Ransomware Response Services

Progent's Ransomware Negotiation Consulting in London
Progent is experienced in negotiating ransomware settlements with threat actors. Negotiating an optimum settlement is a complex exercise that calls for a mix of field experience, IT skills and business savvy. It also requires close co-operation with the ransomware victim's IT team and the cyber insurance carrier, if any. Because the top goal of the ransomware victim is fast recovery, it is critical to deploy response teams that work effectively, concurrently, and with intimate collaboration. Progent has the scope of technical skills and the deep bench of experts to complement your network support team and restore your network quickly and affordably.

Services available from Progent's ransomware negotiation team include:

• Determining the kind of ransomware used in the attack
• identifying and contacting the hacker persona
• Evaluating the recovery risk
• Testing the threat actor's decryption capabilities
• Budgeting a settlement range with the victim and the cyber insurance provider
• Negotiating a settlement and timeline with the hacker
• Checking compliance with anti-money laundering (AML) regulations
• Overseeing the crypto-currency transfer to the hacker
• Receiving, reviewing, and operating the threat actor's decryptor mechanism
• If necessary, contacting the TA for technical assistance with the decryption tool

• Quarantining infected endpoints to arrest the spread of the attack
• Creating digital copies of each infected server and endpoint and data store to allow forensics in parallel with restoration
• Adding A/V protection to all virus-free endpoints
• Salvaging data from offline restores or uncompromised endpoints
• Building a clean environment
• Remapping and connecting datastores to reflect exactly their pre-encryption state

Exfiltration Ransoms
Beyond demanding money for a decryption utility, current strains of crypto-ransomware such as Ryuk, Maze, DopplePaymer, and Egregor often attempt to steal (or "exfiltrate") files. TAs can then require a separate settlement for not posting this information or selling it. Sadly, there exists no method to prove that exfiltrated data have been completely deleted by the TA. Actually, in many cases the threat actor has little control about where the information ends up. Settling an exfiltration ransom does not eliminate the necessity of getting the guidance of privacy attorneys, performing an inventory of files were stolen, and performing the required notifications to affected entities. Generally, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has delivered remote and on-premises network services across the U.S. for over two decades and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes professionals who have earned high-level certifications in core technologies including Cisco infrastructure, VMware, and major distributions of Linux. Progent's data security consultants have earned industry-recognized certifications such as CISM, CISSP, and GIAC. (See Progent's certifications). Progent also offers top-tier support in financial management and Enterprise Resource Planning applications. This broad array of skills gives Progent the ability to identify and integrate the surviving parts of your information system following a ransomware assault and reconstruct them quickly into an operational system. Progent has worked with top cyber insurance carriers like Chubb to help businesses recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Negotiation Guidance in London
To get in touch with Progent about crypto-ransomware settlement expertise in London, call Progent at 800-462-8800 or go to Contact Progent.