1 00:00:00,100 --> 00:00:01,060 W. Curtis Preston: Welcome to the backup. 2 00:00:01,060 --> 00:00:06,280 Wrap up your go-to podcast for all things backup recovery and cyber recovery. 3 00:00:06,280 --> 00:00:06,310 I. 4 00:00:06,910 --> 00:00:10,930 In this latest episode of our series on ransomware, we're 5 00:00:10,930 --> 00:00:16,090 tackling a critical aspect of cybersecurity, the IT security audit. 6 00:00:16,750 --> 00:00:22,150 We'll explore why they are essential, what they entail, and the things that 7 00:00:22,150 --> 00:00:27,550 you could implement in your environment to actually do well in such an audit. 8 00:00:28,210 --> 00:00:31,770 We talk about user education, application white listing, a 9 00:00:31,770 --> 00:00:33,090 whole bunch of other things. 10 00:00:33,915 --> 00:00:39,645 Key elements that make up a comprehensive IT security strategy stick around 11 00:00:39,705 --> 00:00:44,145 as we unpack the ins and outs of it, security audits, and equip you 12 00:00:44,325 --> 00:00:45,885 with the knowledge that you need. 13 00:00:46,471 --> 00:00:51,241 If you are not familiar with me, I am w Curtis Preston, AKA, Mr. 14 00:00:51,241 --> 00:00:51,721 Backup. 15 00:00:52,261 --> 00:00:55,951 And I've been doing this for over 30 years. 16 00:00:56,041 --> 00:00:59,341 Well, not the podcast, of course, but backups. 17 00:00:59,661 --> 00:01:03,471 Ever since, I had to tell my boss that we had no backups of a 18 00:01:03,471 --> 00:01:05,481 production database that we had lost. 19 00:01:05,951 --> 00:01:07,541 I got this passion. 20 00:01:07,751 --> 00:01:11,351 I don't want that to happen to you, and that's why I do things like this. 21 00:01:11,771 --> 00:01:16,901 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 22 00:01:17,201 --> 00:01:19,091 This is the backup wrap up.. 23 00:01:33,715 --> 00:01:34,315 To the show. 24 00:01:34,975 --> 00:01:38,485 Before we continue, can I ask you to click to subscribe or follow button so 25 00:01:38,485 --> 00:01:40,555 that you'll always get our great content? 26 00:01:40,945 --> 00:01:41,425 Thanks. 27 00:01:42,145 --> 00:01:44,905 Hi, I'm w Curtis Preston, AKA, Mr. 28 00:01:44,905 --> 00:01:51,570 Backup, and with me as always is my secret assistant conspire persona. 29 00:01:51,620 --> 00:01:52,650 Molly, how's it going? 30 00:01:52,680 --> 00:01:53,170 Persona? 31 00:01:54,220 --> 00:01:55,420 Prasanna Malaiyandi: I am doing well, Curtis. 32 00:01:55,610 --> 00:01:55,900 Yeah. 33 00:01:56,040 --> 00:01:59,245 So, uh, what can I assist with? 34 00:02:00,010 --> 00:02:00,230 W. Curtis Preston: No. 35 00:02:00,235 --> 00:02:00,595 No, no. 36 00:02:00,940 --> 00:02:05,020 No, you, you're, you're conspiring with me regarding my secret assistant. 37 00:02:05,590 --> 00:02:06,700 Prasanna Malaiyandi: Oh, yes. 38 00:02:06,760 --> 00:02:07,090 Yes. 39 00:02:07,090 --> 00:02:11,020 Your, well, I am assisting with your secret assistant. 40 00:02:11,050 --> 00:02:11,590 Yes. 41 00:02:12,430 --> 00:02:12,820 W. Curtis Preston: Yeah. 42 00:02:12,825 --> 00:02:15,220 Uh, did you know, did you know that he was secret? 43 00:02:15,310 --> 00:02:15,820 Did you know that? 44 00:02:15,820 --> 00:02:16,840 I haven't told my wife. 45 00:02:17,170 --> 00:02:17,350 Prasanna Malaiyandi: Oh, geez. 46 00:02:18,910 --> 00:02:23,200 Don't put me in that spot because you know that if, 47 00:02:23,500 --> 00:02:25,030 W. Curtis Preston: I haven't told my wife that I have a. 48 00:02:27,660 --> 00:02:30,835 Prasanna Malaiyandi: It, it could just say that it's, uh, the Easter 49 00:02:30,835 --> 00:02:34,075 bunny came over and everything went poof and cleaned itself up, 50 00:02:34,825 --> 00:02:37,675 W. Curtis Preston: somehow magically I got a lot more done around the house 51 00:02:37,675 --> 00:02:39,355 than I, than I would normally get done. 52 00:02:39,895 --> 00:02:40,075 Prasanna Malaiyandi: yeah. 53 00:02:40,105 --> 00:02:42,655 Or it could be like those one 800 junk commercials. 54 00:02:42,655 --> 00:02:45,385 You point, we, we take it a bit away. 55 00:02:45,475 --> 00:02:45,805 We make it 56 00:02:46,075 --> 00:02:47,965 W. Curtis Preston: Yeah, it's, it's kind of like that. 57 00:02:47,965 --> 00:02:48,295 Yeah. 58 00:02:48,295 --> 00:02:51,805 I, I've hired a guy who's helping me get some stuff done around the house 59 00:02:51,805 --> 00:02:54,295 because I just can't get it all done. 60 00:02:54,835 --> 00:02:59,125 Um, 'cause you know, me, I'm a, I'm a very, like, I like to do things myself 61 00:02:59,215 --> 00:03:00,570 Prasanna Malaiyandi: that's why I was very surprised. 62 00:03:02,155 --> 00:03:05,125 W. Curtis Preston: Um, and, uh, but. 63 00:03:05,725 --> 00:03:09,565 I just, you know, I've been so busy with, you know, with the new job 64 00:03:09,565 --> 00:03:12,595 and the podcast and all the diff all the stuff that I've been doing to 65 00:03:12,595 --> 00:03:16,525 make the podcast, uh, you know, to grow the podcast and all that stuff. 66 00:03:17,275 --> 00:03:18,445 And, um, 67 00:03:18,790 --> 00:03:20,140 Prasanna Malaiyandi: Well, it's just excuses, 68 00:03:20,250 --> 00:03:21,085 W. Curtis Preston: building, building up. 69 00:03:21,580 --> 00:03:24,730 Prasanna Malaiyandi: Well, I think it's also excuses because if it 70 00:03:24,730 --> 00:03:28,810 was something you enjoy doing, you know, you would go do it 71 00:03:29,095 --> 00:03:30,385 W. Curtis Preston: I would find time. 72 00:03:30,550 --> 00:03:31,000 Prasanna Malaiyandi: yes. 73 00:03:31,060 --> 00:03:37,720 But because this is cleaning stuff up and other tasks which are low on your 74 00:03:37,720 --> 00:03:40,120 priority list and don't bring you joy. 75 00:03:41,185 --> 00:03:42,415 W. Curtis Preston: They don't bring me joy. 76 00:03:43,105 --> 00:03:46,855 The result brings me joy, but the actual activity does not bring me joy. 77 00:03:48,355 --> 00:03:48,715 So I, 78 00:03:48,835 --> 00:03:51,715 Prasanna Malaiyandi: me and the last like four weeks I've been weeding outside and 79 00:03:52,615 --> 00:03:55,855 although it's not awful, it's like very 80 00:03:56,335 --> 00:03:58,255 W. Curtis Preston: how weeding can take you four weeks. 81 00:03:58,855 --> 00:04:01,375 Prasanna Malaiyandi: Well, I do little bits at a time, like I'm out there for 82 00:04:01,375 --> 00:04:05,365 like, like they're like, I'm sitting there picking each individual weed. 83 00:04:05,365 --> 00:04:05,845 Curtis. 84 00:04:08,245 --> 00:04:09,265 W. Curtis Preston: I, uh, I don't know. 85 00:04:09,355 --> 00:04:10,140 I don't know how that works. 86 00:04:12,120 --> 00:04:14,660 You need to get a guy, you need to get a weed guy. 87 00:04:15,220 --> 00:04:15,520 Prasanna Malaiyandi: Yeah. 88 00:04:15,580 --> 00:04:18,520 My wife tells me I need to, we should get a person to clean. 89 00:04:18,520 --> 00:04:20,020 I'm like, uh, it's okay. 90 00:04:20,025 --> 00:04:24,820 It gets me out in the sun and now, like last weekend, we sat outside, 91 00:04:24,820 --> 00:04:28,300 enjoyed the back yard because then you enjoy it even more because you didn't. 92 00:04:29,340 --> 00:04:29,970 W. Curtis Preston: Right, right. 93 00:04:32,605 --> 00:04:32,695 Well. 94 00:04:33,490 --> 00:04:38,200 We're gonna talk about, we're gonna talk about nothing like that. 95 00:04:38,530 --> 00:04:44,230 Uh, this week we're gonna talk about securing your IT environment, and 96 00:04:44,230 --> 00:04:50,465 specifically this is in support of, uh, stopping ransomware. 