1
00:00:00,000 --> 00:00:01,656
ATR2500x-USB Microphone & Logitech BRIO-2:
If you're like the majority of people

2
00:00:01,656 --> 00:00:05,736
I've talked to, you don't really have an
incident response plan for ransomware.

3
00:00:06,576 --> 00:00:10,986
That means you'll be flying by the
seat of your pants when you get hit.

4
00:00:11,736 --> 00:00:14,676
The good news is I have
just the episode for you.

5
00:00:15,036 --> 00:00:19,686
It's an extremely popular episode from
earlier this year where we talk with

6
00:00:19,716 --> 00:00:25,596
Melissa Palmer about what to put in
your response plan and how to build it.

7
00:00:26,226 --> 00:00:30,036
It was so popular that it makes the
perfect episode for our winter break.

8
00:00:30,636 --> 00:00:34,146
Even if you've heard it
before, it's worth a second.

9
00:00:34,146 --> 00:00:34,536
Listen.

10
00:00:34,911 --> 00:00:36,951
If this is your first
time listening to us.

11
00:00:36,981 --> 00:00:40,341
Hi, I'm W Curtis Preston AKA Mr.

12
00:00:40,341 --> 00:00:40,911
Backup.

13
00:00:41,271 --> 00:00:44,961
And I've dedicated my career of over
three decades to helping those of

14
00:00:44,961 --> 00:00:50,331
you that have the job that I had when
I first started the backup person.

15
00:00:50,931 --> 00:00:52,881
This podcast is just for you.

16
00:00:53,211 --> 00:00:56,631
We turned backup admins
into cyber recovery heroes.

17
00:00:56,811 --> 00:00:58,941
This is the backup wrap up.

18
00:01:11,678 --> 00:01:12,848
ATR2500x-USB Microphone-1:
Welcome to the show.

19
00:01:12,987 --> 00:01:15,357
W. Curtis Preston: I'm your
host, W Curtis Preston, aka a Mr.

20
00:01:15,357 --> 00:01:21,327
Backup, and I have with me my super
expensive vacation planner coordinator.

21
00:01:22,317 --> 00:01:23,097
How's it going?

22
00:01:23,347 --> 00:01:23,937
Prasanna

23
00:01:24,617 --> 00:01:27,227
Prasanna Malaiyandi: I'm doing
well, Curtis, how are things going?

24
00:01:27,827 --> 00:01:28,727
Are you excited?

25
00:01:28,757 --> 00:01:29,237
We are.

26
00:01:29,327 --> 00:01:31,817
I we're having technical
difficulties, as you could tell.

27
00:01:31,822 --> 00:01:35,297
We're trying to keep this real, but
yes, doing this for the fifth ta,

28
00:01:35,357 --> 00:01:37,157
fifth time, it's a little hard, but

29
00:01:39,252 --> 00:01:44,202
W. Curtis Preston: I am excited, um, uh,
and my wife is starting to get excited.

30
00:01:44,202 --> 00:01:47,592
I started showing her some
pictures a while ago and she's

31
00:01:47,592 --> 00:01:49,182
been like downplaying it.

32
00:01:49,182 --> 00:01:51,072
Like she doesn't want to get excited.

33
00:01:51,072 --> 00:01:56,362
She wants to be sort of, Excited, but
I needed her to prep for the vacation

34
00:01:56,362 --> 00:02:01,012
because this is, so this is, we're
going to the Maldives, uh, which for

35
00:02:01,017 --> 00:02:05,152
those that don't know, is a series of
islands off the southern coast of India.

36
00:02:05,632 --> 00:02:11,272
And, um, and, and I'm on one of those
islands and, and it's a tiny island that

37
00:02:11,272 --> 00:02:14,632
literally we could walk from one end to
the other in probably about 10 minutes.

38
00:02:15,172 --> 00:02:16,732
Um, and.

39
00:02:17,892 --> 00:02:20,782
We're staying in one of
those things over the water,

40
00:02:20,922 --> 00:02:22,092
Prasanna Malaiyandi:
Oh, the Villas over the.

41
00:02:22,552 --> 00:02:24,652
W. Curtis Preston: villas over the
water with our, we have our own

42
00:02:24,652 --> 00:02:28,102
pool, and then right on the other
side of the pool is the ocean.

43
00:02:28,462 --> 00:02:29,362
Um, I mean, it's

44
00:02:29,367 --> 00:02:30,562
really, really cool.

45
00:02:31,252 --> 00:02:32,692
Prasanna Malaiyandi: Can I
stow away in your luggage

46
00:02:33,512 --> 00:02:35,942
W. Curtis Preston: Yeah, I
mean, it looks really cool.

47
00:02:36,024 --> 00:02:37,344
uh, we're very excited.

