1 00:00:01,380 --> 00:00:05,220 You found the backup wrap up your go-to podcast for all things 2 00:00:05,220 --> 00:00:07,560 backup recovery and cyber recovery. 3 00:00:08,100 --> 00:00:12,030 In this episode, we look at something that most people completely miss 4 00:00:12,030 --> 00:00:16,184 when they think about ransomware, and that's the cost of a ransomware attack. 5 00:00:16,965 --> 00:00:20,085 Is way beyond the cost of the ransom itself. 6 00:00:20,835 --> 00:00:24,015 Join me and my co-host persona as we talk to Dr. 7 00:00:24,015 --> 00:00:27,825 Mike Saylor, who's the co-author on my latest book Learning 8 00:00:27,825 --> 00:00:29,625 Ransomware Response and Recovery. 9 00:00:30,225 --> 00:00:35,985 We walked through real cases like the UVM Health Network attack that ran up a $63 10 00:00:35,985 --> 00:00:43,305 million tab without paying the ransom lost revenue, regulatory fines, staff burnout, 11 00:00:43,305 --> 00:00:45,975 reputational damage, supply chain chaos. 12 00:00:46,350 --> 00:00:51,390 And cyber insurance fine print that I think might surprise you if you think the 13 00:00:51,390 --> 00:00:53,640 ransom is the biggest part of the bill. 14 00:00:53,760 --> 00:00:54,690 Stick around. 15 00:00:55,200 --> 00:00:56,879 I think you ear in for shock. 16 00:00:57,629 --> 00:00:58,860 Just a quick note about me. 17 00:00:58,860 --> 00:01:03,960 I'm w Curtis Preston, AKA Mr. Backup, and I've been obsessing over backup 18 00:01:03,960 --> 00:01:05,850 recovery and now cyber recovery. 19 00:01:06,255 --> 00:01:08,235 For over 30 years. 20 00:01:08,655 --> 00:01:10,604 If that's your bag, then I'm your guy. 21 00:01:10,965 --> 00:01:13,755 You're not gonna find anybody that cares about it more than me. 22 00:01:14,414 --> 00:01:18,494 Ever since 1993 when I had to tell my boss that there were no backups 23 00:01:18,494 --> 00:01:20,384 of that database that we just lost. 24 00:01:21,164 --> 00:01:23,925 Now I've written five books, a blog and a podcast. 25 00:01:23,955 --> 00:01:28,274 Here we turn unappreciated admins into Cyber Recovery Heroes. 26 00:01:28,544 --> 00:01:30,675 This is the backup wrap up. 27 00:01:44,000 --> 00:01:45,830 Hi, and welcome to the backup wrap up. 28 00:01:45,830 --> 00:01:50,240 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have with me a guy 29 00:01:50,240 --> 00:01:52,310 who just confessed his love for me. 30 00:01:52,510 --> 00:01:53,850 Prasanna, Molly. 31 00:01:53,850 --> 00:01:54,560 Andy, how's it going? 32 00:01:54,560 --> 00:01:54,970 Prasanna. 33 00:01:56,215 --> 00:01:58,190 Why do you sound so shocked? 34 00:01:59,600 --> 00:02:00,620 That's what I wanna know. 35 00:02:03,230 --> 00:02:05,855 The, the mutual, it's a mutual admiration society. 36 00:02:06,575 --> 00:02:07,565 You doing all right over there 37 00:02:07,865 --> 00:02:11,555 with your branded shirt, which I still can't find. 38 00:02:11,747 --> 00:02:13,487 I, swear I've looked everywhere. 39 00:02:14,522 --> 00:02:16,052 if you're doing swag 40 00:02:16,142 --> 00:02:19,862 or doing things, you need to buy four for yourself. 41 00:02:20,432 --> 00:02:21,692 Well, clearly more than one. 42 00:02:22,862 --> 00:02:23,192 Yes. 43 00:02:23,252 --> 00:02:24,752 looked all over this house. 44 00:02:24,962 --> 00:02:25,172 I've 45 00:02:25,277 --> 00:02:25,777 And honest. 46 00:02:26,852 --> 00:02:27,542 to clean. 47 00:02:28,097 --> 00:02:28,397 Yeah. 48 00:02:28,397 --> 00:02:30,347 And two is not enough for you Curtis, I 49 00:02:30,347 --> 00:02:30,842 have to say. 50 00:02:31,792 --> 00:02:32,082 Yeah. 51 00:02:32,252 --> 00:02:32,612 Yeah. 52 00:02:33,452 --> 00:02:34,772 Well, you know, what are we gonna do? 53 00:02:35,252 --> 00:02:39,122 Uh, and then also with us, we have somebody who I swear I'm, 54 00:02:39,122 --> 00:02:43,082 I'm sure would not lose a branded piece of swag if I send it to him. 55 00:02:43,622 --> 00:02:45,782 Doctor Mike Sailor, how's it going, Mike? 56 00:02:46,322 --> 00:02:50,437 It is going great guys, and just to be, uh, upfront, I will probably ask for four. 57 00:02:53,222 --> 00:02:56,822 So you, you got CRS as well, can't remember stuff. 58 00:02:57,002 --> 00:02:57,512 Um, 59 00:02:57,662 --> 00:03:00,812 I would, I would probably wear one each day and, 60 00:03:00,812 --> 00:03:02,642 uh, you know, uh, it, 61 00:03:02,642 --> 00:03:03,422 it's, uh, 62 00:03:03,812 --> 00:03:05,672 the Einstein, the Einstein, uh, approach. 63 00:03:05,672 --> 00:03:05,762 Right. 64 00:03:06,302 --> 00:03:06,632 yep. 65 00:03:07,022 --> 00:03:08,312 It simplify my wardrobe. 66 00:03:08,402 --> 00:03:08,642 That's right. 67 00:03:09,137 --> 00:03:09,487 Right. 68 00:03:09,577 --> 00:03:09,927 Right. 69 00:03:10,037 --> 00:03:13,517 but if you are wearing the same thing every day, do you technically need 70 00:03:13,517 --> 00:03:16,607 for, can you just wear one and wear it four days and no one will ever notice? 71 00:03:16,847 --> 00:03:16,997 As 72 00:03:16,997 --> 00:03:17,927 long as it doesn't smell. 73 00:03:18,032 --> 00:03:19,472 well, and there there's more to it. 74 00:03:19,472 --> 00:03:22,952 In my, in my thinking, I, it's, it's, it's about efficiency and economy. 75 00:03:22,952 --> 00:03:26,072 And so if I, if I only had one, then I would have to wash it the next day. 76 00:03:26,072 --> 00:03:28,292 Well, I'm not just gonna wash one shirt, so 77 00:03:28,982 --> 00:03:32,012 after four days, I've probably got a decent amount of laundry to do, 78 00:03:33,227 --> 00:03:33,587 Hmm. 79 00:03:33,782 --> 00:03:34,052 days, 80 00:03:34,052 --> 00:03:34,832 smart man. 81 00:03:35,627 --> 00:03:36,377 Smart man. 82 00:03:36,647 --> 00:03:36,947 Yeah. 83 00:03:38,492 --> 00:03:39,002 All right. 84 00:03:39,032 --> 00:03:42,782 Well, we are not gonna be talking about wardrobes anymore 85 00:03:42,917 --> 00:03:43,137 Can 86 00:03:43,137 --> 00:03:44,372 we talk about laundry? 87 00:03:45,722 --> 00:03:51,752 Uh, we're gonna talk about the hidden cost of a breach and, uh, I, you know, 88 00:03:51,752 --> 00:03:53,132 I was looking around for some stories. 89 00:03:53,972 --> 00:03:59,762 terms of, you know, ones that talk about that show how much more cost of 90 00:03:59,762 --> 00:04:04,022 a breach, how much more of it has to do with things that aren't the ransom. 91 00:04:04,262 --> 00:04:06,602 We, we, when we talk about ransomware, we talk about how 92 00:04:06,602 --> 00:04:07,982 expensive that ransom can be. 93 00:04:08,252 --> 00:04:14,342 But this episode we want you to think about what else might, uh, 94 00:04:14,342 --> 00:04:15,932 a ransomware attack cost you. 95 00:04:16,877 --> 00:04:22,937 And I'm gonna start with this attack from the UVM Health Network in October of 2020. 96 00:04:23,297 --> 00:04:29,987 It crippled their IT systems for nearly a month, costing over $63 million. 97 00:04:30,377 --> 00:04:32,742 Started from, uh, initially via a phishing email. 98 00:04:33,542 --> 00:04:37,562 And, uh, they had to use, if you can get this, I, by the way, I, I'm a fan. 99 00:04:37,592 --> 00:04:39,602 Um, what, shoot, I did it again. 100 00:04:39,782 --> 00:04:40,082 Alright. 101 00:04:40,292 --> 00:04:45,542 The, so it forced the staff to use paper records. 102 00:04:45,902 --> 00:04:51,002 Uh, obviously delayed patient care, uh, shutting down over 1300 servers. 103 00:04:51,332 --> 00:04:53,822 I'm a fan of this TV show called The Pit. 104 00:04:54,242 --> 00:05:00,272 And In the Pit they are currently experiencing this exact, uh, outage 105 00:05:00,512 --> 00:05:02,492 and they are, uh, switching to. 106 00:05:02,927 --> 00:05:07,547 Paper records and, uh, you know, it, it, if you're not a fan of the 107 00:05:07,547 --> 00:05:10,187 show, it's a huge, huge, uh, uh, hit. 108 00:05:10,487 --> 00:05:15,677 And, um, if, if you're arf fan, make sure that you watch it and you look at this 109 00:05:15,737 --> 00:05:21,437 because it really gives you an idea of the impact to the rest of the business. 110 00:05:21,617 --> 00:05:23,087 You're, we're so. 111 00:05:23,412 --> 00:05:27,672 Tied to, uh, technology that we don't know. 112 00:05:27,672 --> 00:05:30,222 And imagine when you think about the degree to which technology 113 00:05:30,222 --> 00:05:33,072 has impacted healthcare, right? 114 00:05:33,072 --> 00:05:37,632 So they talked about how it impacted radiology, uh, laboratory services, 115 00:05:37,632 --> 00:05:43,302 and they used something called the MyChart portal, with, uh, imagine if 116 00:05:43,412 --> 00:05:46,262 My, my, my, my healthcare provider uses that. 117 00:05:46,727 --> 00:05:47,627 Do they MyChart? 118 00:05:48,077 --> 00:05:51,287 Um, imagine if that's how everybody finds out about their 119 00:05:51,287 --> 00:05:54,587 healthcare then suddenly it's gone. 120 00:05:54,977 --> 00:05:55,427 Right? 121 00:05:55,577 --> 00:06:01,217 Um, and, um, um, so they're 122 00:06:01,247 --> 00:06:01,577 Wait, 123 00:06:02,327 --> 00:06:04,547 computers and 1300 servers were encrypted. 