97 00:04:51,370 --> 00:04:53,980 Uh, and, and, you know, and cyber attacks, right? 98 00:04:54,190 --> 00:04:58,270 This continues on from our previous episode where we talked about the 99 00:04:58,270 --> 00:05:04,450 three things that I think like absolutely everybody has to do. 100 00:05:04,900 --> 00:05:09,010 Um, you know, that, that you just absolutely cannot get by, 101 00:05:09,070 --> 00:05:10,480 would doing or without doing. 102 00:05:10,485 --> 00:05:11,290 And what were those, 103 00:05:12,480 --> 00:05:15,685 Prasanna Malaiyandi: Patching password management and MFA. 104 00:05:16,420 --> 00:05:17,260 W. Curtis Preston: yeah, we throw 105 00:05:17,365 --> 00:05:17,545 Prasanna Malaiyandi: Woo hoo. 106 00:05:17,620 --> 00:05:18,670 W. Curtis Preston: there a lot, right? 107 00:05:19,300 --> 00:05:20,860 Prasanna Malaiyandi: I go back and think. 108 00:05:20,860 --> 00:05:22,305 I was like, what did we talk about? 109 00:05:25,885 --> 00:05:28,555 W. Curtis Preston: Well, the good news is we talk about those three a lot, right? 110 00:05:29,155 --> 00:05:34,825 Um, and the, I've been, you know, I've been working with my new, 111 00:05:34,885 --> 00:05:38,005 uh, co-author of my upcoming book. 112 00:05:38,005 --> 00:05:38,035 I. 113 00:05:38,605 --> 00:05:41,275 I don't know if we're public about that yet, so I won't use his 114 00:05:41,275 --> 00:05:43,885 name, but I have a coauthor from my upcoming book on ransomware. 115 00:05:44,275 --> 00:05:45,685 I've been talking to him about that. 116 00:05:45,685 --> 00:05:47,965 And we've been talking about a lot of the things that people 117 00:05:47,965 --> 00:05:52,165 need to be do, that people need to do to secure their environments. 118 00:05:52,645 --> 00:06:01,375 And um, so one of the first things that I wanted to talk about is, you know, I 119 00:06:01,375 --> 00:06:05,695 dunno, you've ever heard this thing that this, um, like, we get a lot more done. 120 00:06:06,340 --> 00:06:10,090 You know, if there weren't so many customers, right, and it, we, you 121 00:06:10,090 --> 00:06:11,800 know, it'd be so many, so much fewer. 122 00:06:11,860 --> 00:06:14,890 So, so, uh, how do I put this? 123 00:06:14,980 --> 00:06:18,970 Uh, there'd be so fewer problems. 124 00:06:18,970 --> 00:06:20,860 There'd be fewer problems. 125 00:06:21,340 --> 00:06:21,550 Why? 126 00:06:21,550 --> 00:06:23,020 Why isn't this coming out in English? 127 00:06:23,740 --> 00:06:24,490 There would be, 128 00:06:25,870 --> 00:06:28,810 Prasanna Malaiyandi: there would be more time to do stuff with, 129 00:06:28,810 --> 00:06:33,610 less with people doing dumb stuff if people didn't do dumb stuff. 130 00:06:34,375 --> 00:06:35,635 W. Curtis Preston: I was just trying to say something funny. 131 00:06:35,635 --> 00:06:36,625 It's just not coming out right. 132 00:06:36,895 --> 00:06:46,105 Anyway, so what would you say is the number one security 133 00:06:46,110 --> 00:06:48,745 risk in every environment? 134 00:06:48,745 --> 00:06:49,855 Every IT environment. 135 00:06:50,095 --> 00:06:51,655 Prasanna Malaiyandi: Oh, this is obvious, Curtis. 136 00:06:52,135 --> 00:06:52,495 W. Curtis Preston: What's that? 137 00:06:53,335 --> 00:06:54,415 Prasanna Malaiyandi: It's the users. 138 00:06:54,445 --> 00:06:55,555 People, humans. 139 00:06:56,185 --> 00:06:56,995 The humans. 140 00:06:57,055 --> 00:06:57,325 W. Curtis Preston: is. 141 00:06:57,415 --> 00:06:58,435 It is the human. 142 00:06:58,435 --> 00:07:00,025 It is the human, by the way. 143 00:07:00,030 --> 00:07:00,205 Do you 144 00:07:00,205 --> 00:07:01,705 Prasanna Malaiyandi: I do have a question 145 00:07:02,035 --> 00:07:02,515 W. Curtis Preston: sure. 146 00:07:02,935 --> 00:07:06,265 Prasanna Malaiyandi: with chat, GPT and hallucinations, do you 147 00:07:06,265 --> 00:07:08,035 think that now becomes an issue? 148 00:07:11,185 --> 00:07:13,360 W. Curtis Preston: I am not prepared to discuss that at this time. 149 00:07:16,130 --> 00:07:17,430 Um, no comment. 150 00:07:18,530 --> 00:07:20,970 So the, the, um, 151 00:07:23,275 --> 00:07:23,695 I was, 152 00:07:23,825 --> 00:07:26,980 Prasanna Malaiyandi: So, so I, I, I like your, uh, users being the 153 00:07:26,980 --> 00:07:30,940 problem because I know in backups, right, if we think about that right. 154 00:07:31,050 --> 00:07:31,400 W. Curtis Preston: right? 155 00:07:32,020 --> 00:07:34,120 Prasanna Malaiyandi: A lot of your restore scenarios are 156 00:07:34,120 --> 00:07:37,030 because people did dumb stuff. 157 00:07:37,540 --> 00:07:37,960 Right. 158 00:07:37,960 --> 00:07:40,255 I think you've made, you've had the story about someone 159 00:07:41,135 --> 00:07:42,775 accidentally deleting a file server. 160 00:07:43,795 --> 00:07:45,055 W. Curtis Preston: Yeah, absolutely. 161 00:07:45,270 --> 00:07:51,115 And, and the thing is, as we have made it systems more resilient, right? 162 00:07:51,120 --> 00:07:55,645 You have to realize that when I started it, we didn't have raid, right? 163 00:07:55,705 --> 00:08:01,135 So we had mission critical servers running on individual hard drives, right? 164 00:08:01,960 --> 00:08:04,990 We didn't really have highly available systems, et cetera. 165 00:08:04,990 --> 00:08:07,330 Not, at least not in the open systems world, I think they 166 00:08:07,330 --> 00:08:08,440 did in the mainframe side. 167 00:08:08,440 --> 00:08:15,340 But, um, so as we've made, especially storage systems more resilient, 168 00:08:16,810 --> 00:08:22,660 the percentage of time that we have to, you know, that the, that the 169 00:08:22,660 --> 00:08:26,500 problem is the user is like 95% 170 00:08:26,755 --> 00:08:27,055 Prasanna Malaiyandi: Yeah, 171 00:08:27,640 --> 00:08:28,000 W. Curtis Preston: right? 172 00:08:28,210 --> 00:08:30,700 That's in backups and is definitely the case in security. 173 00:08:32,260 --> 00:08:32,740 What's that? 174 00:08:33,085 --> 00:08:36,115 Prasanna Malaiyandi: With great power comes great responsibility. 175 00:08:36,310 --> 00:08:37,540 W. Curtis Preston: Yeah, absolutely. 176 00:08:38,200 --> 00:08:41,140 Um, by the way, did you ever think about the fact that there's only two 177 00:08:41,140 --> 00:08:46,270 industries in the world of which I'm aware that refer their customers as users? 178 00:08:49,075 --> 00:08:53,695 Prasanna Malaiyandi: Um, I'm gonna say the, the IT industry 179 00:08:53,695 --> 00:08:55,105 and also the drug trade. 180 00:08:55,535 --> 00:08:56,465 W. Curtis Preston: Yeah, exactly. 181 00:09:00,655 --> 00:09:02,725 Oh, just, you know, something funny there. 182 00:09:02,965 --> 00:09:04,795 So why are we talking about users? 183 00:09:05,425 --> 00:09:11,845 Because the, I would say one of the best things that you can do to help secure 184 00:09:11,845 --> 00:09:18,895 your environment is to educate your users, your customers, the people inside 185 00:09:18,895 --> 00:09:24,535 your environment that are using your, um, you know, all of your IT systems and 186 00:09:24,835 --> 00:09:26,335 what, what, what does that look like? 187 00:09:27,935 --> 00:09:30,340 Prasanna Malaiyandi: So there are different things you could do for. 188 00:09:30,940 --> 00:09:31,780 Training, right? 189 00:09:31,780 --> 00:09:36,310 You could have mandatory training when they join the company, periodic 190 00:09:36,310 --> 00:09:40,300 updates like, Hey, here are security policies, and I'm sure everyone has 191 00:09:40,305 --> 00:09:43,720 like those little cheesy videos that go on on the screen, like with the 192 00:09:43,725 --> 00:09:48,610 little cartoon animations being like, Hey, here's this phishing email. 