Ransomware Response Consulting Experts

Overview of Progent's Ransomware Negotiation Services in Cincinnati
Progent has experience negotiating ransomware settlements with threat actors. Negotiating an optimum settlement is a complicated activity that requires a combination of real-word experience, IT knowledge and business savvy. It also calls for close co-operation with the victim's IT team and the cyber insurance carrier, if any. Since the top priority of the ransomware target is fast recovery, it is vital to deploy response teams that work efficiently, in parallel, and in close communication. Progent offers the breadth of IT knowledge and the deep bench of personnel to complement your IT staff and restore your network environment rapidly and affordably.

Services provided by Progent's ransomware settlement team include:

• Establishing the type of ransomware involved in the assault
• identifying and contacting the hacker persona
• Assessing the likelihood of recovery
• Testing the hacker's decryption capabilities
• Deciding on an acceptable settlement with the victim and the cyber insurance provider
• Establishing a settlement amount and schedule with the hacker
• Confirming compliance with anti-money laundering laws
• Overseeing the crypto-currency disbursement to the TA
• Receiving, learning, and operating the TA's decryption mechanism
• If needed, contacting the threat actor for technical help with the decryptor tool

• Quarantining infected endpoints to arrest the progress of the attack
• Creating digital copies of every breached device and data store in order to perform forensics without interfering with recovery
• Installing A/V agents to all virus-free endpoints
• Recovering files from offline restores or uncompromised endpoints
• Creating a clean recovery environment
• Mapping and connecting datastores to match precisely their pre-encryption state

Settling Exfiltration Ransoms
Beyond extorting payment for a decryption tool, modern strains of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Nephilim commonly attempt to steal (or "exfiltrate") files. Hackers can then require an additional ransom in exchange for not publishing this information or selling it. Unfortunately, there exists no way to prove that stolen files have been completely deleted by the hacker. In fact, in many instances the TA has little control over the disposition of the data. Paying an exfiltration ransom does not free you from the need for engaging the guidance of legal counsel, performing an audit on which data were taken, and sending the mandated notifications to impacted entities. In general, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and on-premises network services throughout the U.S. for more than two decades and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of subject matter experts includes professionals who have earned advanced certifications in core technology platforms including Cisco infrastructure, VMware virtualization, and popular Linux distros. Progent's cybersecurity consultants have earned prestigious certifications including CISA, CISSP, and CRISC. (Refer to certifications earned by Progent consultants). Progent also has guidance in financial and Enterprise Resource Planning software. This breadth of skills allows Progent to identify and integrate the surviving parts of your information system following a ransomware attack and reconstruct them rapidly into an operational system. Progent has worked with top cyber insurance carriers like Chubb to help organizations recover from ransomware attacks.

Contact Progent about Ransomware Settlement Guidance in Cincinnati
To get in touch with Progent about ransomware settlement negotiation expertise in Cincinnati, phone Progent at 800-462-8800 or go to Contact Progent.