Ransomware Response Services

Overview of Progent's Ransomware Negotiation Consulting in San Diego UCSD
Progent has experience negotiating ransomware settlements with adversaries. Reaching an acceptable settlement is a complex exercise that requires a mix of field experience, IT skills and business acumen. It also requires close co-operation with the cyber-extortion target's IT team and the insurance carrier, if there is one. Because the number one goal of the ransomware target is operational continuity, it is vital to deploy response teams that work efficiently, concurrently, and with intimate collaboration. Progent has the breadth of technical knowledge and the deep bench of experts to supplement your IT support team and restore your network environment rapidly and economically.

Support available from Progent's ransomware settlement experts include:

• Establishing the kind of ransomware used in the attack
• Identifying and communicating with the hacker
• Evaluating the recovery risk
• Testing the TA's decryption capabilities
• Agreeing on a settlement range with the ransomware victim and the insurance provider
• Negotiating a settlement and timeline with the hacker
• Checking adherence to anti-money laundering (AML) laws
• Managing the crypto-currency transfer to the hacker
• Receiving, reviewing, and using the TA's decryptor mechanism
• If needed, contacting the hacker for technical help with the decryption utility

• Isolating affected endpoints and data stores to arrest the progress of the attack
• Making replicas of each infected device and data store in order to perform forensics in parallel with cleanup
• Installing A/V agents to all clean endpoints
• Salvaging data from air-gapped backups or uncompromised machines
• Creating a pristine environment
• Remapping and reconnecting datastores to reflect exactly their pre-encryption state

Exfiltration Ransoms
In addition to extorting money for a decryption utility, modern variants of crypto-ransomware like Ryuk, Sodinokibi, Netwalker, and Egregor commonly try to steal (or "exfiltrate") files. Hackers are then able to demand a separate settlement for not posting this information on the dark web. Unfortunately, there is no way to prove that exfiltrated files have been totally deleted by the threat actor. In fact, in many instances the TA has little say about the disposition of the data. Settling an exfiltration ransom does not eliminate the necessity of engaging the advice of legal counsel, conducting an inventory of data were taken, and carrying out the mandated notifications to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has provided remote and onsite IT services across the U.S. for more than 20 years and has been awarded Microsoft's Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes consultants who have earned advanced certifications in foundation technologies such as Cisco infrastructure, VMware virtualization, and major Linux distros. Progent's data security consultants have earned prestigious certifications such as CISA, CISSP-ISSAP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also has top-tier support in financial and ERP applications. This broad array of skills gives Progent the ability to salvage and integrate the undamaged parts of your information system following a ransomware attack and rebuild them quickly into an operational system. Progent has worked with top cyber insurance carriers including Chubb to help businesses clean up after ransomware assaults.

Contact Progent about Ransomware Settlement Expertise in San Diego UCSD
To get in touch with Progent about crypto-ransomware settlement negotiation guidance in San Diego UCSD, call Progent at 800-462-8800 or go to Contact Progent.