Ransomware Response Consultants

Overview of Progent's Ransomware Negotiation Consulting in Ottawa
Progent is experienced in negotiating ransomware settlements with adversaries. Negotiating an acceptable settlement is a complex exercise that calls for a combination of field experience, IT skills and business savvy. It also requires close co-operation with the cyber-extortion target's IT staff and the insurance provider, if any. Because the top priority of the ransomware victim is operational continuity, it is critical to establish response teams that operate effectively, concurrently, and in close communication. Progent offers the breadth of IT skills and the deep bench of personnel to supplement your network support team and restore your network environment rapidly and economically.

Services provided by Progent's ransomware negotiation experts include:

• Establishing the type of ransomware involved in the assault
• Making contact with the hacker persona
• Evaluating the likelihood of recovery
• Verifying the hacker's decryption capabilities
• Deciding on an acceptable settlement amount with the victim and the cyber insurance carrier
• Establishing a settlement and schedule with the TA
• Verifying accordance with anti-money laundering (AML) regulations
• Overseeing the crypto-currency payment to the TA
• Acquiring, learning, and using the hacker's decryptor utility
• If needed, contacting the threat actor for technical help with the decryption utility

• Isolating infected endpoints and data stores to prevent further progress of the attack
• Creating replicas of every breached device and data store in order to perform forensics in parallel with cleanup
• Installing A/V agents to all clean endpoints
• Salvaging data from offline restores or uncompromised machines
• Creating a pristine environment
• Remapping and reconnecting drives to match exactly their pre-attack state

Settling Exfiltration Ransoms
In addition to demanding payment for a decryption tool, modern variants of crypto-ransomware like Ryuk, Maze, Netwalker, and Egregor often try to exfiltrate files. TAs can then require an extra payment for not posting this data on the dark web. Sadly, there is no way to guarantee that stolen files have been completely erased by the threat actor. In fact, in many instances the TA has limited control about where the information ends up. Settling an exfiltration ransom does not eliminate the need for getting the guidance of privacy lawyers, conducting an audit on which files were taken, and carrying out the necessary alerts to affected entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has delivered remote and on-premises IT services throughout the United States for over two decades and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in foundation technology platforms such as Cisco networking, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally recognized certifications including CISM, CISSP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also offers top-tier support in financial management and ERP application software. This broad array of skills allows Progent to salvage and consolidate the undamaged parts of your network after a ransomware attack and reconstruct them rapidly into an operational network. Progent has collaborated with leading insurance carriers including Chubb to help businesses clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Services in Ottawa
To get in touch with Progent about ransomware settlement negotiation expertise in Ottawa, call Progent at 800-462-8800 or go to Contact Progent.