124 00:06:04,647 --> 00:06:07,557 Uh, you have any other, uh, details on this story, Mike? 125 00:06:09,297 --> 00:06:10,407 Uh, just a few. 126 00:06:10,407 --> 00:06:13,167 I mean, I think it was, uh, it's interesting how it actually happened. 127 00:06:13,172 --> 00:06:16,977 Uh, the, uh, an employee took their work laptop with 'em on vacation, 128 00:06:16,977 --> 00:06:21,867 opened a phishing email, laptop, got compromised, brought it back into the 129 00:06:21,867 --> 00:06:26,787 environment, and then, uh, the, the malware spread once, uh, it reconnected 130 00:06:26,787 --> 00:06:28,257 to the, the company's network. 131 00:06:28,497 --> 00:06:29,427 So that was interesting. 132 00:06:29,877 --> 00:06:32,697 Um, and then the, the other part about that is it's not very 133 00:06:32,697 --> 00:06:34,287 often that we catch the bad guys. 134 00:06:34,827 --> 00:06:42,357 Um, not that it, it, it offered any, um, any latitude here other than, you know, 135 00:06:43,107 --> 00:06:47,217 you've got, uh, from a, from a victim perspective, you've got some damages you 136 00:06:47,217 --> 00:06:48,777 could probably collect from this guy. 137 00:06:49,197 --> 00:06:50,517 Pounding rocks in jail. 138 00:06:50,877 --> 00:06:52,347 Uh, but they did catch him. 139 00:06:52,587 --> 00:06:55,047 Uh, it was a Ukrainian, uh, hacker. 140 00:06:55,467 --> 00:06:55,947 Um. 141 00:06:57,642 --> 00:07:00,822 But, you know, we'll, we'll jump into some of the, the other things to think 142 00:07:00,822 --> 00:07:02,652 about from a damages perspective. 143 00:07:02,652 --> 00:07:05,952 It's not just financial, uh, you know, directly related to 144 00:07:05,952 --> 00:07:09,222 ransom or directly even related to, uh, your recovery efforts. 145 00:07:09,222 --> 00:07:10,557 There's a lot of other things to think about. 146 00:07:12,132 --> 00:07:12,672 Yeah. 147 00:07:12,762 --> 00:07:13,332 Um. 148 00:07:13,407 --> 00:07:17,547 Uh, Prasanna, you think about like, what would be, like, what would be 149 00:07:17,547 --> 00:07:21,477 like the first thing that you would think to, obviously the ransom, right? 150 00:07:21,627 --> 00:07:24,747 What would you think would be like the first thing that we would talk about when 151 00:07:25,632 --> 00:07:25,962 Well, 152 00:07:26,067 --> 00:07:27,207 we lost revenue or, uh, 153 00:07:27,672 --> 00:07:28,032 yeah. 154 00:07:28,662 --> 00:07:30,052 Well, well, even with the, the, 155 00:07:30,207 --> 00:07:31,077 the question, but, 156 00:07:32,532 --> 00:07:35,142 no, I'm not, I'm, I'm not even thinking about that stuff. 157 00:07:35,142 --> 00:07:35,382 Right. 158 00:07:35,382 --> 00:07:37,572 What I, what went to my mind, right. 159 00:07:37,777 --> 00:07:38,837 You pay a ransom. 160 00:07:39,127 --> 00:07:39,477 Great. 161 00:07:40,587 --> 00:07:43,752 There's a cost of sort of like recovering your environment. 162 00:07:44,007 --> 00:07:44,847 Mm-hmm. 163 00:07:44,848 --> 00:07:44,858 Mm-hmm. 164 00:07:45,537 --> 00:07:50,367 Be it people going around re-imaging systems, trying to recover data, 165 00:07:50,367 --> 00:07:52,767 getting things back up and running in. 166 00:07:52,767 --> 00:07:55,677 Probably, it's all the stuff that Mike, we've talked about 167 00:07:55,677 --> 00:07:56,757 on the podcast before, right? 168 00:07:56,757 --> 00:07:59,547 It's like that process of just recovering your environment, 169 00:07:59,852 --> 00:08:00,202 Right. 170 00:08:00,597 --> 00:08:00,897 right? 171 00:08:00,927 --> 00:08:04,437 Which might take weeks or months, and there is a cost associated 172 00:08:04,437 --> 00:08:06,782 with that beyond just sort of the, Hey, I paid the ransom. 173 00:08:07,497 --> 00:08:08,607 Let's talk about that. 174 00:08:08,637 --> 00:08:10,557 Like what type of costs are we talking about? 175 00:08:10,587 --> 00:08:16,017 Like, um, are we talking about like, we talking about overtime? 176 00:08:16,167 --> 00:08:16,827 Um, 177 00:08:16,947 --> 00:08:18,027 Well, it's like people, 178 00:08:18,297 --> 00:08:18,747 well yeah. 179 00:08:18,747 --> 00:08:19,797 People, right? 180 00:08:20,457 --> 00:08:20,757 yeah. 181 00:08:21,987 --> 00:08:25,017 Mike, I, I, uh, I was just thinking about whether or not 182 00:08:25,017 --> 00:08:26,667 overtime would, would happen. 183 00:08:27,057 --> 00:08:29,217 That's probably not, not a lot of it. 184 00:08:29,217 --> 00:08:31,527 People, they're, they're, they're generally staffed, right? 185 00:08:31,527 --> 00:08:34,737 They're generally sorry, exempt IT people. 186 00:08:35,797 --> 00:08:37,837 Um, it, it depends on their role. 187 00:08:38,047 --> 00:08:38,287 Uh, 188 00:08:38,287 --> 00:08:41,677 so to, in order to be exempt, you have to be in a leadership, 189 00:08:41,737 --> 00:08:43,087 you know, independent role. 190 00:08:43,087 --> 00:08:43,177 A 191 00:08:43,177 --> 00:08:46,267 lot of lower level IT and cyber people are not. 192 00:08:46,267 --> 00:08:46,567 So they 193 00:08:46,567 --> 00:08:48,907 would be eligible for, for overtime. 194 00:08:49,692 --> 00:08:51,612 So that'd be, that'd be a big cost. 195 00:08:51,612 --> 00:08:51,912 Right? 196 00:08:51,912 --> 00:08:52,482 So, 197 00:08:52,767 --> 00:08:56,697 or hiring people like Mike to come in to help them. 198 00:08:56,827 --> 00:08:59,202 Well, yeah, that's, that was definitely the next, right? 199 00:08:59,202 --> 00:08:59,517 So, so. 200 00:09:00,297 --> 00:09:04,707 So hopefully you are going, you know, one of the things that we make in, uh, 201 00:09:04,737 --> 00:09:09,417 one of the points that I know we make in this lovely book here, uh, learning 202 00:09:09,447 --> 00:09:11,067 Ransomware Response and Recovery. 203 00:09:11,217 --> 00:09:11,397 Yeah. 204 00:09:11,397 --> 00:09:15,457 For people who don't know, we have video you can watch us describe things. 205 00:09:15,457 --> 00:09:18,397 You can see Curtis Point at the book right behind him. 206 00:09:18,397 --> 00:09:21,367 If you go to YouTube and search for this channel, we are there. 207 00:09:21,892 --> 00:09:24,052 By the way, none of us have the actual book Do. 208 00:09:24,052 --> 00:09:25,822 Have you ever received your books yet, Mike? 209 00:09:26,372 --> 00:09:26,552 I have 210 00:09:26,552 --> 00:09:26,972 not. 211 00:09:27,907 --> 00:09:28,087 Yep. 212 00:09:28,312 --> 00:09:29,092 it's gonna happen. 213 00:09:29,647 --> 00:09:32,167 Just at some point then you'd be able to like hold it up. 214 00:09:32,317 --> 00:09:36,277 You know, I was looking at some of my, my other books up there on the shelf. 215 00:09:36,397 --> 00:09:39,397 It's very, it's very cool once you finally have it in your hot little hands. 216 00:09:39,757 --> 00:09:40,207 But yeah. 217 00:09:40,207 --> 00:09:45,607 So one of the things that we recommend is that before all of this happens, 218 00:09:45,877 --> 00:09:49,897 because Mike, what, what, what position did we take in the book 219 00:09:49,897 --> 00:09:53,317 as to whether or not the odds that this would eventually happen to you? 220 00:09:54,187 --> 00:09:54,727 It is pretty high. 221 00:09:55,657 --> 00:09:56,257 Pretty high. 222 00:09:57,727 --> 00:09:58,027 Pretty 223 00:09:58,102 --> 00:09:59,062 An understatement. 224 00:09:59,437 --> 00:10:01,237 Damn near a hundred percent right? 225 00:10:01,567 --> 00:10:06,607 Uh, so before this happens to you, one of the things we talk about is to establish 226 00:10:06,607 --> 00:10:08,677 a relationship with a company like Mike's. 227 00:10:09,097 --> 00:10:11,947 Uh, Mike, you wanna talk about, like, when we say a company like 228 00:10:11,947 --> 00:10:12,862 yours, what, what do we mean? 229 00:10:15,427 --> 00:10:19,507 A company like Black Swan Cybersecurity, uh, you know, we're not just a security 230 00:10:19,507 --> 00:10:23,677 managed security services firm from a protection, monitoring perspective. 231 00:10:23,677 --> 00:10:27,757 We're also an incident response and litigation support firm. 232 00:10:27,757 --> 00:10:31,357 So, uh, kind of that trusted advisor that you can call for, you 233 00:10:31,357 --> 00:10:33,217 know, the entire spectrum of it. 234 00:10:33,307 --> 00:10:37,447 Cyber issues or, or questions or, or services. 235 00:10:37,897 --> 00:10:40,627 Um, and, and that perspective that we bring to the table 236 00:10:40,627 --> 00:10:42,367 regarding, regardless of where we. 237 00:10:43,087 --> 00:10:47,797 Or how we work with a particular organization, we're able to, to expand 238 00:10:47,797 --> 00:10:50,977 the, the value of that conversation based on all the other things we do. 239 00:10:51,547 --> 00:10:56,197 Uh, so we're not just talking about, uh, keeping you from, uh, 240 00:10:56,197 --> 00:10:58,957 getting attacked or mitigating what that attack might look like. 241 00:10:58,957 --> 00:11:02,857 We can also talk about, well, if you do get attacked, uh, depending on what 242 00:11:02,857 --> 00:11:06,727 controls or services or capabilities you have, this is what you can expect. 