Ransomware Response Services

Overview of Progent's Ransomware Negotiation Consulting in Denver
Progent has experience negotiating ransomware settlements with threat actors. Reaching an acceptable settlement is a complicated activity that calls for a mix of field experience, IT knowledge and business acumen. It also requires close co-operation with the ransomware victim's IT team and the cyber insurance carrier, if there is one. Since the top priority of the ransomware target is operational continuity, it is critical to establish recovery groups that operate effectively, in parallel, and with intimate collaboration. Progent has the breadth of technical skills and the depth of experts to complement your network staff and restore your network rapidly and affordably.

Services provided by Progent's ransomware settlement experts include:

• Establishing the type of ransomware used in the attack
• Identifying and communicating with the hacker persona
• Assessing the likelihood of recovery
• Verifying the threat actor's decryption capabilities
• Deciding on an acceptable settlement with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement and timeline with the TA
• Verifying compliance with anti-money laundering laws
• Overseeing the crypto-currency disbursement to the hacker
• Receiving, reviewing, and using the TA's decryption tool
• If necessary, contacting the hacker for technical help with the decryptor utility

• Quarantining infected endpoints and data stores to prevent further spread of the assault
• Making digital copies of every infected server and endpoint and data store to allow forensics without interfering with recovery
• Installing A/V protection to all clean endpoints
• Salvaging files from offline backups or unscathed endpoints
• Building a pristine recovery environment
• Mapping and connecting datastores to reflect precisely their pre-attack state

Settling Exfiltration Ransoms
In addition to demanding payment for a decryption utility, modern strains of ransomware such as Ryuk, Maze, DopplePaymer, and Nephilim commonly try to steal (or "exfiltrate") files. TAs can then demand a separate settlement in exchange for not publishing this data on the dark web. Sadly, there is no method to guarantee that exfiltrated data have been completely erased by the TA. Actually, in many cases the TA has limited say over the disposition of the data. Paying an exfiltration ransom does not free you from the need for seeking the guidance of legal counsel, performing an audit on which data were taken, and sending the required alerts to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered remote and onsite IT services throughout the U.S. for over two decades and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes professionals who have earned high-level certifications in foundation technology platforms such as Cisco infrastructure, VMware, and popular distributions of Linux. Progent's data security consultants have earned internationally recognized certifications such as CISM, CISSP, and CRISC. (Refer to certifications earned by Progent consultants). Progent also offers guidance in financial and Enterprise Resource Planning software. This broad array of skills allows Progent to identify and consolidate the undamaged pieces of your network following a ransomware assault and reconstruct them rapidly into a viable network. Progent has collaborated with top insurance carriers including Chubb to help organizations recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Services in Denver
To get in touch with Progent about crypto-ransomware settlement expertise in Denver, phone Progent at 800-462-8800 or go to Contact Progent.