Ransomware Solutions Consulting Services

Overview of Progent's Ransomware Negotiation Consulting in Bristol
Progent is experienced in negotiating ransomware settlements with threat actors. Reaching an acceptable settlement is a complicated exercise that requires a mix of field experience, technical skills and business acumen. It also calls for close co-operation with the cyber-extortion target's IT staff and the cyber insurance provider, if any. Because the top goal of the ransomware target is fast recovery, it is vital to establish response teams that operate efficiently, in parallel, and in close communication. Progent has the breadth of technical skills and the deep bench of personnel to complement your network staff and restore your network quickly and economically.

Support provided by Progent's ransomware settlement negotiation team include:

• Establishing the type of ransomware involved in the attack
• making contact with the hacker persona
• Evaluating the likelihood of recovery
• Verifying the TA's decryption tool
• Deciding on an acceptable settlement range with the victim and the insurance carrier
• Establishing a settlement and timeline with the hacker
• Checking adherence to anti-money laundering (AML) regulations
• Carrying out the crypto-currency payment to the hacker
• Receiving, learning, and using the hacker's decryption utility
• If needed, contacting the threat actor for technical help with the decryption tool

• Quarantining infected endpoints and data stores to prevent further progress of the assault
• Making digital copies of each infected server and endpoint and data store in order to perform forensics without interfering with restoration
• Adding anti-virus agents to all virus-free endpoints
• Restoring data from air-gapped restores or uncompromised endpoints
• Building a clean environment
• Remapping and reconnecting datastores to reflect precisely their pre-encryption condition

Exfiltration Ransoms
Beyond extorting money for a decryption utility, current variants of crypto-ransomware like Ryuk, Maze, DopplePaymer, and Egregor often try to steal (or "exfiltrate") files. TAs are then able to demand a separate settlement in exchange for not publishing this information on the dark web. Unfortunately, there is no way to prove that exfiltrated data have been totally deleted by the threat actor. In fact, in numerous cases the hacker has little say about who can access the stolen files. Settling an exfiltration ransom does not free you from the need for seeking the guidance of privacy lawyers, conducting an audit on which files were stolen, and carrying out the required notifications to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered remote and on-premises network services throughout the United States for more than two decades and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of SMEs includes professionals who have earned advanced certifications in foundation technologies such as Cisco infrastructure, VMware, and major distributions of Linux. Progent's data security experts have earned prestigious certifications such as CISA, CISSP, and CRISC. (Refer to certifications earned by Progent consultants). Progent also has guidance in financial and ERP application software. This breadth of expertise allows Progent to identify and consolidate the surviving parts of your network after a ransomware attack and rebuild them quickly into an operational system. Progent has collaborated with top insurance providers like Chubb to help organizations recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Expertise in Bristol
To contact with Progent about crypto-ransomware settlement guidance in Bristol, phone Progent at 800-462-8800 or go to Contact Progent.