243 00:11:07,387 --> 00:11:10,747 Uh, on the back end of, of an attack and, and how that's gonna go. 244 00:11:11,167 --> 00:11:16,177 Um, and so even if you have all the great, you know, greatest tools and, and brand 245 00:11:16,177 --> 00:11:20,197 names, uh, deployed in your environment, uh, odds are it's gonna happen. 246 00:11:20,647 --> 00:11:22,717 Uh, and we saw that with CrowdStrike, right? 247 00:11:22,717 --> 00:11:26,167 It, it wasn't a cyber attack on you, it was an outage on CrowdStrike. 248 00:11:26,197 --> 00:11:29,137 With that left your environment vulnerable and then you get attacked. 249 00:11:29,437 --> 00:11:30,997 'cause bad guys watch the news also. 250 00:11:31,717 --> 00:11:35,407 Um, alright, so now what, uh, I had CrowdStrike, but I got attacked. 251 00:11:35,497 --> 00:11:36,517 Who do I call now? 252 00:11:36,667 --> 00:11:39,547 I'm probably not gonna call CrowdStrike 'cause they're busy putting out their own 253 00:11:39,547 --> 00:11:41,707 fire and I'm a little upset at them now. 254 00:11:42,007 --> 00:11:44,257 Uh, so, so who am I gonna call instead? 255 00:11:44,677 --> 00:11:48,097 Um, and so having those, uh, those resources in your pocket and, 256 00:11:48,097 --> 00:11:49,597 and having gotten to know them. 257 00:11:50,017 --> 00:11:53,557 Before an incident, you know, call 'em today, uh, when things are nice 258 00:11:53,557 --> 00:11:57,127 and calm and you can have a good conversation or cup of coffee, um, 259 00:11:57,127 --> 00:12:00,727 and not when the house is on fire and you're emotional and you're not sure 260 00:12:00,727 --> 00:12:02,647 what to say or, or what to do next. 261 00:12:03,967 --> 00:12:08,977 Yeah, so I like that idea of having basically, you know, you, the thing is 262 00:12:08,977 --> 00:12:12,127 that the good news is that most people. 263 00:12:12,532 --> 00:12:16,072 Uh, don't have a lot of experience in cyber recovery. 264 00:12:16,977 --> 00:12:22,112 And, and by that I mean, if they did, then that would really suck, because that 265 00:12:22,112 --> 00:12:23,272 means that they're doing it all the time. 266 00:12:23,602 --> 00:12:26,212 And so this is definitely one of those things where I think a professional 267 00:12:26,212 --> 00:12:30,712 can come in, uh, you know, uh, come in handy, uh, quite a bit, right? 268 00:12:31,132 --> 00:12:34,642 Um, I, I did, while you were talking, I, I, I got this image 269 00:12:34,642 --> 00:12:40,582 of you standing between, uh, the fan and the feces, um, uh, 270 00:12:42,622 --> 00:12:43,852 and fighting it off. 271 00:12:43,942 --> 00:12:49,012 Um, so, we talked about lost revenue, or we didn't talk about we, so 272 00:12:49,042 --> 00:12:52,342 the first thing we talked about lost wages, and we talked about 273 00:12:52,342 --> 00:12:53,692 bringing in third party services. 274 00:12:53,692 --> 00:12:54,322 What were you about to say? 275 00:12:54,332 --> 00:12:54,722 Prasanna? 276 00:12:55,582 --> 00:12:58,372 But also along the recovery aspect before we get to the 277 00:12:58,372 --> 00:12:59,332 revenue piece, right? 278 00:13:00,082 --> 00:13:01,492 It's, you might need hardware. 279 00:13:02,722 --> 00:13:03,112 Right. 280 00:13:03,712 --> 00:13:07,672 Maybe you need to buy more servers or maybe you need to spin up services 281 00:13:07,672 --> 00:13:12,202 in AWS or pick your cloud service in order to recover or start to recover 282 00:13:12,202 --> 00:13:15,892 while you're still remediating other systems in the environment. 283 00:13:16,492 --> 00:13:18,952 Maybe you're gonna need all of those things, right? 284 00:13:19,552 --> 00:13:19,912 Yeah. 285 00:13:20,092 --> 00:13:24,622 you know, and it's gonna be in this category of spare no expense, right? 286 00:13:24,922 --> 00:13:27,622 Um, you know, you're not gonna be able to, uh. 287 00:13:28,207 --> 00:13:32,227 You know, order your servers on Amazon Prime away for free two day delivery. 288 00:13:32,587 --> 00:13:37,327 Uh, you know, you're, you're gonna be, you're gonna be calling your 289 00:13:37,327 --> 00:13:45,397 server company of choice and going, I need 1300 new, you know, Dell, 9,500. 290 00:13:45,397 --> 00:13:49,237 I don't know, I don't, I don't know any server volume numbers or uh, 291 00:13:49,267 --> 00:13:52,567 And, and really I'll, I'll tell you, even even the US government 292 00:13:52,567 --> 00:13:55,657 would have trouble getting a one day turnaround on 1300 servers. 293 00:13:57,097 --> 00:13:57,457 Yeah. 294 00:13:57,697 --> 00:13:58,207 Yeah. 295 00:13:58,387 --> 00:13:59,017 Um. 296 00:14:00,097 --> 00:14:05,257 The, uh, and, and then the, I think the, perhaps the thing that we're getting to 297 00:14:05,257 --> 00:14:09,127 Atlas in terms of some of these costs is the lost business revenue, right? 298 00:14:09,607 --> 00:14:17,377 So we live in a very connected world, and when, uh, you go to do business 299 00:14:17,377 --> 00:14:21,277 with some sort of entity, right? 300 00:14:21,457 --> 00:14:22,327 Obviously this is. 301 00:14:23,052 --> 00:14:27,492 speaks more to commercial businesses rather than governmental entities. 302 00:14:28,182 --> 00:14:32,712 it's not like we can go, oh well the city of San Diego is down. 303 00:14:32,712 --> 00:14:34,722 I will go give my money to Irvine. 304 00:14:35,172 --> 00:14:37,272 Uh, it doesn't quite work like that. 305 00:14:37,272 --> 00:14:42,822 But, um, but with a business, when you go to interact with that 306 00:14:42,822 --> 00:14:45,042 business and you see that it is down. 307 00:14:45,917 --> 00:14:52,037 It's not like your need goes away, so you as a consumer goes and spends 308 00:14:52,037 --> 00:14:54,912 your money elsewhere, and that's money that you're never gonna get back. 309 00:14:58,577 --> 00:14:59,687 And your reputation. 310 00:14:59,837 --> 00:15:04,067 So it, it's not just that direct client that you lost, it's everybody 311 00:15:04,067 --> 00:15:07,967 they know also, uh, that might have potentially, either, either 312 00:15:07,967 --> 00:15:10,637 they were or could potentially be a client of yours in the future. 313 00:15:11,592 --> 00:15:11,812 It. 314 00:15:12,352 --> 00:15:14,002 Do you know Mike? 315 00:15:14,032 --> 00:15:15,082 Just, sorry. 316 00:15:15,082 --> 00:15:17,782 I like to ask stats questions 'cause you seem to have so many of them. 317 00:15:18,712 --> 00:15:26,092 Do you know what percentage of businesses that get hit with ransomware go under? 318 00:15:27,052 --> 00:15:28,312 Oh, it's over half. 319 00:15:29,512 --> 00:15:29,902 So if, 320 00:15:29,902 --> 00:15:33,502 if you don't have, if you don't have a solid, well, it's over half. 321 00:15:33,502 --> 00:15:35,357 For those that don't have a solid response plan. 322 00:15:36,087 --> 00:15:36,207 Hmm. 323 00:15:36,787 --> 00:15:40,777 So more than 50% of the companies that get hit with ransomware or any significant 324 00:15:40,777 --> 00:15:43,957 cyber incident and they don't have an incident response plan can't survive. 325 00:15:45,847 --> 00:15:50,167 But incident, uh, ransomware, especially the double extortion one, very hard 326 00:15:50,167 --> 00:15:53,617 on on businesses that, that aren't prepared for that for two reasons. 327 00:15:53,617 --> 00:15:58,267 One, they've gotta pay for the, the recovery, uh, from the event itself. 328 00:15:58,597 --> 00:16:02,437 And then because it's double extortion, a lot of those, uh, organizations 329 00:16:02,767 --> 00:16:04,762 can't afford the regulatory fines. 330 00:16:05,647 --> 00:16:10,477 Uh, for the, uh, PII or consumer related data that they're gonna get 331 00:16:10,477 --> 00:16:14,497 fined, especially if it's California with, what is it, $25 a record? 332 00:16:15,157 --> 00:16:16,327 Uh, yeah. 333 00:16:16,327 --> 00:16:17,292 It's, it's, it's crazy. 334 00:16:18,187 --> 00:16:20,467 I think we should get that money, don't you think? 335 00:16:20,477 --> 00:16:24,817 Prasanna, you and I live in California, why don't we get this money when our 336 00:16:24,817 --> 00:16:26,677 records, why do they get more money? 337 00:16:26,947 --> 00:16:28,597 Because our data was, was hurt. 338 00:16:28,657 --> 00:16:29,407 That's all I'm saying. 339 00:16:30,252 --> 00:16:31,912 Um, $25 340 00:16:32,017 --> 00:16:32,077 Yeah. 341 00:16:32,272 --> 00:16:33,912 $25 is not gonna be, um, 342 00:16:34,292 --> 00:16:34,412 I. 343 00:16:35,132 --> 00:16:35,912 not gonna be much. 344 00:16:36,052 --> 00:16:37,352 But um, 345 00:16:38,197 --> 00:16:40,087 And I guess that's a third category, right? 346 00:16:40,087 --> 00:16:42,012 We talked about revenue, but then there are the fines. 347 00:16:42,907 --> 00:16:45,757 Yeah, the re the Reg regulatory fines. 348 00:16:45,757 --> 00:16:46,597 It is true. 349 00:16:46,687 --> 00:16:49,057 Uh, GDPR is huge, right? 350 00:16:49,057 --> 00:16:53,497 If you're, if you're in that world, because that's, they start talking about 351 00:16:53,497 --> 00:16:56,257 a percentage of annual turnover, right? 