Ransomware Response Services

Overview of Progent's Ransomware Settlement Negotiation Services in Saddle Brook
Progent is experienced in negotiating ransomware settlements with hackers. Reaching an acceptable settlement is a complex activity that requires a combination of real-word experience, technical knowledge and business savvy. It also demands close co-operation with the cyber-extortion target's IT staff and the cyber insurance provider, if any. Because the number one goal of the ransomware target is operational continuity, it is critical to establish response teams that work efficiently, concurrently, and in close communication. Progent offers the scope of technical skills and the deep bench of experts to supplement your IT staff and restore your network environment rapidly and economically.

Support available from Progent's ransomware settlement negotiation team include:

• Determining the kind of ransomware used in the attack
• identifying and contacting the hacker
• Evaluating the recovery risk
• Validating the threat actor's decryption capabilities
• Determining a settlement with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement amount and schedule with the TA
• Confirming accordance with anti-money laundering (AML) sanctions
• Managing the crypto-currency disbursement to the TA
• Receiving, learning, and operating the threat actor's decryptor tool
• If necessary, contacting the threat actor for assistance with the decryption tool

• Quarantining affected endpoints to arrest the spread of the attack
• Making digital copies of every infected device and data store to allow forensics without interfering with restoration
• Adding A/V protection to all clean endpoints
• Salvaging data from air-gapped backups or uncompromised endpoints
• Creating a clean recovery environment
• Mapping and connecting drives to match precisely their pre-attack condition

Settling Exfiltration Ransoms
Beyond extorting money for a decryption tool, current variants of ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor often attempt to steal (or "exfiltrate") information. TAs can then demand an additional ransom in exchange for not posting this data on the dark web. Sadly, there is no way to be certain that stolen data have been totally deleted by the hacker. In fact, in numerous instances the hacker has limited say over where the information ends up. Paying an exfiltration ransom does not eliminate the necessity of seeking the guidance of privacy lawyers, performing an inventory of files were taken, and carrying out the necessary alerts to impacted entities. Generally, paying an exfiltration ransom is a waste.

Progent's Qualifications
Progent has provided online and onsite network services throughout the United States for over two decades and has earned Microsoft's Gold Partner designation in the Datacenter and Cloud Productivity practice areas. Progent's roster of SMEs includes professionals who have earned advanced certifications in foundation technologies including Cisco networking, VMware virtualization, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally recognized certifications including CISM, CISSP-ISSAP, and CRISC. (Refer to certifications earned by Progent consultants). Progent also has guidance in financial management and ERP application software. This scope of skills allows Progent to salvage and integrate the undamaged pieces of your IT environment following a ransomware attack and reconstruct them quickly into a viable system. Progent has collaborated with leading insurance carriers like Chubb to assist organizations recover from ransomware attacks.

Contact Progent about Crypto-Ransomware Settlement Expertise in Saddle Brook
To contact with Progent about ransomware settlement guidance in Saddle Brook, call Progent at 800-462-8800 or go to Contact Progent.