1 00:00:00,049 --> 00:00:03,530 You found the backup wrap up your go-to podcast for all things 2 00:00:03,530 --> 00:00:05,840 backup recovery and cyber recovery. 3 00:00:06,319 --> 00:00:10,039 This episode we're gonna give you some bad news, I think. 4 00:00:10,099 --> 00:00:14,390 Uh, and that is, uh, we're gonna talk about ransomware sanctions. 5 00:00:14,780 --> 00:00:19,250 What happens when the group that just encrypted your data and wants a ransom is 6 00:00:19,250 --> 00:00:21,290 actually sanctioned by your government? 7 00:00:22,010 --> 00:00:26,090 Paying them might feel like the only way out, but it could also land 8 00:00:26,090 --> 00:00:30,530 you in actually much worse trouble, like massive fines or even jail 9 00:00:30,530 --> 00:00:32,090 time depending on where you are. 10 00:00:32,569 --> 00:00:36,110 Dr. Mike Saylor joins Persona and me to walk through a real 11 00:00:36,110 --> 00:00:38,390 case involving the Lazarus group. 12 00:00:38,750 --> 00:00:41,450 What OFAC is and why you need to know about it. 13 00:00:41,450 --> 00:00:44,420 If you, if you're in the us, why paying that ransom is 14 00:00:44,420 --> 00:00:46,070 almost never the right call. 15 00:00:46,370 --> 00:00:47,829 So let's keep you outta the hot water. 16 00:00:47,859 --> 00:00:48,250 Okay. 17 00:00:48,730 --> 00:00:53,289 By the way, a little note about me, uh, I'm w Curtis Preston, AKA, Mr. 18 00:00:53,289 --> 00:00:56,110 Backup, and I've been obsessing about backups. 19 00:00:56,389 --> 00:01:01,609 For over 30 years and, uh, ever since, I had to tell my boss that there were no 20 00:01:01,609 --> 00:01:03,679 backups of the database that we just lost. 21 00:01:04,339 --> 00:01:07,279 Since then, I've written five books, a blog and a podcast, 22 00:01:07,489 --> 00:01:11,599 and here we turn unappreciated admins into Cyber Recovery Heroes. 23 00:01:11,899 --> 00:01:13,729 This is the backup wrap up. 24 00:01:31,138 --> 00:01:32,518 Welcome to the backup wrap up. 25 00:01:32,518 --> 00:01:36,988 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have a guy with me whose 26 00:01:36,988 --> 00:01:40,468 hair is looking gray every time I see him. 27 00:01:41,268 --> 00:01:43,648 Prasanna Malaiyandi. 28 00:01:45,448 --> 00:01:46,258 How's it going, Prasanna?. 29 00:01:46,738 --> 00:01:47,908 Are you saying I'm old? 30 00:01:48,313 --> 00:01:49,213 saying I'm old? 31 00:01:49,498 --> 00:01:53,368 I'm just saying if fans of the podcast, look back at the original videos. 32 00:01:53,518 --> 00:01:55,378 My hair's been gray since we started. 33 00:01:55,648 --> 00:01:58,858 Yours was Jet Black when we started, and it is, 34 00:01:59,008 --> 00:02:01,158 impact of Curtis on Prasanna. 35 00:02:01,438 --> 00:02:02,138 It could be. 36 00:02:02,293 --> 00:02:05,098 I I agree. 37 00:02:05,753 --> 00:02:06,623 I'll just shave everything. 38 00:02:07,178 --> 00:02:10,048 and then that voice that you may have heard or person you may have 39 00:02:10,048 --> 00:02:13,858 said that would be Dr. Mike Saylor, my co-author on the lovely learning 40 00:02:13,858 --> 00:02:15,658 ransomware Response and Recovery book. 41 00:02:15,658 --> 00:02:16,918 that is out now. 42 00:02:16,948 --> 00:02:20,008 You can order it at your favorite, wherever you get. 43 00:02:20,008 --> 00:02:22,318 And by the way, they're actually doing an audio book. 44 00:02:22,798 --> 00:02:27,148 I'm super excited to listen to someone else say my words. 45 00:02:28,303 --> 00:02:32,773 Ah, can it be, is it the guy, the Sleepy podcast guy? 46 00:02:33,373 --> 00:02:33,673 Oh, no. 47 00:02:34,938 --> 00:02:39,598 I, I actually did the, I actually made a podcast, a recording where I 48 00:02:39,598 --> 00:02:44,398 read a chapter, one of my books, and I read it like Sleepy Podcast guy. 49 00:02:44,758 --> 00:02:49,453 And, I did it for my wife because that's my wife's, the only value she gets in, 50 00:02:49,453 --> 00:02:51,733 in my books is putting her to sleep. 51 00:02:52,288 --> 00:02:57,773 guy is a guy who talks about almost nothing in a very soothing and that's 52 00:02:57,773 --> 00:02:59,318 sometimes what Curtis uses to fall asleep. 53 00:03:00,038 --> 00:03:00,428 yeah. 54 00:03:00,433 --> 00:03:01,798 who you want narrating this book. 55 00:03:02,798 --> 00:03:04,498 but, by the way, thanks for joining us again. 56 00:03:04,718 --> 00:03:05,898 Thanks for having me. 57 00:03:06,568 --> 00:03:07,108 Yeah. 58 00:03:07,138 --> 00:03:07,348 yeah. 59 00:03:07,348 --> 00:03:07,648 Yeah. 60 00:03:07,653 --> 00:03:13,653 we don't need, and then you need to get a cyber insurance company and 61 00:03:13,653 --> 00:03:18,843 potentially investigate whether or not your coverages are sufficient. 62 00:03:19,843 --> 00:03:21,013 that would not be good. 63 00:03:21,013 --> 00:03:21,973 That would not be good. 64 00:03:22,333 --> 00:03:22,553 Now. 65 00:03:22,603 --> 00:03:25,453 Why don't what, Mike, why don't you start out with, this week's 66 00:03:25,453 --> 00:03:27,193 story, what you got for us? 67 00:03:28,383 --> 00:03:28,743 Sure. 68 00:03:28,843 --> 00:03:33,903 so when you experience a cyber event, cyber incident, and there comes a 69 00:03:33,903 --> 00:03:37,713 demand for payment, you know what, for whatever reason, ransom, extortion, 70 00:03:39,333 --> 00:03:42,663 before you make that payment, you've gotta do this analysis of whether 71 00:03:42,663 --> 00:03:44,103 or not you can make that payment. 72 00:03:44,503 --> 00:03:47,053 'cause if you make the payment and the government says, shouldn't have made 73 00:03:47,053 --> 00:03:49,423 that payment, then you're actually gonna be making more payments. 74 00:03:49,813 --> 00:03:52,833 as you get by whatever, government entity that might be. 75 00:03:53,233 --> 00:03:56,623 and so there's some steps you need to go through to, to determine whether or 76 00:03:56,623 --> 00:03:58,783 not, making that payment's even feasible. 77 00:03:59,233 --> 00:04:02,618 and a lot of organizations, I think, may not know, what's 78 00:04:02,618 --> 00:04:04,118 involved with determining that? 79 00:04:05,068 --> 00:04:08,388 so something, something that we were involved in, an incident 80 00:04:08,388 --> 00:04:09,738 we were called to help with. 81 00:04:10,188 --> 00:04:11,628 it was a construction company. 82 00:04:13,758 --> 00:04:18,478 They maintained all of their core proprietary, construction, CAD 83 00:04:18,478 --> 00:04:23,488 drawings and construction plans on a proprietary core system. 84 00:04:23,968 --> 00:04:29,148 And they had this, self-proclaimed, check-in checkout, core system 85 00:04:29,148 --> 00:04:32,838 and the satellite systems where nobody could get to the core. 86 00:04:32,868 --> 00:04:35,358 bad guys couldn't get there, malware couldn't get there, and. 87 00:04:36,348 --> 00:04:36,888 guess what? 88 00:04:36,888 --> 00:04:37,758 Malware got there. 89 00:04:38,208 --> 00:04:40,608 And their systems were down. 90 00:04:40,788 --> 00:04:45,328 And, this was a, this was an organization that, builds hospitals and military 91 00:04:45,328 --> 00:04:49,398 bases and, hundreds of millions of dollars, if not billions of dollars 92 00:04:49,408 --> 00:04:52,378 in ongoing construction projects. 93 00:04:52,718 --> 00:04:54,488 the event happened on a Thursday. 