Ransomware Response Consulting Services

Progent's Ransomware Settlement Negotiation Services in Buffalo
Progent has experience negotiating ransomware settlements with threat actors (TAs). Negotiating an optimum settlement is a complex exercise that calls for a mix of real-word experience, technical knowledge and business acumen. It also requires working closely with the ransomware victim's IT team and the cyber insurance provider, if there is one. Since the number one priority of the ransomware victim is fast recovery, it is critical to deploy response teams that work effectively, concurrently, and in close communication. Progent has the breadth of technical knowledge and the deep bench of experts to complement your IT staff and restore your network rapidly and affordably.

Services offered by Progent's ransomware negotiation experts include:

• Determining the type of ransomware involved in the attack
• identifying and contacting the hacker
• Evaluating the recovery risk
• Testing the TA's decryption tool
• Budgeting a settlement with the ransomware victim and the insurance provider
• Negotiating a settlement and timeline with the TA
• Confirming accordance with anti-money laundering (AML) laws
• Overseeing the crypto-currency payment to the hacker
• Receiving, reviewing, and using the threat actor's decryption tool
• If necessary, contacting the hacker for technical assistance with the decryption utility

• Isolating infected endpoints to arrest the progress of the attack
• Creating digital copies of every compromised server and endpoint and data store in order to perform forensics without interfering with restoration
• Adding A/V agents to all clean endpoints
• Restoring files from air-gapped backups or uncompromised endpoints
• Building a clean recovery environment
• Mapping and connecting drives to reflect precisely their pre-encryption condition

Settling Exfiltration Ransoms
In addition to demanding money for a decryption utility, current strains of ransomware like Ryuk, Sodinokibi, Netwalker, and Nephilim commonly try to steal (or "exfiltrate") files. TAs can then demand a separate ransom in exchange for not divulging this data on the dark web. Unfortunately, there is no method to prove that exfiltrated files have been completely erased by the hacker. Actually, in many cases the threat actor has little say over the disposition of the data. Settling an exfiltration ransom does not free you from the necessity of getting the advice of privacy attorneys, conducting an inventory of data were stolen, and performing the necessary notifications to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and on-premises IT services across the United States for more than 20 years and has been awarded Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes professionals who have been awarded high-level certifications in core technologies such as Cisco infrastructure, VMware virtualization, and popular distributions of Linux. Progent's cybersecurity consultants have earned industry-recognized certifications such as CISM, CISSP-ISSAP, and GIAC. (See certifications earned by Progent consultants). Progent also offers top-tier support in financial and Enterprise Resource Planning application software. This broad array of skills allows Progent to salvage and integrate the surviving pieces of your IT environment following a ransomware attack and rebuild them quickly into a functioning system. Progent has worked with leading cyber insurance providers including Chubb to assist businesses recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Negotiation Services in Buffalo
To contact with Progent about ransomware settlement negotiation guidance in Buffalo, call Progent at 800-462-8800 or go to Contact Progent.