ATR2500x-USB Microphone & Logitech BRIO: Today on the backup wrap up, we're
starting a new series on ransomware.
Today's episode starts at the beginning by defining the scourge.
What is it?
What isn't it?
Uh, and why it's become such a massive threat to businesses and individuals.
We'll talk about the evolution of ransomware attacks from
simple data encryption to sophisticated extortion schemes.
And discuss the critical importance of prevention and recovery strategies.
In the coming weeks, you'll see many more episodes on this topic.
As we focus, especially on how to prepare yourself, to be able to respond
and recover from a ransomware attack.
By the way, if you have no idea who I am.
I'm W.
Curtis Preston.
AKA Mr.
Backup.
And I've been passionate about backup and recovery for over 30 years.
Ever since I had to tell my boss that there were no backups of Paris.
I don't want that to happen to you.
And that's why I do this.
On this podcast, we turn unappreciated backup admins into cyber recovery heroes.
This is the backup wrap-up.
W. Curtis Preston: Welcome to the backup wrap up.
I'm your host, w Curtis Preston, AKA, Mr.
Backup, and I have with me the person who's helping me to celebrate
my financial freedom from the IRS.
How's it going?
Persona.
Prasanna Malaiyandi: I am doing well, Curtis.
Yeah, congratulations.
How does it feel to get, what would you call it, uh, the 10
ton elephant off your back?
Is that the
W. Curtis Preston: Yeah.
Yeah.
So for those that don't know, like through various things that weren't malfeasance
on my part I have owed the IRS money.
For the better part of 10 years, two different totally unrelated
events I ended up owing them money and I've been paying them, uh, slowly
and surely for somewhere in the neighborhood of the last 10 years.
And the literally May 1st I.
Made the last payment.
And so for the first time in my fifties, I don't, I don't owe the IR Rs any money.
Um,
Prasanna Malaiyandi: be in your fifties than your eighties,
W. Curtis Preston: yeah, that is true.
That is true.
I don't recommend owing the IRS money.
They get theirs for sure.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: Anyway, um, so I wanted for, we've, we've finished
our series on cloud disasters and we had the one episode on.
The A cloud non-disaster.
It was a cloud disaster that had a good, happy ending.
Um, and I wanted us to get back to something else that has been very
popular with our listeners, which is this, the concept of ransomware.
If you are, um.
You know, a new listener to the podcast.
We have covered ransomware in various ways over the years, and you're going to,
uh, this episode will actually follow up.
I'm going to be, if you're listening to this now, the previous few episodes will
actually be reruns, if you want to call them, of, of, of really good episodes
where we had guests on that really know.
This, uh, issue of, of, of ransomware and recovering from ransomware.
And so I wanted to, um,
Prasanna Malaiyandi: Do you
W. Curtis Preston: we're gonna follow up.
What's that?
Prasanna Malaiyandi: are you gonna put Tony's episode out?
W. Curtis Preston: Uh, oh, you know what?
Yeah.
Uh, yeah.
Now that I realize who you're talking about, yes.
I will definitely put Tony.
So, uh, you know, that's probably was the most popular episode that
we had of that timeframe, which was, uh, our friend Tony over at, uh,
SPECT Logic and them talking about.
How they actually recovered from a ransomware attack.
And, um, and we'll, we'll have some stuff coming up where we're
gonna be talking about ransomware and different things about how to
protect from it and how to, uh, more importantly, how to, I don't know.
More importantly, it's just.
So many people talk about how to protect from it.
They don't talk enough about how to respond to it and how to recover from it.
And that's where, uh, you know, our specialty lies.
But I Go ahead.
Prasanna Malaiyandi: You know what I just read in the paper, or not
the paper, what I read online today.
So insurance companies are now trying to not have companies pay the ransomware
and just sort of keep this self.
Propagating, uh, issue.
Keep going.
And so they're actually working to not, or to tell their
clients, don't pay the ransom,
W. Curtis Preston: Yeah, which is something we've always advised, right?
We can't make that decision on behalf of those, uh, people.
But obviously it's not a good thing to pay the ransom, right?