94 00:04:54,858 --> 00:04:57,888 bad guys were nice enough to give us the weekend to figure all this out. 95 00:04:58,338 --> 00:04:59,718 and then Sunday evening into 96 00:04:59,783 --> 00:05:01,013 they're so nice, Mike. 97 00:05:01,013 --> 00:05:01,613 Those bad guys. 98 00:05:01,913 --> 00:05:04,143 And this was, this was, the Lazarus group. 99 00:05:04,143 --> 00:05:08,233 So they've actually got a pretty good, it support, if you decide to work with them, 100 00:05:08,233 --> 00:05:12,383 they'll, they've got a whole department of, help desk and troubleshooting and 101 00:05:12,383 --> 00:05:13,973 technicians to help you get through it. 102 00:05:14,593 --> 00:05:16,153 so all included in the price. 103 00:05:16,153 --> 00:05:17,053 But wait, there's more. 104 00:05:17,473 --> 00:05:21,393 so working with the bad guys, and these guys were in that 105 00:05:21,393 --> 00:05:22,533 environment for a long time. 106 00:05:22,533 --> 00:05:27,283 So they knew, and oddly enough, they knew more about this organization's 107 00:05:27,283 --> 00:05:29,173 insurance company than the company did. 108 00:05:29,763 --> 00:05:33,483 and so when they presented the ransom demand, it was very well aligned 109 00:05:33,483 --> 00:05:36,393 with how much insurance coverage they had, which was also nice. 110 00:05:37,503 --> 00:05:40,443 but the company didn't know they had that much insurance, so they were 111 00:05:40,593 --> 00:05:43,203 demanding a lower, look, we don't have that much insurance, but the 112 00:05:43,203 --> 00:05:44,373 bad guys were like, yeah, you do. 113 00:05:44,823 --> 00:05:45,893 and alright, so now we're. 114 00:05:46,343 --> 00:05:50,783 We're negotiating primarily based on the executive management's desire to 115 00:05:50,783 --> 00:05:54,923 get this taken care of and recovered by Monday so that we can continue work. 116 00:05:54,923 --> 00:05:58,853 And there we don't have to tell anybody that there was any of these impacts. 117 00:05:58,853 --> 00:06:00,623 We don't want our reputation impacted. 118 00:06:00,833 --> 00:06:02,903 We don't want these contracts to be canceled. 119 00:06:03,233 --> 00:06:05,363 We just want this, we just want to get through this. 120 00:06:06,083 --> 00:06:07,268 And they wanted to pay the ransom. 121 00:06:08,443 --> 00:06:13,343 And so it, Sunday night into Monday, negotiating, I initially directly with the 122 00:06:13,343 --> 00:06:17,113 threat actors, just going back and forth, turned out to be, pretty swell guys. 123 00:06:17,393 --> 00:06:22,073 that they like small talk and, very amenable to, to ideas and op, options. 124 00:06:22,523 --> 00:06:25,023 and we got down to the point where, all right, I think this 125 00:06:25,023 --> 00:06:26,733 is a, this is the best we can do. 126 00:06:27,153 --> 00:06:28,623 And taking that to management. 127 00:06:28,623 --> 00:06:30,393 And they were like, all right, we can do this. 128 00:06:31,143 --> 00:06:32,673 said, but should you do this? 129 00:06:33,423 --> 00:06:34,083 they're like, what do you mean? 130 00:06:34,983 --> 00:06:40,803 we know who these bad guys are and I'm pretty sure they're a sanctioned group. 131 00:06:41,523 --> 00:06:48,353 So making this payment is going to possibly, in, result in some federal. 132 00:06:49,448 --> 00:06:51,738 Penalties, so what do we do now? 133 00:06:52,398 --> 00:06:55,548 And that brings us to the kind of the topic of our discussion today with 134 00:06:55,598 --> 00:07:00,838 handle, dealing with threat actors that, that are, potentially sanctioned, from 135 00:07:01,003 --> 00:07:01,543 Yeah, 136 00:07:01,768 --> 00:07:02,008 quote 137 00:07:02,113 --> 00:07:03,088 and go ahead. 138 00:07:05,053 --> 00:07:09,793 but it's like the company just wants their data back and they just 139 00:07:09,793 --> 00:07:11,773 wanna make this problem go away. 140 00:07:11,773 --> 00:07:13,313 Like why should they be? 141 00:07:14,368 --> 00:07:18,178 Like jumping through these hoops or potential hoops, I'm guessing, to 142 00:07:18,178 --> 00:07:21,358 avoid these fines when all they wanna do is pay the guy and be done with it. 143 00:07:21,943 --> 00:07:26,048 You were just a pebble in the stream, in the criminal ecosystem. 144 00:07:26,748 --> 00:07:31,308 I actually wrote a paper in my, graduate school about, the sophisticated organ 145 00:07:31,518 --> 00:07:34,998 organized cyber crime that facilitates all these other traditional crimes. 146 00:07:35,703 --> 00:07:39,213 And so ransomware is one of those crimes where they're just collecting 147 00:07:39,213 --> 00:07:45,763 money that's then gonna go towards arms deals or human trafficking or, buying 148 00:07:45,763 --> 00:07:54,123 up more avocado farms in Mexico, to, to, to impact the price of produce. 149 00:07:54,553 --> 00:08:00,043 and so at a kind of a global ecosystem level has to. 150 00:08:00,463 --> 00:08:05,713 Understand the flow of criminal assets and they've identified 151 00:08:05,713 --> 00:08:09,553 certain criminal elements like the Lazarus group as an example. 152 00:08:09,973 --> 00:08:13,273 when they receive where does it go? 153 00:08:14,238 --> 00:08:17,898 is it parties and Lamborghinis or is it some of that? 154 00:08:17,898 --> 00:08:22,688 Plus they give money to the, to the other bad guys that do other bad things. 155 00:08:23,108 --> 00:08:23,528 And if the 156 00:08:23,538 --> 00:08:23,658 I, 157 00:08:23,728 --> 00:08:30,038 or the regulatory body decides, we need to limit these guys getting those 158 00:08:30,038 --> 00:08:33,588 kind of, that kind of funding because it's gonna end up other places, then 159 00:08:33,588 --> 00:08:34,673 they put them on that sanction list. 160 00:08:35,548 --> 00:08:38,708 I think that's a really good point that you're making there, Mike, because I 161 00:08:38,708 --> 00:08:40,898 don't think people think about that a lot. 162 00:08:40,898 --> 00:08:45,468 I think they think about these, ransomware groups as ransomware groups. 163 00:08:45,688 --> 00:08:51,588 And what you're saying is the ransomware, entity is quite 164 00:08:51,588 --> 00:08:53,758 possibly, and even probably. 165 00:08:54,378 --> 00:08:59,148 Just one cog in a much bigger wheel that it, that has to 166 00:08:59,148 --> 00:09:00,918 do with all sorts of crime. 167 00:09:01,218 --> 00:09:02,688 That could have a lot to do with. 168 00:09:03,318 --> 00:09:03,618 Yeah. 169 00:09:03,618 --> 00:09:05,178 It's essentially a business unit. 170 00:09:05,298 --> 00:09:09,518 And what it could be is it could be, it's essentially the, it could be the. 171 00:09:10,053 --> 00:09:11,183 The, what's the word? 172 00:09:11,393 --> 00:09:11,873 What's the word? 173 00:09:11,873 --> 00:09:12,263 I'm looking? 174 00:09:12,263 --> 00:09:15,233 It could be the most profitable, but yeah, it could be a cash cow. 175 00:09:15,233 --> 00:09:15,713 Thank you. 176 00:09:15,743 --> 00:09:16,193 Thank you. 177 00:09:16,293 --> 00:09:16,693 Prasanna. 178 00:09:16,848 --> 00:09:23,578 it could be the cash cow that's helping to fund, much more scary parts of 179 00:09:23,578 --> 00:09:27,448 the organization, which may involve drugs, which may involve, murder 180 00:09:27,448 --> 00:09:29,968 and physical harm to other people. 181 00:09:29,968 --> 00:09:33,598 And, property, the, and also terrorism, right? 182 00:09:33,638 --> 00:09:34,688 that they could be. 183 00:09:35,088 --> 00:09:38,748 Doing this just as a way to fund terrorism, which. 