193 00:09:48,615 --> 00:09:52,510 Please click all the things that rely on phishing and why it's bad, right? 194 00:09:52,960 --> 00:09:56,200 So you have this sort of training that can happen. 195 00:09:56,560 --> 00:09:58,240 You also have the ones. 196 00:09:58,615 --> 00:10:00,925 Which are more testing you. 197 00:10:00,925 --> 00:10:06,835 So some, uh, software packages have the ability to send out phishing emails to 198 00:10:06,835 --> 00:10:10,495 test your users and say, Hey, by the way, are you clicking on something? 199 00:10:10,915 --> 00:10:14,515 And if you did click on an email, maybe you need some additional training. 200 00:10:15,565 --> 00:10:15,775 Right. 201 00:10:16,285 --> 00:10:17,635 W. Curtis Preston: Yeah, exactly. 202 00:10:17,725 --> 00:10:18,955 Uh, so let's talk about those two. 203 00:10:18,985 --> 00:10:21,025 Those are two very different things. 204 00:10:21,025 --> 00:10:25,315 So the first thing I do like, um, what I think you should be doing 205 00:10:25,315 --> 00:10:27,895 is very periodic, obviously some. 206 00:10:28,195 --> 00:10:32,365 New employee training for sure, because you have no idea what they've seen before. 207 00:10:32,695 --> 00:10:35,665 And then I do think that it should be something, uh, I like the idea of 208 00:10:35,665 --> 00:10:39,715 quarterly, um, you know, quarterly, just a little bit, something that's 209 00:10:39,715 --> 00:10:43,315 not gonna take forever, and you're just trying to bubble up into 210 00:10:43,315 --> 00:10:45,355 their minds on a regular basis. 211 00:10:45,355 --> 00:10:49,735 You're trying to remind them of the things that they should be looking for. 212 00:10:50,185 --> 00:10:53,995 Because when we look at the typical attack vector, it's usually something 213 00:10:53,995 --> 00:10:57,415 like phishing, phishing or spear phishing or something like that. 214 00:10:57,415 --> 00:10:57,475 I. 215 00:10:57,625 --> 00:10:59,080 Prasanna Malaiyandi: Or clicking open a link. 216 00:10:59,230 --> 00:11:02,350 W. Curtis Preston: a user, uh, to, yeah, to get them to open a 217 00:11:02,350 --> 00:11:08,800 link, um, to, um, you know, to get them to, to do whatever right. 218 00:11:08,800 --> 00:11:12,040 To, to get them to do something that, that opens up that initial door. 219 00:11:12,700 --> 00:11:18,520 And so the idea of repeated, uh, security training just bubbles that stuff up 220 00:11:18,520 --> 00:11:23,440 and yes, also helps to educate them on the current state of the art in 221 00:11:23,620 --> 00:11:24,370 Prasanna Malaiyandi: I was gonna ask. 222 00:11:25,210 --> 00:11:25,420 W. Curtis Preston: Yeah. 223 00:11:25,570 --> 00:11:26,680 Prasanna Malaiyandi: I was gonna make that point. 224 00:11:26,680 --> 00:11:27,070 Yeah. 225 00:11:27,310 --> 00:11:30,400 I think it's important because you don't wanna have security training, 226 00:11:30,405 --> 00:11:34,775 which is like three years old talking about the issues from three years ago. 227 00:11:35,465 --> 00:11:35,815 Right. 228 00:11:36,115 --> 00:11:38,655 An example would be, it may not make sense. 229 00:11:39,700 --> 00:11:43,750 During the pandemic when no one was going into an office to have 230 00:11:43,750 --> 00:11:48,610 a security training, talking about people tailgating through an office, 231 00:11:48,820 --> 00:11:50,470 through an access control door. 232 00:11:51,430 --> 00:11:54,130 Because people, so why waste people's cycles? 233 00:11:54,130 --> 00:11:55,990 Because users aren't gonna remember things. 234 00:11:55,990 --> 00:11:56,230 Right? 235 00:11:56,230 --> 00:11:57,340 That's the other problem. 236 00:11:57,670 --> 00:12:01,720 So how do you make it relevant for what is common and what is current 237 00:12:01,750 --> 00:12:03,370 in terms of the attack surfaces? 238 00:12:04,615 --> 00:12:05,665 W. Curtis Preston: Yeah, absolutely. 239 00:12:05,665 --> 00:12:12,355 And the one that I know that, uh, you know, my previous employer used, uh, know 240 00:12:12,355 --> 00:12:14,695 before you're, I'm sure you're familiar 241 00:12:14,695 --> 00:12:16,315 Prasanna Malaiyandi: the Kevin Nick one, right? 242 00:12:16,765 --> 00:12:17,365 W. Curtis Preston: Yeah. 243 00:12:17,455 --> 00:12:22,285 Um, and so basically it, it just, it's constantly, you know, doing all of 244 00:12:22,285 --> 00:12:25,495 that, you know, the, the, the security training with little, little bits and 245 00:12:25,495 --> 00:12:29,695 bites, little videos, little little quizzes, all of that kind of stuff. 246 00:12:30,355 --> 00:12:33,925 And I'm sure there are plenty of other, uh, companies that are like 247 00:12:33,925 --> 00:12:39,025 that, that are constantly trying to, um, you know, provide security 248 00:12:39,025 --> 00:12:40,465 training for your end users. 249 00:12:40,675 --> 00:12:44,185 And by the way, I would say additional security training for people with, 250 00:12:44,245 --> 00:12:46,135 uh, privileged accounts, right? 251 00:12:46,915 --> 00:12:47,215 Prasanna Malaiyandi: Yeah. 252 00:12:47,545 --> 00:12:50,215 W. Curtis Preston: Uh, and that, you know, that goes back to your quote too. 253 00:12:50,215 --> 00:12:52,735 Too much is given, much is expected, right? 254 00:12:52,855 --> 00:12:55,405 Uh, or great power comes great responsibility, right? 255 00:12:56,245 --> 00:13:02,215 Um, so then let's talk about this idea of, um, testing those users. 256 00:13:02,675 --> 00:13:09,905 When you're going to test your users, there is sort of the punishment, you know, 257 00:13:09,905 --> 00:13:12,335 the, the stick versus the carrot, right? 258 00:13:12,755 --> 00:13:14,165 That's one of the big things. 259 00:13:14,315 --> 00:13:20,255 And one of the things that um, that, you know, I don't remember which one 260 00:13:20,465 --> 00:13:24,125 of the previous experts that we had on that talked about this, but what 261 00:13:24,125 --> 00:13:28,055 they really liked is they much more appreciated the carrot than the stick. 262 00:13:28,475 --> 00:13:29,735 What, what do I mean by that? 263 00:13:30,335 --> 00:13:35,255 Prasanna Malaiyandi: Basically don't shame and punish users who fail a test, 264 00:13:35,945 --> 00:13:39,905 but give them additional training, be supportive, make sure that they 265 00:13:39,905 --> 00:13:46,355 understand why they sort of failed and sort of do positive reinforcement, right? 266 00:13:46,355 --> 00:13:49,235 Which is kind of, I'm looking at my dog right now, who's sleeping 267 00:13:49,235 --> 00:13:52,235 right next to me, but literally, that's how you train dogs, right? 268 00:13:52,235 --> 00:13:55,535 It's positive reinforcement rather than the stick. 269 00:13:56,165 --> 00:13:56,795 And 270 00:13:56,795 --> 00:13:59,615 W. Curtis Preston: so well, positive reinforcement when 271 00:13:59,615 --> 00:14:00,965 they do something right. 272 00:14:00,995 --> 00:14:02,435 What would be an example of that? 273 00:14:02,440 --> 00:14:03,545 They did something right. 274 00:14:04,610 --> 00:14:09,380 Prasanna Malaiyandi: Um, so that they identified a phishing email correctly, 275 00:14:09,530 --> 00:14:10,190 W. Curtis Preston: Exactly 276 00:14:10,610 --> 00:14:11,030 Prasanna Malaiyandi: right. 277 00:14:11,060 --> 00:14:11,630 Protected the 278 00:14:11,900 --> 00:14:13,580 W. Curtis Preston: them a fake phishing email. 