In some places it may be illegal to pay the ransom.
In other places and well, and in all places.
I think it emboldens the behavior.
Right.
And you're
Prasanna Malaiyandi: I liken it to my dog where it's like, if you want
him to do something, you give him a treat and then he keeps doing it
because he keeps expecting the treat and he knows he'll get a treat.
W. Curtis Preston: Exactly, uh, yeah, there's a lot of
reasons not to pay the ransom.
So let's, let's just start with, I.
Just talking about what ransomware is and just as importantly what ransomware isn't.
So ransomware, um, and, and I'm gonna start with saying
that it's, it's a bad term.
Right.
The, the term ransomware suggests that it's software.
It, it suggests that it is a piece of software that you accidentally
get and boom, you have ransomware.
And that's actually what I thought in my early days of, of working with ransomware.
Prasanna Malaiyandi: If you click the wrong link And then all of a sudden it
encrypts
everything.
yeah,
W. Curtis Preston: And, and that isn't really what it is, or at least not from
what I can tell, uh, most of the time.
But let's just define this concept of ransomware, and it comes from the
term ransom, which, where outside of the world of, of it, where, where
would we see the word ransom used?
Prasanna Malaiyandi: Hostage negotiations,
W. Curtis Preston: Exactly right.
Prasanna Malaiyandi: kidnapping.
W. Curtis Preston: kid.
Yeah, I've taken your kid.
And you can have them back for $1 billion.
the most famous kidnapping of all time that I know of was
the Getty kidnapping, right.
So I believe it was, uh, John Paul Getty at the time that he
was the richest man in the world.
They kidnapped his, um, like grandson and, uh, they demanded probably a
million dollars or something like that.
He told him to go pound sand, and then they sent him, uh, his grandchild's ear
and uh, and he said, fine, you know, I'll, I'll, I'll pay the ransom he got, and
he got the, he got his grandchild back.
Interestingly enough, I sat next to.
Prasanna Malaiyandi: I was gonna say,
W. Curtis Preston: Yeah, I sat next to the grandson of that grandson on a plane once.
His name's Bazar Getty, also, uh, an actor.
Um, and, uh, I just randomly asked him if he was related to the Getty
family, and he's like, well, you know, the, you know, the guy with
the ear that's my grandfather.
It's like, wow, that is definitely a connection.
Um, yeah, so that's what a ransom is, right?
Is is give me, you know, I've got something of yours.
And you can have it back if you give me the ransom.
And you, you've watched tv.
You've watched
movies,
Prasanna Malaiyandi: watch tv.
W. Curtis Preston: well you have watched movies.
You, you definitely watched YouTube more.
What is the general thinking regarding paying the ransom in such movies?
Prasanna Malaiyandi: The SBI comes in and everyone else, and they're like, don't pay
the ransom 'cause you're not gonna see it.
And it's just gonna, they're just gonna go and do something else again.
W. Curtis Preston: Exactly.
Exactly.
And, and they often do things like demand proof of life.
Right.
Um,
Prasanna Malaiyandi: Hold up the newspaper with today's date.
W. Curtis Preston: Exactly right.
I want to talk to my kid.
Right.
I want to verify.
Right.
And all of this has, uh, they, they have parallels in the, the
world of the ransomware, right?
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: So really, it, this is where the term comes from, is that
we're holding your data for ransom.
And the, the classic way that that manifested itself was what?
Prasanna Malaiyandi: They basically would encrypt your data and say, Hey, if you
want your data back, then pay us the money and we will give you the encryption key
so then you can go unencrypt your data and everything will be back to normal.
W. Curtis Preston: Yeah, it's interesting.
They, they don't steal it, like in the, in the old, in, in the way of the, you
know, the, um, uh, of stealing your, your child to, to demand a ransom.
They.
Steal it right away from you, like right in front of you.
It's like, here's your data, but you can't use it.
You can't
have it.
Prasanna Malaiyandi: but I think it's also one of those things where it's probably
faster and easier for them, right?
anD maybe it's also less detectable, right?