184 00:09:39,798 --> 00:09:44,648 by design is a money losing, business unit, right? 185 00:09:44,858 --> 00:09:47,288 You spend a lot of money to blow stuff up. 186 00:09:47,598 --> 00:09:50,393 you got a lot of turnover, for sad reasons. 187 00:09:50,683 --> 00:09:53,933 and so it's that kind of the point that you're making, right? 188 00:09:53,933 --> 00:09:57,013 Is that, that these ransomware organizations, you shouldn't 189 00:09:57,013 --> 00:09:58,993 think about them just by that. 190 00:09:58,993 --> 00:10:01,538 You have to think about them as part of a bigger organization. 191 00:10:01,538 --> 00:10:02,528 Is that about right? 192 00:10:03,118 --> 00:10:05,508 It is, and there's a show out now and I'm. 193 00:10:05,578 --> 00:10:07,708 I am having trouble remembering the name of it. 194 00:10:07,708 --> 00:10:12,568 But, the last couple episodes I've watched, it was a guy in treasury, who 195 00:10:12,568 --> 00:10:16,668 was reviewing these, these red flag reports, transactions of a certain 196 00:10:16,668 --> 00:10:21,203 type over a certain amount in a certain period of time, trigger these reports. 197 00:10:21,438 --> 00:10:24,408 And he was reviewing those reports and found some commonalities. 198 00:10:24,838 --> 00:10:29,048 turns out a lot of them were shell companies, but he followed the money and. 199 00:10:29,423 --> 00:10:32,063 The money led to a terrorist attack on an airline. 200 00:10:33,673 --> 00:10:34,693 And absolutely. 201 00:10:34,793 --> 00:10:38,273 people that, that are in that field with that skillset are the ones who are 202 00:10:38,273 --> 00:10:43,183 advising, these different government agencies on who to sanction and the 203 00:10:43,183 --> 00:10:46,483 trends or the behavior of some of these groups and how they spend their money 204 00:10:46,523 --> 00:10:49,193 or donate or transact their money. 205 00:10:49,533 --> 00:10:49,753 Yep. 206 00:10:50,588 --> 00:10:52,983 So it makes sense that we don't want to fund. 207 00:10:53,843 --> 00:10:56,543 These organizations are right, who are now gonna take the money 208 00:10:56,543 --> 00:10:57,443 and use it for other things. 209 00:10:57,803 --> 00:11:00,313 But I know Mike, you mentioned fines, right? 210 00:11:00,313 --> 00:11:04,633 Federal penalties and other things like that in comparison to 211 00:11:04,633 --> 00:11:06,103 the ransom that they're paying. 212 00:11:06,103 --> 00:11:07,093 What does that look like? 213 00:11:07,093 --> 00:11:10,453 Is it like 10 times the amount of whatever they paid? 214 00:11:10,648 --> 00:11:16,133 Or is it not just monetary penalties, but is there other types of penalties 215 00:11:16,583 --> 00:11:19,793 associated with that, like auditing or other compliance efforts? 216 00:11:20,488 --> 00:11:24,838 There could be, financial penalties, are typically the iceberg. 217 00:11:24,838 --> 00:11:27,448 and sometimes it's enough to put you outta business, right? 218 00:11:27,448 --> 00:11:29,878 So it, they'll consume the rest of your insurance. 219 00:11:30,188 --> 00:11:32,258 we've talked about cyber insurance, but then there's usually this 220 00:11:32,258 --> 00:11:33,578 corporate insurance umbrella. 221 00:11:33,948 --> 00:11:34,668 and if you can't. 222 00:11:35,068 --> 00:11:37,978 Make a payment plan or address the rest of it, then you may have to 223 00:11:38,218 --> 00:11:39,838 declare bankruptcy or grab a business. 224 00:11:40,588 --> 00:11:45,173 some examples, that I looked up a minute ago from a proportionate perspective, 225 00:11:45,513 --> 00:11:50,843 one company paid just over half a million dollars, to the US Treasury, 226 00:11:51,093 --> 00:11:57,973 because they made, 2100 transactions to San Sanction government, entities 227 00:11:58,023 --> 00:12:04,703 or, organizations in sanctioned, parts of the world, another one $98,000 228 00:12:04,703 --> 00:12:08,483 penalty for $9,000 in transactions. 229 00:12:08,483 --> 00:12:08,933 Wow. 230 00:12:09,933 --> 00:12:11,818 that's more than 10 x. That's interesting. 231 00:12:11,883 --> 00:12:16,773 $3 million ransom to a sanctioned organization that could be 30 to 300 232 00:12:16,773 --> 00:12:18,893 million in, penalties from the government. 233 00:12:19,193 --> 00:12:19,678 Now, the government. 234 00:12:20,718 --> 00:12:24,168 it also un unfortunately, depends on who you are as a company. 235 00:12:24,568 --> 00:12:28,623 so like Colonial Pipeline as an example, they didn't, they paid a ransom, but 236 00:12:28,623 --> 00:12:32,623 they went through the OFAC process, to determine if the bad guys were 237 00:12:32,623 --> 00:12:35,083 sanctioned, even if they were sanctioned. 238 00:12:35,443 --> 00:12:38,083 There is an, an exception process. 239 00:12:38,263 --> 00:12:40,823 It takes longer, to go through that process. 240 00:12:40,823 --> 00:12:44,393 But if you're one of these too big to fail or critical infrastructure. 241 00:12:44,733 --> 00:12:48,093 organizations, the government's probably gonna be more lenient or give 242 00:12:48,093 --> 00:12:49,503 you a pass on making that payment. 243 00:12:49,503 --> 00:12:54,383 'cause you could impact the, the critical infrastructure of the economy in the US 244 00:12:54,433 --> 00:12:55,993 if you couldn't go back into business. 245 00:12:56,278 --> 00:13:00,128 you, you just dropped a name, which I don't think we've actually even 246 00:13:00,128 --> 00:13:01,778 mentioned yet in this episode. 247 00:13:02,138 --> 00:13:04,298 And that would be ofac, who is ofac? 248 00:13:05,228 --> 00:13:07,553 OFAC is the Office of Foreign Asset Control. 249 00:13:07,553 --> 00:13:11,063 It's a part of the treasury, treasury Department in the us. 250 00:13:12,113 --> 00:13:16,913 and treasury in the US would be the one that primarily tracks, transactions, 251 00:13:16,913 --> 00:13:21,913 especially with foreign assets and making sure that bad guys aren't getting, money, 252 00:13:22,333 --> 00:13:24,853 to fund their illegitimate activities. 253 00:13:25,053 --> 00:13:26,163 but Mike, here's a question. 254 00:13:26,193 --> 00:13:30,663 Most of these ransomware payments come in Bitcoin, right? 255 00:13:30,918 --> 00:13:31,128 yep. 256 00:13:31,413 --> 00:13:33,843 And usually with Bitcoin you don't know who. 257 00:13:34,443 --> 00:13:38,343 The destination account wallet really belongs to technically, right? 258 00:13:38,343 --> 00:13:39,843 That's the entire purpose. 259 00:13:39,843 --> 00:13:41,553 That bad guys use it. 260 00:13:42,543 --> 00:13:47,343 How can they prove that it was a certain organization that's on the sanction 261 00:13:47,343 --> 00:13:50,433 list and not some other organization that you're paying money for? 262 00:13:50,433 --> 00:13:52,463 And how does that like weave together? 263 00:13:52,748 --> 00:13:53,018 Yep. 264 00:13:53,858 --> 00:13:56,018 Bitcoin allows you to be a little more anonymous. 265 00:13:56,813 --> 00:14:01,093 But the idea of your wallet is not, so I don't know who owns that wallet, 266 00:14:01,333 --> 00:14:05,203 but I can track that wallet, So that money came into that wallet. 267 00:14:05,233 --> 00:14:07,933 Money went out of that wallet, and I can track where it 268 00:14:07,933 --> 00:14:09,073 came from and where it goes. 269 00:14:09,073 --> 00:14:13,633 And so transaction out goes to wallet B. That transaction got 270 00:14:13,633 --> 00:14:15,103 split into multiple things. 