Ransomware Response Consultants

Overview of Progent's Ransomware Negotiation Services in Toronto
Progent has experience negotiating ransomware settlements with threat actors. Reaching an optimum settlement is a complex activity that calls for a mix of real-word experience, technical skills and business savvy. It also requires working closely with the ransomware victim's IT team and the cyber insurance carrier, if any. Since the top priority of the ransomware victim is fast recovery, it is vital to establish recovery groups that work effectively, in parallel, and in close communication. Progent offers the breadth of IT knowledge and the deep bench of experts to supplement your network support team and recover your network environment quickly and economically.

Support offered by Progent's ransomware settlement negotiation team include:

• Establishing the type of ransomware involved in the attack
• making contact with the hacker
• Assessing the likelihood of recovery
• Validating the threat actor's decryption capabilities
• Agreeing on a settlement amount with the victim and the cyber insurance provider
• Establishing a settlement amount and timeline with the hacker
• Confirming adherence to anti-money laundering laws
• Carrying out the crypto-currency payment to the hacker
• Acquiring, reviewing, and using the threat actor's decryptor mechanism
• If needed, contacting the threat actor for assistance with the decryptor utility

• Isolating affected endpoints to prevent further progress of the assault
• Making digital copies of every breached device and data store in order to perform forensics without interfering with cleanup
• Installing anti-virus protection to all clean endpoints
• Salvaging data from air-gapped restores or uncompromised machines
• Building a pristine recovery environment
• Mapping and connecting drives to reflect exactly their pre-encryption state

Exfiltration Ransoms
In addition to extorting money for a decryption tool, current variants of crypto-ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor commonly try to steal (or "exfiltrate") files. Hackers are then able to require a separate payment in exchange for not divulging this data on the dark web. Unfortunately, there is no way to prove that exfiltrated files have been completely deleted by the threat actor. In fact, in numerous instances the TA has limited control over who can access the stolen files. Paying an exfiltration ransom does not free you from the need for engaging the advice of privacy attorneys, conducting an audit on which files were stolen, and sending the necessary alerts to affected entities. In general, paying an exfiltration ransom is a waste.

Progent's Background
Progent has delivered remote and on-premises network services throughout the U.S. for more than two decades and has earned Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity competencies. Progent's roster of SMEs includes consultants who have earned high-level certifications in foundation technology platforms including Cisco infrastructure, VMware virtualization, and popular Linux distros. Progent's data security consultants have earned prestigious certifications including CISM, CISSP, and GIAC. (See certifications earned by Progent consultants). Progent also has guidance in financial management and ERP applications. This breadth of skills allows Progent to identify and consolidate the surviving pieces of your information system following a ransomware attack and rebuild them quickly into an operational network. Progent has collaborated with top cyber insurance providers including Chubb to help businesses recover from ransomware assaults.

Contact Progent about Crypto-Ransomware Settlement Negotiation Expertise in Toronto
To contact with Progent about crypto-ransomware settlement expertise in Toronto, call Progent at 800-462-8800 or go to Contact Progent.