Ransomware Response Consulting Experts

Progent's Ransomware Settlement Negotiation Consulting
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an optimum settlement is a complex activity that calls for a combination of field experience, IT knowledge and business savvy. It also requires working closely with the victim's IT team and the cyber insurance carrier, if there is one. Since the number one priority of the ransomware target is fast recovery, it is critical to deploy recovery groups that operate efficiently, concurrently, and in close communication. Progent offers the scope of IT knowledge and the depth of personnel to supplement your IT staff and recover your network environment rapidly and economically.

Services provided by Progent's ransomware settlement experts include:

• Determining the kind of ransomware involved in the assault
• Identifying and communicating with the hacker
• Assessing the recovery risk
• Validating the threat actor's decryption capabilities
• Determining a settlement amount with the victim and the insurance provider
• Establishing a settlement and timeline with the TA
• Verifying adherence to anti-money laundering sanctions
• Overseeing the crypto-currency payment to the TA
• Receiving, reviewing, and using the hacker's decryption mechanism
• If needed, contacting the TA for technical assistance with the decryption tool

• Isolating infected endpoints to prevent further spread of the attack
• Creating replicas of each compromised server and endpoint and data store in order to perform forensics without interfering with restoration
• Adding A/V protection to all clean endpoints
• Recovering data from air-gapped backups or unscathed machines
• Creating a pristine recovery environment
• Mapping and connecting datastores to match precisely their pre-attack condition

Paying Exfiltration Ransoms
In addition to demanding payment for a decryption utility, modern strains of ransomware such as Ryuk, Maze, Netwalker, and Egregor often try to steal (or "exfiltrate") information. TAs are then able to require a separate payment in exchange for not posting this information on the dark web. Unfortunately, there exists no method to prove that exfiltrated files have been completely erased by the threat actor. In fact, in many cases the TA has little control over the disposition of the data. Settling an exfiltration ransom does not free you from the need for getting the guidance of privacy attorneys, conducting an inventory of files were compromised, and sending the mandated alerts to impacted entities. In general, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided online and onsite network services across the U.S. for over 20 years and has been awarded Microsoft's Gold Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts includes professionals who have been awarded high-level certifications in core technology platforms such as Cisco networking, VMware virtualization, and popular Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISA, CISSP-ISSAP, CRISC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also has guidance in financial management and Enterprise Resource Planning application software. This broad array of skills allows Progent to salvage and consolidate the undamaged pieces of your information system after a ransomware intrusion and reconstruct them rapidly into an operational network. Progent has worked with top insurance providers including Chubb to help businesses recover from ransomware assaults.

Contact Progent about Ransomware Settlement Expertise
To get in touch with Progent about ransomware settlement negotiation expertise, call Progent at 800-462-8800 or go to Contact Progent.