352 00:16:56,257 --> 00:17:00,667 Which is, and that semi analogous to revenue, it's a different term, but 353 00:17:01,027 --> 00:17:03,817 I've never quite fully understood the difference between annual. 354 00:17:03,847 --> 00:17:04,537 Do you know, Mike? 355 00:17:04,537 --> 00:17:07,477 Are you a revenue annual turnover person? 356 00:17:08,077 --> 00:17:10,387 Yeah, just stick with US terms, 357 00:17:10,732 --> 00:17:11,002 Yeah. 358 00:17:11,002 --> 00:17:11,242 Okay. 359 00:17:11,492 --> 00:17:12,052 Okay. 360 00:17:12,592 --> 00:17:14,532 It is like 4% though, I believe right 361 00:17:15,352 --> 00:17:16,212 up to 4% 362 00:17:16,342 --> 00:17:17,572 of the annual turnover. 363 00:17:17,572 --> 00:17:17,872 Yeah. 364 00:17:18,022 --> 00:17:24,502 Um, the, um, so yeah, so we talked about lost revenue. 365 00:17:24,772 --> 00:17:29,302 And Mike, you talked about the reputation effect because it's. 366 00:17:30,232 --> 00:17:37,042 I can, I can think back companies that have lost my data, a company that have 367 00:17:37,042 --> 00:17:42,592 had in, you know, incidents with my data and I haven't forgotten that. 368 00:17:43,222 --> 00:17:43,702 Right. 369 00:17:43,942 --> 00:17:46,552 Uh, you know, I can think literally, um. 370 00:17:48,667 --> 00:17:54,907 Of like the first cyber incident that I remember that had that involved my data. 371 00:17:55,387 --> 00:18:01,597 Um, it goes, you know, all the way back to 2005 and I remember that incident 372 00:18:01,597 --> 00:18:04,897 and I know exactly which company that was and I will never forget it. 373 00:18:05,212 --> 00:18:09,262 Right now in, now in that particular company, I don't get a 374 00:18:09,262 --> 00:18:10,702 choice of not working with them. 375 00:18:11,242 --> 00:18:11,722 Right. 376 00:18:11,962 --> 00:18:16,282 It's, uh, it's, um, the, um, regulatory, I'm not regulatory, 377 00:18:16,312 --> 00:18:18,262 um, credit reporting agency. 378 00:18:18,682 --> 00:18:19,102 Right. 379 00:18:19,192 --> 00:18:24,622 Um, but the, I, I wish we had the choice of not working with, with 380 00:18:24,787 --> 00:18:25,177 But, 381 00:18:25,627 --> 00:18:28,807 but here's a question though, Curtis, do you remember that first one 382 00:18:28,867 --> 00:18:29,407 clearly? 383 00:18:30,187 --> 00:18:33,877 Do you remember the next 25 or 50 that have come up? 384 00:18:33,877 --> 00:18:37,447 Just given how many of those notices that you get every 385 00:18:37,657 --> 00:18:38,047 month? 386 00:18:38,122 --> 00:18:41,032 I mean there, there is a, that is a good point, right? 387 00:18:41,032 --> 00:18:46,552 That, that we are starting to get, um, somewhat, it's sort of like, um, Mike, you 388 00:18:46,552 --> 00:18:53,032 don't live in California, but you know, in California, we, um, um, of, uh, over 389 00:18:53,032 --> 00:18:57,952 here we have this like thing about, um, this thing has been shown to cause cancer. 390 00:18:58,612 --> 00:18:59,602 Literally everywhere 391 00:18:59,647 --> 00:19:01,597 I see them on all the labels, but I tear. 392 00:19:01,597 --> 00:19:02,662 I'm able to tear that one off. 393 00:19:03,412 --> 00:19:03,892 Yeah. 394 00:19:03,922 --> 00:19:04,402 Yeah. 395 00:19:04,432 --> 00:19:08,212 Um, but, uh, with every, every business that you go in there, it's 396 00:19:08,212 --> 00:19:12,052 like, uh, so it's like, there is, there's certainly, uh, alert fatigue. 397 00:19:12,272 --> 00:19:14,167 That's a good point, Prasanna. 398 00:19:14,912 --> 00:19:20,522 Um, but I will say that I definitely remember the ones that 399 00:19:20,522 --> 00:19:21,752 definitely inconvenienced me. 400 00:19:22,892 --> 00:19:23,522 Definitely. 401 00:19:26,987 --> 00:19:27,977 I definitely do. 402 00:19:28,337 --> 00:19:32,207 Um, you know, where if, if, if I was significantly inconvenienced, 403 00:19:32,207 --> 00:19:33,287 I definitely remember that. 404 00:19:33,287 --> 00:19:36,677 And my point, my point is that I, I will never forgive that. 405 00:19:36,707 --> 00:19:38,087 I will never forget that. 406 00:19:38,387 --> 00:19:41,447 I can also remember, and again, I'm not gonna throw their name out because 407 00:19:41,507 --> 00:19:45,917 I don't want to get sued, but I also know the, the one backup company that 408 00:19:45,917 --> 00:19:50,027 I know lost people's data, right. 409 00:19:50,837 --> 00:19:52,757 and I, I won't ever forget that, right? 410 00:19:52,757 --> 00:19:55,637 So the, the, the damage to your reputation, I don't 411 00:19:55,637 --> 00:19:56,837 think you can ever get back. 412 00:19:57,017 --> 00:19:59,987 And another thing that you're never gonna get back, we talked about lost revenue. 413 00:20:01,172 --> 00:20:04,232 There's lost revenue of what happens during the outage. 414 00:20:04,232 --> 00:20:09,332 But what happens if during the outage your, your customer goes to your 415 00:20:09,332 --> 00:20:14,792 competitor and they go, oh, this company's not as bad as I thought it was. 416 00:20:15,212 --> 00:20:18,572 You know, I, I guess we could, we could continue doing 417 00:20:18,572 --> 00:20:19,982 business with them over here. 418 00:20:20,162 --> 00:20:21,542 Now, not only did you lose. 419 00:20:21,767 --> 00:20:23,117 Revenue during that outage. 420 00:20:23,387 --> 00:20:27,317 You have lost the future revenue from that customer. 421 00:20:27,737 --> 00:20:31,337 Um, and the, you know, the reputational damage that you talked about 422 00:20:31,337 --> 00:20:37,607 Mike, that does damage to future revenue from future customers. 423 00:20:37,937 --> 00:20:40,607 They're going around, Googling whether or not they should do business with 424 00:20:40,607 --> 00:20:42,467 you, and this is the story that pops up. 425 00:20:42,962 --> 00:20:43,322 Yeah. 426 00:20:43,562 --> 00:20:43,862 And, 427 00:20:44,762 --> 00:20:47,282 and Curtis, I know we've done podcast episodes last 428 00:20:47,282 --> 00:20:48,272 year, right? 429 00:20:48,272 --> 00:20:49,862 If I look at Rackspace 430 00:20:49,922 --> 00:20:51,512 and their exchange outage, 431 00:20:51,512 --> 00:20:55,952 which caused them to shut down a huge business for them, right? 432 00:20:55,952 --> 00:20:59,912 Hosted exchange, we also talked about LastPass. 433 00:21:00,992 --> 00:21:01,212 Yep. 434 00:21:02,177 --> 00:21:03,137 And their breach. 435 00:21:03,137 --> 00:21:06,467 And you could just imagine like all those fines and penalties. 436 00:21:06,797 --> 00:21:10,487 I think they even started getting sued like years later, right 437 00:21:10,487 --> 00:21:11,657 after the incident happened. 438 00:21:11,657 --> 00:21:15,827 Because sometimes it takes that long before activities, criminal 439 00:21:15,827 --> 00:21:19,307 activities start to show up based on, uh, the data that was stolen. 440 00:21:20,327 --> 00:21:24,377 Yeah, you know, I actually know somebody, by the way, that went to go do marketing 441 00:21:24,377 --> 00:21:27,467 at LastPass, and I was like, Good 442 00:21:27,642 --> 00:21:27,722 Hmm. 443 00:21:27,887 --> 00:21:28,157 with that. 444 00:21:28,802 --> 00:21:31,022 Well, there's a couple other things to consider too. 445 00:21:31,052 --> 00:21:34,562 Uh, we talked about overtime and, and the staff, internal staff that 446 00:21:34,562 --> 00:21:36,572 are addressing a particular incident. 447 00:21:36,962 --> 00:21:38,732 You may actually lose that staff. 448 00:21:38,762 --> 00:21:42,482 You know, they, they, they're used to their eight to five or shift job, 449 00:21:42,482 --> 00:21:45,572 and now you've got 'em working three hour, you know, three days straight 450 00:21:45,572 --> 00:21:48,692 with, with, you know, sleeping on the floor at their desk and eating. 451 00:21:49,262 --> 00:21:53,252 You know, carry out food or pizza, which, you know, I wouldn't mind for three days. 452 00:21:53,252 --> 00:21:56,792 But, uh, at the end of that, you know, they're exhausted and that's, 453 00:21:56,822 --> 00:21:58,412 that's not what they signed up for. 454 00:21:58,412 --> 00:22:01,802 Or maybe even they were getting, you know, a little bit of attitude 455 00:22:01,802 --> 00:22:04,557 from, from other employees or executives and they, they quit. 456 00:22:05,822 --> 00:22:08,912 Uh, and, and it's probably the ones that quit are probably the ones that have been 457 00:22:08,912 --> 00:22:11,762 telling you that there's this problem that hasn't been addressed for some period of 458 00:22:11,762 --> 00:22:12,062 time. 459 00:22:12,062 --> 00:22:13,262 And that's what led to this breach. 460 00:22:13,262 --> 00:22:13,352 And 461 00:22:13,352 --> 00:22:16,592 they're like, I told you so, and you know, I'll help you get through this, but 462 00:22:16,592 --> 00:22:18,422 I'm gonna, uh, I'll be out after that. 463 00:22:18,812 --> 00:22:23,702 The other thing, uh, so the, the human impact, um, and whether 464 00:22:23,702 --> 00:22:26,072 they quit or not, they, they're not gonna be the same person. 