48
00:02:37,629 --> 00:02:42,849
We're having our, a repeat guest
and, um, we, we had her on, uh, a few

49
00:02:42,849 --> 00:02:47,799
weeks ago and we got talking about
ransomware, one of our favorite topics.

50
00:02:48,239 --> 00:02:52,859
And we, we, we got into this phase
where it was like, you know what?

51
00:02:52,859 --> 00:02:57,359
That, that is a great conversation,
but there's no way we could, we could

52
00:02:57,359 --> 00:02:59,219
do it justice on that recording.

53
00:03:00,059 --> 00:03:02,219
So it was, Hey, we're
gonna have her come back.

54
00:03:02,249 --> 00:03:08,129
And, uh, she is, uh, she's been in the
industry for quite a while and she's been

55
00:03:08,129 --> 00:03:10,649
specializing in, uh, she's done VMware.

56
00:03:10,919 --> 00:03:11,399
Uh, she did.

57
00:03:11,399 --> 00:03:18,034
Now she's, she's working, uh, Starting
to specialize in security and ransomware.

58
00:03:18,274 --> 00:03:23,254
So we're, uh, and she's the author
of the vmiss.net blog, and we are

59
00:03:23,254 --> 00:03:25,294
excited to have her on the podcast.

60
00:03:25,294 --> 00:03:29,104
Again, Melissa Palmer, aka @vmiss.

61
00:03:29,584 --> 00:03:29,954
How's it going?

62
00:03:30,064 --> 00:03:30,294
you for

63
00:03:30,294 --> 00:03:31,119
Melissa Palmer: having me back.

64
00:03:31,119 --> 00:03:32,019
It's going good.

65
00:03:32,259 --> 00:03:33,639
Prasanna Malaiyandi: I was surprised
that you were like, Ooh, I'll

66
00:03:33,639 --> 00:03:35,289
come back on the podcast after

67
00:03:35,324 --> 00:03:37,269
Melissa Palmer: yeah, that was,
of course, when I come back

68
00:03:38,499 --> 00:03:39,159
Prasanna Malaiyandi: Well, thank you for

69
00:03:39,159 --> 00:03:39,519
Melissa Palmer: scare.

70
00:03:39,519 --> 00:03:40,569
It takes a lot more.

71
00:03:40,929 --> 00:03:41,349
You said it.

72
00:03:41,349 --> 00:03:42,819
I've been in around this
industry for a while.

73
00:03:42,819 --> 00:03:45,369
It takes a lot more than that to
scare me away after all these years.

74
00:03:46,794 --> 00:03:49,454
Prasanna Malaiyandi: And Curtis, I
think, uh, now might be a good time

75
00:03:49,459 --> 00:03:50,754
to put out our normal disclaimer.

76
00:03:51,669 --> 00:03:53,774
W. Curtis Preston: Yeah, prasanna
and I work for different companies.

77
00:03:54,074 --> 00:03:55,124
Uh, he works for Zoom.

78
00:03:55,124 --> 00:03:56,174
I work for Druva.

79
00:03:56,294 --> 00:04:01,154
This is not a podcast of either company
and the opinions that you hear are ours.

80
00:04:01,424 --> 00:04:06,699
Also, be sure to rate us at, uh,
Uh, rate this podcast.com/restore

81
00:04:07,209 --> 00:04:10,209
and, um, if you wanna join the
conversation, reach out to me.

82
00:04:10,209 --> 00:04:13,119
By the way, I, I gotta give a
bunch of ways cuz I, I got some

83
00:04:13,489 --> 00:04:15,429
complaints and people say, well,
I don't use Twitter anymore.

84
00:04:15,429 --> 00:04:17,079
So how you give your Twitter address.

85
00:04:17,379 --> 00:04:21,399
So my LinkedIn is, you
know, linkedin.com/ally/mr.

86
00:04:21,404 --> 00:04:21,849
Backup.

87
00:04:22,209 --> 00:04:23,079
Uh, you can find me there.

88
00:04:23,509 --> 00:04:25,129
Uh, you can find me on Facebook.

89
00:04:25,129 --> 00:04:29,869
I'm on Facebook, Facebook Messenger,
but my email is, uh, w Curtis Preston.

90
00:04:30,349 --> 00:04:32,179
Uh, my Facebook is w Curtis Preston.

91
00:04:32,184 --> 00:04:34,069
I'm pretty easy to find
if you're looking for me.

92
00:04:34,549 --> 00:04:38,239
Um, and reach out to me and we'll get
you in on the, on the conversation.

93
00:04:38,779 --> 00:04:39,379
Yeah.

94
00:04:39,469 --> 00:04:47,989
Um, the, um, this, this thing of
responding to a ransomware attack,

95
00:04:48,059 --> 00:04:51,349
this, this is something I've been
spending a lot of time on lately, uh,

96
00:04:51,349 --> 00:04:55,279
because I've been, I'm, I'm working
on writing my next book, which will be

97
00:04:55,279 --> 00:04:57,589
about responding to ransomware attacks.