279 00:14:14,030 --> 00:14:16,760 They identified it and they did what you trained them to 280 00:14:16,765 --> 00:14:18,170 do, which is report it to it. 281 00:14:18,890 --> 00:14:21,650 They should definitely get some brownie points if they do that. 282 00:14:21,650 --> 00:14:21,680 I. 283 00:14:22,430 --> 00:14:22,880 Right. 284 00:14:23,420 --> 00:14:28,610 Um, and then if they get, if they get caught, if you will, this isn't like put 285 00:14:28,610 --> 00:14:32,840 them up on a d board, you know, the, you know, announce the list of people that 286 00:14:32,840 --> 00:14:37,070 are messing up the world, or, or, you know, here's, you know, you've got three 287 00:14:37,070 --> 00:14:38,840 strikes this month, you're gonna be fired. 288 00:14:38,840 --> 00:14:39,080 What? 289 00:14:39,500 --> 00:14:45,710 I, I, I don't like any of the, now, um, we, we can talk about the extreme person. 290 00:14:46,640 --> 00:14:51,710 If there is someone who just doesn't seem to be able to get the concept of 291 00:14:51,710 --> 00:14:53,570 cybersecurity, you have two choices. 292 00:14:53,570 --> 00:14:58,040 You either build a wall around them, which is increasingly difficult to 293 00:14:58,040 --> 00:15:01,250 do, or you decide to terminate them. 294 00:15:01,400 --> 00:15:01,790 Right? 295 00:15:02,390 --> 00:15:07,100 But the person who makes the occasional mistake should just be reminded, 296 00:15:07,430 --> 00:15:12,140 you know, in a, in a pleasant way that you know, Hey, you know what? 297 00:15:12,145 --> 00:15:13,400 However, however you want to do that. 298 00:15:13,400 --> 00:15:13,670 Yeah. 299 00:15:13,835 --> 00:15:16,565 Prasanna Malaiyandi: and don't feel bad if you. 300 00:15:17,390 --> 00:15:21,470 Failed that test because I was actually just browsing Twitter earlier this 301 00:15:21,470 --> 00:15:25,490 morning, and there was a security person who was going through training because 302 00:15:25,490 --> 00:15:26,990 they got caught by a phishing attack. 303 00:15:27,410 --> 00:15:27,620 Right. 304 00:15:27,625 --> 00:15:29,030 Or by the phishing training test. 305 00:15:29,030 --> 00:15:29,300 Right. 306 00:15:29,305 --> 00:15:33,890 And so it can happen to any of us because some of those are hard, and that's really 307 00:15:33,895 --> 00:15:36,110 what the bad guys are looking at as well. 308 00:15:36,115 --> 00:15:36,470 Right. 309 00:15:36,530 --> 00:15:42,200 These aren't gonna be obvious that it, this is a phishing attack, so it's okay. 310 00:15:44,090 --> 00:15:46,370 W. Curtis Preston: Yeah, I, I can remember one that I fell 311 00:15:46,370 --> 00:15:49,820 for a couple of years ago, and 312 00:15:49,895 --> 00:15:50,850 Prasanna Malaiyandi: drained your bank account. 313 00:15:51,740 --> 00:15:56,840 W. Curtis Preston: no, look, I got, I got, uh, not, no, no, ill effects happened as 314 00:15:56,840 --> 00:16:02,720 a result of it, but it was the, it was, I think it was spear phishing because 315 00:16:03,380 --> 00:16:11,150 they specifically said your, um, the, the, the, the employer that I worked for. 316 00:16:11,930 --> 00:16:15,470 Had paid for like Norton or something? 317 00:16:15,470 --> 00:16:18,680 Uh, they had, they had paid, not Norton, they had paid for. 318 00:16:18,680 --> 00:16:22,520 What's that service that, um, the one that the guy puts his 319 00:16:22,520 --> 00:16:24,080 social security number online? 320 00:16:25,350 --> 00:16:25,910 Prasanna Malaiyandi: LifeLock, 321 00:16:27,320 --> 00:16:27,530 W. Curtis Preston: Yeah. 322 00:16:27,620 --> 00:16:28,040 What was it? 323 00:16:28,040 --> 00:16:28,490 What is it? 324 00:16:28,670 --> 00:16:29,230 Prasanna Malaiyandi: LifeLock. 325 00:16:29,810 --> 00:16:30,320 W. Curtis Preston: LifeLock? 326 00:16:30,350 --> 00:16:30,620 Yeah. 327 00:16:31,070 --> 00:16:33,740 Well, they had paid for LifeLock because we had had a breach. 328 00:16:33,740 --> 00:16:36,800 So they paid for LifeLock for like a year and then. 329 00:16:38,135 --> 00:16:41,465 I got this notice it said, your LifeLock thing is expiring. 330 00:16:41,525 --> 00:16:42,965 Do you want to Right. 331 00:16:43,565 --> 00:16:49,985 And it f it, it came at just the right time and it was like, and it's quite 332 00:16:49,990 --> 00:16:54,155 possibly that the, that the attacker knew that there had been a breach. 333 00:16:54,185 --> 00:16:58,205 They had waited the right amount of time and then they went and just sent 334 00:16:58,205 --> 00:17:01,085 an email to everybody and I fell for it. 335 00:17:01,085 --> 00:17:02,255 I went right in there. 336 00:17:02,255 --> 00:17:04,865 And, um, the. 337 00:17:05,630 --> 00:17:11,930 I remember at the time I was really not happy with LifeLock's response. 338 00:17:11,930 --> 00:17:16,550 Like I felt I had, I'd done something and, uh, but anyway. 339 00:17:16,550 --> 00:17:21,230 Yeah, you, you can, you can, can fall for it. 340 00:17:21,560 --> 00:17:25,160 Um, and so don't feel horrible about 341 00:17:25,235 --> 00:17:27,515 Prasanna Malaiyandi: yeah, and the one thing I want to add, I know 342 00:17:27,515 --> 00:17:32,585 we're talking about sort of training and testing, but also when a user 343 00:17:32,585 --> 00:17:38,255 accidentally gets caught with actual phishing, make it such that it's okay 344 00:17:38,255 --> 00:17:42,635 for them to come forward and be proactive because that's the best thing to do. 345 00:17:43,325 --> 00:17:46,625 Is you want them to be like, Hey, tell us when something goes wrong so 346 00:17:46,625 --> 00:17:50,855 we can start locking down systems and dealing with this, rather than, Hey, 347 00:17:50,855 --> 00:17:54,935 I'm just going to pretend this never happened and go along on my merry way. 348 00:17:55,775 --> 00:17:56,405 W. Curtis Preston: Agreed. 349 00:17:56,405 --> 00:17:59,555 And, and you know, that goes, you know, you've heard the phrase before that 350 00:17:59,555 --> 00:18:01,445 you train people how to treat you. 351 00:18:01,805 --> 00:18:05,735 You train your users on how they're going to respond if they actually 352 00:18:05,740 --> 00:18:07,865 get, you know, uh, they get. 353 00:18:08,510 --> 00:18:11,000 They respond to an actual, uh, phishing attack. 354 00:18:11,000 --> 00:18:15,980 So if you're big, you're, if you're a big stick environment, right? 355 00:18:16,310 --> 00:18:19,430 And, and they get beat a little head with a real stick, imagine what 356 00:18:19,430 --> 00:18:22,850 they're, what they think is going to happen if they actually get hit with a 357 00:18:22,850 --> 00:18:25,280 real, um, you know, a real ransomware. 358 00:18:25,490 --> 00:18:25,910 So, yeah. 359 00:18:25,970 --> 00:18:28,640 Um, this is back to that positive reinforcement. 360 00:18:29,240 --> 00:18:31,880 Um, and I, and I'll give you an example of something that, that 361 00:18:32,120 --> 00:18:34,040 was just a little while ago. 362 00:18:34,430 --> 00:18:35,390 There was a. 363 00:18:36,020 --> 00:18:40,340 I think we talked about it on the podcast where the guy said that everyone, 364 00:18:40,400 --> 00:18:47,120 that on Valentine's Day, that everyone received a notice that they had flowers 365 00:18:47,120 --> 00:18:50,930 down at the front desk or something and they just needed to respond to, 366 00:18:51,470 --> 00:18:52,910 to get the flowers or something. 367 00:18:53,270 --> 00:18:56,120 And, and it was, it was all fishing related. 