Because all of a sudden if you're like, Hey, why is my, why am I
uploading like 10 terabytes today?
W. Curtis Preston: Exactly.
Yeah.
It, it's super easy and super fast to, to encrypt the data just
enough that it's not useful to you.
And so they're saying, we'll give you the keys, um, you know,
and you can have your data back.
That is a traditional ransomware attack.
What was that?
Prasanna Malaiyandi: Hopefully we will
give you the keys and you can recover your data.
W. Curtis Preston: Right, right.
And the idea was that, that, that paying the ransom, you know, historically paying
the ransom was only a good idea if you had no backup of your data or if your backup.
Was such that it was going to take you so long in order to restore.
I, when I think back to one of the most famous ransomware attacks in
the last few years was the Colonial pipeline attack, and that one, as I
understand it, was that they had a.
A backup, right?
But they didn't think they could get the backup recovered fast enough.
And so they decided to pay the ransom.
And, um, and, and so they did both, they did recovery and they paid the ransom,
and, which just seems fundamentally wrong, but historically, that was the
only reason that you would pay the ransom is if you had no backup or a backup.
That was not good enough because.
Unencrypting the data or deen encrypting the data was, the idea
was that deen encrypting the data was faster than restoring it, right?
Prasanna Malaiyandi: Yep, yep.
And that was worthwhile until sort of the.
Ransomware actors, they had poor code quality, right?
And so you're putting faith that you are going to pay the ransom
and you're going to, going back to our classic example, right?
You're gonna get back your kid,
W. Curtis Preston: Right.
Yeah.
Prasanna Malaiyandi: Except sometimes these ransomware actors,
they would write sort of bad code.
And when they gave you back the key, like how they actually did the encryption
W. Curtis Preston: Right.
Prasanna Malaiyandi: very sound.
And so yeah, it would.
Decrypt maybe some of the data, but it wasn't still usable.
So that's like paying the ransom and they give back your kid's finger.
Right.
Or
W. Curtis Preston: Yeah,
Prasanna Malaiyandi: right.
Or
Right.
Or Or they give like a doll of your kid back.
Right.
Or whatever it is.
Right.
But it's not what you originally had transacted for.
W. Curtis Preston: Here's some videos of your, while we, while we had kidnapped.
You have to think about these organizations as very
sophisticated businesses.
This is not a script kitty.
This is not a random piece of software that you download off the internet.
This is an organization that is trying to make money for other reasons, right?
They're, they want to do things.
Sometimes they're state actors, sometimes they're, they're just criminals that are
just trying to make a lot of money and.
You need to think about what are they going to focus on
in terms of software quality?
The thing they're gonna focus on is making sure that the data gets
encrypted and making sure that you can't decrypt it without their help.
They're not necessarily that focused on that second half,
which is the the decryption part.
You could make some argument that maybe they want it to work because
they want to have a reputation as.
An organization that does get the data back if you actually pay
the ransom, but the, you know,
Prasanna Malaiyandi: yeah, or the other thing is it may not be very fast, right?
So
you might get all your data back, but it might take you a month
W. Curtis Preston: Exactly.
Exactly.
Um, so go ahead.
Prasanna Malaiyandi: I know you talked about, uh, these organizations, right?
By which you mean the ransomware actors.
Who are kind of well organized.
I think the other thing to also mention is it's no longer just a
single organization necessarily, right?
You have ransomware as a service where you have these people who have all these
tools and capabilities and they provided as a service just like you might use AWS
as a service to host your application.
They provide all the infrastructure tooling for all these other
organizations to now start.
Um.
Attacking other companies and also encrypting their data.
W. Curtis Preston: Right.
Yeah.
And, and actually I want to get into that in, in a little bit,
um, what I want to, and that, that everything you said is, is correct.
Um, let's talk a little bit about what ransomware is not
Prasanna Malaiyandi: what is ransomware, not Curtis.
W. Curtis Preston: So it, well, it's not just a piece of software that downloads
and, you know, magic happens, right?
Um, the, the, the process of getting infected with ransomware is actually
a very manual process with many steps.
