Ransomware Response Consulting Services

Progent's Ransomware Negotiation Consulting in Cincinnati
Progent is experienced in negotiating ransomware settlements with threat actors (TAs). Reaching an optimum settlement is a complicated activity that calls for a mix of field experience, IT skills and business savvy. It also demands close co-operation with the ransomware victim's IT team and the insurance provider, if there is one. Because the number one goal of the ransomware victim is operational continuity, it is critical to establish recovery groups that work efficiently, in parallel, and in close communication. Progent has the breadth of technical knowledge and the deep bench of personnel to complement your network staff and recover your network environment quickly and affordably.

Services available from Progent's ransomware negotiation team include:

• Establishing the kind of ransomware involved in the attack
• identifying and contacting the hacker persona
• Evaluating the recovery risk
• Verifying the TA's decryption capabilities
• Agreeing on a settlement range with the victim and the cyber insurance carrier
• Establishing a settlement amount and timeline with the threat actor
• Checking accordance with anti-money laundering laws
• Managing the crypto-currency disbursement to the TA
• Receiving, learning, and using the TA's decryptor mechanism
• If needed, contacting the hacker for technical assistance with the decryption utility

• Isolating affected endpoints and data stores to arrest the spread of the attack
• Creating replicas of every compromised device and data store to allow forensics in parallel with recovery
• Installing anti-virus protection to all virus-free endpoints
• Salvaging data from air-gapped backups or uncompromised endpoints
• Creating a pristine recovery environment
• Remapping and connecting drives to reflect exactly their pre-attack state

Settling Exfiltration Ransoms
Beyond extorting payment for a decryption utility, current variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim often attempt to steal (or "exfiltrate") information. TAs can then demand a separate payment for not posting this information on the dark web. Unfortunately, there is no way to prove that stolen files have been totally deleted by the hacker. In fact, in many instances the TA has limited say over data custody. Paying an exfiltration ransom does not eliminate the necessity of seeking the advice of privacy lawyers, performing an investigation into which data were taken, and carrying out the mandated notifications to impacted entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided online and onsite IT services throughout the United States for over 20 years and has earned Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of SMEs includes consultants who have earned advanced certifications in foundation technology platforms including Cisco networking, VMware, and popular distributions of Linux. Progent's data security experts have earned internationally recognized certifications including CISA, CISSP-ISSAP, and CRISC. (See Progent's certifications). Progent also offers top-tier support in financial and Enterprise Resource Planning application software. This broad array of skills gives Progent the ability to salvage and consolidate the surviving parts of your IT environment following a ransomware assault and reconstruct them rapidly into a viable network. Progent has worked with top insurance providers like Chubb to assist organizations recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Guidance in Cincinnati
To get in touch with Progent about crypto-ransomware settlement guidance in Cincinnati, call Progent at 800-462-8800 or go to Contact Progent.