98
00:04:57,979 --> 00:05:03,379
You know, one of the things that you
said in the pre-call was that if, if

99
00:05:03,379 --> 00:05:06,499
the first time you're thinking about
responding to a ransomware attack is

100
00:05:06,499 --> 00:05:08,389
after you got a ransomware attack,

101
00:05:09,129 --> 00:05:09,909
Melissa Palmer: Um,

102
00:05:10,099 --> 00:05:11,209
W. Curtis Preston: it's not so good.

103
00:05:11,209 --> 00:05:11,539
Right.

104
00:05:11,914 --> 00:05:13,249
, 
there's a lot of, yeah.

105
00:05:13,249 --> 00:05:16,399
In fact, when I was looking at the,
sort of the outline that I've been

106
00:05:16,399 --> 00:05:21,859
working on for the book, most of the
outline is the first half , right?

107
00:05:22,309 --> 00:05:25,489
Everything that you need
to do before, right.

108
00:05:25,519 --> 00:05:26,179
Um,

109
00:05:26,289 --> 00:05:29,079
Melissa Palmer: that's, it's like
you can't just talk about ransomware

110
00:05:29,079 --> 00:05:32,589
recovery, Right, Like, it, it, it's
a hard topic to talk about because

111
00:05:32,589 --> 00:05:35,529
you're like, there's all this other stuff
that if you haven't done it, guess what?

112
00:05:35,534 --> 00:05:36,849
You are not gonna be able to recover.

113
00:05:36,849 --> 00:05:38,349
So we can't just talk about recovering.

114
00:05:38,859 --> 00:05:39,669
It doesn't work that way.

115
00:05:40,264 --> 00:05:40,624
W. Curtis Preston: Right.

116
00:05:40,624 --> 00:05:44,865
It's sort of like I, I've made the
joke, uh, a few times probably on

117
00:05:44,870 --> 00:05:47,854
the pod where I've said, listen,
you know, I've been in the backup

118
00:05:47,854 --> 00:05:49,474
industry, you know, a long time.

119
00:05:49,504 --> 00:05:52,924
I, I've decided to give up backups and
I'm just gonna skip straight to restores.

120
00:05:53,284 --> 00:05:53,644
Right?

121
00:05:53,794 --> 00:05:56,104
You can't really , you
can't really do that.

122
00:05:56,834 --> 00:05:59,744
Just like I've also said that if I'd
have known how great grandkids were,

123
00:05:59,744 --> 00:06:01,124
I would've just gone straight to them.

124
00:06:01,544 --> 00:06:04,004
Um, but not, not really

125
00:06:04,269 --> 00:06:05,319
Prasanna Malaiyandi:
It's not how it works.

126
00:06:05,469 --> 00:06:05,889
Yeah.

127
00:06:06,014 --> 00:06:06,524
W. Curtis Preston: Yeah.

128
00:06:06,934 --> 00:06:07,524
Melissa Palmer: It is a really

129
00:06:07,529 --> 00:06:08,514
good analogy though.

130
00:06:08,874 --> 00:06:09,234
It really

131
00:06:09,439 --> 00:06:10,909
W. Curtis Preston: Yeah, it is, it is.

132
00:06:11,059 --> 00:06:13,489
By the way, you want a
little, little sad thing.

133
00:06:14,269 --> 00:06:18,709
So my granddaughter and her
mother and, and her husband,

134
00:06:19,189 --> 00:06:22,279
uh, are, this is their last day

135
00:06:22,554 --> 00:06:24,534
Prasanna Malaiyandi: Oh,
I was gonna ask you about

136
00:06:24,649 --> 00:06:27,559
W. Curtis Preston: been living here for
a while, and they're moving out tomorrow.

137
00:06:28,189 --> 00:06:28,539
So,

138
00:06:28,884 --> 00:06:29,084
Prasanna Malaiyandi: Hmm.

139
00:06:29,819 --> 00:06:30,259
W. Curtis Preston: little sad moment.

140
00:06:30,409 --> 00:06:31,189
Little sad moment.

141
00:06:31,884 --> 00:06:32,234
Prasanna Malaiyandi: No.

142
00:06:32,869 --> 00:06:37,449
W. Curtis Preston: Um, but, uh, anyway,
so, you know, sorry to bring that down.

143
00:06:38,374 --> 00:06:42,004
So let's talk about what,
what do you think, Melissa?

144
00:06:42,214 --> 00:06:48,754
Let, let's sort of go through those things
that we really needed to have done before.

145
00:06:49,044 --> 00:06:51,594
Melissa Palmer: Uh, well, lemme, lemme
try to set the stage a little bit.