And, uh, and, and they are steps that are being manually driven by a human
being somewhere else in the world.
And.
The, the idea is that there is that initial access.
There is, uh, that, that, you know, that basically the, the initial breach, which
could be via a number of mechanisms.
It could be, uh, old school phishing.
It could be something that you download.
Uh, it, it quite possibly will be something that you download, that
you get via email, an attachment that you open that you shouldn't have.
What was the, what was the thing you said?
Yeah, it could be a zero day exploit, right?
There are myriad ways that you can basically find yourself with a
portal to, to the bad guys, right?
So that, that's the first thing that has to happen, is someone has to gain
remote access, usually with escalated privileges, but not necessarily so.
They might just have a, you know, they might have simply
leveraged stolen credentials.
That's another thing.
They, they leveraged stolen credentials and then you didn't
have MFA on, you might have had a, a server that's got RDP enabled
and it's, uh, open to the internet.
Oh my Lord.
RDP, the ransomware deployment protocol,
Prasanna Malaiyandi: or you just have insecure systems that are internet facing,
right?
How many people have like VMware, ESXI, and then they automatically have it
available on the internet and boom.
W. Curtis Preston: Exactly.
Yeah.
So there, like I said, there, there are myriad ways that you,
that a bad actor can be given.
Initial access to one or more, uh, systems.
Right.
And there are, and this was, uh, basically you, you referenced this
earlier, is that there are companies, and again, it's the correct.
Thing is to call them companies, right?
There are companies who, this is what they do.
They call them initial access brokers.
This is all they do.
They just get a foothold into an organization and then they say, Hey,
I've got a foothold into a, b, c company.
Who wants that?
And then they bid that on the, you know, on the dark web.
Prasanna Malaiyandi: It just kind of scary when you think about it, right?
Because it is a specialized role, right?
That is all they do day in and day out is they try to figure out, how do
I gain that initial foothold with all these various mechanisms that you talked
about, Curtis, and then take that and now pass it on to the next person, right?
And it's their job to now figure out, okay, now what can I do next?
W. Curtis Preston: Yeah, it's a very specialized world, right?
Um, because there's sort of three phases.
There's that initial access, there's a second phase, which is discovery and uh,
and crawling around trying to do lateral movement, trying to expand the footprint.
And, um, and, and then that third phase, which is the actual, we're going
to go and encrypt everything, right?
The go ahead.
Prasanna Malaiyandi: And that second phase, right?
Just to touch on it, right?
Moving laterally and trying to figure out other things, right?
They're trying to do all of this while staying undetected, right?
Because the last thing you wanna do is give up that access that you paid for from
initial access broker, right?
And so you wanna make sure you stay under the radar of the security team
or whoever else is out there trying to prevent what you're trying to do.
W. Curtis Preston: Which is why one of the ways they do well, I would say the
way that they do that next phase is they use the same tools that you use, right?
They're downloading cybersecurity tools that are designed to defend,
but they use them to attack.
Prasanna Malaiyandi: How about Strike is a common
one
W. Curtis Preston: yeah.
Cobalt Strike is definitely one of the, uh, most common ones.
And, uh, there are a number of other tools that they download that, that don't
initially set off alarms because they're not, it's not like, Hey, hacker tool dot
exe, it's a tool that you would install.
And so they, they install these tools and then they go and they,
they crawl around your organization.
And it can be very difficult to detect that once they have gained that foothold
and once they're using the same tools that you might be using to poke around.
And again, I, I'll go back to that initial access.
This is why MFA is so important.
Uh, they could, there are a number of ways that they could get in, but MFA would be
one of the ways that you would then stop.
By the way, it, it does appear that the most common way that they get
in is actually stolen credentials.
Right.
And um, which is just really sad.
Um, but, but it is what It's Right.
Yeah.
Um, and, and so I, I just, this is the thing.
This is where the, what ransomware is not.
I just want people to understand that ransomware is not just one
piece of software that you happen to accidentally download and then
it affects your entire data center.
That is absolutely what I, what I, what I used to think it was.