271 00:14:15,163 --> 00:14:18,583 I can see all those transactions, those wallet IDs also. 272 00:14:18,973 --> 00:14:22,463 And so they're simply, following the money, they may not be 273 00:14:22,463 --> 00:14:23,573 able to put a name on it. 274 00:14:23,633 --> 00:14:24,653 Eventually they will. 275 00:14:24,683 --> 00:14:28,153 'cause someone's going to, show up in person, to pay for something 276 00:14:28,153 --> 00:14:32,153 with Bitcoin or go to a bank to, to convert that to cash to go. 277 00:14:32,153 --> 00:14:36,983 And so there, there are always the, the exit from the Bitcoin transaction 278 00:14:36,983 --> 00:14:39,363 into the, physical world is where. 279 00:14:39,658 --> 00:14:43,388 we're able to put faces and names to things and then track it backwards. 280 00:14:44,108 --> 00:14:45,128 who did, who do you know? 281 00:14:45,128 --> 00:14:46,238 Who'd you get paid from? 282 00:14:46,288 --> 00:14:46,888 that kind of thing. 283 00:14:47,653 --> 00:14:53,593 It's less about sort of the Lazarus group as like an entity and more from like 284 00:14:53,623 --> 00:14:55,543 the wallet perspective, if you will. 285 00:14:55,853 --> 00:15:00,413 They just use Lazarus group as like on the sanction as referring to say, 286 00:15:00,413 --> 00:15:01,883 Hey, here are all these other wallets. 287 00:15:02,803 --> 00:15:07,933 and once you be, become consistent with the wallet you use, that's 288 00:15:07,933 --> 00:15:09,763 another, behavioral baseline. 289 00:15:09,853 --> 00:15:14,083 So now we know that the Lazarus group always uses this Bitcoin 290 00:15:14,353 --> 00:15:16,063 or the set of Bitcoin wallets. 291 00:15:17,503 --> 00:15:18,673 and so they've become known and. 292 00:15:19,228 --> 00:15:22,838 From that perspective, then, obviously they're bad guys and they're causing 293 00:15:22,838 --> 00:15:26,463 damage economically to companies in the us so they're gonna get attention. 294 00:15:26,763 --> 00:15:31,393 And so as the US government investigates that group in their Bitcoin wallets, 295 00:15:31,823 --> 00:15:36,143 and those transac, those IDs, they can then see, where does that money go next? 296 00:15:36,383 --> 00:15:40,583 Is that to their employees, their mules, their affiliates? 297 00:15:41,408 --> 00:15:44,928 is it somewhere specific, parts of the world as an example? 298 00:15:45,158 --> 00:15:49,598 and then at some point, do those transactions then interact with other 299 00:15:49,598 --> 00:15:53,198 known bad guy, wallets and transactions? 300 00:15:53,198 --> 00:15:58,028 And so building that, that map of transactions, that ecosystem is 301 00:15:58,028 --> 00:16:00,508 the exercise they go through and they maintain it pretty often. 302 00:16:01,148 --> 00:16:02,978 because bad guys do fall out of favor. 303 00:16:03,368 --> 00:16:05,718 and so they could say, they're not sanctioned now because they're not 304 00:16:05,718 --> 00:16:07,578 giving money to those bad guys now. 305 00:16:07,938 --> 00:16:09,138 so go ahead and pay 'em now. 306 00:16:09,138 --> 00:16:10,923 It's okay to pay 'em now, that may change. 307 00:16:11,733 --> 00:16:15,903 so yeah, it's, they track the ID based on known, known owners. 308 00:16:15,953 --> 00:16:19,023 known, wallet custodians, if you will. 309 00:16:19,273 --> 00:16:22,273 and then who they do business with, who they transact with. 310 00:16:23,188 --> 00:16:27,068 So I, I took a look around and I saw that, the UK and 311 00:16:27,068 --> 00:16:29,348 Australia have two very similar. 312 00:16:29,648 --> 00:16:34,118 Organizations, the UK has the Office of Financial Sanctions Implementation or. 313 00:16:35,558 --> 00:16:37,118 Oi, I think OFAC easier to say. 314 00:16:37,588 --> 00:16:42,508 and the Minister for Foreign Affairs in Australia said, we're responsible for 315 00:16:42,508 --> 00:16:46,858 designating sanctioned entities making payments that these groups can lead up to 316 00:16:46,858 --> 00:16:50,068 10 years in prison, which is different. 317 00:16:50,248 --> 00:16:53,448 they're saying, They're saying in the US that you can actually 318 00:16:53,448 --> 00:16:55,188 get jail time for violations. 319 00:16:55,518 --> 00:16:58,128 We don't have a lot of example of that, and I think this is one of 320 00:16:58,128 --> 00:17:00,708 those, this may happen to you, I think. 321 00:17:00,918 --> 00:17:02,988 I think the biggest lesson here is just. 322 00:17:03,653 --> 00:17:06,023 we're not drawing a line in the sand per se. 323 00:17:06,023 --> 00:17:09,633 We're not saying, hey, paying a ransom, is illegal. 324 00:17:09,813 --> 00:17:14,703 We're saying it may be illegal depending on what organization that we're talking 325 00:17:14,703 --> 00:17:19,053 about, where that is, what you know and what, like the point you were making. 326 00:17:19,083 --> 00:17:22,683 Depending on the day of the week, it sounds like whether or not this entity 327 00:17:22,683 --> 00:17:27,573 is, sanctioned, and if you do make payments to a sanctioned organization. 328 00:17:28,023 --> 00:17:31,113 That could get you into a lot of hot water, which may include 329 00:17:31,113 --> 00:17:34,623 fines, it may include jail time, depends on where you're at. 330 00:17:35,043 --> 00:17:40,103 but it's just something that I don't think a lot of people think about when 331 00:17:40,103 --> 00:17:42,023 they're considering paying a ransom. 332 00:17:42,653 --> 00:17:45,503 And I think this is what Mike had earlier talked about in this 333 00:17:45,503 --> 00:17:47,453 construction example, right? 334 00:17:47,453 --> 00:17:48,503 The construction company. 335 00:17:48,773 --> 00:17:54,563 You need an expert like Mike, who understands these nuances rather than if 336 00:17:54,563 --> 00:17:57,443 you try to do this on your own or oh yeah, I'll just go ahead and pay the ransom. 337 00:17:57,803 --> 00:18:00,533 You don't understand all the rep repercussions because. 338 00:18:01,163 --> 00:18:03,053 You never deal with this, right? 339 00:18:03,113 --> 00:18:07,043 It's not your standard day-to-day things versus someone who's trained 340 00:18:07,043 --> 00:18:10,553 in this space and understands it, knows what all to look out for. 341 00:18:11,573 --> 00:18:14,053 Speaking of that real quick, one of the other things that we, I 342 00:18:14,053 --> 00:18:17,023 think we may have talked on it, we bring it up in the book for sure. 343 00:18:17,473 --> 00:18:21,913 If you a ransom, if you pay once, you're gonna pay again. 344 00:18:22,103 --> 00:18:26,383 that, that guy's, they, they know this, in this case, a lot of bad guys, will 345 00:18:26,383 --> 00:18:31,603 just sell whatever it is that allowed them access to compromise your environment. 346 00:18:31,603 --> 00:18:32,833 They're gonna sell that to somebody else. 347 00:18:33,383 --> 00:18:37,773 in this case, they paid the ransom and they got clearance to pay the 348 00:18:37,773 --> 00:18:42,633 ransom, because of their size and the impact it would have on the economy. 349 00:18:43,353 --> 00:18:46,833 so they got an exception to pay the ransom the very next day. 350 00:18:46,833 --> 00:18:48,483 I kid you not the very next day. 351 00:18:49,323 --> 00:18:52,593 They contacted the comp, bad guys contacted the company and 352 00:18:52,593 --> 00:18:56,453 said, for another $800,000, we promise to leave you alone. 