Ransomware Response Consulting Services

Overview of Progent's Ransomware Settlement Negotiation Services in Grand Rapids
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an acceptable settlement is a complex exercise that calls for a combination of real-word experience, technical knowledge and business savvy. It also requires working closely with the victim's IT staff and the cyber insurance carrier, if there is one. Since the number one priority of the ransomware target is fast recovery, it is critical to establish recovery teams that work efficiently, concurrently, and in close communication. Progent offers the breadth of IT knowledge and the depth of experts to supplement your network support team and restore your network rapidly and affordably.

Support provided by Progent's ransomware negotiation team include:

• Determining the kind of ransomware involved in the attack
• Identifying and communicating with the hacker persona
• Assessing the recovery risk
• Validating the hacker's decryption capabilities
• Budgeting a settlement payment with the victim and the cyber insurance provider
• Establishing a settlement and timeline with the TA
• Confirming adherence to anti-money laundering regulations
• Managing the crypto-currency disbursement to the hacker
• Receiving, reviewing, and operating the TA's decryption utility
• If necessary, contacting the TA for assistance with the decryptor tool

• Isolating affected endpoints and data stores to prevent further spread of the attack
• Making replicas of each breached device and data store to allow forensics in parallel with recovery
• Adding anti-virus agents to all virus-free endpoints
• Restoring data from offline backups or unscathed machines
• Building a clean recovery environment
• Mapping and connecting datastores to match exactly their pre-encryption state

Exfiltration Ransoms
Beyond demanding money for a decryption utility, current variants of ransomware such as Ryuk, Maze, Netwalker, and Egregor often attempt to steal (or "exfiltrate") information. TAs can then require an extra settlement for not publishing this data on the dark web. Sadly, there exists no way to prove that stolen data have been totally deleted by the TA. Actually, in numerous cases the hacker has limited say about where the information ends up. Paying an exfiltration ransom does not eliminate the necessity of getting the advice of privacy attorneys, performing an audit on which data were stolen, and sending the necessary alerts to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered online and onsite IT services across the United States for over 20 years and has earned Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have been awarded advanced certifications in foundation technologies including Cisco networking, VMware virtualization, and popular Linux distros. Progent's data security experts have earned prestigious certifications such as CISM, CISSP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers guidance in financial management and ERP application software. This broad array of skills gives Progent the ability to salvage and integrate the undamaged parts of your information system following a ransomware attack and rebuild them rapidly into an operational network. Progent has worked with leading insurance providers including Chubb to assist businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Guidance in Grand Rapids
To contact with Progent about crypto-ransomware settlement guidance in Grand Rapids, phone Progent at 800-462-8800 or go to Contact Progent.