Uh, it is a very sophisticated series of actions that are taken in series
different, there may be as many as a dozen pieces of software that are
installed to affect the ultimate goal that the, the bad actor wants, uh,
which of course is demanding the ransom.
Prasanna Malaiyandi: I do wonder though.
Yeah, I do.
I agree with that.
Curtis, I also wonder though, if we should really think about sort of two segments
to, uh, victim segments, if you will.
One is the enterprise, which I think a hundred percent everything you said makes
sense.
I think though, when you think about sort of consumer side.
I think it might be slightly different in term because you aren't going to have
all of this individual access, right?
People spending time on grandma trying to gain access to her laptop, right?
I think in those cases it's probably more find common vulnerabilities and
whatever is the quickest and easiest way, and you just go as broad as you
can because their data may not be as sensitive and as valuable necessarily.
Or the willingness to pay.
Or the ability to pay.
W. Curtis Preston: I do think that
consumer based.
Attacks probably are much closer to that initial, I download one piece of software
and it grabs all my data and boom, right?
And then tries to reach out to a command and control server.
Uh, and then it's probably closer to that initial definition than we talked
about where it's just one single piece of software because there, there really
isn't anything else, uh, to get out there.
But that's not necessarily our target market.
So I wasn't really focusing on that.
But you know, from a company perspective.
Uh, you know, or any, any organization perspective, it's going
to be a very complicated process.
Uh, and that could go on for months
Prasanna Malaiyandi: I was actually gonna
W. Curtis Preston: before you actually get a, you know, a big, a big payload.
Prasanna Malaiyandi: Yeah.
Yeah.
Just uh, I think if I go back and think about, and it's not ransomware, but just
talking about this attack vector, because it is common in other places as well.
If I think about like the SolarWinds attack, right?
They were in their systems for months,
right?
W. Curtis Preston: they were part of the, they were actually part of the
supply chain, as I recall, right?
Yeah.
They're very, depending on the size of the fish, right?
They're very, very there.
There is a risk reward.
Um, you know, a trade off, right?
The longer they can stay in undetected, the more exploration that they can do,
the bigger the payoff, but the longer they stay in undetected, the greater
the risk that they will eventually be detected before they can do the payoff.
So there's a, you know, a big risk reward there.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: Um, so the other and really important
thing, and this is why, um.
This is why some have changing the name of, uh, ransomware and that is that no
longer, um, is simply encrypting the data and then saying you can have it back if
you, uh, give us a ransomware no longer.
Is that the normal mo of the, the ransomware attackers?
What
is the normal mo.
Have evolved, or I would say devolved, but yeah, they have, they have evolved.
Prasanna Malaiyandi: Right.
Yeah.
So now they realize, okay, people have backups, they have other systems, right?
And so I would say before we get to sort of, okay, what is it really now,
right?
I think in between what they had started to do was really
attack those systems, right?
So it wasn't just encrypt your data,
W. Curtis Preston: Right.
Prasanna Malaiyandi: But even locally it was like, Hey, now let's start
going after the backup systems, right?
Because if you can restore your data, then you don't need us, right?
You don't need the key.
W. Curtis Preston: Yeah,
that, that is a really good point.
That basically part of that sophisticated ex, you know, um, uh,
large attack, they are definitely going to go after the backup system.
They're trying to identify what your backup system, they know the
vulnerabilities of the different backup systems, and they then
go after those vulnerabilities.
And this is.
Why I talk about, and we'll talk later about changes that you should
be making to your backup system in order to protect from this.
This is part of the evolution of the, of these ransomware attackers, is
first all they had to do was encrypt.
And then they found out, uh, you know, and people would pay the ransom.
And then they found that some people had backup and recovery systems
and disaster recovery systems, and they were stopped, pay the ransom.
Well, they want people to pay the ransom.
And so they're like, well, what can we do next?
And so the next thing they decided to do was attack the backup systems.
Prasanna Malaiyandi: I, I don't think that they listen to this podcast
or I've read your books, Curtis.
I'm just saying.
W. Curtis Preston: Yeah, I don't think so.
I don't think so.