353 00:18:59,123 --> 00:19:04,603 And they made that, that, that offer because what the company didn't realize 354 00:19:04,633 --> 00:19:08,868 is the bad guys had three dormant back doors into their environment 355 00:19:09,643 --> 00:19:10,873 they could trigger at any time. 356 00:19:11,263 --> 00:19:14,833 We found those fortunately, and we had them all sealed off and 357 00:19:14,833 --> 00:19:17,083 we told the company, you don't need to pay the extra 800,000. 358 00:19:17,813 --> 00:19:19,703 so we, but bad guys will do that. 359 00:19:19,703 --> 00:19:27,173 And the percentage of attacks within six months of paying ransom is close to 70%. 360 00:19:28,313 --> 00:19:28,403 It's 361 00:19:28,413 --> 00:19:28,983 Yeah, because it. 362 00:19:29,298 --> 00:19:29,778 Wow. 363 00:19:29,883 --> 00:19:30,453 something like that. 364 00:19:30,528 --> 00:19:34,218 Because all you're doing by paying the ran and let's just put this on the thing. 365 00:19:34,308 --> 00:19:35,778 We are not a fan of paying the ransom. 366 00:19:35,998 --> 00:19:37,648 In case that's not obvious, right. 367 00:19:37,698 --> 00:19:39,858 the whole point of the book, right? 368 00:19:39,858 --> 00:19:44,058 The whole point of your job is to help people not pay the ransom. 369 00:19:44,248 --> 00:19:45,628 and just put that on the record. 370 00:19:45,628 --> 00:19:47,728 We are not a fan of paying the ransomware, having this whole 371 00:19:47,728 --> 00:19:48,603 episode where we're talking about. 372 00:19:48,953 --> 00:19:51,503 Potentially paying their ransom, but potential ramifications. 373 00:19:51,503 --> 00:19:53,153 But we think it's a bad idea. 374 00:19:53,243 --> 00:19:57,293 And this is one of those reasons, because the only thing you do, but, 375 00:19:57,293 --> 00:20:01,013 not the only thing, but one of the things that you do by paying a ransom 376 00:20:01,163 --> 00:20:03,713 is you say, Hey, I pay ransoms. 377 00:20:04,643 --> 00:20:04,793 And 378 00:20:04,843 --> 00:20:05,173 And it's 379 00:20:05,173 --> 00:20:08,683 no recourse of recovery, but to pay ransom and have bad guys help me 380 00:20:08,993 --> 00:20:10,223 yeah, exactly. 381 00:20:10,303 --> 00:20:14,653 and you, anybody who's ever watched any show, any movie. 382 00:20:15,048 --> 00:20:17,418 Whereas somebody's kidnapped, what do they tell you? 383 00:20:17,688 --> 00:20:19,308 Don't negotiate with the terrorists. 384 00:20:19,308 --> 00:20:20,328 Don't pay the ransom. 385 00:20:20,328 --> 00:20:21,168 don't do that. 386 00:20:21,438 --> 00:20:22,368 It's the same position. 387 00:20:22,368 --> 00:20:22,968 We're saying 388 00:20:23,193 --> 00:20:24,453 movie, they do pay the 389 00:20:24,708 --> 00:20:28,038 they do end up paying the ransom and then they put the, they take the bag and then 390 00:20:28,038 --> 00:20:31,128 they, we told you not to go out and put the stuff in and then, and then you got 391 00:20:31,128 --> 00:20:32,688 the dead girl at the end of the movie. 392 00:20:32,958 --> 00:20:34,308 That's what happens in the movie. 393 00:20:34,358 --> 00:20:37,858 so yeah, I, I lost a, I lost, I had a trail. 394 00:20:38,578 --> 00:20:38,873 I hit him. 395 00:20:40,483 --> 00:20:41,803 I had a trail of thought. 396 00:20:42,043 --> 00:20:43,183 I don't know where it went. 397 00:20:43,718 --> 00:20:46,813 Paying the ransom ahead of getting proof of life. 398 00:20:48,658 --> 00:20:50,818 Don't pay the ran because of secondary tax. 399 00:20:50,943 --> 00:20:51,153 Yeah. 400 00:20:51,153 --> 00:20:55,433 So by you, you've, you've used this phrase a few times in this episode. 401 00:20:55,463 --> 00:20:56,393 what do you mean by that? 402 00:20:56,393 --> 00:20:57,468 getting proof of life. 403 00:20:58,518 --> 00:21:00,998 So similar to, kinetic real world. 404 00:21:01,088 --> 00:21:05,688 That's my kinetic use again, if look at the current, The current kidnapping 405 00:21:05,688 --> 00:21:10,308 in California, bad guys keep asking for money, but they have yet to indicate 406 00:21:10,308 --> 00:21:11,968 at all that lady is still alive. 407 00:21:12,858 --> 00:21:16,698 very similarly, why would I pay a ransom to bad guys that encrypted 408 00:21:16,698 --> 00:21:18,708 my stuff if they can't prove. 409 00:21:19,413 --> 00:21:21,033 They can unencrypt my stuff. 410 00:21:21,673 --> 00:21:25,603 in that construction example I gave earlier, they paid the ransom. 411 00:21:26,153 --> 00:21:31,303 but only after sending the bad guys, a variety of different encrypted files to 412 00:21:31,303 --> 00:21:33,103 prove that they could unencrypt them. 413 00:21:33,983 --> 00:21:40,903 what they didn't choose is were files, on this core engineering, CAD system. 414 00:21:42,073 --> 00:21:44,953 They felt if I sent those to them to decrypt, then they 415 00:21:44,953 --> 00:21:48,643 would have my proprietary, blueprints for this military base. 416 00:21:48,998 --> 00:21:52,148 So they didn't send them those to prove that they could decrypt. 417 00:21:54,278 --> 00:21:58,218 Bad guys showed and were able to evidence that they could decrypt the files. 418 00:21:58,218 --> 00:22:01,798 They did send normal Word documents, They paid the ransom, they got the 419 00:22:01,798 --> 00:22:03,808 decryption key, and it did not work. 420 00:22:05,128 --> 00:22:06,298 On the important stuff, 421 00:22:06,508 --> 00:22:08,758 work on their core engineering documents. 422 00:22:09,373 --> 00:22:09,593 hey. 423 00:22:10,468 --> 00:22:13,018 But remember, bad guys were like, Hey, we're here to help. 424 00:22:13,018 --> 00:22:14,638 Call us if you have any problems. 425 00:22:14,638 --> 00:22:18,268 And they worked on that for almost a week with the bad guys to try and 426 00:22:18,568 --> 00:22:21,898 manipulate or give them different versions of this decryption key, 427 00:22:23,038 --> 00:22:26,838 decryption tool, to decrypt these files, and it just wouldn't happen. 428 00:22:27,588 --> 00:22:31,548 So they, they completely lost their entire repository of engineering diagrams. 429 00:22:32,193 --> 00:22:33,333 And they never had a backup. 430 00:22:33,873 --> 00:22:34,518 And they never had a backup. 431 00:22:35,193 --> 00:22:35,763 oh. 432 00:22:36,068 --> 00:22:40,903 Hey, I just, That's just sad, by the way, or, we've been talking about 433 00:22:40,903 --> 00:22:43,373 OFAC a lot, how do you do that? 434 00:22:43,423 --> 00:22:45,883 OFAC has a sanction search tool, right? 435 00:22:46,063 --> 00:22:49,653 Just Google OFAC sanction search or whatever entity you're dealing 436 00:22:49,653 --> 00:22:50,883 with in your country, right? 437 00:22:50,883 --> 00:22:55,563 Just Google that and they've got, here it is, sanction search dot ofac dores.gov. 438 00:22:55,893 --> 00:22:59,763 By the way, treasury is also who runs, the Secret Service, as I recall, right? 439 00:22:59,763 --> 00:23:00,693 So they do that. 440 00:23:00,753 --> 00:23:02,043 They do, counterfeit. 441 00:23:02,223 --> 00:23:02,883 Secret Service. 442 00:23:02,883 --> 00:23:03,093 Yep. 443 00:23:03,633 --> 00:23:03,993 Yeah. 444 00:23:04,058 --> 00:23:04,348 Yeah. 445 00:23:04,353 --> 00:23:09,053 real quick, from an incident response perspective, normal companies, people 446 00:23:09,053 --> 00:23:11,783 that, that have never had to deal with bad guys and aren't trained, 447 00:23:11,783 --> 00:23:13,853 should never interact with bad guys. 448 00:23:14,463 --> 00:23:15,573 if you get a ransom. 