368 00:18:56,630 --> 00:18:59,570 And, uh, he said his wife didn't fall for it. 369 00:18:59,570 --> 00:19:01,070 So he was, you know, because of. 370 00:19:01,940 --> 00:19:07,700 You know, he had trained her right, but, but he's like, for, for a few minutes 371 00:19:07,700 --> 00:19:09,650 everyone in that building fell loved. 372 00:19:09,725 --> 00:19:11,525 Prasanna Malaiyandi: Oh yeah, I do remember 373 00:19:11,635 --> 00:19:13,490 W. Curtis Preston: a, that's an example of the, of the wrong 374 00:19:13,490 --> 00:19:14,810 kind of thing to do for sure. 375 00:19:15,410 --> 00:19:20,150 Um, so the next thing, and, and, and I think I wanted, I, I really want, 376 00:19:20,155 --> 00:19:24,110 this is something that I don't think very many people do, but, but I'd 377 00:19:24,110 --> 00:19:28,250 like you to at least consider that, and that's application white listing. 378 00:19:29,060 --> 00:19:31,280 What is that and why would that be such a big deal? 379 00:19:32,030 --> 00:19:34,550 Prasanna Malaiyandi: So this is basically saying only certain 380 00:19:34,550 --> 00:19:39,110 applications are allowed to be installed, are able to run on your devices. 381 00:19:39,710 --> 00:19:40,250 Um. 382 00:19:40,835 --> 00:19:44,675 In order to sort of lock down the scope and prevent people from 383 00:19:44,675 --> 00:19:48,065 going and downloading arbitrary packages which might have issues. 384 00:19:48,695 --> 00:19:55,085 Um, while I agree in principle with the purpose and probably locks down a lot 385 00:19:55,085 --> 00:19:59,825 of things, uh, I have two concerns with application white listing, maybe three. 386 00:20:00,185 --> 00:20:01,925 So the first concern is. 387 00:20:03,350 --> 00:20:07,430 By putting a white list, you sort of restrict like a user's 388 00:20:07,430 --> 00:20:08,540 ability to get work done. 389 00:20:08,870 --> 00:20:11,360 For instance, Curtis, I'm sure if there was a software package that 390 00:20:11,360 --> 00:20:14,480 you needed in order to be able to get your work done and you couldn't get 391 00:20:14,480 --> 00:20:17,900 access to it because it wasn't part of the white list, now there's probably 392 00:20:17,935 --> 00:20:19,055 W. Curtis Preston: Absolutely a downside of it. 393 00:20:19,160 --> 00:20:19,430 Yeah. 394 00:20:19,730 --> 00:20:22,700 Prasanna Malaiyandi: Yeah, there's a giant process in order to get that going. 395 00:20:23,420 --> 00:20:27,980 The second thing, and I know we had talked about this the other day, um, 396 00:20:28,340 --> 00:20:32,330 is it doesn't necessarily protect you from supply chain attacks. 397 00:20:33,950 --> 00:20:38,450 So if someone had compromised that application that you are, that you have 398 00:20:38,450 --> 00:20:42,530 on the white list, it's not gonna protect you because it's still on your white list. 399 00:20:42,530 --> 00:20:46,190 You're still able to run it, and the fact that the application itself 400 00:20:46,190 --> 00:20:48,140 is compromised doesn't help you. 401 00:20:49,655 --> 00:20:50,015 W. Curtis Preston: Yeah. 402 00:20:51,440 --> 00:20:51,890 Prasanna Malaiyandi: So, 403 00:20:51,965 --> 00:20:53,465 W. Curtis Preston: you, I thought you thought, I thought, 404 00:20:53,855 --> 00:20:54,880 I thought you said you had three. 405 00:20:55,700 --> 00:20:58,580 Prasanna Malaiyandi: And then the third one is, um. 406 00:20:59,585 --> 00:21:04,985 When you're writing code, sometimes you do need access to libraries and other pieces 407 00:21:04,985 --> 00:21:07,715 of software to download install packages. 408 00:21:08,225 --> 00:21:08,585 Right. 409 00:21:08,585 --> 00:21:14,615 I think it would be a big burden and also a big compliance and governance thing. 410 00:21:14,765 --> 00:21:18,605 Like how do you make sure, like what's the process for adding a software, how long 411 00:21:18,605 --> 00:21:20,615 does it take to go through that process? 412 00:21:20,930 --> 00:21:24,350 In order to add something to the application white list to make sure 413 00:21:24,350 --> 00:21:28,400 everything's signed off, how long does it stay there as software packages are 414 00:21:28,400 --> 00:21:29,930 changing, when do things get dropped? 415 00:21:29,930 --> 00:21:35,570 Like it's so much of a program that sometimes it may be difficult for 416 00:21:35,900 --> 00:21:39,410 both small and large organizations to implement something like this. 417 00:21:40,535 --> 00:21:42,665 W. Curtis Preston: So those are all valid concerns. 418 00:21:42,815 --> 00:21:48,875 Um, I want to counter counter them. 419 00:21:50,600 --> 00:21:51,620 Prasanna Malaiyandi: I'm not saying it's bad. 420 00:21:51,620 --> 00:21:51,920 I'm not. 421 00:21:52,510 --> 00:21:52,865 W. Curtis Preston: no, no, no. 422 00:21:53,495 --> 00:21:53,705 Yeah. 423 00:21:53,705 --> 00:21:54,695 You did what? 424 00:21:54,695 --> 00:21:55,715 So what are the three what? 425 00:21:55,955 --> 00:21:57,005 Remind me the three. 426 00:21:57,005 --> 00:21:59,735 It was, um, so you were worried about the. 427 00:22:00,695 --> 00:22:04,235 You're worried about the, uh, the difficulty on the user, right? 428 00:22:04,235 --> 00:22:07,325 You're worried about supply chain hacks and then sort of the, the burden 429 00:22:07,325 --> 00:22:09,815 on it, developing third party apps. 430 00:22:09,820 --> 00:22:14,735 Yeah, so what I would say is, you know, I agree with all of those and I 431 00:22:14,735 --> 00:22:21,995 think that especially with the first one, I think with the first one, I 432 00:22:21,995 --> 00:22:24,605 think you're focused a little bit too much on people like you and me. 433 00:22:25,100 --> 00:22:26,030 Prasanna Malaiyandi: Yeah, I agree. 434 00:22:26,120 --> 00:22:26,330 Yeah. 435 00:22:26,330 --> 00:22:26,420 That 436 00:22:26,855 --> 00:22:27,545 W. Curtis Preston: right. 437 00:22:27,635 --> 00:22:34,655 Uh, and I'm focusing at least with this on, on servers, right. 438 00:22:35,045 --> 00:22:38,015 And especially servers, number one. 439 00:22:38,015 --> 00:22:42,095 And especially like the laptops for the masses. 440 00:22:42,575 --> 00:22:43,055 Right. 441 00:22:43,565 --> 00:22:44,255 Um, 442 00:22:44,810 --> 00:22:45,745 Prasanna Malaiyandi: Don't also forget phones. 443 00:22:47,735 --> 00:22:48,665 W. Curtis Preston: well, yeah. 444 00:22:48,725 --> 00:22:49,145 Okay. 445 00:22:49,175 --> 00:22:50,525 I'll, I'll, I'll agree to that. 446 00:22:50,525 --> 00:22:52,685 It's just most environments. 447 00:22:53,225 --> 00:22:54,545 That's a whole other discussion. 448 00:22:54,695 --> 00:22:56,315 That's a whole other can of worms. 449 00:22:56,555 --> 00:22:57,125 Agreed. 450 00:22:57,455 --> 00:23:01,895 Um, but what, what do you think the percentage of the people that have 451 00:23:01,900 --> 00:23:03,605 actual company phones these days? 452 00:23:04,175 --> 00:23:06,845 Prasanna Malaiyandi: Well, or they're using their phones with 453 00:23:06,875 --> 00:23:08,585 access to company resources. 454 00:23:08,945 --> 00:23:09,905 It's all the same, right? 455 00:23:11,165 --> 00:23:14,465 W. Curtis Preston: Yes, that's a whole other, that's a whole other can of worms. 456 00:23:15,065 --> 00:23:18,095 But because, because pushing application, white listing on somebody 457 00:23:18,095 --> 00:23:19,475 else's phone, that's not gonna work. 458 00:23:19,775 --> 00:23:20,165 Right. 459 00:23:20,945 --> 00:23:25,955 Um, so I, I guess what I'm saying is, what I am saying is if you can 460 00:23:25,955 --> 00:23:27,125 do it, I think you should do it 461 00:23:27,545 --> 00:23:27,835 Prasanna Malaiyandi: Yeah. 462 00:23:28,205 --> 00:23:28,625 W. Curtis Preston: right? 