465 00:22:26,072 --> 00:22:29,222 It's like going into war, like you, you come out the other side 466 00:22:29,222 --> 00:22:32,822 and, and, and you're just, you don't see things the same way. 467 00:22:32,822 --> 00:22:33,992 You're, you're not the same person. 468 00:22:34,682 --> 00:22:38,282 Uh, so people that have been through a significant incident are, are, 469 00:22:38,282 --> 00:22:39,692 uh, they're changed in a way. 470 00:22:40,172 --> 00:22:40,442 Alright? 471 00:22:40,442 --> 00:22:45,272 So there's the human person, uh, the human perspective or the impact supply 472 00:22:45,272 --> 00:22:49,292 chain and, um, supply chain's one. 473 00:22:49,292 --> 00:22:52,592 So now you're going to, you're probably gonna burn some bridges trying to get, 474 00:22:52,922 --> 00:22:55,592 you know, equipment or, or, or support. 475 00:22:56,102 --> 00:22:59,432 Uh, and by that I mean you're, you're gonna approach this, uh, this 476 00:22:59,432 --> 00:23:01,112 incident with a little bit of, uh. 477 00:23:01,907 --> 00:23:06,737 Um, uh, emotion and, and, um, aggressiveness that some 478 00:23:06,737 --> 00:23:08,087 people may not appreciate. 479 00:23:08,537 --> 00:23:12,557 Uh, and then the other part of that is, uh, if, if you are heavily 480 00:23:12,557 --> 00:23:15,767 involved in financing stuff, right? 481 00:23:15,767 --> 00:23:19,697 Like maybe you're building a new facility or you need, you need, you need credit 482 00:23:19,697 --> 00:23:22,217 to buy equipment that you then resell. 483 00:23:22,997 --> 00:23:27,617 Uh, this incident could, could impact your credit rating as a company, uh, your 484 00:23:27,617 --> 00:23:31,367 bond rating, uh, things like that, that may, so maybe you're a 485 00:23:31,367 --> 00:23:34,397 construction company and you build hospitals and military bases, and 486 00:23:34,397 --> 00:23:37,847 now all of a sudden you've got this cyber attack that puts you down. 487 00:23:37,967 --> 00:23:43,847 Uh, those, those, uh, financial funding vehicles may, may have 488 00:23:43,847 --> 00:23:45,802 a different perspective of working with you in the future. 489 00:23:45,802 --> 00:23:46,042 Also. 490 00:23:47,207 --> 00:23:47,897 Yeah, no. 491 00:23:47,897 --> 00:23:51,497 When you were talking about that, Mike, I was thinking about the reputation comment 492 00:23:51,497 --> 00:23:57,407 you made earlier where you've now impacted not only the reputation of your customers, 493 00:23:57,407 --> 00:24:01,607 but even your vendors and suppliers too, who are like, Nope, we don't quite trust 494 00:24:01,607 --> 00:24:04,967 what you're doing, or maybe you don't get preferred rates or other things like 495 00:24:04,967 --> 00:24:05,267 that 496 00:24:05,301 --> 00:24:05,627 Mm-hmm. 497 00:24:05,687 --> 00:24:06,827 potentially as well. 498 00:24:07,712 --> 00:24:09,212 And, and, and it's weird. 499 00:24:09,242 --> 00:24:13,172 Uh, it's not just the inputs, it's also the outputs, uh, from a, from a vendor 500 00:24:13,172 --> 00:24:15,062 or relationship or system perspective. 501 00:24:15,632 --> 00:24:16,022 Um. 502 00:24:16,832 --> 00:24:18,332 We worked with a company. 503 00:24:18,337 --> 00:24:22,052 It was a, it was a dental, a dental practice. 504 00:24:22,652 --> 00:24:26,282 Their payment processor shut off when, when they had an incident, 505 00:24:26,282 --> 00:24:29,672 they notified everybody, uh, very diligent and responsible. 506 00:24:30,032 --> 00:24:34,217 The payment processor shut off access, and even after they said we fixed 507 00:24:34,562 --> 00:24:38,612 all the problems, uh, the payment processor required a third party 508 00:24:38,612 --> 00:24:42,212 objective review of that environment before they turned that access back on. 509 00:24:42,212 --> 00:24:43,442 So this, it wasn't just. 510 00:24:44,117 --> 00:24:49,097 You know, paper records and, and operating the way we used to, they were, they 511 00:24:49,097 --> 00:24:52,727 were literally also taking, having to take, uh, credit card, you know, the 512 00:24:52,727 --> 00:24:59,447 carbon copy swipes of credit cards to, to, uh, to take payment so that 513 00:24:59,447 --> 00:25:02,297 they could process it later when their payment processor came back online. 514 00:25:04,082 --> 00:25:04,802 That's crazy. 515 00:25:04,802 --> 00:25:06,932 I don't even remember the last time I had to do that, 516 00:25:07,907 --> 00:25:10,637 Well, and, and to that point, I mean, these are, these are all things 517 00:25:10,637 --> 00:25:12,137 you've gotta think about today. 518 00:25:12,137 --> 00:25:12,467 All right? 519 00:25:12,467 --> 00:25:15,677 So if our payment, whatever, all our critical things, well payment 520 00:25:15,677 --> 00:25:17,087 processing's a critical thing. 521 00:25:17,087 --> 00:25:18,797 Well, what happens if that goes away? 522 00:25:18,827 --> 00:25:21,437 How are we gonna process 523 00:25:21,437 --> 00:25:21,557 our. 524 00:25:22,382 --> 00:25:27,002 yeah, that's interesting that you mention that because I just, just, uh, I don't 525 00:25:27,002 --> 00:25:33,632 know, a week or two, a week or two ago, I set up a new, um, you know, a new minute, 526 00:25:33,662 --> 00:25:39,182 my new, uh, LLCI set it up in, uh, Stripe to be able to accept, you know, to be 527 00:25:39,182 --> 00:25:41,852 able to send a, a payment leak that took. 528 00:25:42,507 --> 00:25:47,007 A few days, Because there's, there's an authentication process. 529 00:25:47,307 --> 00:25:53,097 And, um, so e even if you let, let's say if you're able to quickly go over to 530 00:25:53,097 --> 00:25:58,827 another payment processor, it, it's not like that's gonna just start processing 531 00:25:58,827 --> 00:26:00,807 payments, uh, immediately for you. 532 00:26:00,837 --> 00:26:01,047 They, 533 00:26:01,107 --> 00:26:02,487 they did not pay the ransom. 534 00:26:02,487 --> 00:26:07,467 So even, even with $30 million in, in insurance coverage, 535 00:26:08,037 --> 00:26:09,417 not even paying the ransom. 536 00:26:10,002 --> 00:26:13,017 Their, Their, recovery cost was almost 65 537 00:26:13,017 --> 00:26:13,452 million. 538 00:26:13,887 --> 00:26:14,337 right. 539 00:26:15,027 --> 00:26:19,827 Um, and then of course they're gonna end up with, uh, probably increased, 540 00:26:19,887 --> 00:26:24,597 um, insurance rates after this and possible cancellation of the policy. 541 00:26:24,657 --> 00:26:25,047 Right. 542 00:26:25,407 --> 00:26:27,087 I wonder, Mike, have you ever seen that? 543 00:26:27,087 --> 00:26:30,147 Where that, where people file a claim and then they get their 544 00:26:30,147 --> 00:26:32,037 cyber insurance policy canceled? 545 00:26:33,327 --> 00:26:33,777 It. 546 00:26:34,227 --> 00:26:34,827 Yes. 547 00:26:34,887 --> 00:26:39,957 Uh, but it's, it's less common than the insurance company giving 548 00:26:39,957 --> 00:26:42,267 them a very long list of things. 549 00:26:42,267 --> 00:26:47,007 They've gotta remediate and prove that they've remediated that, uh, to keep 550 00:26:47,007 --> 00:26:48,897 their policy, their premium will go up. 551 00:26:48,927 --> 00:26:49,917 'cause their risk went up. 552 00:26:50,532 --> 00:26:53,022 Uh, but that's usually just in the following year. 553 00:26:53,022 --> 00:26:56,142 So let's say, you know, every year there's a 3% increase 554 00:26:56,592 --> 00:27:00,972 after an incident, having, having satisfied the insurance company's 555 00:27:00,972 --> 00:27:04,782 remediation list, if you do all that, you may get a five and a 556 00:27:04,782 --> 00:27:07,992 half percent or 6% increase in your premium for the next year. 557 00:27:08,472 --> 00:27:13,812 Well then subsequent years, uh, you know, that may go back down to just 558 00:27:13,812 --> 00:27:16,272 the, the standard 3% or whatever it is. 559 00:27:16,782 --> 00:27:18,192 Uh, if you maintain your. 560 00:27:18,957 --> 00:27:23,907 Your, uh, hygiene and, and, and control effectiveness according to, 561 00:27:24,087 --> 00:27:27,477 and, and that insurance company may ask for, you know, multiple years 562 00:27:27,477 --> 00:27:29,457 of, of, of third party assessments 563 00:27:29,457 --> 00:27:30,552 to, to keep your policy. 564 00:27:30,567 --> 00:27:34,377 And, and we're gonna cover this on a later episode, but that's definitely something 565 00:27:34,377 --> 00:27:39,027 you should be doing upfront, again, where you can talk to your insurance company, 566 00:27:39,057 --> 00:27:41,607 uh, you know, what are the things that we should be doing already, right? 567 00:27:41,607 --> 00:27:43,467 Again, talk to a company like yours, right? 568 00:27:43,467 --> 00:27:47,697 A blue team company, uh, that, that will help you defend yourself. 569 00:27:48,057 --> 00:27:50,037 So let's talk about, um, 570 00:27:50,472 --> 00:27:51,042 I have one. 571 00:27:51,927 --> 00:27:52,287 Yep. 572 00:27:52,962 --> 00:27:58,512 So as Mike was talking about that, uh, one thing popped to my mind, which was, 573 00:28:00,582 --> 00:28:01,902 so you get hit with ransomware. 574 00:28:02,082 --> 00:28:04,392 You're like, okay, X, Y, and Z all needs to change. 