146
00:06:51,624 --> 00:06:55,074
Like, does everybody remember like,
the disaster recovery tests, like

147
00:06:55,074 --> 00:06:58,704
back in the day, you go to the
colo, you got the checkbook, the.

148
00:06:58,794 --> 00:06:59,114
the

149
00:06:59,949 --> 00:07:02,799
Clipboard you make, the checkbox
isn't like, I don't know, you play

150
00:07:02,799 --> 00:07:04,539
doom for a while and eat some food.

151
00:07:04,539 --> 00:07:06,969
Someone restores a server and it's like,

152
00:07:06,969 --> 00:07:08,589
well, it kind of worked and we're good.

153
00:07:08,589 --> 00:07:08,649
Yeah,

154
00:07:09,009 --> 00:07:10,239
that's how old I am.

155
00:07:10,569 --> 00:07:13,749
Um, so and then you're
like, oh, it kind of worked.

156
00:07:13,754 --> 00:07:16,539
So we passed our d r test,
but we can't actually recover.

157
00:07:16,689 --> 00:07:16,959
Right?

158
00:07:17,709 --> 00:07:20,529
So what you need to do is actually
do a ransomware recovery test where

159
00:07:20,529 --> 00:07:21,999
you actually recover everything.

160
00:07:22,899 --> 00:07:25,719
There's a novel concept, and when you do
that, you're gonna figure out all the.

161
00:07:26,639 --> 00:07:28,929
but you didn't do cuz it's not
gonna work or something's not gonna

162
00:07:29,019 --> 00:07:29,409
whatever.

163
00:07:29,829 --> 00:07:33,459
But it, it's, you know, talking
from the backup lens cuz I was

164
00:07:33,459 --> 00:07:34,899
at Veeam for quite some time.

165
00:07:35,409 --> 00:07:39,849
Um, something I talked a lot about with
Veeam customers was, you know, trying to

166
00:07:39,849 --> 00:07:41,949
understand the whole recovery process.

167
00:07:41,954 --> 00:07:45,129
Cuz if I'm the backup admin and
we get ransomware, I don't just

168
00:07:45,129 --> 00:07:47,109
go start restoring stuff all over.

169
00:07:47,349 --> 00:07:48,099
Like that's not what happens.

170
00:07:48,099 --> 00:07:51,129
It's not like, oh no, right somewhere
tech, let me start restoring servers.

171
00:07:51,129 --> 00:07:51,249
We'll

172
00:07:51,519 --> 00:07:52,239
be back online in 20

173
00:07:52,244 --> 00:07:52,539
minutes.

174
00:07:52,539 --> 00:07:53,589
Like it doesn't work that way.

175
00:07:55,189 --> 00:07:56,289
, you have to figure out what happened.

176
00:07:56,319 --> 00:07:58,419
Before you can start restoring, you
have to figure out what happened.

177
00:07:58,419 --> 00:08:00,099
You have to figure out if the
threat actors are still around.

178
00:08:00,099 --> 00:08:02,259
You have to understand what was impacted.

179
00:08:02,619 --> 00:08:07,659
I have heard a lot of people say,
um, oh, well, we treat ransomware

180
00:08:07,659 --> 00:08:09,279
different and we just recover in place.

181
00:08:09,279 --> 00:08:10,719
So we're good to go.

182
00:08:10,989 --> 00:08:11,469
And I'll go

183
00:08:11,469 --> 00:08:12,759
back to the little VMware.

184
00:08:12,759 --> 00:08:14,529
Yeah, I'll go back to the
VMware ransomware thing.

185
00:08:14,529 --> 00:08:16,689
Well, if your VMware environment
is ransomware, guess what?

186
00:08:16,689 --> 00:08:19,509
You're not recovering in place
cuz there's nowhere to recover to.

187
00:08:20,139 --> 00:08:22,299
Uh, so it's understanding
all those different things.

188
00:08:22,299 --> 00:08:25,479
You need to have some kind of
understanding of what happened

189
00:08:25,479 --> 00:08:26,409
before you can recover.

190
00:08:26,829 --> 00:08:30,489
And that is generally driven by the
incident response process, which is

191
00:08:30,489 --> 00:08:31,779
gonna be driven by the security team.

192
00:08:32,619 --> 00:08:35,829
So again, if you haven't talked
to the security team before,

193
00:08:35,829 --> 00:08:37,539
ransomware has attacked you.

194
00:08:38,154 --> 00:08:39,774
You're gonna have a bad time.

195
00:08:40,089 --> 00:08:44,199
Prasanna Malaiyandi: Or vice versa, if the
security team hasn't talked to you about

196
00:08:44,199 --> 00:08:46,719
how backup integrates into that process.

197
00:08:46,734 --> 00:08:47,574
Melissa Palmer: that's really scary.

