Ransomware Response Services

Overview of Progent's Ransomware Negotiation Consulting in Knoxville
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an acceptable settlement is a complicated exercise that calls for a mix of real-word experience, technical skills and business acumen. It also demands working closely with the ransomware victim's IT team and the cyber insurance provider, if there is one. Because the number one priority of the ransomware target is operational continuity, it is critical to deploy response groups that work effectively, in parallel, and in close communication. Progent offers the breadth of technical knowledge and the deep bench of personnel to supplement your network staff and recover your network environment rapidly and economically.

Support offered by Progent's ransomware settlement experts include:

• Establishing the kind of ransomware involved in the assault
• Identifying and communicating with the hacker persona
• Evaluating the recovery risk
• Validating the TA's decryption capabilities
• Determining a settlement amount with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement amount and schedule with the TA
• Checking accordance with anti-money laundering sanctions
• Carrying out the crypto-currency payment to the TA
• Receiving, learning, and operating the TA's decryptor tool
• If necessary, contacting the threat actor for assistance with the decryptor utility

• Quarantining affected endpoints and data stores to arrest the spread of the attack
• Making replicas of each compromised device and data store in order to perform forensics in parallel with cleanup
• Adding A/V agents to all clean endpoints
• Recovering data from offline backups or uncompromised machines
• Building a clean environment
• Mapping and connecting drives to match precisely their pre-attack state

Paying Exfiltration Ransoms
In addition to demanding money for a decryption tool, modern variants of crypto-ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor often attempt to steal (or "exfiltrate") information. TAs are then able to demand a separate ransom in exchange for not posting this information or selling it. Sadly, there exists no way to prove that stolen data have been totally erased by the hacker. In fact, in many instances the threat actor has little say over data custody. Settling an exfiltration ransom does not eliminate the need for engaging the guidance of legal counsel, conducting an inventory of files were stolen, and sending the necessary alerts to impacted entities. In almost all cases, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has provided online and on-premises IT services throughout the U.S. for more than two decades and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in core technologies such as Cisco infrastructure, VMware, and popular Linux distros. Progent's data security consultants have earned prestigious certifications such as CISA, CISSP-ISSAP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also has guidance in financial management and Enterprise Resource Planning software. This breadth of expertise allows Progent to identify and consolidate the surviving pieces of your information system after a ransomware attack and rebuild them rapidly into a functioning system. Progent has worked with top insurance providers like Chubb to assist organizations recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Negotiation Expertise in Knoxville
To contact with Progent about crypto-ransomware settlement negotiation services in Knoxville, phone Progent at 800-462-8800 or go to Contact Progent.