Ransomware Response Consultants
Ransomware Negotiation Guidance
Overview of Progent's Ransomware Negotiation Consulting in Anchorage
Progent has experience negotiating ransomware settlements with attackers. Negotiating an acceptable settlement is a complicated exercise that requires a mix of real-word experience, IT knowledge and business savvy. It also demands close co-operation with the victim's IT team and the cyber insurance carrier, if any. Since the number one goal of the ransomware target is fast recovery, it is vital to deploy response teams that operate efficiently, concurrently, and with intimate collaboration. Progent has the breadth of technical knowledge and the depth of experts to complement your network staff and recover your network rapidly and affordably.
Support offered by Progent's ransomware settlement negotiation experts include:
- Determining the type of ransomware used in the attack
- Making contact with the hacker
- Evaluating the recovery risk
- Validating the threat actor's decryption capabilities
- Deciding on an acceptable settlement payment with the victim and the cyber insurance carrier
- Establishing a settlement amount and timeline with the threat actor
- Confirming accordance with anti-money laundering regulations
- Managing the crypto-currency disbursement to the hacker
- Acquiring, reviewing, and operating the threat actor's decryptor mechanism
- If necessary, contacting the TA for assistance with the decryptor utility
- Isolating infected endpoints and data stores to prevent further spread of the attack
- Making digital copies of each compromised device and data store in order to perform forensics in parallel with recovery
- Adding anti-virus agents to all virus-free endpoints
- Salvaging files from air-gapped restores or uncompromised machines
- Building a pristine environment
- Mapping and connecting drives to reflect precisely their pre-encryption state
Settling Exfiltration Ransoms
In addition to demanding money for a decryption tool, current variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim commonly try to steal (or "exfiltrate") information. Hackers can then demand a separate payment in exchange for not posting this information or selling it. Unfortunately, there is no way to guarantee that exfiltrated files have been completely deleted by the threat actor. Actually, in many cases the threat actor has little say over who can access the stolen files. Paying an exfiltration ransom does not eliminate the necessity of getting the advice of legal counsel, conducting an audit on which data were taken, and sending the necessary notifications to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.
Progent's Qualifications
Progent has delivered online and onsite network services throughout the United States for over 20 years and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts includes professionals who have been awarded high-level certifications in foundation technology platforms including Cisco infrastructure, VMware, and popular Linux distros. Progent's cybersecurity experts have earned prestigious certifications such as CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has guidance in financial management and Enterprise Resource Planning application software. This scope of expertise gives Progent the ability to identify and consolidate the undamaged parts of your IT environment following a ransomware attack and rebuild them quickly into an operational network. Progent has collaborated with top insurance providers including Chubb to assist organizations recover from ransomware attacks.
Contact Progent about Crypto-Ransomware Settlement Expertise in Anchorage
To get in touch with Progent about ransomware settlement negotiation services in Anchorage, phone Progent at
Select Topic: