Ransomware Solutions Services

Overview of Progent's Ransomware Negotiation Services in Toronto
Progent is experienced in negotiating ransomware settlements with threat actors (TAs). Negotiating an optimum settlement is a complex exercise that calls for a mix of field experience, technical knowledge and business savvy. It also calls for working closely with the ransomware victim's IT team and the insurance carrier, if there is one. Since the top priority of the ransomware victim is fast recovery, it is vital to deploy recovery groups that work efficiently, concurrently, and in close communication. Progent offers the breadth of IT knowledge and the deep bench of personnel to complement your network support team and recover your network quickly and economically.

Support available from Progent's ransomware settlement team include:

• Establishing the type of ransomware involved in the attack
• identifying and contacting the hacker persona
• Assessing the recovery risk
• Verifying the hacker's decryption tool
• Budgeting a settlement amount with the victim and the cyber insurance carrier
• Negotiating a settlement amount and timeline with the hacker
• Confirming compliance with anti-money laundering sanctions
• Carrying out the crypto-currency payment to the TA
• Acquiring, reviewing, and using the TA's decryptor utility
• If necessary, contacting the TA for technical help with the decryption tool

• Quarantining affected endpoints and data stores to prevent further spread of the assault
• Creating replicas of every breached server and endpoint and data store in order to perform forensics in parallel with restoration
• Installing anti-virus agents to all virus-free endpoints
• Salvaging files from air-gapped backups or uncompromised machines
• Creating a clean recovery environment
• Mapping and connecting datastores to reflect precisely their pre-attack state

Paying Exfiltration Ransoms
Beyond demanding money for a decryption tool, current variants of crypto-ransomware like Ryuk, Sodinokibi, DopplePaymer, and Nephilim often try to exfiltrate information. TAs are then able to demand an additional settlement for not divulging this information or selling it. Unfortunately, there is no method to prove that exfiltrated files have been totally erased by the threat actor. In fact, in many cases the TA has little control over data custody. Settling an exfiltration ransom does not free you from the need for seeking the advice of privacy lawyers, conducting an audit on which data were stolen, and performing the necessary notifications to impacted entities. In general, paying an exfiltration ransom is a waste.

Progent's Background
Progent has delivered online and on-premises IT services throughout the U.S. for more than 20 years and has earned Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes consultants who have earned high-level certifications in core technology platforms including Cisco networking, VMware virtualization, and major distributions of Linux. Progent's cybersecurity consultants have earned prestigious certifications such as CISA, CISSP-ISSAP, and CRISC. (Refer to certifications earned by Progent consultants). Progent also has top-tier support in financial management and ERP software. This scope of skills gives Progent the ability to salvage and consolidate the undamaged parts of your network following a ransomware attack and rebuild them quickly into a functioning network. Progent has collaborated with leading cyber insurance carriers like Chubb to assist organizations clean up after ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Guidance in Toronto
To get in touch with Progent about ransomware settlement negotiation guidance in Toronto, call Progent at 800-462-8800 or go to Contact Progent.