Ransomware Response Consulting Services
Ransomware Settlement Negotiation Services
Overview of Progent's Ransomware Settlement Negotiation Consulting in Cambridge
Progent is experienced in negotiating ransomware settlements with attackers. Negotiating an acceptable settlement is a complex exercise that requires a mix of real-word experience, IT knowledge and business savvy. It also demands close co-operation with the cyber-extortion target's IT team and the insurance carrier, if there is one. Since the number one priority of the ransomware victim is fast recovery, it is critical to deploy recovery groups that operate effectively, in parallel, and in close communication. Progent offers the scope of technical knowledge and the depth of personnel to supplement your IT support team and recover your network environment rapidly and economically.
Services available from Progent's ransomware settlement negotiation experts include:
- Establishing the kind of ransomware used in the assault
- Identifying and communicating with the hacker
- Evaluating the recovery risk
- Verifying the TA's decryption capabilities
- Agreeing on a settlement with the victim and the insurance carrier
- Negotiating a settlement amount and timeline with the TA
- Checking compliance with anti-money laundering sanctions
- Overseeing the crypto-currency payment to the TA
- Acquiring, reviewing, and using the hacker's decryption tool
- If needed, contacting the hacker for assistance with the decryption utility
- Isolating affected endpoints to prevent further spread of the attack
- Making digital copies of every infected server and endpoint and data store in order to perform forensics in parallel with restoration
- Installing anti-virus protection to all virus-free endpoints
- Salvaging data from air-gapped restores or uncompromised machines
- Building a clean environment
- Remapping and reconnecting drives to reflect precisely their pre-attack state
Exfiltration Ransoms
Beyond extorting money for a decryption tool, modern strains of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor often try to exfiltrate files. TAs are then able to require a separate payment in exchange for not posting this information on the dark web. Unfortunately, there exists no way to guarantee that exfiltrated files have been totally erased by the TA. In fact, in many cases the hacker has little control about the disposition of the data. Paying an exfiltration ransom does not eliminate the need for engaging the guidance of privacy lawyers, performing an audit on which data were compromised, and performing the necessary alerts to impacted entities. In general, paying an exfiltration ransom is not recommended.
Progent's Background
Progent has provided online and on-premises IT services across the U.S. for more than two decades and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced certifications in foundation technologies including Cisco infrastructure, VMware virtualization, and popular Linux distros. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISA, CISSP-ISSAP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also has top-tier support in financial management and ERP software. This scope of skills allows Progent to identify and integrate the undamaged parts of your network after a ransomware attack and reconstruct them rapidly into a viable network. Progent has worked with top insurance providers including Chubb to assist organizations recover from ransomware attacks.
Contact Progent about Ransomware Settlement Services in Cambridge
To contact with Progent about crypto-ransomware settlement expertise in Cambridge, call Progent at
Select Topic: