Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Consulting in Chandler
Progent is experienced in negotiating ransomware settlements with threat actors. Reaching an optimum settlement is a complex activity that requires a combination of field experience, IT skills and business acumen. It also demands close co-operation with the cyber-extortion target's IT staff and the cyber insurance carrier, if there is one. Because the top priority of the ransomware victim is operational continuity, it is critical to deploy response groups that work effectively, in parallel, and with intimate collaboration. Progent offers the scope of technical knowledge and the depth of personnel to supplement your network support team and recover your network environment quickly and economically.

Services offered by Progent's ransomware negotiation team include:

• Establishing the kind of ransomware involved in the attack
• Identifying and contacting the hacker
• Evaluating the recovery risk
• Testing the threat actor's decryption capabilities
• Budgeting a settlement amount with the ransomware victim and the insurance carrier
• Establishing a settlement and timeline with the TA
• Checking accordance with anti-money laundering sanctions
• Carrying out the crypto-currency transfer to the hacker
• Acquiring, reviewing, and using the TA's decryption tool
• If necessary, contacting the hacker for assistance with the decryption tool

• Isolating infected endpoints to prevent further spread of the attack
• Making digital copies of every breached device and data store in order to perform forensics in parallel with recovery
• Installing anti-virus protection to all virus-free endpoints
• Recovering files from offline restores or unscathed endpoints
• Creating a pristine recovery environment
• Remapping and reconnecting drives to match exactly their pre-encryption condition

Settling Exfiltration Ransoms
Beyond demanding money for a decryption utility, current strains of crypto-ransomware like Ryuk, Sodinokibi, Netwalker, and Egregor commonly try to steal (or "exfiltrate") information. TAs are then able to require an additional settlement in exchange for not divulging this data on the dark web. Unfortunately, there exists no way to be certain that stolen data have been completely deleted by the threat actor. In fact, in numerous cases the hacker has little say about the disposition of the data. Settling an exfiltration ransom does not eliminate the need for engaging the guidance of privacy attorneys, conducting an investigation into which files were stolen, and carrying out the required alerts to affected entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has delivered remote and onsite network services throughout the U.S. for more than two decades and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts includes consultants who have been awarded high-level certifications in foundation technologies such as Cisco infrastructure, VMware, and major Linux distros. Progent's data security consultants have earned prestigious certifications including CISM, CISSP, CRISC, and CMMC 2.0. (Refer to Progent's certifications). Progent also offers guidance in financial management and Enterprise Resource Planning application software. This broad array of expertise allows Progent to salvage and consolidate the undamaged parts of your information system after a ransomware attack and reconstruct them quickly into an operational system. Progent has worked with top insurance carriers like Chubb to assist businesses recover from ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Guidance in Chandler
To get in touch with Progent about crypto-ransomware settlement services in Chandler, phone Progent at 800-462-8800 or go to Contact Progent.