Ransomware Response Consulting Services

Progent's Ransomware Settlement Negotiation Services in Manhattan Beach
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an optimum settlement is a complex activity that requires a mix of field experience, technical skills and business savvy. It also calls for close co-operation with the victim's IT team and the cyber insurance carrier, if there is one. Because the top goal of the ransomware target is fast recovery, it is critical to establish recovery teams that work efficiently, in parallel, and in close communication. Progent has the scope of IT skills and the depth of personnel to complement your IT staff and recover your network environment rapidly and affordably.

Support provided by Progent's ransomware negotiation experts include:

• Establishing the kind of ransomware used in the attack
• Identifying and communicating with the hacker persona
• Evaluating the recovery risk
• Verifying the threat actor's decryption capabilities
• Determining a settlement payment with the victim and the insurance provider
• Negotiating a settlement amount and timeline with the TA
• Verifying accordance with anti-money laundering (AML) sanctions
• Overseeing the crypto-currency payment to the hacker
• Receiving, reviewing, and using the threat actor's decryption utility
• If needed, contacting the TA for technical assistance with the decryption tool

• Quarantining affected endpoints to arrest the progress of the attack
• Creating replicas of every compromised server and endpoint and data store in order to perform forensics in parallel with cleanup
• Adding anti-virus protection to all clean endpoints
• Restoring files from offline restores or unscathed endpoints
• Creating a clean environment
• Mapping and connecting drives to match precisely their pre-encryption state

Settling Exfiltration Ransoms
In addition to extorting payment for a decryption utility, current variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor commonly try to steal (or "exfiltrate") files. Hackers can then demand an additional ransom for not posting this data on the dark web. Unfortunately, there exists no way to prove that stolen data have been completely deleted by the TA. In fact, in many instances the TA has little control over who can access the stolen files. Paying an exfiltration ransom does not eliminate the necessity of engaging the advice of legal counsel, performing an inventory of data were compromised, and performing the mandated notifications to impacted entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided remote and onsite network services throughout the U.S. for over 20 years and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts includes professionals who have been awarded high-level certifications in core technologies such as Cisco infrastructure, VMware virtualization, and major Linux distros. Progent's data security experts have earned prestigious certifications such as CISA, CISSP-ISSAP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also offers guidance in financial and ERP software. This breadth of expertise allows Progent to salvage and integrate the surviving parts of your information system after a ransomware intrusion and reconstruct them rapidly into a viable network. Progent has collaborated with leading insurance carriers including Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Services in Manhattan Beach
To get in touch with Progent about crypto-ransomware settlement negotiation expertise in Manhattan Beach, call Progent at 800-462-8800 or go to Contact Progent.