Ransomware Response Services

Overview of Progent's Ransomware Negotiation Services in Allen
Progent has experience negotiating ransomware settlements with threat actors. Reaching an acceptable settlement is a complex exercise that requires a mix of real-word experience, IT skills and business savvy. It also demands working closely with the ransomware victim's IT team and the cyber insurance provider, if there is one. Since the number one priority of the ransomware target is fast recovery, it is critical to establish recovery teams that work effectively, concurrently, and in close communication. Progent offers the breadth of technical knowledge and the depth of personnel to supplement your IT support team and recover your network rapidly and economically.

Services available from Progent's ransomware negotiation team include:

• Establishing the kind of ransomware involved in the attack
• Identifying and communicating with the hacker
• Assessing the recovery risk
• Verifying the TA's decryption tool
• Budgeting a settlement amount with the victim and the insurance provider
• Negotiating a settlement and schedule with the threat actor
• Confirming compliance with anti-money laundering regulations
• Carrying out the crypto-currency transfer to the TA
• Acquiring, learning, and using the threat actor's decryption utility
• If needed, contacting the hacker for assistance with the decryptor tool

• Isolating infected endpoints to arrest the spread of the attack
• Making digital copies of every compromised server and endpoint and data store in order to perform forensics without interfering with recovery
• Installing A/V protection to all virus-free endpoints
• Recovering data from offline restores or unscathed endpoints
• Creating a pristine recovery environment
• Remapping and reconnecting drives to match precisely their pre-attack condition

Paying Exfiltration Ransoms
In addition to demanding payment for a decryption tool, modern variants of crypto-ransomware like Ryuk, Maze, Netwalker, and Nephilim often try to exfiltrate information. Hackers can then demand a separate settlement for not divulging this data or selling it. Unfortunately, there exists no way to prove that stolen data have been totally deleted by the TA. In fact, in numerous cases the threat actor has little say over who can access the stolen files. Paying an exfiltration ransom does not free you from the necessity of engaging the advice of legal counsel, conducting an audit on which data were stolen, and sending the required alerts to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered online and on-premises network services throughout the United States for more than 20 years and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in foundation technology platforms including Cisco networking, VMware virtualization, and major distributions of Linux. Progent's data security consultants have earned industry-recognized certifications including CISM, CISSP-ISSAP, CRISC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has top-tier support in financial management and Enterprise Resource Planning application software. This broad array of skills gives Progent the ability to salvage and consolidate the surviving parts of your information system after a ransomware intrusion and rebuild them rapidly into a viable system. Progent has worked with leading cyber insurance providers like Chubb to assist businesses clean up after ransomware assaults.

Contact Progent about Ransomware Settlement Negotiation Guidance in Allen
To get in touch with Progent about ransomware settlement guidance in Allen, phone Progent at 800-462-8800 or go to Contact Progent.