Ransomware Solutions Consulting Services

Overview of Progent's Ransomware Negotiation Services in Sydney
Progent has experience negotiating ransomware settlements with adversaries. Reaching an optimum settlement is a complicated exercise that requires a combination of field experience, IT skills and business savvy. It also calls for working closely with the cyber-extortion target's IT team and the cyber insurance provider, if any. Because the number one priority of the ransomware victim is fast recovery, it is vital to deploy response groups that operate effectively, in parallel, and with intimate collaboration. Progent has the breadth of IT skills and the depth of personnel to supplement your network staff and restore your network environment rapidly and economically.

Services offered by Progent's ransomware settlement experts include:

• Establishing the type of ransomware involved in the attack
• Identifying and communicating with the hacker persona
• Assessing the recovery risk
• Verifying the hacker's decryption tool
• Agreeing on a settlement with the ransomware victim and the cyber insurance carrier
• Negotiating a settlement and timeline with the threat actor
• Verifying compliance with anti-money laundering (AML) regulations
• Managing the crypto-currency disbursement to the TA
• Acquiring, learning, and using the TA's decryptor tool
• If necessary, contacting the hacker for technical help with the decryption utility

• Isolating affected endpoints to prevent further spread of the assault
• Creating replicas of every infected server and endpoint and data store in order to perform forensics in parallel with cleanup
• Adding anti-virus protection to all clean endpoints
• Recovering files from air-gapped backups or uncompromised endpoints
• Building a clean environment
• Mapping and reconnecting datastores to match exactly their pre-encryption state

Paying Exfiltration Ransoms
Beyond extorting payment for a decryption utility, current strains of crypto-ransomware like Ryuk, Maze, DopplePaymer, and Egregor often try to steal (or "exfiltrate") files. TAs can then demand an extra payment in exchange for not publishing this data on the dark web. Sadly, there is no method to guarantee that exfiltrated data have been totally deleted by the threat actor. In fact, in many instances the TA has limited say about the disposition of the data. Paying an exfiltration ransom does not eliminate the need for getting the guidance of legal counsel, performing an investigation into which data were taken, and performing the mandated notifications to impacted entities. Generally, paying an exfiltration ransom is a waste.

Progent's Background
Progent has provided remote and onsite IT services across the United States for over 20 years and has earned Microsoft's Partner certification in the Datacenter and Cloud Productivity practice areas. Progent's team of subject matter experts includes consultants who have earned advanced certifications in core technologies including Cisco infrastructure, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned prestigious certifications including CISA, CISSP, CRISC, and CMMC 2.0. (Refer to certifications earned by Progent consultants). Progent also has guidance in financial management and Enterprise Resource Planning application software. This breadth of skills allows Progent to identify and consolidate the undamaged pieces of your information system after a ransomware attack and rebuild them quickly into a viable network. Progent has worked with leading cyber insurance providers including Chubb to help organizations clean up after ransomware attacks.

Contact Progent about Ransomware Settlement Negotiation Guidance in Sydney
To contact with Progent about ransomware settlement negotiation services in Sydney, call Progent at 800-462-8800 or go to Contact Progent.