Ransomware Response Services

Progent's Ransomware Negotiation Consulting in Providence
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an acceptable settlement is a complex exercise that requires a mix of field experience, technical skills and business acumen. It also demands close co-operation with the ransomware victim's IT team and the cyber insurance carrier, if any. Since the number one priority of the ransomware victim is operational continuity, it is critical to establish response groups that work effectively, concurrently, and in close communication. Progent offers the scope of technical knowledge and the depth of personnel to supplement your IT support team and restore your network quickly and affordably.

Services provided by Progent's ransomware negotiation team include:

• Determining the type of ransomware used in the attack
• Identifying and contacting the hacker persona
• Evaluating the likelihood of recovery
• Testing the threat actor's decryption capabilities
• Budgeting a settlement range with the victim and the cyber insurance provider
• Negotiating a settlement amount and timeline with the TA
• Checking compliance with anti-money laundering (AML) sanctions
• Overseeing the crypto-currency transfer to the TA
• Receiving, reviewing, and operating the hacker's decryption tool
• If necessary, contacting the hacker for assistance with the decryptor utility

• Isolating affected endpoints and data stores to arrest the spread of the attack
• Making digital copies of every breached device and data store to allow forensics without interfering with cleanup
• Installing A/V agents to all virus-free endpoints
• Salvaging data from offline backups or uncompromised endpoints
• Creating a clean environment
• Mapping and connecting datastores to reflect exactly their pre-attack condition

Settling Exfiltration Ransoms
In addition to demanding payment for a decryption tool, modern variants of ransomware such as Ryuk, Sodinokibi, Netwalker, and Nephilim commonly attempt to exfiltrate information. Hackers can then demand an extra ransom for not divulging this data or selling it. Sadly, there is no method to be certain that exfiltrated data have been totally deleted by the threat actor. In fact, in many instances the TA has limited control over data custody. Paying an exfiltration ransom does not free you from the need for engaging the guidance of privacy attorneys, performing an inventory of files were stolen, and performing the required alerts to affected entities. In almost all cases, paying an exfiltration ransom is a waste.

Progent's Background
Progent has delivered remote and onsite IT services throughout the U.S. for more than two decades and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of SMEs includes consultants who have been awarded advanced certifications in core technology platforms including Cisco infrastructure, VMware virtualization, and major Linux distros. Progent's data security experts have earned prestigious certifications such as CISM, CISSP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also has guidance in financial and ERP applications. This scope of expertise gives Progent the ability to salvage and consolidate the surviving parts of your network after a ransomware attack and rebuild them quickly into a viable network. Progent has collaborated with leading cyber insurance carriers including Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Guidance in Providence
To contact with Progent about ransomware settlement negotiation guidance in Providence, phone Progent at 800-462-8800 or go to Contact Progent.