Ransomware Response Consulting Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Birmingham
Progent has experience negotiating ransomware settlements with attackers. Reaching an acceptable settlement is a complicated exercise that requires a combination of field experience, technical knowledge and business acumen. It also requires close co-operation with the ransomware victim's IT team and the insurance provider, if any. Because the top goal of the ransomware victim is fast recovery, it is critical to deploy response groups that operate efficiently, in parallel, and in close communication. Progent has the breadth of IT skills and the depth of personnel to supplement your network support team and recover your network rapidly and economically.

Services offered by Progent's ransomware settlement experts include:

• Establishing the kind of ransomware used in the assault
• Identifying and contacting the hacker
• Assessing the likelihood of recovery
• Verifying the hacker's decryption capabilities
• Deciding on an acceptable settlement payment with the victim and the insurance carrier
• Establishing a settlement amount and timeline with the threat actor
• Verifying compliance with anti-money laundering sanctions
• Overseeing the crypto-currency disbursement to the hacker
• Receiving, reviewing, and using the hacker's decryption utility
• If necessary, contacting the threat actor for assistance with the decryption utility

• Isolating infected endpoints and data stores to arrest the spread of the assault
• Creating digital copies of every breached server and endpoint and data store to allow forensics in parallel with cleanup
• Adding A/V agents to all clean endpoints
• Salvaging files from offline restores or uncompromised endpoints
• Building a pristine environment
• Mapping and connecting drives to match precisely their pre-encryption state

Exfiltration Ransoms
Beyond extorting money for a decryption tool, current variants of ransomware such as Ryuk, Maze, DopplePaymer, and Egregor often attempt to steal (or "exfiltrate") files. Hackers are then able to require a separate settlement for not publishing this data or selling it. Sadly, there exists no way to guarantee that stolen data have been completely deleted by the threat actor. Actually, in many instances the threat actor has little say about the disposition of the data. Settling an exfiltration ransom does not free you from the necessity of getting the advice of legal counsel, conducting an investigation into which files were taken, and carrying out the required notifications to affected entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and onsite network services throughout the U.S. for over 20 years and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes professionals who have been awarded high-level certifications in foundation technology platforms such as Cisco networking, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally recognized certifications including CISM, CISSP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers top-tier support in financial and ERP software. This broad array of expertise allows Progent to identify and integrate the surviving parts of your network after a ransomware assault and reconstruct them quickly into a viable system. Progent has worked with top insurance carriers including Chubb to assist businesses recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Guidance in Birmingham
To contact with Progent about ransomware settlement expertise in Birmingham, call Progent at 800-462-8800 or go to Contact Progent.