They went after specific backup products that had specific vulnerabilities,
especially Windows based backup products, because Windows was the, you know, or
it continues to be the prop predominant.
Os that they're attacking in a ransomware attack.
It's not the only one, but it is a predominant one.
So they went after backup systems that were based on windows.
Also backup systems whose backups were all stored on disk.
'cause those backups are easy to, uh, delete and or encrypt.
Right?
Um, and.
The, and we'll, we'll talk more about things, but the idea is to,
with the backup system, the, the, the quick answer is to make sure
that your backup system isn't susceptible to those types of attacks.
We'll talk about that, uh, in another episode.
Prasanna Malaiyandi: That could be an entire episode in and of itself.
W. Curtis Preston: Yeah, exactly.
Uh, so what, what happened next?
Prasanna Malaiyandi: yeah.
So then, okay, they went after a backup system.
Sometimes they were successful, sometimes they weren't.
But then they realized just like classic ransomware or classic kidnapping and
people paying ransom, they're like, Hey, if we actually take your data right.
Then now you don't have that option to be like, Hey, just
give me the encryption key.
You can actually blackmail people and say, by the way, if you don't want me
to release this information, pay up.
And it might be sensitive information like the Sony hack where they
exfiltrated a bunch of data and it was emails about studio, like what studio
executives were saying and all the rest things you don't want out in public.
W. Curtis Preston: Right.
Yeah.
And, and it could be anything.
I, I think the Sony attack was the first one that I really remember.
Because it was basically impair, it was embarrassing data.
There are, um, others where it's like, listen, we have your 11 herbs and spices
and we're gonna release 'em to the public.
By the way, the 11 herbs and spices, I'm pretty sure have been
released, but not by KFC, but, but by other comp or other entities.
But you know, we have your company's trade secrets.
We may have, um, proof of you doing things that are actually crimes, right?
We, you know, um, you know, there are basically, we might have competitive
information that you don't want given to your closest competitor.
There are a number of things, and also I'd say the, the, the one
category of data that we haven't discussed is we have PII, right?
We have a whole bunch of names and credit card data.
That we're going to release if you don't pay the ransom.
I'd say the best example of that would be the Ashley Madison attack.
I don't remember if that was actually a ransomware attack, but that is an example
of the kind of thing I'm so Ashley mad.
So for those that you don't remember, and it's still around amazingly
enough, Ashley Madison is a website and an organization designed, uh, to
help people cheat on their spouses.
And they released a bunch of identities of people that were there.
There were a number of suicides that followed that, uh, particular incident.
So it could be personal information, it could be medical information.
Prasanna Malaiyandi: Healthcare records of celebrities or even other folks that
could be detrimental if released publicly.
W. Curtis Preston: Right, right.
And, and put it into your company.
Amazingly, Ashley Madison, they released all that stuff and one of the things that
came out was that it turns out that all of the female subscribers were all fake,
and yet the company still runs.
The company is still out there and people are still paying memberships.
But, um, yeah, so that's, that is an important.
Change in how the, the ransomware folks are operating.
Uh, basically, this is why many people are now starting to call it extortion
wear rather than just ransomware, because they're saying that we, we
literally have stolen your data and we are going to release it to the
public if you don't give us the ransom.
And here's my question.
Let's just say I've got the best, the absolute best.
Backup and disaster recovery system in the world.
I've got a button that I can press and five seconds later, my entire
environment is recovered without incident.
How well will that help me with an extortion attack?
Prasanna Malaiyandi: It wouldn't
W. Curtis Preston: Not at
all.
That's the worst.
That's the worst part.
I this whole thing.
Prasanna Malaiyandi: well, and this is my problem.
I know we had talked about comparing classic ransomware to digital ransomware.
W. Curtis Preston: Mm-Hmm.
Prasanna Malaiyandi: Right.
In classic ransomware, you pay the ransom.
They may or may not return the person, but if they return the
person, you know you're good
W. Curtis Preston: Right.
Prasanna Malaiyandi: in digital ransomware.
Even if you pay the ransom to give you back the encryption keys, they
still have that original data.
