Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Consulting in São José dos Campos
Progent has experience negotiating ransomware settlements with attackers. Negotiating an acceptable settlement is a complex activity that calls for a mix of field experience, technical skills and business acumen. It also calls for close co-operation with the ransomware victim's IT team and the insurance carrier, if there is one. Since the number one goal of the ransomware victim is operational continuity, it is vital to deploy recovery groups that operate effectively, in parallel, and with intimate collaboration. Progent offers the breadth of technical skills and the depth of personnel to supplement your IT staff and restore your network environment quickly and economically.

Support provided by Progent's ransomware settlement negotiation team include:

• Determining the type of ransomware involved in the assault
• Making contact with the hacker
• Evaluating the likelihood of recovery
• Verifying the threat actor's decryption tool
• Budgeting a settlement amount with the victim and the insurance carrier
• Establishing a settlement and timeline with the TA
• Verifying adherence to anti-money laundering (AML) sanctions
• Carrying out the crypto-currency payment to the hacker
• Receiving, reviewing, and using the TA's decryptor utility
• If necessary, contacting the threat actor for technical help with the decryption utility

• Isolating infected endpoints to arrest the spread of the assault
• Making replicas of each compromised server and endpoint and data store to allow forensics without interfering with recovery
• Installing A/V agents to all virus-free endpoints
• Restoring data from offline backups or uncompromised machines
• Creating a pristine environment
• Remapping and connecting drives to match precisely their pre-encryption state

Paying Exfiltration Ransoms
In addition to extorting payment for a decryption utility, current variants of crypto-ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Nephilim commonly attempt to exfiltrate files. TAs are then able to demand an extra ransom in exchange for not publishing this data or selling it. Sadly, there exists no way to guarantee that exfiltrated data have been completely erased by the threat actor. In fact, in numerous cases the hacker has limited control over the disposition of the data. Paying an exfiltration ransom does not free you from the need for engaging the advice of privacy lawyers, performing an investigation into which data were compromised, and performing the mandated notifications to affected entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has delivered online and on-premises IT services throughout the U.S. for more than two decades and has been awarded Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes professionals who have earned advanced certifications in core technologies such as Cisco networking, VMware virtualization, and popular distributions of Linux. Progent's data security consultants have earned industry-recognized certifications including CISM, CISSP-ISSAP, CRISC, and CMMC 2.0. (See Progent's certifications). Progent also has guidance in financial and ERP application software. This scope of expertise gives Progent the ability to identify and integrate the surviving parts of your network following a ransomware attack and reconstruct them rapidly into an operational network. Progent has collaborated with leading cyber insurance providers including Chubb to help businesses recover from ransomware assaults.

Contact Progent about Ransomware Settlement Negotiation Expertise in São José dos Campos
To contact with Progent about ransomware settlement negotiation guidance in São José dos Campos, phone Progent at 800-462-8800 or go to Contact Progent.