Ransomware Response Consultants

Progent's Ransomware Settlement Negotiation Consulting in Savannah
Progent has experience negotiating ransomware settlements with attackers. Negotiating an optimum settlement is a complex activity that requires a combination of real-word experience, technical skills and business acumen. It also requires working closely with the ransomware victim's IT staff and the insurance provider, if there is one. Since the top priority of the ransomware target is operational continuity, it is vital to establish recovery groups that operate efficiently, in parallel, and with intimate collaboration. Progent offers the scope of IT knowledge and the deep bench of experts to supplement your network staff and recover your network quickly and economically.

Support provided by Progent's ransomware settlement experts include:

• Determining the type of ransomware used in the assault
• Identifying and communicating with the hacker persona
• Assessing the recovery risk
• Verifying the TA's decryption tool
• Agreeing on a settlement range with the victim and the cyber insurance provider
• Negotiating a settlement and timeline with the threat actor
• Confirming compliance with anti-money laundering regulations
• Managing the crypto-currency disbursement to the TA
• Acquiring, reviewing, and using the hacker's decryptor mechanism
• If necessary, contacting the threat actor for technical assistance with the decryptor tool

• Quarantining infected endpoints to arrest the spread of the assault
• Making replicas of every compromised server and endpoint and data store in order to perform forensics in parallel with recovery
• Adding A/V agents to all clean endpoints
• Salvaging data from air-gapped restores or uncompromised machines
• Creating a clean recovery environment
• Mapping and reconnecting drives to match exactly their pre-encryption condition

Paying Exfiltration Ransoms
Beyond extorting payment for a decryption tool, current variants of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor often try to steal (or "exfiltrate") information. Hackers can then demand an additional ransom for not posting this data or selling it. Sadly, there exists no method to guarantee that stolen files have been completely deleted by the TA. Actually, in numerous instances the hacker has little control over who can access the stolen files. Paying an exfiltration ransom does not free you from the need for getting the guidance of legal counsel, conducting an investigation into which files were compromised, and performing the mandated notifications to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered online and on-premises IT services across the U.S. for more than 20 years and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts (SMEs) includes professionals who have earned advanced certifications in foundation technology platforms such as Cisco infrastructure, VMware, and major Linux distros. Progent's data security experts have earned internationally recognized certifications including CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also offers top-tier support in financial and ERP software. This scope of skills allows Progent to salvage and consolidate the surviving parts of your IT environment following a ransomware attack and reconstruct them rapidly into an operational network. Progent has worked with leading cyber insurance carriers including Chubb to assist organizations clean up after ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Negotiation Services in Savannah
To contact with Progent about crypto-ransomware settlement guidance in Savannah, call Progent at 800-462-8800 or go to Contact Progent.