463 00:23:28,895 --> 00:23:29,765 Yes. 464 00:23:29,855 --> 00:23:34,715 Um, it's gonna be difficult for it people and like power users, 465 00:23:34,715 --> 00:23:36,335 and perhaps you have exceptions. 466 00:23:36,665 --> 00:23:39,935 This is what we talk about, like block all outgoing traffic except 467 00:23:40,115 --> 00:23:42,905 for, you know, the ones that you need. 468 00:23:44,000 --> 00:23:47,270 Restrict as many laptops as you can, except for the ones that 469 00:23:47,270 --> 00:23:49,700 you can't restrict servers. 470 00:23:49,820 --> 00:23:51,650 Uh, really think about that, right? 471 00:23:51,650 --> 00:23:56,360 You know, if you're, if you're, if it's just a server that does one job, perhaps 472 00:23:56,360 --> 00:23:58,670 you, you make, you know, exchange. 473 00:23:59,000 --> 00:24:02,210 It's the only thing that's allowed to run on that box or whatever else it needs, 474 00:24:02,215 --> 00:24:03,830 you know, active directory, et cetera. 475 00:24:04,940 --> 00:24:07,040 Um, and. 476 00:24:08,105 --> 00:24:11,795 The, uh, regarding your second one, I would say I'm gonna, 477 00:24:11,795 --> 00:24:12,965 but I'm gonna do a Yeah. 478 00:24:12,965 --> 00:24:14,015 But, okay. 479 00:24:14,375 --> 00:24:14,825 Yes. 480 00:24:14,825 --> 00:24:17,465 It doesn't stop you from supply chain attacks, but supply 481 00:24:17,465 --> 00:24:19,175 chain attacks are really rare. 482 00:24:19,865 --> 00:24:20,195 Right. 483 00:24:20,195 --> 00:24:23,015 I'm not saying they don't happen, but they are really rare. 484 00:24:23,015 --> 00:24:25,985 And just because it doesn't stop you from everything doesn't 485 00:24:25,985 --> 00:24:26,735 mean you shouldn't do it. 486 00:24:26,825 --> 00:24:27,155 Right. 487 00:24:27,815 --> 00:24:32,375 Um, and then the third, I would say, um, this, this just 488 00:24:32,375 --> 00:24:33,395 goes back to the first one. 489 00:24:33,395 --> 00:24:33,755 It's like. 490 00:24:34,520 --> 00:24:35,360 Yes. 491 00:24:35,420 --> 00:24:39,080 But again, I think maybe you're, I think there's a lot of companies that don't do 492 00:24:39,080 --> 00:24:40,820 their own in-house development, right? 493 00:24:40,940 --> 00:24:46,370 And they're just using, um, you know, their own, they're using, they're 494 00:24:46,370 --> 00:24:48,920 using Microsoft Word, et cetera. 495 00:24:48,950 --> 00:24:49,190 Right? 496 00:24:49,190 --> 00:24:52,520 They're using 15 applications and everybody's using the same 15 497 00:24:52,520 --> 00:24:56,600 applications, and you could whitelist those applications and nothing else, 498 00:24:56,870 --> 00:24:57,230 Prasanna Malaiyandi: yeah. 499 00:24:57,560 --> 00:25:00,920 And I agree for most users, they probably don't need access beyond 500 00:25:00,920 --> 00:25:04,640 those specific apps like your 15 or whatever the number is. 501 00:25:04,970 --> 00:25:08,870 And then I think also for, um. 502 00:25:10,430 --> 00:25:11,630 The servers. 503 00:25:11,630 --> 00:25:14,900 I think that, like you said, you should be probably be going through an IT 504 00:25:15,080 --> 00:25:20,510 process anyway to onboard an application, including looking at the resources, 505 00:25:21,050 --> 00:25:26,840 making sure you're including backup and DR as part of the deployment process. 506 00:25:27,500 --> 00:25:30,260 So I, I think that is also a good point. 507 00:25:31,055 --> 00:25:31,475 W. Curtis Preston: Agreed. 508 00:25:31,475 --> 00:25:31,775 Agreed. 509 00:25:31,775 --> 00:25:32,225 Agreed. 510 00:25:32,775 --> 00:25:34,725 Prasanna Malaiyandi: I know you talked about application whitelisting. 511 00:25:35,235 --> 00:25:35,625 W. Curtis Preston: Yeah. 512 00:25:37,395 --> 00:25:40,215 Prasanna Malaiyandi: What are your thoughts on extending that to 513 00:25:40,245 --> 00:25:43,635 browser whitelisting like website? 514 00:25:45,615 --> 00:25:46,425 W. Curtis Preston: Um, that. 515 00:25:48,030 --> 00:25:50,520 That it's a very similar concept, right? 516 00:25:50,760 --> 00:25:55,530 Um, where you allow, I, I'll just say this, um, it doesn't, it doesn't 517 00:25:55,530 --> 00:26:03,240 work because all it takes is, um, all it takes is someone using A-C-T-P-S 518 00:26:03,270 --> 00:26:08,880 and the right tool to go around your, um, to go around your tool, right? 519 00:26:09,270 --> 00:26:12,120 All they need is something as simple as hide my ass.com. 520 00:26:12,125 --> 00:26:13,830 Have, have you seen hide my ass.com? 521 00:26:14,220 --> 00:26:14,730 Prasanna Malaiyandi: No, I have 522 00:26:14,955 --> 00:26:18,285 W. Curtis Preston: Um, there's literally a website called hide my ass.com, and 523 00:26:18,285 --> 00:26:21,195 you can go there and put the website you actually want to go to and they'll take 524 00:26:21,195 --> 00:26:24,885 you there and encrypt the whole thing so that your security software won't find it. 525 00:26:25,335 --> 00:26:27,795 So it's only gonna stop like the dumbest people. 526 00:26:28,050 --> 00:26:28,440 Prasanna Malaiyandi: Yeah. 527 00:26:29,070 --> 00:26:30,420 But hey, if that's common. 528 00:26:31,365 --> 00:26:31,845 W. Curtis Preston: Yeah. 529 00:26:31,935 --> 00:26:32,385 Yeah. 530 00:26:32,565 --> 00:26:39,375 Um, the, that is the, I, I think that's something you should discuss 531 00:26:39,375 --> 00:26:41,205 as to whether or not you should block. 532 00:26:41,835 --> 00:26:46,575 Um, you know, access to, well, well, let's just move on into the next thing, 533 00:26:46,575 --> 00:26:50,535 which, talking about, so disabled different attack vectors, right? 534 00:26:50,535 --> 00:26:54,195 So the, the, the first thing I, I do think you should be looking at when 535 00:26:54,195 --> 00:26:56,235 you're, when you're inventorying your environment and you're looking for 536 00:26:56,235 --> 00:27:00,135 things to lock down, is you really need to look at service accounts. 537 00:27:00,135 --> 00:27:04,215 This really came up when we had Dwayne on here and he was talking about that, 538 00:27:04,215 --> 00:27:08,025 and that freaked me out when he was talking about the backup service account, 539 00:27:08,415 --> 00:27:11,625 how that allows you to do whatever you want without auditing at all. 540 00:27:12,290 --> 00:27:12,580 Prasanna Malaiyandi: Yeah. 541 00:27:12,690 --> 00:27:15,840 W. Curtis Preston: Uh, and, and there are many, many service accounts. 542 00:27:15,840 --> 00:27:18,630 So the first thing I think, or one of the things that you should do as 543 00:27:18,630 --> 00:27:21,390 you're inventorying your environment and you're trying to secure your 544 00:27:21,395 --> 00:27:24,180 environment, is to go through your environment and look for service accounts. 545 00:27:25,080 --> 00:27:26,610 What are they being used for? 546 00:27:26,640 --> 00:27:30,720 Do they have a, I'm, I'm gonna say the most common thing with these is 547 00:27:30,720 --> 00:27:32,610 that they have a very basic password. 548 00:27:33,570 --> 00:27:37,980 Um, or they have a default password or they have no password and they're being 549 00:27:37,980 --> 00:27:39,870 used by something really important. 550 00:27:40,440 --> 00:27:41,880 Um, and. 551 00:27:42,390 --> 00:27:46,920 The result is that it becomes a really easily, um, hackable account. 552 00:27:47,205 --> 00:27:47,535 Prasanna Malaiyandi: Yeah. 553 00:27:48,225 --> 00:27:55,035 Yeah, no, and also turning off things that you don't need a service, that 554 00:27:55,365 --> 00:27:56,775 particular service account for. 555 00:27:58,200 --> 00:27:58,770 W. Curtis Preston: exactly. 