198
00:08:47,634 --> 00:08:49,554
That's really, That's really,
that's really, disturbing.

199
00:08:50,244 --> 00:08:50,784
Those are actually

200
00:08:50,784 --> 00:08:51,894
really even, I think that's

201
00:08:51,894 --> 00:08:52,464
scarier.

202
00:08:53,764 --> 00:08:56,614
W. Curtis Preston: I think it's,
it's a, it's a combination, right?

203
00:08:56,914 --> 00:09:00,934
Well, you know, uh, yesterday, I
think that was yesterday, we recorded

204
00:09:01,384 --> 00:09:06,574
a, a great podcast, uh, by the way,
with Tom from Gestalt, um, that,

205
00:09:06,604 --> 00:09:09,614
that, uh, net, uh @networkingnerd.

206
00:09:09,814 --> 00:09:10,174
Yeah.

207
00:09:10,789 --> 00:09:15,889
and he, uh, we were talking a lot
about the networking side of the, the

208
00:09:16,379 --> 00:09:16,879
response, right?

209
00:09:17,059 --> 00:09:18,589
Shutting down things.

210
00:09:18,949 --> 00:09:24,259
Um, and, and using a combination of
technologies, many of which are easier

211
00:09:24,259 --> 00:09:26,969
to use if you, if you set them up front.

212
00:09:27,339 --> 00:09:27,729
Right.

213
00:09:28,089 --> 00:09:32,229
And, uh, talking about things like
VLANs and, uh, you know, like one of

214
00:09:32,229 --> 00:09:36,159
the things we talked about was having
a VLAN for all of your desktops and

215
00:09:36,159 --> 00:09:40,779
laptops, so that if you want to stop
everybody from doing anything, you

216
00:09:40,784 --> 00:09:42,999
just shut off those VLANs and boom.

217
00:09:43,509 --> 00:09:48,039
Um, there, you know, instead of having
to notify 5,000 users, hey, stop doing

218
00:09:48,039 --> 00:09:50,289
anything, you just shut off their network.

219
00:09:50,289 --> 00:09:51,819
So they can't, they can't do anything.

220
00:09:52,119 --> 00:09:56,224
And then if stuff is still happening,
, um, well, it's not the users,

221
00:09:56,224 --> 00:09:56,494
right?

222
00:09:56,494 --> 00:09:57,814
It's, it's malware,

223
00:09:58,024 --> 00:09:58,384
right?

224
00:09:58,544 --> 00:09:59,724
Prasanna Malaiyandi: back to segmentation.

225
00:09:59,824 --> 00:10:03,004
W. Curtis Preston: know, yeah, the,
the network segmentation and the, the

226
00:10:03,444 --> 00:10:11,139
security part, I think, um, What, what,
what role do you think the, I'll ask you

227
00:10:11,139 --> 00:10:12,639
what you think before I say what I think

228
00:10:13,479 --> 00:10:20,889
So what role do you think cyber insurance
companies and then the, the companies

229
00:10:20,889 --> 00:10:22,749
that they can put you in touch with?

230
00:10:22,809 --> 00:10:23,529
The, the

231
00:10:23,759 --> 00:10:25,739
Melissa Palmer: Cyber insurance is
becoming more and more interesting

232
00:10:25,744 --> 00:10:27,869
cuz it gets to the point where they
hand you the list of things you

233
00:10:27,869 --> 00:10:30,089
need to do before they'll issue
your policy and guess what you're

234
00:10:30,089 --> 00:10:31,529
gonna probably be able to cover anyway.

235
00:10:31,979 --> 00:10:35,399
Um, but a big part of, I've seen
in a lot of policies lately is

236
00:10:35,404 --> 00:10:40,109
having, um, basically an instant
response from on retainer ready to go

237
00:10:40,169 --> 00:10:41,339
as part of your policy.

238
00:10:41,609 --> 00:10:41,789
And

239
00:10:41,789 --> 00:10:42,989
I think that is invaluable.

240
00:10:43,049 --> 00:10:43,169
I.

241
00:10:43,984 --> 00:10:46,439
, everybody should have some kinda
relationship with an IR firm

242
00:10:46,439 --> 00:10:47,549
if you can't do it in house.

243
00:10:47,549 --> 00:10:49,589
And uh, even if you can, right?

244
00:10:49,594 --> 00:10:51,899
Sometimes you do still need
that outside perspective.

245
00:10:51,899 --> 00:10:56,819
I know a lot of larger orgs are like,
no, no, we do our own ir, well, you do

246
00:10:56,819 --> 00:10:59,819
your own ir, but you're not dealing with
ransomware every day and these people are

247
00:10:59,824 --> 00:11:01,469
so you might want a little bit of help.

248
00:11:02,424 --> 00:11:03,024
W. Curtis Preston: Yeah.

