Ransomware Response Consulting Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Des Moines
Progent has experience negotiating ransomware settlements with hackers. Reaching an acceptable settlement is a complicated activity that calls for a combination of field experience, IT knowledge and business acumen. It also calls for close co-operation with the cyber-extortion target's IT team and the insurance provider, if there is one. Since the top goal of the ransomware target is operational continuity, it is vital to deploy recovery groups that operate effectively, concurrently, and in close communication. Progent has the scope of technical skills and the depth of experts to complement your network staff and restore your network rapidly and economically.

Support provided by Progent's ransomware negotiation team include:

• Establishing the kind of ransomware used in the attack
• making contact with the hacker
• Evaluating the recovery risk
• Verifying the TA's decryption capabilities
• Agreeing on a settlement with the ransomware victim and the cyber insurance carrier
• Establishing a settlement and schedule with the TA
• Checking accordance with anti-money laundering (AML) regulations
• Managing the crypto-currency payment to the hacker
• Acquiring, learning, and operating the TA's decryptor mechanism
• If necessary, contacting the threat actor for technical help with the decryption utility

• Isolating infected endpoints to prevent further progress of the attack
• Making digital copies of every breached server and endpoint and data store in order to perform forensics without interfering with restoration
• Adding anti-virus protection to all clean endpoints
• Restoring files from air-gapped backups or uncompromised machines
• Building a pristine environment
• Mapping and reconnecting datastores to reflect precisely their pre-attack condition

Settling Exfiltration Ransoms
In addition to demanding money for a decryption tool, current strains of ransomware such as Ryuk, Maze, Netwalker, and Nephilim commonly try to exfiltrate information. TAs can then demand a separate settlement for not divulging this information on the dark web. Unfortunately, there is no method to be certain that stolen files have been completely deleted by the threat actor. In fact, in numerous cases the threat actor has limited control over who can access the stolen files. Paying an exfiltration ransom does not eliminate the necessity of seeking the guidance of legal counsel, conducting an audit on which files were stolen, and performing the mandated alerts to impacted entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and onsite network services throughout the United States for over 20 years and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes professionals who have been awarded high-level certifications in foundation technology platforms including Cisco infrastructure, VMware, and major distributions of Linux. Progent's data security experts have earned industry-recognized certifications including CISM, CISSP, and GIAC. (See Progent's certifications). Progent also has guidance in financial management and ERP applications. This scope of skills allows Progent to identify and integrate the undamaged parts of your information system after a ransomware assault and reconstruct them quickly into an operational system. Progent has worked with top cyber insurance providers including Chubb to assist businesses recover from ransomware assaults.

Contact Progent about Ransomware Settlement Guidance in Des Moines
To contact with Progent about ransomware settlement negotiation expertise in Des Moines, phone Progent at 800-462-8800 or go to Contact Progent.