556 00:27:58,800 --> 00:27:59,460 Exactly. 557 00:27:59,610 --> 00:28:06,060 Um, and, and on that end, um, let's talk about services that typically run. 558 00:28:06,060 --> 00:28:06,090 I. 559 00:28:06,585 --> 00:28:07,725 That maybe shouldn't. 560 00:28:08,025 --> 00:28:11,145 Let's talk about what I like to call the ransomware deployment 561 00:28:11,145 --> 00:28:14,265 protocol, otherwise known as RDP. 562 00:28:15,180 --> 00:28:15,720 Prasanna Malaiyandi: Yes. 563 00:28:15,720 --> 00:28:18,540 RDP or Remote Desktop Protocol. 564 00:28:18,795 --> 00:28:19,365 W. Curtis Preston: Yeah. 565 00:28:19,425 --> 00:28:23,205 Uh, it, it, uh, I'm trying to get the world to change. 566 00:28:23,210 --> 00:28:28,935 It's the ransomware deployment protocol, disabled, RDP disable, RDP, disable RDP. 567 00:28:29,605 --> 00:28:30,505 Prasanna Malaiyandi: Can I correct that? 568 00:28:30,555 --> 00:28:32,415 W. Curtis Preston: it sure. 569 00:28:33,435 --> 00:28:36,765 Prasanna Malaiyandi: So, or slightly mod tweak your statement. 570 00:28:36,765 --> 00:28:40,065 I think it's disable RDP, unless you really need a 571 00:28:40,070 --> 00:28:41,745 machine that needs RDP running. 572 00:28:43,365 --> 00:28:45,525 W. Curtis Preston: that, I mean, that's the way I am with everything. 573 00:28:45,530 --> 00:28:45,765 Right. 574 00:28:45,765 --> 00:28:47,475 Disable it wherever you can. 575 00:28:47,685 --> 00:28:51,315 Prasanna Malaiyandi: I think the other thing is also disable RDP 576 00:28:51,405 --> 00:28:57,465 leaving your network unless you need access outside of your intranet. 577 00:28:58,395 --> 00:29:02,145 W. Curtis Preston: Well, I, I would say that you, you absolutely cannot 578 00:29:02,235 --> 00:29:07,965 allow direct RDP access to the internet 100% there is in, in my opinion, 579 00:29:07,965 --> 00:29:11,055 there is no reason to ever do that. 580 00:29:11,415 --> 00:29:14,805 If you need, if, if you need something like that, then you 581 00:29:14,805 --> 00:29:17,400 should, you should require VPN. 582 00:29:17,475 --> 00:29:22,185 In fact, what I would suggest is that if you're going to do RDP, you put 583 00:29:22,185 --> 00:29:24,195 those interfaces on a separate network. 584 00:29:25,035 --> 00:29:29,475 And then you must be on that network, either physically or via VPN in 585 00:29:29,475 --> 00:29:31,575 order to access those, those, um, 586 00:29:32,055 --> 00:29:32,600 Prasanna Malaiyandi: Those hosts. 587 00:29:32,990 --> 00:29:33,280 Yeah. 588 00:29:33,315 --> 00:29:33,645 W. Curtis Preston: yeah. 589 00:29:34,270 --> 00:29:34,560 Prasanna Malaiyandi: Yeah. 590 00:29:34,755 --> 00:29:37,425 W. Curtis Preston: Um, because already you, you just need to understand, just 591 00:29:37,425 --> 00:29:41,805 like we talk a lot about with backups, you need to understand the degree to 592 00:29:41,805 --> 00:29:43,515 which your backup server is under attack. 593 00:29:43,515 --> 00:29:49,905 You need to understand just how bad RDP is from a ransomware deployment perspective. 594 00:29:49,905 --> 00:29:49,995 Right. 595 00:29:51,375 --> 00:29:53,985 Prasanna Malaiyandi: And I know we harp on RDP, but the same is 596 00:29:53,985 --> 00:29:56,655 true for any other service, which you don't need to be running. 597 00:29:57,405 --> 00:30:03,285 W. Curtis Preston: S-M-B-N-F-S-A Fs, PFTP, right? 598 00:30:03,855 --> 00:30:07,305 Um, all of these services need to be turned off. 599 00:30:07,725 --> 00:30:12,700 And this is why, by the way, this is why Windows got, I think, a, 600 00:30:12,705 --> 00:30:16,815 a, a big knock for, you know, being insecure, mainly because it 601 00:30:16,815 --> 00:30:18,525 turned everything on by default. 602 00:30:18,870 --> 00:30:21,780 Whereas Unix and Linux turned everything off by default. 603 00:30:22,260 --> 00:30:28,020 Um, and so just go and look at these services, all of the services 604 00:30:28,020 --> 00:30:31,530 that are running and ask you do you absolutely have to, to, to run them. 605 00:30:32,070 --> 00:30:34,050 Prasanna Malaiyandi: or the other thing is just do a port scan on your 606 00:30:34,050 --> 00:30:39,450 servers that'll tell you if this, like what ports are being listened to on, 607 00:30:39,450 --> 00:30:43,680 and you could map those back to figure out, okay, what services is that? 608 00:30:43,680 --> 00:30:45,300 And it's all pretty standard, right? 609 00:30:45,300 --> 00:30:47,580 I think RDP is 3 9 2 2. 610 00:30:48,720 --> 00:30:49,080 W. Curtis Preston: Right. 611 00:30:49,080 --> 00:30:53,070 And, and I would say if you, let's go back to RDP for a minute and 612 00:30:53,075 --> 00:30:54,300 then, and this is just remote. 613 00:30:54,330 --> 00:30:59,100 If you need remote access and in today's world, you probably do need remote access. 614 00:30:59,220 --> 00:31:00,300 Don't use RDP. 615 00:31:00,570 --> 00:31:04,620 Use a service that gives remote access, right. 616 00:31:04,960 --> 00:31:09,940 Like ConnectWise, which is a service that is properly securing and probably, 617 00:31:10,000 --> 00:31:15,070 uh, you know, properly doing things in a way that doesn't, it, it's a 618 00:31:15,070 --> 00:31:19,450 service Where the way ConnectWise works is it, is it reaches out, right? 619 00:31:19,450 --> 00:31:21,880 And you, you, you've gotta first connect to them and then 620 00:31:21,880 --> 00:31:23,080 it will connect to you, right? 621 00:31:23,080 --> 00:31:24,700 And so you can add things like. 622 00:31:25,675 --> 00:31:30,625 A and all of that extra protection on, um, and so I, if you need 623 00:31:30,625 --> 00:31:34,405 remote access and you need remote access, use a service to do it. 624 00:31:34,405 --> 00:31:39,295 Please don't allow something like RDP or SSH or any of that stuff 625 00:31:39,685 --> 00:31:41,545 directly accessible via the internet. 626 00:31:41,995 --> 00:31:42,985 Prasanna Malaiyandi: Yeah, those are 627 00:31:43,225 --> 00:31:43,525 W. Curtis Preston: Yeah. 628 00:31:44,335 --> 00:31:44,995 Prasanna Malaiyandi: Very, very bad. 629 00:31:45,925 --> 00:31:50,875 W. Curtis Preston: Um, and then, uh, also let's talk about, um, you know. 630 00:31:52,060 --> 00:31:56,020 Again, I, I can't believe I have to say this, but you need to look at some type 631 00:31:56,020 --> 00:31:59,710 of, um, uh, malware scanning, right? 632 00:31:59,715 --> 00:32:02,170 Some type of antivirus, anti malware. 633 00:32:02,560 --> 00:32:06,160 Um, and this is not just on Windows, this is also on Mac, 634 00:32:06,895 --> 00:32:10,825 Prasanna Malaiyandi: Which is surprising that how many people say, 635 00:32:11,125 --> 00:32:12,715 I don't need anything on my Mac. 636 00:32:12,715 --> 00:32:14,215 It's like, no, you really do. 637 00:32:14,800 --> 00:32:15,250 W. Curtis Preston: Yeah. 638 00:32:15,340 --> 00:32:15,640 Yeah. 639 00:32:15,640 --> 00:32:17,080 And the same thing on Linux, right? 640 00:32:17,080 --> 00:32:20,110 And the same thing on like, they're, they're targeting, they're directly 641 00:32:20,110 --> 00:32:24,460 targeting VMware and other, other, uh, uh, uh, virtualization solutions. 642 00:32:24,465 --> 00:32:28,180 So, um, you need to, uh, put that in. 643 00:32:28,630 --> 00:32:32,680 And then finally, let's just talk a little bit about, um. 644 00:32:33,625 --> 00:32:34,885 Proactive. 