249
00:11:03,114 --> 00:11:03,654
Yeah.

250
00:11:03,774 --> 00:11:08,064
Um, you know, um, I hate to do it, but
a another, another movie reference.

251
00:11:08,064 --> 00:11:12,774
I just saw the , the movie plane, and
you know, the plane goes down in the

252
00:11:12,774 --> 00:11:16,044
middle of nowhere and they brought in
the guy, they brought in the incident

253
00:11:16,044 --> 00:11:18,684
response guy basically once he showed up.

254
00:11:18,714 --> 00:11:19,274
Right.

255
00:11:19,884 --> 00:11:21,894
See, there's a movie
reference for everything,

256
00:11:22,214 --> 00:11:22,814
Melissa Palmer: I haven't, I

257
00:11:22,814 --> 00:11:24,554
can't tell you the last
movie I've watched.

258
00:11:24,554 --> 00:11:25,334
I really can't.

259
00:11:25,424 --> 00:11:25,664
I don't

260
00:11:25,834 --> 00:11:29,034
W. Curtis Preston: I can, I
can, I can pull up my app, uh,

261
00:11:29,064 --> 00:11:30,984
cuz I have the Regal Unlimited.

262
00:11:31,004 --> 00:11:32,384
Melissa Palmer: tell you
the last thing I watched.

263
00:11:32,384 --> 00:11:34,344
I can't tell you the last movie
I watched, cuz I don't remember.

264
00:11:35,544 --> 00:11:38,244
W. Curtis Preston: I, I, yeah,
I, I saw like three this week.

265
00:11:38,244 --> 00:11:38,694
So

266
00:11:39,264 --> 00:11:40,834
in, in the theaters

267
00:11:41,279 --> 00:11:43,859
Prasanna Malaiyandi: so back to
the cyber insurance from movies.

268
00:11:44,099 --> 00:11:44,459
Uh,

269
00:11:44,699 --> 00:11:45,569
I, yes.

270
00:11:45,869 --> 00:11:46,049
Yeah.

271
00:11:46,169 --> 00:11:50,909
No, but, but, but I think, well, this
is one of the points that I remember

272
00:11:50,909 --> 00:11:54,809
because remember when Tony came on from
SPECT Logic, Curtis, and he was like,

273
00:11:54,839 --> 00:11:56,459
oh my God, they got hit with ransomware.

274
00:11:56,459 --> 00:11:59,879
And he's like, just the previous month
they had signed up for cyber insurance.

275
00:11:59,879 --> 00:12:03,479
They had an IR firm come in, give
them sort of the list of, Hey, here's

276
00:12:03,479 --> 00:12:04,739
everything you need to do to help.

277
00:12:06,149 --> 00:12:06,284
Right.

278
00:12:06,284 --> 00:12:09,944
And he was like, that was probably the
most valuable thing of that sort of

279
00:12:09,944 --> 00:12:13,514
cyber insurance policy was having the
experts who could walk you through.

280
00:12:14,259 --> 00:12:17,589
W. Curtis Preston: And it, and it
wasn't even like he, he was just

281
00:12:17,589 --> 00:12:20,469
lucky enough to have already,
you know, contracted with them.

282
00:12:20,469 --> 00:12:20,829
Right.

283
00:12:21,099 --> 00:12:23,619
But the best I think would be to

284
00:12:24,184 --> 00:12:27,339
, 
well, not that you would know this, but
to do it not a month in advance, but

285
00:12:27,344 --> 00:12:28,029
obviously way in

286
00:12:28,254 --> 00:12:28,814
Melissa Palmer: right.

287
00:12:28,869 --> 00:12:31,719
W. Curtis Preston: to get, and to give
you some time to work with the incident

288
00:12:31,724 --> 00:12:36,729
response team and to make sure that
you are doing the things that they want

289
00:12:36,779 --> 00:12:38,699
Melissa Palmer: but that's like
that's like the problem, right?

290
00:12:38,699 --> 00:12:41,969
Like it's not, if it's when,
and you don't know when.

291
00:12:41,969 --> 00:12:44,369
It could be tomorrow, it could be
next week, it could be next month.

292
00:12:44,369 --> 00:12:44,969
It could be next year.

293
00:12:44,969 --> 00:12:45,509
Like you don't

294
00:12:45,594 --> 00:12:47,034
W. Curtis Preston: It could
have been three weeks ago.

295
00:12:47,369 --> 00:12:49,049
Melissa Palmer: and you just
haven't realized it yet, right?

296
00:12:49,164 --> 00:12:49,644
W. Curtis Preston: Yeah.

297
00:12:50,114 --> 00:12:50,894
Prasanna Malaiyandi: Do it today.

298
00:12:51,284 --> 00:12:51,584
Yeah.

