Ransomware Response Services

Progent's Ransomware Negotiation Services in Garland
Progent has experience negotiating ransomware settlements with threat actors. Reaching an acceptable settlement is a complicated activity that calls for a combination of field experience, technical knowledge and business acumen. It also calls for close co-operation with the victim's IT staff and the insurance provider, if any. Because the number one goal of the ransomware target is fast recovery, it is critical to establish response teams that operate efficiently, concurrently, and in close communication. Progent offers the scope of IT knowledge and the deep bench of personnel to supplement your network support team and recover your network rapidly and economically.

Support available from Progent's ransomware settlement negotiation experts include:

• Establishing the kind of ransomware used in the assault
• Identifying and communicating with the hacker
• Assessing the likelihood of recovery
• Verifying the TA's decryption capabilities
• Agreeing on a settlement range with the victim and the insurance provider
• Establishing a settlement amount and schedule with the TA
• Confirming compliance with anti-money laundering (AML) sanctions
• Managing the crypto-currency payment to the TA
• Acquiring, reviewing, and using the threat actor's decryption utility
• If necessary, contacting the hacker for assistance with the decryptor tool

• Quarantining infected endpoints and data stores to arrest the spread of the assault
• Making digital copies of every infected device and data store to allow forensics without interfering with cleanup
• Installing A/V protection to all clean endpoints
• Salvaging data from air-gapped restores or uncompromised endpoints
• Creating a pristine environment
• Remapping and reconnecting datastores to match precisely their pre-attack condition

Paying Exfiltration Ransoms
In addition to extorting payment for a decryption tool, current variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim commonly attempt to steal (or "exfiltrate") files. TAs are then able to require an additional settlement for not divulging this data or selling it. Unfortunately, there exists no method to prove that stolen files have been totally deleted by the threat actor. Actually, in numerous cases the TA has limited say over where the information ends up. Settling an exfiltration ransom does not eliminate the need for engaging the guidance of legal counsel, performing an inventory of files were compromised, and carrying out the mandated alerts to impacted entities. In general, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided online and on-premises IT services across the U.S. for more than two decades and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in foundation technologies such as Cisco infrastructure, VMware, and major Linux distros. Progent's data security consultants have earned internationally recognized certifications such as CISA, CISSP, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has top-tier support in financial management and ERP applications. This scope of skills allows Progent to identify and consolidate the undamaged parts of your IT environment following a ransomware intrusion and reconstruct them rapidly into a functioning network. Progent has collaborated with top cyber insurance carriers like Chubb to assist organizations recover from ransomware assaults.

Contact Progent about Ransomware Settlement Negotiation Expertise in Garland
To get in touch with Progent about ransomware settlement negotiation guidance in Garland, phone Progent at 800-462-8800 or go to Contact Progent.