645 00:32:34,975 --> 00:32:37,705 Uh, what, what was the term that, that he used? 646 00:32:38,035 --> 00:32:39,805 He didn't like the term ethical hacking. 647 00:32:39,805 --> 00:32:43,645 He didn't like the term, what did he call the red team concept? 648 00:32:43,645 --> 00:32:44,455 What did he call it? 649 00:32:45,640 --> 00:32:46,600 Prasanna Malaiyandi: I don't remember. 650 00:32:49,525 --> 00:32:50,305 W. Curtis Preston: um, 651 00:32:52,705 --> 00:32:53,275 the, 652 00:32:56,335 --> 00:32:57,715 well, let's just say this. 653 00:32:57,865 --> 00:32:58,945 You need a red team, 654 00:32:59,370 --> 00:32:59,620 Prasanna Malaiyandi: Yeah, 655 00:32:59,755 --> 00:33:00,145 W. Curtis Preston: right? 656 00:33:00,415 --> 00:33:02,455 What is a red te What is a red team persona? 657 00:33:02,890 --> 00:33:04,485 Prasanna Malaiyandi: this is basically a. 658 00:33:05,650 --> 00:33:09,100 Team who works for you, who thinks like the bad guy. 659 00:33:09,520 --> 00:33:15,190 So they are there attacking your systems just the same way a bad guy would, but 660 00:33:15,190 --> 00:33:17,110 unlike a bad guy, they work for you. 661 00:33:17,110 --> 00:33:20,135 So then hopefully once they've identified the issues, you can go fix 'em. 662 00:33:21,865 --> 00:33:22,285 W. Curtis Preston: Yeah. 663 00:33:22,375 --> 00:33:26,665 And I, and I really liked, um, you know, you know, when we had Dwayne 664 00:33:26,665 --> 00:33:29,215 on here, I really liked the way he talked about the way they did it, 665 00:33:29,215 --> 00:33:30,775 where they work with the blue team. 666 00:33:31,225 --> 00:33:33,445 Uh, the blue team of course is the defensive side. 667 00:33:33,445 --> 00:33:33,475 I. 668 00:33:34,115 --> 00:33:36,365 And you need a red team, you need a blue team. 669 00:33:36,425 --> 00:33:37,655 You need both of these. 670 00:33:37,715 --> 00:33:41,135 And, and I do believe that you should hire experts to do this. 671 00:33:41,465 --> 00:33:47,405 Um, and, um, I can put links to the two episodes that we just played, 672 00:33:47,405 --> 00:33:51,905 if you miss them, um, uh, that, that show you what a red team does, what 673 00:33:51,905 --> 00:33:56,495 a blue team does, and why you need a relationship with them now versus, you 674 00:33:56,495 --> 00:34:00,935 know, waiting to call, you know, waiting until after attack to call a blue team. 675 00:34:01,625 --> 00:34:02,045 Right. 676 00:34:02,425 --> 00:34:09,355 Um, so the, the, basically what they'll do, and this is more than 677 00:34:09,355 --> 00:34:13,375 just port scanning, this is more than just a basic penetration test. 678 00:34:13,380 --> 00:34:18,025 This is, this is a, a group, this is a company with a group of people 679 00:34:18,025 --> 00:34:21,235 that are actively going to try and attack your company, uh, and 680 00:34:21,670 --> 00:34:22,030 Prasanna Malaiyandi: Yep. 681 00:34:22,210 --> 00:34:23,680 Expose any weaknesses. 682 00:34:23,890 --> 00:34:23,950 Yeah. 683 00:34:24,265 --> 00:34:25,285 W. Curtis Preston: Yeah, absolutely. 684 00:34:25,315 --> 00:34:26,725 Which may include. 685 00:34:27,040 --> 00:34:30,070 Depending on, you know, what level of service you're gonna buy, which 686 00:34:30,070 --> 00:34:34,870 may include physical penetration testing, which may include things like 687 00:34:34,875 --> 00:34:38,500 trying to figure out how to scan your security badges and things like that. 688 00:34:38,770 --> 00:34:39,070 Right. 689 00:34:39,310 --> 00:34:39,640 Prasanna Malaiyandi: yep. 690 00:34:39,760 --> 00:34:44,560 Or even probably working with third party vendors who might be connected 691 00:34:44,560 --> 00:34:47,770 with you to try to get access to your accounts through those other ways. 692 00:34:48,535 --> 00:34:48,885 W. Curtis Preston: Right. 693 00:34:49,840 --> 00:34:52,165 So these are other things, um, you know. 694 00:34:53,020 --> 00:34:56,950 When you're going to do some to type of security audit, these are things 695 00:34:56,950 --> 00:35:02,560 that you might want to take a look at, uh, in order to, uh, ensure, 696 00:35:02,650 --> 00:35:05,410 you know, to further ensure that you're securing your environment. 697 00:35:06,040 --> 00:35:07,900 Uh, be, go ahead. 698 00:35:09,340 --> 00:35:09,670 Prasanna Malaiyandi: Yeah. 699 00:35:09,670 --> 00:35:12,790 Well, I like the term doing a security audit. 700 00:35:13,300 --> 00:35:19,510 I do wonder if many of these things that we are looking at get sort of baked into 701 00:35:19,510 --> 00:35:22,270 when an application gets deployed, right? 702 00:35:22,270 --> 00:35:25,660 Here are the things that you should be taking into consideration, 703 00:35:26,120 --> 00:35:26,540 W. Curtis Preston: Mm-Hmm. 704 00:35:26,800 --> 00:35:27,070 Prasanna Malaiyandi: right? 705 00:35:27,070 --> 00:35:30,280 As part of that questionnaire to identify, okay, are they really 706 00:35:30,280 --> 00:35:31,510 following the best practices? 707 00:35:31,510 --> 00:35:33,850 Because if you get to the point where you're doing a security 708 00:35:33,850 --> 00:35:36,490 audit and you found things, that means that it failed upfront. 709 00:35:37,555 --> 00:35:37,915 Right. 710 00:35:37,915 --> 00:35:42,415 So it's not a bad idea to do a security audit at the end, right? 711 00:35:42,415 --> 00:35:43,825 Or at some point, but 712 00:35:44,530 --> 00:35:46,105 W. Curtis Preston: I would say on a regular basis. 713 00:35:46,375 --> 00:35:46,705 Right. 714 00:35:47,305 --> 00:35:47,665 Prasanna Malaiyandi: Yeah. 715 00:35:48,055 --> 00:35:51,235 But also, remember doing a security audit is time consuming 716 00:35:51,925 --> 00:35:53,335 across an organization, right? 717 00:35:53,335 --> 00:35:56,545 And so baking it into the process, so everyone's thinking about this 718 00:35:56,545 --> 00:36:00,805 day in and day out will make it more scalable and achievable. 719 00:36:01,855 --> 00:36:03,925 W. Curtis Preston: Yeah, I, I think the idea is like, you've 720 00:36:03,925 --> 00:36:05,665 gotta start somewhere, right? 721 00:36:05,665 --> 00:36:09,355 So you go through, you, you, you know, you get a list of, I, you get a list of 722 00:36:09,355 --> 00:36:11,095 applications, you get a list of things. 723 00:36:11,125 --> 00:36:14,575 You, you train your users, you do all the things that you, maybe you 724 00:36:14,575 --> 00:36:18,085 haven't been doing up to this point, and then we can start talking about. 725 00:36:18,880 --> 00:36:21,520 Things that we should be doing on a regular basis, which is a list of 726 00:36:21,520 --> 00:36:24,190 things from a security perspective that you should be looking at 727 00:36:24,430 --> 00:36:25,960 when you deploy a new application. 728 00:36:26,050 --> 00:36:26,590 Exactly. 729 00:36:27,910 --> 00:36:31,120 Um, so, uh, all right, persona. 730 00:36:31,120 --> 00:36:32,830 Well thanks for good discussion as always. 731 00:36:33,475 --> 00:36:34,885 Prasanna Malaiyandi: Oh, thank you Curtis. 732 00:36:34,885 --> 00:36:41,935 And, uh, yeah, I'm excited to hear what your, uh, secret assistant does next. 733 00:36:43,405 --> 00:36:43,975 W. Curtis Preston: Me too. 734 00:36:44,665 --> 00:36:45,625 Uh, all right. 735 00:36:45,655 --> 00:36:48,445 Uh, listeners, uh, we love you. 736 00:36:48,655 --> 00:36:49,915 You're, you're why we're here. 737 00:36:50,275 --> 00:36:53,965 Uh, we're trying to turn you into a, a cybersecurity hero. 738 00:36:54,325 --> 00:36:56,035 So, uh, be sure to subscribe. 739 00:36:56,515 --> 00:36:59,095 Uh, and, uh, that is a wrap.