Ransomware Response Consulting Experts

Overview of Progent's Ransomware Negotiation Consulting in Aurora
Progent is experienced in negotiating ransomware settlements with hackers. Reaching an optimum settlement is a complex activity that calls for a mix of real-word experience, IT knowledge and business savvy. It also demands working closely with the ransomware victim's IT staff and the insurance provider, if any. Since the number one goal of the ransomware target is fast recovery, it is critical to establish recovery groups that work efficiently, concurrently, and in close communication. Progent has the breadth of technical skills and the depth of personnel to supplement your IT staff and recover your network environment rapidly and economically.

Services offered by Progent's ransomware settlement negotiation experts include:

• Establishing the type of ransomware used in the assault
• Identifying and contacting the hacker persona
• Evaluating the recovery risk
• Verifying the threat actor's decryption tool
• Deciding on an acceptable settlement range with the victim and the insurance carrier
• Establishing a settlement and timeline with the threat actor
• Checking compliance with anti-money laundering (AML) sanctions
• Carrying out the crypto-currency transfer to the hacker
• Receiving, reviewing, and using the hacker's decryptor mechanism
• If necessary, contacting the threat actor for technical help with the decryption tool

• Quarantining affected endpoints and data stores to prevent further spread of the assault
• Making digital copies of each compromised device and data store to allow forensics in parallel with restoration
• Adding anti-virus agents to all virus-free endpoints
• Salvaging data from air-gapped restores or unscathed endpoints
• Creating a pristine environment
• Mapping and connecting datastores to match exactly their pre-attack state

Settling Exfiltration Ransoms
In addition to extorting money for a decryption tool, current variants of ransomware such as Ryuk, Maze, DopplePaymer, and Egregor commonly try to steal (or "exfiltrate") files. TAs can then require an extra ransom in exchange for not publishing this data or selling it. Unfortunately, there is no method to guarantee that stolen data have been totally erased by the threat actor. In fact, in many cases the threat actor has limited say over where the information ends up. Paying an exfiltration ransom does not eliminate the need for getting the advice of privacy attorneys, conducting an audit on which files were taken, and carrying out the necessary alerts to impacted entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and on-premises IT services throughout the United States for more than 20 years and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of SMEs includes professionals who have been awarded advanced certifications in core technology platforms including Cisco infrastructure, VMware, and popular distributions of Linux. Progent's data security consultants have earned industry-recognized certifications including CISA, CISSP, GIAC, and CMMC 2.0. (See certifications earned by Progent consultants). Progent also offers guidance in financial management and Enterprise Resource Planning applications. This broad array of skills allows Progent to salvage and integrate the surviving pieces of your information system after a ransomware assault and reconstruct them quickly into an operational network. Progent has worked with leading insurance carriers like Chubb to assist businesses clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Services in Aurora
To contact with Progent about ransomware settlement services in Aurora, phone Progent at 800-462-8800 or go to Contact Progent.