They could decide in a year, Hey, I'm gonna release this and embarrass you.
They could decide, Hey, I'm just gonna release
this anyway.
Right.
And.
If there's no honor among thieves, right,
W. Curtis Preston: Right.
Right.
Prasanna Malaiyandi: how can you trust that they will do the right thing?
W. Curtis Preston: Yeah, you, you can, you can't, which is really why the only
defense to this type of ransomware is to not let it happen in the first place.
Which is why I think that people should be focusing a lot more on the
prevention of exfiltration, right?
Exfiltration is just a very fancy word for sucking the data
out of your company, right?
Um, and there are ways, there are ways to do that, but they are not.
Easy and they come with a lot of false positives, et cetera, et cetera.
So not everybody is that, um, hot on it.
And I just think it's something that we need to continue to work on.
Prasanna Malaiyandi: Yeah.
Or detection also,
right?
W. Curtis Preston: Yes, yes.
Yeah.
Well, yeah, detecting it, detecting that you've got the ransomware detecting
that the exfiltration is happening.
Stopping the exfiltration, right?
Because a lot of the exfiltration is all sent to like the same place right there.
There's certain websites and things that, um, it's like, why are we
sending data to what is like mega sum?
And there's some big file sharing site.
Like you, you should block all access to all, like, file
sharing sites like that, right?
Um, and then if you, if you have a legitimate need for that.
Then, um, you open it up, but chances are you probably don't.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: Yeah.
Um, so that's just a brief overview of what ransomware is, what it isn't,
how it's evolved, uh, in terms, and by the way, just a final thing regarding
the whole exfiltration thing, talk, talking about part two and part three.
Not only have they gone directly attacking the backup systems in order to.
Basically take them out of the war.
The, that's not what I, that's not what I meant to take them, to take to, to take
them away from you as a weapon in the war.
I, I don't know, I'm mixing metaphors here, but they're also, they've discovered
that it is a source for exfiltration.
So if they can gain, uh, unrestricted access to the backup
system, then um, they can do that.
And by the way, if, if you, if you're.
This is your first episode.
You really should go back a couple episodes and listen to that episode
with Dwayne Lalo, uh, where, where it's talking about a red team P person, and
he talked about just how great it is if you can gain access to a backup system.
He, he was like, I love backup systems.
Right.
Yeah, that was a great episode.
Any final thoughts?
Prasanna Malaiyandi: No, I think, yeah, we covered sort of what's ransomware,
what isn't, and yeah, like you said, Curtis, at the beginning I was also
thinking, oh, it's just software installed that someone drops onto your system.
But really it's this lengthy process that happens in order to
be able to gain that foothold.
And so,
W. Curtis Preston: Yeah.
And I, and I, I do think that maybe that's the way it's,
that's the way it started, right?
It was an initial piece of software that you just happened to download
and it would encrypt your data, boom.
And then, and then, and reach out to the person so that they could, uh, do that.
But that's not going to work in a large organization, right?
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: So they, so their attack evolved as well, right?
So they've evolved over the time to go after a bigger, bigger, and bigger fish.
Prasanna Malaiyandi: Yeah.
Well, and I think also that a lot of the security infrastructure has
also evolved, and so the ransomware attackers are also evolving.
In turn, it's like a cat and mouse game.
W. Curtis Preston: Exactly.
Um, and, and you know, you have to be right all the time.
They only have to be right once, unfortunately.
All right.
Well thanks for having a chat.
Prasanna Malaiyandi: Yeah.
It was good.
I enjoy these.
I'm excited for this new series.
I.
W. Curtis Preston: Yeah, me too.
Thanks to our listeners, uh, we'd be nothing without you.
Make sure to subscribe so that you don't miss an episode.
That is a wrap,
The backup wrap up is written, recorded and produced by me w Curtis Preston.
If you need backup or Dr.
Consulting content generation or expert witness work,
check out backup central.com.
You can also find links from my O'Reilly Books on the same website.
Remember, this is an independent podcast and any opinions that you
hear are those of the speaker.
And not necessarily an employer.
Thanks for listening.