Ransomware Solutions Consulting Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Garland
Progent is experienced in negotiating ransomware settlements with threat actors. Reaching an acceptable settlement is a complicated exercise that calls for a mix of field experience, IT knowledge and business acumen. It also demands working closely with the ransomware victim's IT team and the insurance carrier, if any. Because the top goal of the ransomware target is fast recovery, it is vital to establish recovery groups that work effectively, in parallel, and with intimate collaboration. Progent has the breadth of IT knowledge and the deep bench of experts to complement your network staff and recover your network environment quickly and affordably.

Services available from Progent's ransomware settlement team include:

• Establishing the type of ransomware used in the attack
• making contact with the hacker
• Evaluating the recovery risk
• Validating the threat actor's decryption capabilities
• Determining a settlement range with the victim and the cyber insurance provider
• Negotiating a settlement and timeline with the threat actor
• Confirming accordance with anti-money laundering (AML) sanctions
• Carrying out the crypto-currency transfer to the hacker
• Receiving, learning, and operating the TA's decryption mechanism
• If needed, contacting the TA for technical assistance with the decryption utility

• Isolating affected endpoints and data stores to prevent further progress of the attack
• Creating digital copies of each breached server and endpoint and data store to allow forensics in parallel with restoration
• Adding A/V agents to all clean endpoints
• Restoring data from air-gapped backups or uncompromised machines
• Building a pristine recovery environment
• Remapping and reconnecting datastores to match precisely their pre-encryption state

Paying Exfiltration Ransoms
In addition to extorting money for a decryption utility, current strains of ransomware such as Ryuk, Sodinokibi, Netwalker, and Egregor often attempt to exfiltrate information. TAs are then able to demand an extra ransom in exchange for not publishing this data or selling it. Sadly, there is no method to be certain that stolen files have been totally erased by the TA. In fact, in many cases the hacker has limited control about where the information ends up. Settling an exfiltration ransom does not eliminate the need for getting the advice of legal counsel, conducting an audit on which files were stolen, and sending the necessary alerts to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered online and on-premises network services across the United States for more than two decades and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in core technology platforms including Cisco infrastructure, VMware, and major distributions of Linux. Progent's data security experts have earned industry-recognized certifications such as CISA, CISSP-ISSAP, and GIAC. (See Progent's certifications). Progent also offers guidance in financial and Enterprise Resource Planning application software. This breadth of expertise allows Progent to identify and consolidate the undamaged pieces of your IT environment following a ransomware intrusion and reconstruct them rapidly into a functioning system. Progent has collaborated with leading cyber insurance providers like Chubb to help organizations clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Expertise in Garland
To contact with Progent about crypto-ransomware settlement guidance in Garland, call Progent at 800-462-8800 or go to Contact Progent.