449 00:23:16,803 --> 00:23:20,913 on your screen, it says, contact us at this address and don't do it. 450 00:23:21,243 --> 00:23:24,593 If you get a phone call, an email demanding whatever, don't 451 00:23:24,593 --> 00:23:25,733 interact with them at all. 452 00:23:25,733 --> 00:23:27,563 Don't say, stop contacting me. 453 00:23:27,563 --> 00:23:29,083 Don't say, take a hike. 454 00:23:29,083 --> 00:23:30,193 We've got good backups. 455 00:23:30,203 --> 00:23:31,348 don't interact with them at all. 456 00:23:31,968 --> 00:23:33,383 And there's a lot of reasons for that. 457 00:23:33,383 --> 00:23:35,303 That's maybe another whole podcast. 458 00:23:35,303 --> 00:23:37,013 But, I'll add to that then. 459 00:23:37,018 --> 00:23:38,633 So first, don't ever interact with 'em. 460 00:23:38,633 --> 00:23:42,783 Second, call your insurance company and your legal counsel next, because 461 00:23:42,783 --> 00:23:46,383 in most cases, the legal, the legal company, your legal advisor's gonna 462 00:23:46,383 --> 00:23:49,703 tell you, one, don't these people. 463 00:23:49,883 --> 00:23:54,263 But second, everything you do after you contact your legal counsel is now 464 00:23:54,263 --> 00:23:56,273 potentially covered under privilege. 465 00:23:56,558 --> 00:23:56,908 Right. 466 00:23:56,963 --> 00:23:59,633 then call your insurance company with your legal counsel. 467 00:24:00,113 --> 00:24:01,463 Insurance company knows how to. 468 00:24:01,823 --> 00:24:02,753 Deal with this. 469 00:24:03,073 --> 00:24:06,703 they've dealt with ransomware probably 10 times a day at this point. 470 00:24:07,063 --> 00:24:08,923 you've got, they've got negotiators. 471 00:24:09,193 --> 00:24:11,323 they can help you with the OFAC process. 472 00:24:11,683 --> 00:24:16,723 And, one of the things that a lot of organizations don't realize because 473 00:24:16,723 --> 00:24:19,753 they haven't had to go through it, is Bitcoin's not easy to get. 474 00:24:20,473 --> 00:24:23,233 so if you don't have insurance and you're not involving them and you 475 00:24:23,233 --> 00:24:27,383 think, I'm just gonna pay $3 million in Bitcoin, good 'cause normal people 476 00:24:27,383 --> 00:24:30,983 can only get, I think, one and a half or two Bitcoin every couple of weeks. 477 00:24:31,343 --> 00:24:34,068 It's not Now, it's not a fun process. 478 00:24:34,518 --> 00:24:35,898 rely on your insurance company. 479 00:24:35,948 --> 00:24:38,968 they've got experts that do this all the time, and they can help you 480 00:24:38,968 --> 00:24:40,648 through the process and advise you. 481 00:24:41,098 --> 00:24:44,428 So at the end of the day, if you paid the ransom and the treasury knocks on your 482 00:24:44,428 --> 00:24:46,318 door and says, you, you paid bad guys. 483 00:24:46,318 --> 00:24:47,398 You're like, Hey, I went. 484 00:24:47,818 --> 00:24:51,528 I involved my legal counsel and my they both, said it was okay to do it. 485 00:24:51,528 --> 00:24:53,443 So let's add some more people to this conversation. 486 00:24:55,193 --> 00:24:58,093 So we will, I'll add to the list of action items. 487 00:24:58,093 --> 00:25:05,093 Is the only way that you're going to, not pay the ransom, what would that be? 488 00:25:05,103 --> 00:25:05,573 Prasanna. 489 00:25:06,548 --> 00:25:07,568 To have backups, 490 00:25:07,763 --> 00:25:08,303 Yeah. 491 00:25:09,598 --> 00:25:09,678 further. 492 00:25:09,743 --> 00:25:09,983 chicken 493 00:25:10,038 --> 00:25:12,078 it's specifically what kind of backups? 494 00:25:13,323 --> 00:25:14,493 recoverable backups, 495 00:25:14,578 --> 00:25:17,308 yeah, but just another word I'm looking for here. 496 00:25:17,668 --> 00:25:18,278 Immutable. 497 00:25:19,063 --> 00:25:19,693 There we go. 498 00:25:19,903 --> 00:25:20,473 There we go. 499 00:25:20,533 --> 00:25:21,643 Immutable backups. 500 00:25:21,793 --> 00:25:25,063 Mike has taken over my, badge as backup person. 501 00:25:27,643 --> 00:25:28,123 Yeah. 502 00:25:28,213 --> 00:25:28,423 So 503 00:25:28,423 --> 00:25:28,573 my 504 00:25:28,738 --> 00:25:29,968 that's the, 505 00:25:32,278 --> 00:25:33,118 but I don't do that. 506 00:25:33,118 --> 00:25:35,098 I gotta buy, I gotta buy four of 'em apparently. 507 00:25:35,668 --> 00:25:39,568 the, I really gotta get some more merch, but the we talk a lot about 508 00:25:39,568 --> 00:25:42,748 this and I'm not gonna spend a ton of time here, but the whole purpose 509 00:25:42,748 --> 00:25:46,078 of this podcast, the backup wrap up, is to help you have better backups. 510 00:25:46,348 --> 00:25:50,638 And one of the things that you have to have is truly immutable backups. 511 00:25:50,638 --> 00:25:51,898 Unfortunately, immutable is. 512 00:25:52,318 --> 00:25:57,788 Has become one of those words that is just thrown around like a marketing term, 513 00:25:57,878 --> 00:25:59,558 and it's very much not a marketing term. 514 00:25:59,708 --> 00:26:03,168 The backups are either it should be a binary condition, right? 515 00:26:03,168 --> 00:26:05,268 Like pregnant or dead, right? 516 00:26:05,268 --> 00:26:07,038 You're either pregnant or you're not pregnant. 517 00:26:07,038 --> 00:26:09,408 You're either dead or you're not dead, right? 518 00:26:09,638 --> 00:26:11,528 it, you're either immutable or you're not immutable. 519 00:26:11,528 --> 00:26:14,038 Unfortunately, it is a bit of a, of a pendulum. 520 00:26:14,128 --> 00:26:15,238 No, not, no, not the word. 521 00:26:15,268 --> 00:26:16,073 What's the word I was looking for there? 522 00:26:16,413 --> 00:26:16,533 Spectrum. 523 00:26:17,158 --> 00:26:17,818 Yeah, thank you. 524 00:26:18,028 --> 00:26:20,068 It's a spectrum, right? 525 00:26:20,428 --> 00:26:21,433 And, but the. 526 00:26:22,093 --> 00:26:25,693 The standard by which I judge whether or not it's immutable. 527 00:26:25,693 --> 00:26:29,473 If it's truly immutable, then even you cannot delete it. 528 00:26:30,343 --> 00:26:33,438 even if you wanted to, if that's how immutable your 529 00:26:33,438 --> 00:26:35,388 backups are, then I'm happy. 530 00:26:35,598 --> 00:26:38,598 If it's anything less than that, then I have questions. 531 00:26:38,728 --> 00:26:42,418 I'm not saying it's wrong, I'm just saying I have questions. 532 00:26:42,498 --> 00:26:45,018 And I know companies where it's it's immutable. 533 00:26:45,633 --> 00:26:50,523 Unless you call in and super authenticate yourself again, I have 534 00:26:50,523 --> 00:26:55,683 questions, the, there are, I can think of some types of immutable, 535 00:26:55,683 --> 00:26:57,243 it's immutable unless you have root. 536 00:26:57,303 --> 00:26:59,643 If you have root, then we can turn off the immutable flag and 537 00:26:59,643 --> 00:27:00,633 then we can delete the files. 538 00:27:00,633 --> 00:27:03,438 That's not, that's really not that immutable. 539 00:27:03,453 --> 00:27:06,213 That's barely security by obscurity. 540 00:27:06,763 --> 00:27:07,203 Because 541 00:27:07,623 --> 00:27:10,143 real, real quick, that construction example I gave 542 00:27:10,343 --> 00:27:10,633 yeah. 543 00:27:10,743 --> 00:27:12,318 did that the Wednesday before the attack. 544 00:27:12,953 --> 00:27:14,993 Wednesday before the attack, back backup. 