Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Services in Scottsdale
Progent has experience negotiating ransomware settlements with adversaries. Reaching an optimum settlement is a complex activity that calls for a mix of field experience, IT skills and business savvy. It also calls for close co-operation with the ransomware victim's IT staff and the insurance provider, if there is one. Because the top goal of the ransomware victim is fast recovery, it is critical to establish recovery teams that work effectively, concurrently, and with intimate collaboration. Progent has the breadth of IT knowledge and the depth of experts to supplement your network support team and recover your network environment rapidly and affordably.

Support provided by Progent's ransomware settlement team include:

• Determining the type of ransomware used in the attack
• Identifying and communicating with the hacker
• Evaluating the likelihood of recovery
• Testing the hacker's decryption tool
• Determining a settlement amount with the victim and the cyber insurance provider
• Establishing a settlement amount and schedule with the hacker
• Checking adherence to anti-money laundering (AML) regulations
• Managing the crypto-currency transfer to the TA
• Receiving, reviewing, and operating the TA's decryptor tool
• If needed, contacting the hacker for technical assistance with the decryptor tool

• Quarantining affected endpoints and data stores to prevent further spread of the attack
• Creating replicas of each infected device and data store in order to perform forensics without interfering with cleanup
• Adding A/V protection to all clean endpoints
• Salvaging files from air-gapped backups or unscathed endpoints
• Creating a clean environment
• Remapping and connecting drives to match precisely their pre-attack condition

Paying Exfiltration Ransoms
In addition to extorting money for a decryption tool, current variants of crypto-ransomware such as Ryuk, Maze, DopplePaymer, and Egregor often try to exfiltrate files. TAs can then demand an additional payment in exchange for not divulging this information or selling it. Unfortunately, there exists no way to be certain that exfiltrated files have been totally erased by the hacker. In fact, in numerous cases the hacker has little say over the disposition of the data. Paying an exfiltration ransom does not eliminate the need for getting the guidance of legal counsel, performing an audit on which files were stolen, and sending the required notifications to impacted entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Background
Progent has delivered remote and onsite network services across the U.S. for over two decades and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts (SMEs) includes professionals who have earned advanced certifications in foundation technologies such as Cisco networking, VMware virtualization, and major distributions of Linux. Progent's data security consultants have earned prestigious certifications including CISM, CISSP, CRISC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has guidance in financial and Enterprise Resource Planning application software. This breadth of skills gives Progent the ability to identify and integrate the surviving pieces of your network after a ransomware attack and reconstruct them quickly into a viable system. Progent has worked with leading cyber insurance carriers including Chubb to assist organizations clean up after ransomware assaults.

Contact Progent about Ransomware Settlement Expertise in Scottsdale
To contact with Progent about ransomware settlement negotiation services in Scottsdale, call Progent at 800-462-8800 or go to Contact Progent.