299
00:12:51,629 --> 00:12:52,229
Melissa Palmer: my favorite.

300
00:12:52,914 --> 00:12:53,484
W. Curtis Preston: Yeah.

301
00:12:54,324 --> 00:12:58,844
Uh, so, which is why it doesn't
matter when you invent a time machine.

302
00:13:00,389 --> 00:13:01,769
Melissa Palmer: You know,
I have bad news to you.

303
00:13:02,444 --> 00:13:02,934
W. Curtis Preston: What

304
00:13:02,969 --> 00:13:04,469
Melissa Palmer: I haven't
invented a time machine

305
00:13:04,769 --> 00:13:05,879
because there are certain

306
00:13:05,884 --> 00:13:07,469
points I've always promised to myself.

307
00:13:07,469 --> 00:13:10,739
If I invented the time machine, I
would go back to this point and tell

308
00:13:10,739 --> 00:13:12,389
myself I invented the time machine.

309
00:13:12,389 --> 00:13:14,789
And if that hasn't happened,
I haven't invented it because

310
00:13:14,794 --> 00:13:17,039
time is not linear, right?

311
00:13:17,044 --> 00:13:19,769
So I haven't invented a time machine.

312
00:13:19,889 --> 00:13:21,179
I'm very upset about that.

313
00:13:21,189 --> 00:13:21,549
W. Curtis Preston: Yeah.

314
00:13:21,549 --> 00:13:22,119
Me neither.

315
00:13:23,059 --> 00:13:29,559
Um, but, um, well, it's been a weird,
it's been, we've been jumping in and out

316
00:13:29,559 --> 00:13:31,389
of the topic here on this podcast, but,

317
00:13:32,309 --> 00:13:33,269
Prasanna Malaiyandi: Incident response.

318
00:13:33,759 --> 00:13:34,029
W. Curtis Preston: yeah.

319
00:13:34,029 --> 00:13:36,849
So we, we, we get the cyber
insurance folks because I

320
00:13:36,849 --> 00:13:38,409
think in the, in the initial.

321
00:13:39,959 --> 00:13:44,379
Ransomware phase, what people
thought of cyber insurance was just a

322
00:13:44,379 --> 00:13:48,219
company to pay their ransom for you,
and that they're definitely saying

323
00:13:48,289 --> 00:13:49,809
they're not interested in it anymore.

324
00:13:50,159 --> 00:13:50,579
Melissa Palmer: Yeah.

325
00:13:50,999 --> 00:13:51,389
And there's

326
00:13:51,389 --> 00:13:53,459
more costs beyond the ransom, right?

327
00:13:53,459 --> 00:13:53,609
So

328
00:13:53,609 --> 00:13:55,589
you paid the ransom, but
what about everything else?

329
00:13:55,679 --> 00:13:57,209
Um, that's the thing.

330
00:13:57,209 --> 00:14:01,199
And policies have changed over time, like,
back in the day a couple years ago, right?

331
00:14:01,199 --> 00:14:05,159
Like before the pandemic, uh, it was
like easy to get cyber insurance.

332
00:14:05,159 --> 00:14:08,639
Like, oh yeah, I'll take a cyber insurance
policy for 5 million, please, whatever.

333
00:14:08,639 --> 00:14:08,729
And

334
00:14:08,729 --> 00:14:09,539
now it's hard.

335
00:14:09,929 --> 00:14:12,599
And if you do actually use your,
I've seen a lot of cases where if you

336
00:14:12,989 --> 00:14:14,399
actually use the insurance policy,

337
00:14:15,029 --> 00:14:16,079
guess what?

338
00:14:16,439 --> 00:14:19,109
They don't necessarily drop you, but
guess what Your deductible co becomes.

339
00:14:19,889 --> 00:14:23,069
What they paid for your last
ransomware attack, right?

340
00:14:23,099 --> 00:14:26,789
So if I had to pay 2.5
million, guess what?

341
00:14:26,789 --> 00:14:29,849
I now have a 2.5 million deductible
for my next attack because

342
00:14:30,119 --> 00:14:30,539
let's face it.

343
00:14:31,799 --> 00:14:33,089
We get IR in, right?

344
00:14:33,089 --> 00:14:35,309
We figured out what happened, we have
to recovered, and then there's a whole

345
00:14:35,309 --> 00:14:38,159
stage where we have to do a postmortem,
figure out how they got in, if they're

346
00:14:38,159 --> 00:14:40,439
still in and close up the gaps.

347
00:14:40,829 --> 00:14:45,869
That doesn't always happen cuz people are
so, like, ohms are back, we're good to go.

348
00:14:45,874 --> 00:14:46,679
Happy day, happy

349
00:14:46,679 --> 00:14:47,069
day.