545 00:27:14,993 --> 00:27:16,913 Bad men took his first vacation ever. 546 00:27:16,913 --> 00:27:17,333 By the way. 547 00:27:17,333 --> 00:27:21,473 He was like number one suspicious person on the list when this happened. 548 00:27:21,713 --> 00:27:22,133 But he took 549 00:27:22,173 --> 00:27:22,493 I bet. 550 00:27:22,493 --> 00:27:23,633 vacation ever. 551 00:27:24,003 --> 00:27:28,223 and the first thing that bad guys did at just after midnight, Thursday, 552 00:27:28,583 --> 00:27:31,583 Wednesday night, in the Thursday morning is they forensically scrubbed 553 00:27:31,583 --> 00:27:35,893 all of their backups because they had his root, root credentials. 554 00:27:37,468 --> 00:27:41,178 And then starting at, four or five o'clock in the morning is when they started, 555 00:27:41,178 --> 00:27:44,858 they used the domain controller to script the, the release of ransomware across 556 00:27:44,858 --> 00:27:46,298 the entire environment at the same time. 557 00:27:48,113 --> 00:27:48,983 It just hurts. 558 00:27:49,953 --> 00:27:53,228 you gave me another flashback, Mike, and that is going all the way back. 559 00:27:54,103 --> 00:27:55,333 31 years. 560 00:27:55,513 --> 00:27:59,598 when, my daughter was born and I took a day off, I had one of those jobs that, 561 00:27:59,628 --> 00:28:04,118 I was the backup guy at this MBNA at this, big giant credit card company. 562 00:28:04,838 --> 00:28:07,988 And I took my first day off 'cause I never took days off. 563 00:28:07,988 --> 00:28:12,978 And I took a day off because my daughter was born and I was in, the hospital. 564 00:28:13,168 --> 00:28:14,548 my wife's hospital room. 565 00:28:15,073 --> 00:28:17,913 My daughter was born, and she was actually in the nicu. 566 00:28:17,943 --> 00:28:18,873 she was actually healthy. 567 00:28:18,873 --> 00:28:19,983 But it's a long story. 568 00:28:19,983 --> 00:28:22,413 I'm standing in the hospital room with my wife. 569 00:28:22,803 --> 00:28:25,113 With our baby and the phone. 570 00:28:25,263 --> 00:28:27,433 And now again, for the children in the room. 571 00:28:27,733 --> 00:28:29,383 We didn't have cell phones back then. 572 00:28:29,623 --> 00:28:30,073 Okay. 573 00:28:30,343 --> 00:28:34,983 And the phone, the table phone, it's a phone. 574 00:28:35,013 --> 00:28:37,893 It's like a cell phone, but it's tied to the wall. 575 00:28:38,073 --> 00:28:41,313 And it was on the table next to my wife's hospital bed. 576 00:28:41,793 --> 00:28:43,833 And that phone rang. 577 00:28:45,063 --> 00:28:46,473 And it's yeah, it's for you. 578 00:28:46,473 --> 00:28:51,063 And they hand me the phone and they're like, yeah, we have this, this big 579 00:28:51,063 --> 00:28:53,033 restore that we need your help with. 580 00:28:53,273 --> 00:28:54,773 And I'm just like. 581 00:28:55,808 --> 00:28:57,613 And I remember saying it is. 582 00:28:57,613 --> 00:28:59,323 Is it this process documented? 583 00:28:59,323 --> 00:29:01,603 Because even back then, I believed in documentation. 584 00:29:01,783 --> 00:29:03,883 Is this pro, is this process documented? 585 00:29:03,883 --> 00:29:04,633 They said, yes. 586 00:29:04,883 --> 00:29:06,593 did you follow the documentation? 587 00:29:06,593 --> 00:29:09,023 Did you, are there any questions about the documentation? 588 00:29:09,263 --> 00:29:11,533 They go, oh, we haven't actually tried to follow the 589 00:29:11,533 --> 00:29:12,823 documentation we just called you. 590 00:29:12,823 --> 00:29:13,693 'cause it was a bigger store. 591 00:29:13,693 --> 00:29:14,383 And I just hung up. 592 00:29:14,653 --> 00:29:17,863 I was like, yeah, I'm here because like you. 593 00:29:18,213 --> 00:29:21,358 Mike, I believe earlier, I don't know if that was, the other episode 594 00:29:21,358 --> 00:29:23,698 or this episode where you talked about when your daughter calls, 595 00:29:24,068 --> 00:29:25,208 you're gonna answer the phone. 596 00:29:25,508 --> 00:29:25,868 Yeah. 597 00:29:25,898 --> 00:29:29,408 My, the daughter at that point, my wife obviously her health, we have 598 00:29:29,408 --> 00:29:34,148 this new tiny little baby and then they're gonna call me and ask me 599 00:29:34,148 --> 00:29:36,188 about restored some empty squat file. 600 00:29:36,578 --> 00:29:37,538 so what's the lesson we. 601 00:29:37,818 --> 00:29:41,388 Curtis, newborn daughter or a restore in doing your 602 00:29:41,388 --> 00:29:43,518 Yeah, it's a question. 603 00:29:44,118 --> 00:29:47,623 It's a good question, but I think that, the whole point here we've been talking 604 00:29:47,623 --> 00:29:51,913 about, we talked about ofac, similar organizations in your country, in your, 605 00:29:51,943 --> 00:29:53,563 whatever your country happens to be. 606 00:29:53,903 --> 00:29:55,853 is that paying a ransom? 607 00:29:55,913 --> 00:29:58,643 First off is never a good idea for a long list of reasons. 608 00:29:58,883 --> 00:30:04,373 And second, it potentially may be, e either a crime or sanctionable. 609 00:30:04,613 --> 00:30:07,823 It might not be a crime, but it might be something that could subject your 610 00:30:07,823 --> 00:30:13,583 company fines and you could potentially be, liable for jail time depending on your 611 00:30:13,583 --> 00:30:15,683 country and how they enforce such things. 612 00:30:16,123 --> 00:30:17,863 and what we would much rather. 613 00:30:18,238 --> 00:30:23,098 Have you do is just have, when I say just have immutable backups, 614 00:30:23,338 --> 00:30:27,118 an incident response plan, disaster recovery plan so that you're able 615 00:30:27,118 --> 00:30:29,588 to respond, and not pay the ransom. 616 00:30:29,618 --> 00:30:30,788 What's that Prasanna Sure. 617 00:30:30,818 --> 00:30:31,598 Can I add one thing? 618 00:30:32,288 --> 00:30:32,828 Add 619 00:30:32,973 --> 00:30:33,693 insurance too. 620 00:30:34,358 --> 00:30:35,588 and have cyber insurance. 621 00:30:35,648 --> 00:30:36,338 Absolutely. 622 00:30:36,978 --> 00:30:38,208 you have any final thoughts, Mike? 623 00:30:39,913 --> 00:30:40,723 I have a joke. 624 00:30:41,418 --> 00:30:41,748 Okay. 625 00:30:43,563 --> 00:30:45,663 son goes to mom and says, mom, I'm sick. 626 00:30:45,903 --> 00:30:46,803 I just, I'm sick. 627 00:30:46,803 --> 00:30:48,593 And mom says, it's really not that bad. 628 00:30:48,593 --> 00:30:49,553 You got two options. 629 00:30:49,553 --> 00:30:51,413 You're either gonna get better or you're gonna get worse. 630 00:30:52,283 --> 00:30:54,143 And if you get worse, you got two options. 631 00:30:54,503 --> 00:30:55,823 You're gonna get better or you're gonna die. 632 00:30:57,143 --> 00:30:58,673 And if you die, you got two options. 633 00:30:58,673 --> 00:31:00,083 You're gonna go to heaven, you're gonna get hell. 634 00:31:00,953 --> 00:31:02,633 if you go to hell, you got two options. 635 00:31:03,503 --> 00:31:04,643 Original or extra crispy. 636 00:31:05,643 --> 00:31:06,453 That's quite the joke. 637 00:31:06,453 --> 00:31:07,413 That's quite the joke, Mike. 638 00:31:08,463 --> 00:31:10,773 so ba Basically she was saying other things are gonna get 639 00:31:10,773 --> 00:31:11,793 better, they're gonna get worse. 640 00:31:11,793 --> 00:31:12,783 If they get better, great. 641 00:31:12,783 --> 00:31:13,143 If they get 642 00:31:13,323 --> 00:31:13,683 Yeah. 643 00:31:13,803 --> 00:31:14,373 options. 