Ransomware Response Consulting Services
Ransomware Negotiation Guidance
Overview of Progent's Ransomware Negotiation Services in Liverpool
Progent is experienced in negotiating ransomware settlements with adversaries. Reaching an acceptable settlement is a complicated exercise that requires a mix of real-word experience, IT skills and business savvy. It also demands close co-operation with the victim's IT team and the cyber insurance provider, if there is one. Since the top priority of the ransomware victim is fast recovery, it is critical to deploy recovery groups that operate effectively, concurrently, and in close communication. Progent has the breadth of technical skills and the depth of experts to complement your network support team and restore your network environment rapidly and affordably.
Support offered by Progent's ransomware negotiation team include:
- Determining the type of ransomware involved in the assault
- Identifying and contacting the hacker persona
- Evaluating the recovery risk
- Testing the hacker's decryption capabilities
- Determining a settlement with the ransomware victim and the cyber insurance carrier
- Negotiating a settlement and schedule with the TA
- Confirming compliance with anti-money laundering regulations
- Overseeing the crypto-currency payment to the TA
- Receiving, reviewing, and using the threat actor's decryptor tool
- If needed, contacting the hacker for technical help with the decryptor tool
- Isolating affected endpoints and data stores to arrest the progress of the assault
- Making digital copies of each infected server and endpoint and data store to allow forensics without interfering with restoration
- Adding anti-virus agents to all virus-free endpoints
- Restoring data from air-gapped restores or uncompromised endpoints
- Building a pristine environment
- Mapping and connecting datastores to match precisely their pre-encryption condition
Exfiltration Ransoms
In addition to demanding money for a decryption tool, current variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim often attempt to steal (or "exfiltrate") information. TAs are then able to demand a separate payment in exchange for not publishing this information on the dark web. Sadly, there is no way to guarantee that stolen files have been completely deleted by the TA. In fact, in numerous instances the threat actor has little control about data custody. Paying an exfiltration ransom does not free you from the need for getting the advice of privacy lawyers, conducting an audit on which files were taken, and sending the required alerts to affected entities. Generally, paying an exfiltration ransom is not recommended.
Progent's Qualifications
Progent has delivered online and on-premises network services throughout the United States for more than two decades and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have been awarded advanced certifications in core technology platforms such as Cisco infrastructure, VMware virtualization, and major Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISA, CISSP-ISSAP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial management and ERP software. This scope of skills allows Progent to salvage and integrate the undamaged pieces of your network after a ransomware attack and rebuild them rapidly into an operational system. Progent has worked with leading cyber insurance carriers including Chubb to help organizations clean up after ransomware attacks.
Contact Progent about Crypto-Ransomware Settlement Negotiation Expertise in Liverpool
To get in touch with Progent about crypto-ransomware settlement services in Liverpool, phone Progent at
Select Topic: