Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Birmingham
Progent has experience negotiating ransomware settlements with threat actors (TAs). Negotiating an acceptable settlement is a complex activity that calls for a mix of field experience, IT knowledge and business savvy. It also calls for close co-operation with the victim's IT staff and the cyber insurance provider, if there is one. Because the number one goal of the ransomware target is operational continuity, it is critical to establish response groups that work effectively, concurrently, and in close communication. Progent offers the scope of IT skills and the depth of personnel to supplement your IT staff and recover your network environment quickly and economically.

Support available from Progent's ransomware settlement negotiation team include:

• Determining the kind of ransomware used in the attack
• Identifying and communicating with the hacker persona
• Assessing the recovery risk
• Testing the threat actor's decryption capabilities
• Determining a settlement range with the ransomware victim and the cyber insurance carrier
• Establishing a settlement amount and schedule with the threat actor
• Verifying adherence to anti-money laundering regulations
• Managing the crypto-currency transfer to the hacker
• Receiving, learning, and operating the hacker's decryptor mechanism
• If needed, contacting the TA for technical help with the decryptor tool

• Isolating infected endpoints and data stores to prevent further spread of the attack
• Making replicas of each compromised server and endpoint and data store in order to perform forensics without interfering with restoration
• Adding A/V agents to all clean endpoints
• Salvaging files from air-gapped restores or uncompromised endpoints
• Creating a clean recovery environment
• Mapping and connecting drives to match precisely their pre-encryption state

Paying Exfiltration Ransoms
Beyond extorting money for a decryption utility, modern variants of crypto-ransomware like Ryuk, Maze, DopplePaymer, and Nephilim often attempt to exfiltrate information. Hackers can then require an additional settlement for not posting this information on the dark web. Unfortunately, there exists no method to prove that stolen files have been totally erased by the TA. In fact, in numerous cases the TA has limited control about where the information ends up. Settling an exfiltration ransom does not eliminate the necessity of seeking the guidance of privacy attorneys, performing an inventory of data were compromised, and performing the mandated notifications to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered online and on-premises IT services across the United States for over two decades and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of SMEs includes professionals who have earned advanced certifications in core technologies including Cisco networking, VMware virtualization, and popular Linux distros. Progent's data security consultants have earned industry-recognized certifications such as CISM, CISSP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also has top-tier support in financial management and Enterprise Resource Planning applications. This scope of expertise allows Progent to salvage and integrate the undamaged parts of your network following a ransomware assault and reconstruct them rapidly into an operational system. Progent has worked with leading insurance providers including Chubb to assist businesses recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Negotiation Expertise in Birmingham
To get in touch with Progent about ransomware settlement services in Birmingham, call Progent at 800-462-8800 or go to Contact Progent.