Ransomware Solutions Consultants

Overview of Progent's Ransomware Negotiation Services in San Antonio
Progent has experience negotiating ransomware settlements with adversaries. Negotiating an optimum settlement is a complex exercise that requires a combination of field experience, IT skills and business savvy. It also calls for close co-operation with the cyber-extortion target's IT team and the cyber insurance provider, if any. Because the top priority of the ransomware victim is operational continuity, it is critical to establish response groups that operate efficiently, in parallel, and with intimate collaboration. Progent offers the breadth of IT knowledge and the depth of personnel to supplement your IT support team and recover your network environment rapidly and economically.

Services offered by Progent's ransomware negotiation team include:

• Determining the kind of ransomware involved in the assault
• Identifying and contacting the hacker
• Assessing the likelihood of recovery
• Testing the hacker's decryption capabilities
• Budgeting a settlement amount with the ransomware victim and the cyber insurance carrier
• Establishing a settlement and timeline with the TA
• Confirming adherence to anti-money laundering laws
• Overseeing the crypto-currency transfer to the hacker
• Acquiring, learning, and using the hacker's decryptor mechanism
• If necessary, contacting the threat actor for technical assistance with the decryptor utility

• Quarantining affected endpoints to prevent further progress of the assault
• Creating digital copies of every compromised server and endpoint and data store to allow forensics without interfering with restoration
• Adding anti-virus protection to all clean endpoints
• Restoring data from air-gapped restores or uncompromised endpoints
• Building a pristine recovery environment
• Remapping and connecting drives to reflect exactly their pre-encryption condition

Settling Exfiltration Ransoms
Beyond demanding payment for a decryption utility, modern strains of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor often try to exfiltrate information. Hackers are then able to require an additional payment for not publishing this information or selling it. Sadly, there exists no method to be certain that exfiltrated files have been completely deleted by the TA. In fact, in many instances the threat actor has little say about where the information ends up. Settling an exfiltration ransom does not eliminate the need for engaging the guidance of legal counsel, conducting an audit on which data were stolen, and sending the required alerts to impacted entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and onsite network services throughout the U.S. for over 20 years and has earned Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of subject matter experts includes consultants who have earned high-level certifications in core technologies including Cisco networking, VMware virtualization, and major Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISA, CISSP, CRISC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers guidance in financial and ERP software. This breadth of skills gives Progent the ability to salvage and consolidate the surviving parts of your information system after a ransomware attack and reconstruct them rapidly into an operational system. Progent has collaborated with leading insurance carriers including Chubb to assist organizations clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Expertise in San Antonio
To contact with Progent about crypto-ransomware settlement expertise in San Antonio, call Progent at 800-462-8800 or go to Contact Progent.