Ransomware Response Consultants

Progent's Ransomware Settlement Negotiation Services in Irvine
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an optimum settlement is a complicated exercise that calls for a mix of field experience, technical knowledge and business savvy. It also calls for working closely with the victim's IT staff and the cyber insurance carrier, if there is one. Because the number one priority of the ransomware victim is fast recovery, it is critical to establish recovery groups that operate efficiently, concurrently, and with intimate collaboration. Progent has the breadth of technical skills and the deep bench of personnel to complement your IT support team and restore your network rapidly and affordably.

Services available from Progent's ransomware negotiation team include:

• Determining the kind of ransomware involved in the attack
• Identifying and contacting the hacker
• Evaluating the recovery risk
• Validating the hacker's decryption capabilities
• Budgeting a settlement amount with the ransomware victim and the insurance provider
• Negotiating a settlement and schedule with the TA
• Verifying accordance with anti-money laundering laws
• Managing the crypto-currency payment to the hacker
• Receiving, reviewing, and operating the threat actor's decryption utility
• If necessary, contacting the hacker for technical assistance with the decryption utility

• Quarantining affected endpoints and data stores to arrest the progress of the attack
• Making replicas of each infected server and endpoint and data store in order to perform forensics in parallel with cleanup
• Adding anti-virus agents to all clean endpoints
• Restoring data from air-gapped restores or unscathed endpoints
• Building a clean environment
• Mapping and connecting datastores to match exactly their pre-attack condition

Exfiltration Ransoms
Beyond extorting payment for a decryption tool, current variants of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor often attempt to steal (or "exfiltrate") information. Hackers can then demand an extra settlement in exchange for not divulging this data on the dark web. Sadly, there exists no method to prove that stolen data have been completely deleted by the hacker. In fact, in many cases the threat actor has little control about where the information ends up. Paying an exfiltration ransom does not eliminate the need for engaging the advice of legal counsel, conducting an audit on which data were compromised, and performing the mandated alerts to affected entities. In almost all cases, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has delivered online and onsite IT services across the U.S. for over two decades and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes consultants who have been awarded high-level certifications in core technology platforms including Cisco infrastructure, VMware virtualization, and popular distributions of Linux. Progent's data security consultants have earned industry-recognized certifications such as CISA, CISSP, CRISC, and CMMC 2.0. (Refer to Progent's certifications). Progent also offers guidance in financial and ERP software. This broad array of expertise gives Progent the ability to identify and consolidate the undamaged pieces of your IT environment after a ransomware attack and reconstruct them rapidly into a functioning system. Progent has collaborated with leading cyber insurance providers including Chubb to assist businesses recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Guidance in Irvine
To get in touch with Progent about ransomware settlement negotiation expertise in Irvine, call Progent at 800-462-8800 or go to Contact Progent.