Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Chesapeake
Progent is experienced in negotiating ransomware settlements with threat actors (TAs). Negotiating an optimum settlement is a complicated activity that calls for a combination of real-word experience, technical knowledge and business savvy. It also requires working closely with the cyber-extortion target's IT staff and the cyber insurance carrier, if there is one. Since the number one goal of the ransomware victim is operational continuity, it is vital to deploy response teams that work effectively, concurrently, and with intimate collaboration. Progent offers the breadth of IT skills and the deep bench of experts to supplement your network staff and restore your network environment quickly and affordably.

Services available from Progent's ransomware negotiation team include:

• Determining the type of ransomware used in the assault
• identifying and contacting the hacker
• Evaluating the recovery risk
• Testing the TA's decryption capabilities
• Determining a settlement amount with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement amount and schedule with the TA
• Checking adherence to anti-money laundering regulations
• Managing the crypto-currency transfer to the hacker
• Acquiring, learning, and using the hacker's decryptor mechanism
• If necessary, contacting the threat actor for assistance with the decryption tool

• Quarantining affected endpoints and data stores to arrest the progress of the assault
• Making replicas of every compromised server and endpoint and data store in order to perform forensics without interfering with recovery
• Installing A/V agents to all virus-free endpoints
• Salvaging files from air-gapped backups or unscathed endpoints
• Creating a clean recovery environment
• Remapping and reconnecting datastores to match exactly their pre-encryption condition

Exfiltration Ransoms
In addition to extorting payment for a decryption tool, current strains of crypto-ransomware such as Ryuk, Sodinokibi, Netwalker, and Egregor often try to exfiltrate files. Hackers can then demand an additional ransom for not divulging this data or selling it. Unfortunately, there exists no way to be certain that exfiltrated files have been totally erased by the threat actor. In fact, in numerous instances the threat actor has little control about data custody. Settling an exfiltration ransom does not free you from the need for seeking the advice of privacy lawyers, conducting an audit on which files were taken, and carrying out the necessary alerts to affected entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered online and on-premises IT services throughout the U.S. for over 20 years and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have been awarded advanced certifications in core technologies including Cisco networking, VMware, and major Linux distros. Progent's cybersecurity experts have earned industry-recognized certifications including CISM, CISSP-ISSAP, and CRISC. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial management and ERP application software. This breadth of expertise allows Progent to salvage and integrate the undamaged parts of your IT environment after a ransomware assault and reconstruct them quickly into an operational system. Progent has worked with leading insurance providers including Chubb to assist organizations clean up after ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Expertise in Chesapeake
To get in touch with Progent about crypto-ransomware settlement negotiation expertise in Chesapeake, call Progent at 800-462-8800 or go to Contact Progent.