575 00:28:05,112 --> 00:28:09,012 There's the cost of updating and changing processes 576 00:28:09,852 --> 00:28:13,602 that may be significant depending on how you are operating today. 577 00:28:15,747 --> 00:28:18,897 I think, and I don't know how to quantify that. 578 00:28:18,897 --> 00:28:21,717 I'm sure it depends on what the risk is, or like Mike, what you were saying. 579 00:28:21,717 --> 00:28:26,667 If your insurance company tells you to remediate a bunch of issues that 580 00:28:26,667 --> 00:28:32,487 might involve significant restructuring of your organization processes in 581 00:28:32,487 --> 00:28:33,657 order to be able to handle this. 582 00:28:34,127 --> 00:28:34,997 Here's a good example. 583 00:28:34,997 --> 00:28:38,477 Let's say, let's say you're a, a, a, a medium sized company. 584 00:28:38,477 --> 00:28:42,437 You probably have some things documented like, how do I restore a computer? 585 00:28:42,857 --> 00:28:46,307 How do we revert to a, a manual process in the absence of 586 00:28:46,307 --> 00:28:47,702 our systems being available? 587 00:28:47,927 --> 00:28:50,207 You probably have some of that documented. 588 00:28:50,507 --> 00:28:51,262 It's probably old. 589 00:28:52,077 --> 00:28:57,357 Uh, it maybe some of it's tribal knowledge, uh, but at, as a result 590 00:28:57,357 --> 00:29:00,537 of an incident, the insurance company may come and do an audit and they 591 00:29:00,537 --> 00:29:04,797 may say, you've, you've got some or nothing, but this is what we expect. 592 00:29:05,157 --> 00:29:05,337 And 593 00:29:05,337 --> 00:29:10,317 so in a lot of cases, you can't just update something that's been 594 00:29:10,317 --> 00:29:14,307 in place for a long time because it's obviously not effective. 595 00:29:14,787 --> 00:29:18,297 And in order for a control to be effective, it has to be designed well. 596 00:29:18,597 --> 00:29:20,307 In order to design well, you've gotta. 597 00:29:21,252 --> 00:29:24,402 Get good information, current information from all the stakeholders. 598 00:29:24,852 --> 00:29:28,152 Uh, and so a control is this thing that operates, and most controls 599 00:29:28,152 --> 00:29:31,452 have inputs and outputs and so those are other stakeholders and controls. 600 00:29:31,452 --> 00:29:36,012 So you've got this kind of enterprise exercise that you have to go through. 601 00:29:36,432 --> 00:29:40,842 Um, and if you haven't gone through a business impact analysis, this 602 00:29:40,842 --> 00:29:42,552 exercise would be very similar. 603 00:29:42,957 --> 00:29:46,527 So you essentially go and look for all the critical things in our company that, 604 00:29:46,737 --> 00:29:51,057 that keep the lights on and pay the bills, and, you know, sustain our, our 605 00:29:51,057 --> 00:29:54,867 revenue and our reputation and our client base and whatever those things are. 606 00:29:55,557 --> 00:29:58,377 And in that assessment, you then determine what are the, the 607 00:29:58,377 --> 00:30:03,722 critical people, processes, and technologies required to function, 608 00:30:04,422 --> 00:30:05,967 and then what are the alternatives? 609 00:30:05,967 --> 00:30:09,057 So if that thing goes away, I can do it, I can do it this 610 00:30:09,057 --> 00:30:10,557 other way for a period of time. 611 00:30:10,557 --> 00:30:11,397 But what is that? 612 00:30:11,892 --> 00:30:12,882 What's that pain point? 613 00:30:12,882 --> 00:30:13,512 Is it an hour? 614 00:30:13,512 --> 00:30:14,292 Is it a day? 615 00:30:14,397 --> 00:30:16,452 And, and what's, how do I quantify that? 616 00:30:16,452 --> 00:30:17,892 Is that a million dollars an hour? 617 00:30:17,892 --> 00:30:18,942 Is it a million dollars a day? 618 00:30:18,942 --> 00:30:20,082 Is it a million dollars a week? 619 00:30:20,592 --> 00:30:25,512 Uh, and so now we we're, we've got all of this stuff laid out and current 620 00:30:25,992 --> 00:30:30,612 so that I know if that department or that process breaks, this is how much 621 00:30:30,612 --> 00:30:33,402 time and what is required to recover. 622 00:30:34,032 --> 00:30:38,082 And in that time, this is my financial impact or these other impacts. 623 00:30:38,082 --> 00:30:40,962 It could be, you know, if it's a hospital and the intensive care 624 00:30:40,962 --> 00:30:44,592 unit goes down, that could be human life, it could be regulatory, 625 00:30:44,592 --> 00:30:45,852 you know, whatever the case is. 626 00:30:45,852 --> 00:30:50,322 But I have all this stuff lined out now and then from this body of knowledge 627 00:30:50,322 --> 00:30:54,522 that I've, I've just created, that translates directly into business 628 00:30:54,522 --> 00:30:58,422 continuity, disaster recovery, incident response, and how I categorize all 629 00:30:58,422 --> 00:31:01,452 my, you know, the criticality of all these things that could happen. 630 00:31:01,857 --> 00:31:06,177 You know, ransomware on a print server, probably not really high unless 631 00:31:06,177 --> 00:31:11,007 that print server is what's creating checks, uh, or, or shipping orders. 632 00:31:11,007 --> 00:31:14,967 And I, you know, and I'm, I'm, I'm shipping million dollar things. 633 00:31:15,387 --> 00:31:18,507 Uh, and so that's, that's a perspective a lot of people think, well, ransomware 634 00:31:18,507 --> 00:31:19,737 on a print server, that's nothing. 635 00:31:19,737 --> 00:31:21,957 Well, it is if that's how you make money. 636 00:31:22,437 --> 00:31:26,517 Uh, and so going through an exercise like that really puts some 637 00:31:26,517 --> 00:31:30,807 gravity, uh, and awareness in your environment that you can share with. 638 00:31:31,212 --> 00:31:31,962 Leadership. 639 00:31:32,442 --> 00:31:33,522 Executive leadership. 640 00:31:33,522 --> 00:31:36,792 And that's very important because when we go to leadership and say, I need 641 00:31:36,792 --> 00:31:40,512 budget to keep the lights on to make sure this stuff doesn't happen, and they're 642 00:31:40,512 --> 00:31:43,002 like, yeah, we're not gonna pay that. 643 00:31:43,002 --> 00:31:46,782 'cause we we're, we've got this new marketing advertising campaign 644 00:31:47,172 --> 00:31:48,582 to, you know, for whatever. 645 00:31:48,582 --> 00:31:53,832 And, and they don't, they don't always realize that where they're focused, um. 646 00:31:55,047 --> 00:31:58,617 Oftentimes leaves a huge gap in, in risk. 647 00:31:58,977 --> 00:32:02,547 Uh, and, and maybe there's some kind of middle ground that we can come 648 00:32:02,547 --> 00:32:04,737 to, uh, or roadmap we can build. 649 00:32:04,737 --> 00:32:07,887 Maybe we don't have to do it all at the same time, uh, but you know, this month 650 00:32:07,887 --> 00:32:10,797 we need to do something and six months we need to do something and so on. 651 00:32:11,457 --> 00:32:15,327 Um, but that business impact analysis and that that huge analysis of all 652 00:32:15,327 --> 00:32:19,167 those different criticalities and risks will help you have that conversation. 653 00:32:19,647 --> 00:32:23,277 Um, and by the way, leadership, uh, executive leadership is often 654 00:32:23,337 --> 00:32:27,237 included in those, those workshops, in that process, that exercise. 655 00:32:27,567 --> 00:32:32,007 Uh, so they get to, uh, they get to participate in and have some, some 656 00:32:32,247 --> 00:32:35,847 introspection, uh, of their, of their business and their, and their 657 00:32:35,847 --> 00:32:38,907 responsibility during that exercise, so that sometimes that, that helps 658 00:32:38,907 --> 00:32:40,287 facilitate a better discussion. 659 00:32:40,932 --> 00:32:45,192 Well, that, that whole thing that you just described, it's one of those things where. 660 00:32:46,437 --> 00:32:50,157 It's the, you know, the phrase, you know, uh, never time to do it, right. 661 00:32:50,157 --> 00:32:51,477 Always time to do it over, right. 662 00:32:51,477 --> 00:32:57,807 It falls into that category of like, it's, it's activities that you need 663 00:32:57,807 --> 00:33:05,277 to do that are best done upfront, and they're kind of a pain, like everything 664 00:33:05,277 --> 00:33:10,467 you just described sounds really, really important, but it's a pain right? 665 00:33:10,467 --> 00:33:10,677 To, 666 00:33:10,762 --> 00:33:11,482 But you know what? 667 00:33:11,602 --> 00:33:13,402 I think there's, there's some misconception there. 668 00:33:13,732 --> 00:33:16,582 Yeah, there's, it's gonna take time away from your, your job. 669 00:33:16,912 --> 00:33:21,622 But to your point, you know, if, if I'm, if I'm busy doing something and, 670 00:33:21,682 --> 00:33:24,592 and my daughter calls me, I'm gonna stop what I'm doing and I may have 671 00:33:24,592 --> 00:33:25,822 an hour phone call with my daughter, 672 00:33:26,392 --> 00:33:29,992 30 minutes, whatever the case is, because I can prioritize that 673 00:33:30,082 --> 00:33:31,972 over this spreadsheet I'm created. 