644 00:31:17,043 --> 00:31:19,593 so those are your final thoughts regarding paying the ransom. 645 00:31:19,908 --> 00:31:20,148 Yeah, 646 00:31:20,253 --> 00:31:20,583 Okay. 647 00:31:20,598 --> 00:31:20,838 don't 648 00:31:21,003 --> 00:31:21,363 All right. 649 00:31:21,828 --> 00:31:22,218 Yeah. 650 00:31:22,653 --> 00:31:23,043 advisor. 651 00:31:23,043 --> 00:31:26,253 Find a friend that knows something, or multiple friends that knows 652 00:31:26,253 --> 00:31:27,453 something about something. 653 00:31:28,128 --> 00:31:28,488 Yeah. 654 00:31:28,573 --> 00:31:29,563 spread the grief. 655 00:31:29,933 --> 00:31:32,548 and don't do it by yourself and don't think you need to. 656 00:31:32,548 --> 00:31:34,568 I know a lot of, people that build their. 657 00:31:35,183 --> 00:31:37,163 Their IT environment are very proud of it. 658 00:31:37,213 --> 00:31:39,913 and they wanna, they feel like they've, they're responsible and they have 659 00:31:39,913 --> 00:31:41,713 to put this fire out by themselves. 660 00:31:42,013 --> 00:31:44,993 I don't know any firefighter that's gonna go at it by themselves unless 661 00:31:44,993 --> 00:31:47,423 they're a pyro, but, don't be a pyro. 662 00:31:47,733 --> 00:31:50,343 and man, there, that just reminded me of, I think it was an insurance 663 00:31:50,433 --> 00:31:53,563 company at some point in the past where it said, Bob did this. 664 00:31:53,563 --> 00:31:54,373 Bob did that. 665 00:31:54,373 --> 00:31:55,633 Bob ended up in the ditch. 666 00:31:57,043 --> 00:31:57,943 Don't beat Bob. 667 00:31:58,213 --> 00:31:59,413 Don't be Bob in the ditch. 668 00:31:59,783 --> 00:32:00,233 yeah. 669 00:32:00,663 --> 00:32:00,873 yeah. 670 00:32:00,923 --> 00:32:01,343 go ahead. 671 00:32:01,523 --> 00:32:01,793 Go ahead. 672 00:32:02,573 --> 00:32:02,933 Yeah. 673 00:32:03,203 --> 00:32:05,303 I know it's late in the day for us here, but 674 00:32:05,418 --> 00:32:05,538 I. 675 00:32:06,413 --> 00:32:10,693 tomorrow when you have a minute, Google, local people you can talk to 676 00:32:10,783 --> 00:32:12,433 and a lot of those organizations will. 677 00:32:13,118 --> 00:32:13,868 like a law firm. 678 00:32:13,868 --> 00:32:15,988 They'll, they'll do a free consultation. 679 00:32:16,408 --> 00:32:16,888 In fact, there 680 00:32:16,978 --> 00:32:17,328 Right. 681 00:32:17,368 --> 00:32:20,038 law firms, there's one here in, it's, I think they're a national firm, 682 00:32:20,038 --> 00:32:22,468 but they're headquartered in Dallas, I think it's called Spencer Fa. 683 00:32:23,318 --> 00:32:26,318 they have a cybersecurity, group. 684 00:32:26,318 --> 00:32:28,568 That's all they do is incident response breach stuff. 685 00:32:28,568 --> 00:32:30,458 And they do $0 retainers. 686 00:32:30,458 --> 00:32:34,808 So they get all the deconfliction and paperwork outta the way, and you've got 687 00:32:34,808 --> 00:32:37,328 your attorney when something bad happens. 688 00:32:38,128 --> 00:32:40,403 You've got a piece of paper that says they're gonna answer the 689 00:32:40,403 --> 00:32:42,793 phone when you call 'em because you got something going on. 690 00:32:43,243 --> 00:32:45,748 I think when came on the podcast, many. 691 00:32:47,593 --> 00:32:52,513 You mentioned also like sometimes the FBI does in their area, don't they do 692 00:32:52,513 --> 00:32:57,283 some trainings or get togethers and other things like that around some of this? 693 00:32:57,688 --> 00:33:02,118 there are, the FBI and the Secret Service both have this, networking. 694 00:33:02,598 --> 00:33:03,138 Club. 695 00:33:03,718 --> 00:33:07,193 I know I'm minimizing it and I don't mean to be disrespectful in doing so, 696 00:33:07,193 --> 00:33:11,973 but like the FBI has a program called the InfraGard, and there are, there 697 00:33:11,973 --> 00:33:14,103 is an InfraGard chapter everywhere. 698 00:33:14,103 --> 00:33:16,203 There is a FBI field office. 699 00:33:16,893 --> 00:33:21,153 so go to the FBI's, go to the it's infragard.org. 700 00:33:21,603 --> 00:33:23,223 You can sign up to be a member. 701 00:33:23,273 --> 00:33:27,313 and in doing so, you get to rub elbows with FBI agents and make friends. 702 00:33:27,643 --> 00:33:28,843 You don't have to do that. 703 00:33:28,843 --> 00:33:32,643 Just call your local FBI office and say, Hey, I work for a small business, 704 00:33:32,643 --> 00:33:34,473 I'd like to get to know you guys. 705 00:33:34,473 --> 00:33:38,053 And very often they'll buy you coffee and, exchange phone numbers and. 706 00:33:38,478 --> 00:33:40,778 Now you've got a Contact Secret Service. 707 00:33:40,778 --> 00:33:45,228 Very similarly they've got, electronic crimes Task force, kind of group that 708 00:33:45,228 --> 00:33:47,868 you can join in tech in north Texas. 709 00:33:47,868 --> 00:33:51,108 It's called the North Texas Cyber Fraud Task Force. 710 00:33:52,248 --> 00:33:56,748 and so those are events where you get to, in infra regard too, they have trainings 711 00:33:57,138 --> 00:34:02,488 and so a vendor or some, some member will speak on some topic and then the agency 712 00:34:02,488 --> 00:34:04,678 will give an update on cyber crime or. 713 00:34:05,543 --> 00:34:07,013 Terrorism or whatever it is. 714 00:34:07,453 --> 00:34:10,603 so for those two agencies, those types of groups to belong to. 715 00:34:10,943 --> 00:34:13,213 and there's others too, depending on what your needs are. 716 00:34:13,213 --> 00:34:16,253 DEA has one, department of Justice has one. 717 00:34:16,253 --> 00:34:20,583 A lot of local district attorneys have, like Citizen Academy type, 718 00:34:21,123 --> 00:34:22,713 things you can participate in. 719 00:34:24,108 --> 00:34:26,358 But the point, and you don't have to do all those. 720 00:34:26,358 --> 00:34:29,778 The point is reach out to all those different groups and make friends, 721 00:34:29,778 --> 00:34:33,108 get a phone number, so that when you have a bad day or you're having 722 00:34:33,108 --> 00:34:34,668 a bad day, you know who to call. 723 00:34:35,583 --> 00:34:37,263 Do they start all those meetings with? 724 00:34:37,263 --> 00:34:38,643 We're the government and we're here to help. 725 00:34:39,588 --> 00:34:40,068 No. 726 00:34:40,128 --> 00:34:43,258 very often they start the meeting with, we are the government, but 727 00:34:43,258 --> 00:34:45,418 I am here to talk with you and, 728 00:34:45,638 --> 00:34:45,928 Okay. 729 00:34:46,108 --> 00:34:48,688 I say is my own opinion and not, whatever. 730 00:34:48,733 --> 00:34:49,603 Oh, okay. 731 00:34:50,083 --> 00:34:50,473 Yeah. 732 00:34:51,493 --> 00:34:51,823 All right. 733 00:34:51,823 --> 00:34:52,663 good questions today. 734 00:34:52,673 --> 00:34:53,203 Prasanna. 735 00:34:54,723 --> 00:34:55,803 I try Curtis. 736 00:34:55,803 --> 00:34:57,158 See, I'm stepping up my game. 737 00:34:58,008 --> 00:34:59,233 Hey, we, oh. 738 00:34:59,233 --> 00:35:00,253 This is just a game to you. 739 00:35:00,433 --> 00:35:01,513 Anyway, thank. 740 00:35:04,003 --> 00:35:04,843 All right, thanks. 741 00:35:04,843 --> 00:35:06,163 Thanks for being on today, Mike. 742 00:35:06,163 --> 00:35:06,883 Thanks, Prasanna. 743 00:35:08,503 --> 00:35:08,833 This was 744 00:35:09,253 --> 00:35:09,913 Thanks everybody. 745 00:35:10,633 --> 00:35:12,553 All right, and that is a wrap.