Ransomware Solutions Consulting Services

Progent's Ransomware Settlement Negotiation Consulting in Chandler
Progent has experience negotiating ransomware settlements with threat actors (TAs). Reaching an acceptable settlement is a complex exercise that requires a mix of real-word experience, IT knowledge and business acumen. It also demands close co-operation with the cyber-extortion target's IT staff and the cyber insurance carrier, if any. Since the number one goal of the ransomware target is fast recovery, it is critical to establish response groups that work effectively, in parallel, and in close communication. Progent has the scope of technical knowledge and the depth of personnel to supplement your network support team and recover your network environment quickly and affordably.

Services available from Progent's ransomware negotiation team include:

• Establishing the kind of ransomware involved in the attack
• Making contact with the hacker
• Assessing the likelihood of recovery
• Verifying the TA's decryption tool
• Determining a settlement amount with the victim and the insurance carrier
• Negotiating a settlement and schedule with the hacker
• Confirming accordance with anti-money laundering regulations
• Managing the crypto-currency payment to the hacker
• Acquiring, learning, and operating the hacker's decryptor mechanism
• If necessary, contacting the hacker for technical assistance with the decryption tool

• Quarantining affected endpoints to prevent further progress of the attack
• Making digital copies of each infected device and data store to allow forensics without interfering with recovery
• Adding A/V protection to all clean endpoints
• Recovering data from offline restores or uncompromised machines
• Building a clean environment
• Mapping and reconnecting drives to match precisely their pre-encryption state

Exfiltration Ransoms
Beyond extorting payment for a decryption utility, modern strains of ransomware like Ryuk, Sodinokibi, Netwalker, and Nephilim commonly try to steal (or "exfiltrate") files. TAs are then able to demand a separate ransom for not posting this data on the dark web. Unfortunately, there exists no method to prove that exfiltrated files have been totally deleted by the threat actor. Actually, in many instances the threat actor has little say about data custody. Paying an exfiltration ransom does not eliminate the necessity of engaging the advice of privacy lawyers, conducting an investigation into which data were stolen, and carrying out the required notifications to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and onsite IT services across the U.S. for more than 20 years and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced certifications in core technologies such as Cisco networking, VMware, and major distributions of Linux. Progent's data security consultants have earned prestigious certifications such as CISA, CISSP-ISSAP, CRISC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also has guidance in financial management and Enterprise Resource Planning application software. This broad array of expertise gives Progent the ability to salvage and integrate the surviving parts of your IT environment following a ransomware intrusion and rebuild them quickly into a viable system. Progent has worked with top insurance carriers including Chubb to help businesses recover from ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Expertise in Chandler
To get in touch with Progent about crypto-ransomware settlement expertise in Chandler, call Progent at 800-462-8800 or go to Contact Progent.