Ransomware Response Consultants
Ransomware Negotiation Services
Overview of Progent's Ransomware Negotiation Services in Kansas City
Progent is experienced in negotiating ransomware settlements with attackers. Reaching an acceptable settlement is a complex exercise that calls for a combination of field experience, IT knowledge and business acumen. It also calls for close co-operation with the ransomware victim's IT team and the insurance provider, if there is one. Since the number one priority of the ransomware victim is fast recovery, it is critical to deploy response teams that work efficiently, in parallel, and in close communication. Progent has the breadth of IT knowledge and the depth of personnel to complement your IT staff and restore your network environment quickly and economically.
Services offered by Progent's ransomware settlement negotiation experts include:
- Establishing the kind of ransomware involved in the assault
- Identifying and communicating with the hacker
- Evaluating the recovery risk
- Validating the TA's decryption capabilities
- Agreeing on a settlement range with the victim and the insurance provider
- Establishing a settlement and timeline with the threat actor
- Verifying compliance with anti-money laundering (AML) laws
- Overseeing the crypto-currency payment to the TA
- Acquiring, reviewing, and operating the hacker's decryption utility
- If necessary, contacting the hacker for technical assistance with the decryptor utility
- Isolating infected endpoints and data stores to prevent further progress of the assault
- Making digital copies of every compromised server and endpoint and data store to allow forensics in parallel with recovery
- Installing anti-virus protection to all virus-free endpoints
- Restoring data from air-gapped backups or uncompromised machines
- Creating a pristine recovery environment
- Remapping and reconnecting datastores to reflect precisely their pre-encryption state
Paying Exfiltration Ransoms
Beyond demanding money for a decryption utility, modern strains of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor commonly attempt to steal (or "exfiltrate") files. TAs are then able to demand an extra ransom for not divulging this information on the dark web. Sadly, there exists no method to guarantee that exfiltrated files have been totally erased by the hacker. In fact, in numerous instances the hacker has little control about who can access the stolen files. Paying an exfiltration ransom does not eliminate the necessity of engaging the guidance of privacy attorneys, conducting an investigation into which files were stolen, and performing the mandated notifications to affected entities. In general, paying an exfiltration ransom is not recommended.
Progent's Background
Progent has provided remote and onsite IT services across the United States for more than 20 years and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes professionals who have been awarded high-level certifications in core technology platforms including Cisco networking, VMware virtualization, and popular Linux distros. Progent's cybersecurity experts have earned internationally recognized certifications such as CISM, CISSP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also has guidance in financial and Enterprise Resource Planning applications. This breadth of expertise allows Progent to identify and integrate the undamaged parts of your IT environment following a ransomware intrusion and rebuild them quickly into an operational network. Progent has worked with top cyber insurance providers including Chubb to help businesses recover from ransomware attacks.
Contact Progent about Ransomware Settlement Services in Kansas City
To contact with Progent about ransomware settlement expertise in Kansas City, phone Progent at
Select Topic: