Ransomware Response Consulting Services

Overview of Progent's Ransomware Negotiation Services in Tulsa
Progent has experience negotiating ransomware settlements with threat actors. Negotiating an optimum settlement is a complex exercise that requires a combination of field experience, technical skills and business acumen. It also demands close co-operation with the cyber-extortion target's IT team and the cyber insurance provider, if there is one. Since the top priority of the ransomware target is fast recovery, it is critical to establish recovery teams that work effectively, concurrently, and in close communication. Progent has the breadth of IT knowledge and the depth of personnel to complement your IT staff and restore your network environment quickly and affordably.

Services available from Progent's ransomware negotiation team include:

• Establishing the type of ransomware involved in the assault
• Making contact with the hacker persona
• Evaluating the recovery risk
• Testing the hacker's decryption capabilities
• Deciding on an acceptable settlement with the ransomware victim and the cyber insurance provider
• Establishing a settlement amount and timeline with the threat actor
• Checking adherence to anti-money laundering regulations
• Overseeing the crypto-currency payment to the hacker
• Acquiring, learning, and using the hacker's decryptor tool
• If needed, contacting the threat actor for technical help with the decryption utility

• Isolating infected endpoints to arrest the spread of the assault
• Creating replicas of each breached device and data store in order to perform forensics without interfering with cleanup
• Adding anti-virus protection to all clean endpoints
• Salvaging data from air-gapped backups or unscathed machines
• Creating a pristine environment
• Mapping and connecting drives to match precisely their pre-encryption state

Paying Exfiltration Ransoms
Beyond demanding money for a decryption tool, current variants of ransomware such as Ryuk, Sodinokibi, DopplePaymer, and Egregor often try to steal (or "exfiltrate") files. Hackers are then able to require an additional ransom in exchange for not divulging this information on the dark web. Unfortunately, there is no method to be certain that exfiltrated files have been totally erased by the hacker. In fact, in many instances the TA has little say over data custody. Settling an exfiltration ransom does not free you from the necessity of seeking the advice of privacy attorneys, performing an audit on which files were compromised, and carrying out the required notifications to affected entities. In almost all cases, paying an exfiltration ransom is not recommended.

Progent's Qualifications
Progent has provided remote and on-premises network services across the United States for over 20 years and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned advanced certifications in core technologies including Cisco networking, VMware virtualization, and popular Linux distros. Progent's data security experts have earned industry-recognized certifications such as CISM, CISSP-ISSAP, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has guidance in financial and ERP application software. This scope of expertise allows Progent to salvage and consolidate the surviving pieces of your IT environment following a ransomware intrusion and reconstruct them quickly into a functioning system. Progent has worked with top insurance providers like Chubb to help businesses clean up after ransomware assaults.

Contact Progent about Ransomware Settlement Negotiation Guidance in Tulsa
To contact with Progent about ransomware settlement expertise in Tulsa, phone Progent at 800-462-8800 or go to Contact Progent.