Ransomware Response Services

Overview of Progent's Ransomware Negotiation Consulting in Petaluma
Progent is experienced in negotiating ransomware settlements with threat actors. Reaching an optimum settlement is a complex activity that requires a mix of real-word experience, technical knowledge and business acumen. It also demands close co-operation with the victim's IT staff and the insurance provider, if any. Because the number one priority of the ransomware target is fast recovery, it is critical to establish recovery teams that work effectively, in parallel, and with intimate collaboration. Progent has the breadth of technical knowledge and the depth of experts to complement your IT support team and recover your network environment rapidly and affordably.

Support offered by Progent's ransomware settlement experts include:

• Determining the kind of ransomware used in the assault
• Identifying and contacting the hacker
• Assessing the recovery risk
• Verifying the hacker's decryption tool
• Determining a settlement payment with the ransomware victim and the insurance provider
• Negotiating a settlement and timeline with the hacker
• Checking adherence to anti-money laundering regulations
• Overseeing the crypto-currency payment to the hacker
• Receiving, learning, and operating the hacker's decryptor mechanism
• If needed, contacting the threat actor for technical assistance with the decryptor tool

• Isolating affected endpoints to prevent further spread of the assault
• Creating replicas of each infected device and data store to allow forensics in parallel with cleanup
• Adding A/V protection to all virus-free endpoints
• Restoring data from offline backups or unscathed endpoints
• Building a clean recovery environment
• Mapping and connecting datastores to match exactly their pre-attack state

Paying Exfiltration Ransoms
In addition to extorting payment for a decryption tool, current variants of crypto-ransomware such as Ryuk, Sodinokibi, Netwalker, and Nephilim often try to exfiltrate information. TAs are then able to require a separate ransom in exchange for not publishing this data or selling it. Unfortunately, there exists no way to prove that exfiltrated files have been completely erased by the threat actor. Actually, in many instances the TA has little say over who can access the stolen files. Paying an exfiltration ransom does not free you from the need for getting the guidance of privacy lawyers, performing an audit on which files were stolen, and carrying out the necessary alerts to impacted entities. Generally, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided online and onsite network services across the U.S. for over 20 years and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have earned high-level certifications in foundation technology platforms including Cisco networking, VMware virtualization, and popular Linux distros. Progent's data security consultants have earned prestigious certifications such as CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers top-tier support in financial management and ERP application software. This broad array of skills gives Progent the ability to identify and consolidate the undamaged parts of your information system following a ransomware intrusion and reconstruct them quickly into an operational system. Progent has worked with leading cyber insurance carriers including Chubb to help organizations clean up after ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Expertise in Petaluma
To get in touch with Progent about ransomware settlement negotiation expertise in Petaluma, call Progent at 800-462-8800 or go to Contact Progent.