Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Consulting in Oakland
Progent is experienced in negotiating ransomware settlements with hackers. Reaching an acceptable settlement is a complicated exercise that calls for a combination of field experience, technical knowledge and business savvy. It also requires close co-operation with the ransomware victim's IT team and the insurance carrier, if any. Since the top goal of the ransomware victim is fast recovery, it is vital to establish response teams that work effectively, in parallel, and in close communication. Progent has the scope of technical knowledge and the depth of personnel to complement your IT support team and recover your network environment quickly and economically.

Services provided by Progent's ransomware negotiation experts include:

• Establishing the kind of ransomware involved in the attack
• Identifying and communicating with the hacker
• Assessing the likelihood of recovery
• Testing the hacker's decryption capabilities
• Budgeting a settlement range with the victim and the insurance carrier
• Negotiating a settlement amount and timeline with the hacker
• Checking compliance with anti-money laundering (AML) laws
• Overseeing the crypto-currency payment to the hacker
• Receiving, learning, and operating the TA's decryption tool
• If necessary, contacting the hacker for assistance with the decryption tool

• Isolating infected endpoints and data stores to prevent further spread of the assault
• Making digital copies of each compromised server and endpoint and data store in order to perform forensics in parallel with restoration
• Adding A/V protection to all clean endpoints
• Restoring data from air-gapped backups or unscathed machines
• Creating a pristine recovery environment
• Remapping and reconnecting datastores to match exactly their pre-attack condition

Settling Exfiltration Ransoms
Beyond extorting money for a decryption utility, modern variants of ransomware like Ryuk, Maze, DopplePaymer, and Egregor often attempt to exfiltrate files. TAs can then demand a separate ransom for not divulging this data on the dark web. Unfortunately, there exists no method to guarantee that stolen files have been completely erased by the TA. Actually, in many instances the threat actor has limited say over who can access the stolen files. Paying an exfiltration ransom does not eliminate the need for engaging the guidance of legal counsel, performing an inventory of data were compromised, and carrying out the mandated notifications to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided online and on-premises network services across the U.S. for more than two decades and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned advanced certifications in foundation technology platforms including Cisco networking, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned industry-recognized certifications including CISA, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial management and Enterprise Resource Planning software. This breadth of skills gives Progent the ability to identify and integrate the undamaged pieces of your IT environment following a ransomware intrusion and reconstruct them rapidly into a functioning system. Progent has collaborated with top insurance providers like Chubb to help organizations clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Services in Oakland
To get in touch with Progent about ransomware settlement expertise in Oakland, phone Progent at 800-462-8800 or go to Contact Progent.