making network diagrams, expanding your network, finding devices that require critical software patches, or identifying the cause of performance issues. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth reporting utilities created to integrate with the top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as inconsistent support follow-through or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup technology providers to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and monitor your backup operations and enable non-disruptive backup and rapid restoration of critical files/folders, apps, system images, plus virtual machines. ProSight DPS lets your business avoid data loss resulting from hardware failures, natural calamities, fire, malware such as ransomware, human error, ill-intentioned employees, or software bugs. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading information security vendors to deliver centralized management and comprehensive security for all your inbound and outbound email. The hybrid architecture of Email Guard integrates cloud-based filtering with an on-premises gateway device to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your exposure to external attacks and saves system bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a deeper level of analysis for inbound email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The local gateway can also help Microsoft Exchange Server to monitor and protect internal email that stays inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo supports one-tap identity verification on Apple iOS, Google Android, and other personal devices. Using 2FA, when you sign into a protected application and enter your password you are requested to confirm who you are on a device that only you have and that uses a different network channel. A wide range of out-of-band devices can be used for this added form of ID validation including an iPhone or Android or wearable, a hardware token, a landline phone, etc. You can register multiple validation devices. To find out more about ProSight Duo two-factor identity authentication services, visit Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Call Center services allow your IT group to outsource Help Desk services to Progent or split activity for support services transparently between your internal network support staff and Progent's nationwide pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a seamless extension of your in-house support resources. Client interaction with the Help Desk, provision of support, issue escalation, ticket creation and tracking, efficiency measurement, and management of the support database are consistent whether incidents are resolved by your corporate support organization, by Progent, or both. Read more about Progent's outsourced/co-managed Call Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior-based machine learning tools to guard endpoints as well as physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which easily escape legacy signature-based anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a unified platform to address the complete malware attack lifecycle including protection, identification, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and automatic network-wide immunization against new threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and protect data about your network infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted about impending expirations of SSLs or domains. By cleaning up and managing your network documentation, you can save up to 50% of time thrown away trying to find vital information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you require when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of all sizes a flexible and affordable alternative for evaluating, testing, scheduling, implementing, and tracking updates to your dynamic IT system. Besides maximizing the protection and functionality of your computer environment, Progent's software/firmware update management services free up time for your IT team to concentrate on line-of-business initiatives and activities that derive the highest business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure Tier III data center on a fast virtual machine host configured and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware solution without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which routinely evade legacy signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a single platform to manage the entire malware attack progression including filtering, infiltration detection, containment, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services deliver ultra-affordable multi-layer protection for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to security assaults from all vectors. ProSight ESP provides firewall protection, intrusion alarms, endpoint management, and web filtering via leading-edge technologies packaged within one agent managed from a unified control. Progent's data protection and virtualization consultants can help you to design and configure a ProSight ESP environment that meets your company's specific requirements and that helps you demonstrate compliance with legal and industry data protection standards. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require urgent attention. Progent's consultants can also assist you to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.