674 00:33:32,697 --> 00:33:32,997 Yeah. 675 00:33:33,217 --> 00:33:33,957 If, if you can. 676 00:33:35,247 --> 00:33:42,267 Set aside an hour to talk to an advisor or a consultant about 677 00:33:42,267 --> 00:33:44,277 this business impact analysis. 678 00:33:45,282 --> 00:33:47,667 You, you, sometimes you just have to have it on your calendar 679 00:33:47,727 --> 00:33:48,777 and you're just gonna do it. 680 00:33:49,647 --> 00:33:52,647 And I think the mis, there's a misconception that this business impact 681 00:33:52,647 --> 00:33:57,982 analysis is this huge, cumbersome, you know, 90 day, 120 day thing. 682 00:33:58,707 --> 00:34:01,857 And yeah, I'm sure there's some large enterprises where it, it would take 683 00:34:01,857 --> 00:34:05,607 that long, but for the most part, small to medium sized businesses can 684 00:34:05,607 --> 00:34:08,097 get a BIA done in one to three weeks. 685 00:34:08,577 --> 00:34:08,697 And 686 00:34:08,697 --> 00:34:11,637 that's like one person talking with, you know, one-on-one with 687 00:34:11,637 --> 00:34:17,697 different, we did a city government, um, 14, 15 different departments. 688 00:34:17,697 --> 00:34:18,432 We did it in two weeks. 689 00:34:20,202 --> 00:34:20,592 Yeah. 690 00:34:20,622 --> 00:34:23,262 Uh, well, I, I think that that's a really good point, Mike. 691 00:34:23,262 --> 00:34:28,212 I, I like, I, I, the point, I, you made a different point, which is a great point. 692 00:34:28,422 --> 00:34:31,962 The point I was making was whatever level of pain it is, whether 693 00:34:31,962 --> 00:34:34,122 it's a day, weeks, or months. 694 00:34:34,922 --> 00:34:40,862 The point is that by doing this work upfront, it gives you the power 695 00:34:40,892 --> 00:34:44,702 that you need to make, the changes that you need to your environment 696 00:34:44,972 --> 00:34:48,362 from a recovery perspective, from a cybersecurity perspective. 697 00:34:48,632 --> 00:34:55,352 And also when the feces sits, the rotary oscillator, you know where you need to be. 698 00:34:55,632 --> 00:34:56,112 Right. 699 00:34:56,412 --> 00:34:59,502 You know, like you said, you, you, you know that your daughter 700 00:34:59,502 --> 00:35:01,272 calling is, is important. 701 00:35:01,572 --> 00:35:01,992 Right. 702 00:35:02,142 --> 00:35:03,102 You will know. 703 00:35:03,192 --> 00:35:05,652 Well, I know that this thing, like, you know, you, you 704 00:35:05,652 --> 00:35:06,942 talked about the print server. 705 00:35:07,662 --> 00:35:10,512 know, we're, let, let's say I immediately thought of, uh, 706 00:35:10,542 --> 00:35:12,132 what we used to call Kinko's. 707 00:35:12,342 --> 00:35:13,512 You remember Kinko's? 708 00:35:13,872 --> 00:35:18,612 Uh, now it's called the FedEx Print Center, uh, which I was, I was in a 709 00:35:18,612 --> 00:35:20,832 FedEx Print Center just a few days ago. 710 00:35:21,147 --> 00:35:21,297 In 711 00:35:21,297 --> 00:35:23,102 the middle there, it was called FedEx Kinkos. 712 00:35:23,787 --> 00:35:26,757 Yes, it wa There was, there was, that was a FedEx Kinko's. 713 00:35:26,757 --> 00:35:27,117 Yeah. 714 00:35:27,537 --> 00:35:32,307 Uh, but in the, their print server going down, that is a direct, um, 715 00:35:32,547 --> 00:35:33,987 you know, revenue generator, right? 716 00:35:33,987 --> 00:35:38,937 So if you know that, you know the different parts of your business and you 717 00:35:38,937 --> 00:35:45,237 know the, the cost that your business is going to experience when a ransomware 718 00:35:45,237 --> 00:35:49,322 attack hits, it just empowers you with the ability to make the right decisions. 719 00:35:49,742 --> 00:35:52,442 To minimize the impact on your, on your business. 720 00:35:52,442 --> 00:35:52,772 So 721 00:35:52,782 --> 00:35:53,952 Knowledge is power. 722 00:35:54,012 --> 00:35:57,432 And my other favorite saying from GI Joe is knowing is half the battle. 723 00:35:59,937 --> 00:36:00,417 Love it. 724 00:36:00,902 --> 00:36:01,982 is that from GI Joe? 725 00:36:01,982 --> 00:36:02,732 The movie? 726 00:36:03,372 --> 00:36:04,182 It's GI Joe. 727 00:36:04,272 --> 00:36:04,962 Well, it 728 00:36:05,252 --> 00:36:05,727 the TV 729 00:36:05,952 --> 00:36:06,582 cartoons. 730 00:36:06,582 --> 00:36:10,032 It's like the, at the, very end it's uh, you know, 731 00:36:10,752 --> 00:36:11,292 knowing is 732 00:36:11,292 --> 00:36:11,982 half the battle. 733 00:36:12,372 --> 00:36:13,572 would always say that at the end. 734 00:36:15,372 --> 00:36:19,962 Uh, I, for the record, not familiar with GI I, Joe, beyond the 735 00:36:19,987 --> 00:36:20,847 Oh, it's amazing. 736 00:36:21,217 --> 00:36:22,087 Cobra and. 737 00:36:22,722 --> 00:36:23,322 Yeah. 738 00:36:23,412 --> 00:36:23,922 Yeah. 739 00:36:24,012 --> 00:36:27,942 Um, so the, the next thing, another, uh, action. 740 00:36:27,942 --> 00:36:30,252 I, so we talked about doing a BIA, right? 741 00:36:30,642 --> 00:36:33,582 The next thing that we have is action items, is to review again, 742 00:36:33,582 --> 00:36:36,492 now review your insurance coverage. 743 00:36:36,702 --> 00:36:38,502 You, you want to talk about that, Mike? 744 00:36:38,502 --> 00:36:40,272 Like what kind of, what kind of stuff? 745 00:36:40,692 --> 00:36:43,932 Well, it's, it's critical because a lot there, I think there's a lot of companies 746 00:36:43,932 --> 00:36:48,492 that, that just Google cyber insurance and they get quotes and they go with the 747 00:36:48,492 --> 00:36:51,642 lowest quote and they figure they're, you know, they're the lowest premium 748 00:36:51,642 --> 00:36:53,052 and they, they figure they're covered. 749 00:36:53,112 --> 00:36:58,212 Well, you're covered based on all that fine print, and I've got 750 00:36:58,212 --> 00:36:59,982 a, a pretty interesting example. 751 00:37:00,042 --> 00:37:04,332 Uh, so in addition to, to helping companies, uh, on the defensive side. 752 00:37:04,962 --> 00:37:07,122 Uh, we also do litigation support. 753 00:37:07,122 --> 00:37:11,292 And, and in one case we were, we were working for the insurance company, 754 00:37:11,742 --> 00:37:13,962 uh, who didn't wanna pay a claim. 755 00:37:14,682 --> 00:37:20,052 And so they sent us all this data and our, our objective was to determine if, 756 00:37:20,412 --> 00:37:22,092 where, where did the attack originate? 757 00:37:22,602 --> 00:37:24,012 Was it a domestic attack? 758 00:37:24,012 --> 00:37:25,632 Was it, was it international? 759 00:37:25,902 --> 00:37:27,552 It turned out to be international. 760 00:37:27,552 --> 00:37:30,672 And they declined the, they, they declined the claim because the 761 00:37:30,672 --> 00:37:33,192 policy only covered domestic attacks. 762 00:37:35,277 --> 00:37:35,637 Wow. 763 00:37:35,892 --> 00:37:36,432 So 764 00:37:36,972 --> 00:37:41,292 it is important, uh, you know, go with a reputable insurance carrier, 765 00:37:41,322 --> 00:37:45,102 make sure you read the fine print, get an advisor or a broker to help you. 766 00:37:45,642 --> 00:37:51,912 Um, and then, you know, a lot of those, uh, a lot of that process 767 00:37:51,912 --> 00:37:56,202 stems from a questionnaire that the insurance company is gonna send you. 768 00:37:56,562 --> 00:37:59,892 And a lot of organizations, especially the small ones, don't know how to. 769 00:38:00,492 --> 00:38:01,632 Fill out that questionnaire. 770 00:38:01,632 --> 00:38:02,172 A lot of times 771 00:38:02,172 --> 00:38:05,112 it's yes, no, they don't give you the opportunity to add context. 772 00:38:05,592 --> 00:38:09,312 Uh, like there's no maybe, uh, it's either yes or no. 773 00:38:09,672 --> 00:38:13,332 Uh, and so I think a lot of organizations on in the maybe category 774 00:38:13,332 --> 00:38:17,022 will still say yes, even though they're not sure, or maybe it's not 775 00:38:17,022 --> 00:38:17,922 fully implemented. 776 00:38:18,252 --> 00:38:21,252 Well, the insurance company's gonna hold you to those answers if 777 00:38:21,252 --> 00:38:22,632 there's an incident or a breach. 778 00:38:23,052 --> 00:38:26,502 And they're gonna go, well, you said yes and you, it's actually no. 779 00:38:26,532 --> 00:38:29,562 So we're not gonna cover your claim 'cause you lied to us. 780 00:38:30,297 --> 00:38:30,747 Uh, when, 781 00:38:30,747 --> 00:38:32,637 when we establish this, this policy. 782 00:38:33,717 --> 00:38:37,707 The other thing to think about too is you can have more than one policy, uh, 783 00:38:37,707 --> 00:38:42,057 just make sure that you maintain and are fully aware of, of both of them and, you 784 00:38:42,057 --> 00:38:46,617 know, any, any attributes or requirements or stipulations in either one. 785 00:38:47,187 --> 00:38:47,457 Um. 786 00:38:49,647 --> 00:38:51,297 You know, that brings up a story. 787 00:38:51,537 --> 00:38:55,917 Do you remember Tony Curtis from Spectral Logic when he 788 00:38:55,917 --> 00:38:56,607 came on the podcast? 789 00:38:57,167 --> 00:38:57,457 Yeah. 790 00:38:58,017 --> 00:39:02,487 And so this was a company Mike that got hit with, uh, ransomware, shut down 791 00:39:02,487 --> 00:39:03,477 their entire environment. 