Compass Global Services Pvt Ltd (CGS) is a Business Process Outsourcing (BPO) company in India. We develop and provide customized BPO & KPO products and  services which vary depending on industry, application, and specific client requirements.

 About: - 

• They manage call-center applications so effectively that they make on-site presence redundant. They provide high quality BPO & KPO services with significant competitive pricing advantages and create solutions which help their customers to grow and develop. They currently have clients across North America, Europe, Middle East, Far East and Australasia.
• Launched in 2008 from a small 'garage' back office in Bengaluru, Compass Global Services has grown from strength to strength and is now the nerve center of their operations. At the heart of digital solutions developed in Bengaluru, is a cloud-based IT-platform (Zybo) which enables paperless control and data processing. In addition, the 150+ professionals stationed here work on applications and services related to Operations, Business Process Outsourcing (BPO), Knowledge Process Outsourcing (KPO), Customer Relationship Management (CRM), Accounting Services, data, and Information management.

     Problems: -   

• Identifying the extent of the attack occurred on the customer’s Azure infrastructure, performing   analysis on it along with Root-cause analysis (RCA) & providing the solution of the same in a series of regulated timelines.
• After the problem identification, the solution led us to create a whole new infrastructure for our client.
• We provided a new and improved level of security and protection, to protect our client against future threats and attacks on the environment.

LDS Solution: - 

• The first most important thing was to get in touch with the customer for better understanding of the issue that had occurred, which on further inspection was found that the App Server VM had been compromised through a “Ransomware attack” as most of the OS Disk / Data disk files had been encrypted completely. While the few files that were still in working condition, we ensured that those were moved securely to the other Server or any on-premises machine / Cloud storage.
• Restore the VM to the latest possible recovery point in time using the “System consistent snapshot” feature in the Azure Backup pre-configured as a policy to run daily as a best practice & also ensuring that a similar situation can be tackled if it occurs again. The healthiest recovery point of around 2 to 3 days was considered for the process to be initiated, while it overall took around 4 to 5 hours for its completion which resulted in having deployed a new VM altogether using the point-in-time restoration, with minimal data loss on the Disks.
• Hardening of the networking rules on both the VM Network Security Group (NSG) level & Firewall level of the Restored VM, by mainly allowing RDP access to a range of IP addresses & eliminating of unwanted ports including the ones enabled for having “PING” on the Server.
• Setting up of monitoring alerts for “CPU utilization”, “Memory usage”, “Disk usage” on the restored App Server VM which would trigger email notifications to the email id’s configured based on certain threshold conditions met.
• Once things were up & running smoothly, migration activity of the App Server VM & its resources was performed to the region where the DB Server was located, thus ensuring that the Application & Database could communicate with each other over VNets across the same region.
• As a protective measure, later we performed a Disaster Recovery drill as well on the restored App Server VM to another target region by configuring the “Azure Site Recovery” feature for the VM in the portal.
• Also, they have added new workload, as addition in the server & their backups, attached managed disk & their snapshots. We have installed antivirus on their virtual machines.
• We have provided the managed support to them like any server maintenance, troubleshooting, activities, monitoring, sending budgetary alerts, managing consumption & any kind of support is required.

Result: -

• Due to the Ransomware attack on the Compass Global Server, most of the OS Disk / Data Disk files had been encrypted completely.
• If swift action wasn’t taken on time, most of their important Files, Data would have been permanently lost and would have caused a big damage to the company.
• Quick and creative thinking from our side led us to come up with a solution which not only recovered the Backed-up data from the previous recovery point but also, we managed to Back up the files that had not yet been attacked by the Ransomware.