792 00:39:03,597 --> 00:39:05,337 be in the backup industry. 793 00:39:05,337 --> 00:39:05,787 By the way, 794 00:39:06,087 --> 00:39:06,447 Yeah. 795 00:39:06,597 --> 00:39:08,217 tape library manufacturer, right? 796 00:39:08,847 --> 00:39:15,567 And he was, I think he was like head of it or something, some position like that. 797 00:39:16,287 --> 00:39:20,787 And he found out that just a week before they had signed up 798 00:39:20,787 --> 00:39:22,197 for a cyber insurance policy. 799 00:39:23,602 --> 00:39:23,842 Yeah, 800 00:39:25,082 --> 00:39:25,372 Yeah. 801 00:39:25,452 --> 00:39:27,942 was like a week or two before he was like, oh my gosh, thank God. 802 00:39:28,432 --> 00:39:28,612 well. 803 00:39:28,722 --> 00:39:30,462 they brought in all the experts and all the rest. 804 00:39:30,492 --> 00:39:33,162 I am glad it worked out for him because a lot of those, uh, a 805 00:39:33,162 --> 00:39:36,852 lot of a, a lot of policies will have a, a cooling off period. 806 00:39:36,852 --> 00:39:40,242 So you sign up today, but it's really not effective for 30 days. 807 00:39:40,542 --> 00:39:40,902 Yeah. 808 00:39:41,007 --> 00:39:44,307 So I guess the last action item is you've sort of gone 809 00:39:44,307 --> 00:39:45,927 through, you've created a BIA. 810 00:39:45,927 --> 00:39:49,527 You've done all these things and making sure that you understand 811 00:39:49,797 --> 00:39:51,657 what needs to be recovered first. 812 00:39:51,657 --> 00:39:53,487 It's kinda like Mike was talking about the prioritization. 813 00:39:54,367 --> 00:39:54,727 Right. 814 00:39:54,847 --> 00:39:57,277 So making sure you understand what is critical to your 815 00:39:57,277 --> 00:39:59,377 business, have that listed down. 816 00:39:59,377 --> 00:40:02,407 So those are the things that you focus on first, rather than say, 817 00:40:02,677 --> 00:40:06,817 Curtis's home directory, which isn't the highest priority to recover from 818 00:40:06,817 --> 00:40:07,807 a ransomware attack. 819 00:40:07,827 --> 00:40:08,452 it is to me, 820 00:40:09,007 --> 00:40:10,237 Well, it's not the first thing. 821 00:40:10,267 --> 00:40:14,017 I know it's important to you, Curtis, all the cat videos that you have, but. 822 00:40:14,302 --> 00:40:14,882 cat fitting. 823 00:40:16,637 --> 00:40:18,287 I think that those are great points. 824 00:40:18,287 --> 00:40:22,482 And so in your BIA one of the, one of the outputs of your BIA as far as 825 00:40:22,487 --> 00:40:26,327 prioritization goes, it's not just the criticality of a particular system. 826 00:40:26,852 --> 00:40:29,372 But it's also the recovery point objective. 827 00:40:29,372 --> 00:40:32,762 So is is the, does that system have a lot of journaling that 828 00:40:32,762 --> 00:40:37,922 would allow us to do manual input or manual uh, uh, transactions? 829 00:40:38,192 --> 00:40:39,032 Uh, and so 830 00:40:41,492 --> 00:40:46,742 just as an example, we had a, a, a ransomware incident with a client who got 831 00:40:46,742 --> 00:40:49,622 hit on a Thursday night, uh, 10 o'clock. 832 00:40:49,802 --> 00:40:52,532 And we knew exactly what servers they hit and how it happened. 833 00:40:53,162 --> 00:40:53,642 Um. 834 00:40:54,447 --> 00:40:58,407 We were comf, we were comfortable thinking that Thursday night 835 00:40:58,407 --> 00:40:59,547 is when the attack happened. 836 00:40:59,547 --> 00:41:01,287 It wasn't some time in the past. 837 00:41:01,857 --> 00:41:04,497 Well, we still needed to have that conversation with the client. 838 00:41:04,497 --> 00:41:10,617 Well, how far back, how many days or weeks back should we target to recover from? 839 00:41:11,427 --> 00:41:14,487 Because we don't wanna just do earlier today or yesterday. 840 00:41:14,517 --> 00:41:15,597 'cause that may also have. 841 00:41:16,122 --> 00:41:20,412 The, you know, the attack, uh, artifacts in it, malware, whatever it was. 842 00:41:20,982 --> 00:41:25,692 And so having a good understanding of, of their backup strategy and 843 00:41:25,692 --> 00:41:28,242 their capabilities, we were able to say, all right, well, let's, 844 00:41:28,242 --> 00:41:31,182 because of, and in this case, it was a heavily virtualized environment. 845 00:41:31,482 --> 00:41:32,622 Well, let's go with Tuesday. 846 00:41:33,132 --> 00:41:36,612 And let's, let's run all our, all, all of our analysis against 847 00:41:36,612 --> 00:41:40,092 Tuesday's, uh, restored systems before they, we put 'em back online. 848 00:41:40,092 --> 00:41:42,132 If they're clean, then we'll go with Tuesday. 849 00:41:42,132 --> 00:41:44,562 If not, then we can go with Monday or whatever. 850 00:41:45,072 --> 00:41:50,442 Uh, a lot of organizations, uh, still have this full incremental, 851 00:41:50,532 --> 00:41:54,102 you know, weekly that kind of, uh, backup schedule because they're, they, 852 00:41:54,102 --> 00:41:57,042 they haven't adopted virtualization or whatever the case might be. 853 00:41:57,552 --> 00:42:02,322 Uh, and so if, if a, a system was compromised between those fulls. 854 00:42:02,622 --> 00:42:04,992 Then you've gotta do fulls plus the incrementals to get you 855 00:42:04,992 --> 00:42:06,222 back to some restore point. 856 00:42:06,852 --> 00:42:11,892 Well, your BIA is going to help you determine how far back can I go before it 857 00:42:11,892 --> 00:42:16,842 hurts, and if I have to go back further, do I have transaction, you know, logs, 858 00:42:16,842 --> 00:42:19,782 journaling to help me fill in the gaps? 859 00:42:20,202 --> 00:42:24,192 Uh, and if not, then, you know, here's the impact, uh, that I can expect. 860 00:42:24,762 --> 00:42:29,437 Um, one of the other things I was gonna add, uh, and I, I 861 00:42:29,442 --> 00:42:30,972 lost my train of thought a bit. 862 00:42:31,482 --> 00:42:32,022 Um. 863 00:42:33,657 --> 00:42:34,347 And what was it? 864 00:42:36,432 --> 00:42:36,792 Let's see. 865 00:42:37,362 --> 00:42:37,692 You were, 866 00:42:40,072 --> 00:42:41,337 Uh, it was a good point. 867 00:42:41,337 --> 00:42:41,757 It's a good point. 868 00:42:41,847 --> 00:42:45,447 Oh, here's a, here's another funny example. 869 00:42:45,507 --> 00:42:49,527 Funny for now that it's, it's years later, but, uh, 870 00:42:50,652 --> 00:42:52,107 plus time equals comedy. 871 00:42:53,272 --> 00:42:56,097 it was a telecom, $5 billion telecom. 872 00:42:56,667 --> 00:43:02,787 Uh, and they had an outage, and the outage, uh, sat on top of a legacy server. 873 00:43:03,267 --> 00:43:08,757 That legacy server continued to be backed up every day, but it was backed up, uh, 874 00:43:09,237 --> 00:43:12,267 initially to nine track backup tape. 875 00:43:15,567 --> 00:43:15,777 Give, 876 00:43:15,777 --> 00:43:24,657 The backup, the backup technology was, was in, in current day was the, um, DLT tapes. 877 00:43:25,137 --> 00:43:25,437 Yep. 878 00:43:26,262 --> 00:43:32,412 But they didn't create a base system backup, a bare metal backup on DLT tape. 879 00:43:32,502 --> 00:43:35,502 It was the, the only bare metal backup was on nine track. 880 00:43:36,792 --> 00:43:39,372 So when they had to recover this server, they couldn't, because 881 00:43:39,372 --> 00:43:43,032 they couldn't find a nine track tape to recover the tape from. 882 00:43:45,372 --> 00:43:49,692 So yeah, they were down hard for over a month until we 883 00:43:49,767 --> 00:43:50,067 know what? 884 00:43:50,082 --> 00:43:50,712 on eBay. 885 00:43:51,457 --> 00:43:51,837 Yep. 886 00:43:52,437 --> 00:43:53,162 Not uncommon. 887 00:43:53,877 --> 00:43:54,207 yeah. 888 00:43:54,207 --> 00:43:57,537 You know what, uh, when you were talking about, um. 889 00:43:58,182 --> 00:44:00,702 Just like, you know, switching to alternative methods. 890 00:44:01,032 --> 00:44:04,662 Remind me there, I think it was a, a Xerox commercial. 891 00:44:05,292 --> 00:44:08,982 When they go, if your printers go down, do your people go, it's okay. 892 00:44:08,982 --> 00:44:10,812 We'll just use carbon paper. 893 00:44:15,522 --> 00:44:17,232 It's like, no, no, they're not gonna do. 894 00:44:18,152 --> 00:44:21,062 Well, yeah, I think, I think we've given, uh, people enough to think 895 00:44:21,062 --> 00:44:25,382 about and to, um, you know, some action items where they can go work. 896 00:44:25,412 --> 00:44:29,072 Uh, it sounds like, uh, they'll do their BIA in a day or two, 897 00:44:29,072 --> 00:44:30,302 and then, uh, they'll be good. 898 00:44:31,112 --> 00:44:31,772 So, uh, 899 00:44:31,917 --> 00:44:32,217 the way. 900 00:44:32,672 --> 00:44:33,362 knock it out. 901 00:44:33,362 --> 00:44:35,372 Just, you know, it's like a lot of things. 902 00:44:35,402 --> 00:44:37,952 Just, uh, do it sooner than later. 903 00:44:38,042 --> 00:44:39,092 Doesn't matter when. 904 00:44:39,212 --> 00:44:42,362 The only thing that I know is it doesn't matter when you invent a time machine. 905 00:44:43,082 --> 00:44:43,562 All right. 906 00:44:43,682 --> 00:44:46,322 And with that, uh, that is a wrap.