350
00:14:47,189 --> 00:14:48,239
And they get hit again

351
00:14:48,389 --> 00:14:50,339
because they never fixed the way
they got in in the first place.

352
00:14:51,024 --> 00:14:53,244
W. Curtis Preston: What, what
do you think about the idea of.

353
00:14:53,904 --> 00:14:56,154
And again, this would
be driven by management.

354
00:14:56,304 --> 00:14:59,694
And you know, a lot of times, like
you said, management isn't necessarily

355
00:15:00,024 --> 00:15:04,194
at that moment thinking about
the the best way to do something.

356
00:15:04,194 --> 00:15:06,144
They just wanna do the
fastest way to do something.

357
00:15:06,624 --> 00:15:06,924
right?

358
00:15:06,924 --> 00:15:12,504
So another thing I've been looking
into is the idea of wouldn't the best

359
00:15:12,504 --> 00:15:17,694
practice to be to figure out how they
got in before you do the recovery,

360
00:15:17,694 --> 00:15:19,494
before you turn everything back on.

361
00:15:19,799 --> 00:15:20,289
Melissa Palmer: Yeah.

362
00:15:20,289 --> 00:15:22,469
And that, that's where the
IR firms come in, because.

363
00:15:24,854 --> 00:15:27,014
they'll kind of get in and
they'll be able to do that.

364
00:15:27,014 --> 00:15:29,114
They'll be able to say like,
you guys are so messed up.

365
00:15:29,114 --> 00:15:30,884
You didn't have any
logging unabled anywhere.

366
00:15:30,884 --> 00:15:32,714
Like we, we can't tell right now.

367
00:15:32,984 --> 00:15:33,194
Right?

368
00:15:33,194 --> 00:15:35,534
It really depends on what
happens in that first phase.

369
00:15:35,864 --> 00:15:36,374
Um,

370
00:15:36,834 --> 00:15:37,324
W. Curtis Preston: Yeah.

371
00:15:37,424 --> 00:15:39,854
Melissa Palmer: and it comes back
to kind of getting ready for the

372
00:15:39,854 --> 00:15:42,524
attack and what kind of security
practice you have in some places.

373
00:15:42,524 --> 00:15:42,704
Yeah.

374
00:15:42,709 --> 00:15:46,274
We could see, people can figure out, uh,
throw in a tool and say, yeah, guess what?

375
00:15:46,304 --> 00:15:46,934
They came in here.

376
00:15:46,934 --> 00:15:47,924
We know we're good to go.

377
00:15:48,134 --> 00:15:50,054
Other times they might not find it just

378
00:15:50,054 --> 00:15:51,164
because there was never.

379
00:15:51,524 --> 00:15:52,034
Prasanna Malaiyandi: they came in.

380
00:15:52,034 --> 00:15:53,714
They went out before you even knew

381
00:15:54,344 --> 00:15:55,064
or nothing was

382
00:15:55,149 --> 00:15:55,479
W. Curtis Preston: under

383
00:15:55,514 --> 00:15:56,939
Melissa Palmer: or we didn't,
you know, we didn't have logging

384
00:15:56,939 --> 00:15:57,689
on or whatever.

385
00:15:57,689 --> 00:15:59,399
Or they turned something off or,

386
00:15:59,829 --> 00:16:01,869
W. Curtis Preston: Logging is
a beautiful thing and, and also

387
00:16:01,874 --> 00:16:03,969
a system to get those logs off

388
00:16:04,379 --> 00:16:05,489
Melissa Palmer: yeah, that's what

389
00:16:05,489 --> 00:16:05,879
people like

390
00:16:05,884 --> 00:16:09,899
forget about, like who cares about
the logs, like whatever their logs.

391
00:16:09,899 --> 00:16:11,309
No, you're, you're going to care about the

392
00:16:11,309 --> 00:16:12,539
logs someday, I promise you.

393
00:16:12,954 --> 00:16:15,714
W. Curtis Preston: Yeah, I mean, even
if it's something as simple of making

394
00:16:15,714 --> 00:16:19,314
sure that the logs are represented
as text somewhere, that is then

395
00:16:19,314 --> 00:16:22,014
backed up by the backup system so
that you can restore all of them.

396
00:16:22,314 --> 00:16:26,514
That's basic, but there are
systems that you can buy that

397
00:16:26,514 --> 00:16:28,434
will just automatically, uh,

398
00:16:28,494 --> 00:16:30,114
exfiltrate all of those logs for you.

399
00:16:30,114 --> 00:16:30,354
Yeah.

400
00:16:30,624 --> 00:16:30,924
Yeah.

401
00:16:31,289 --> 00:16:33,479
Prasanna Malaiyandi: I wanna go back to
a point you made earlier, Melissa, about

402
00:16:33,479 --> 00:16:39,239
sort of, okay, how do you make sure that
you fix the things that broke so everyone

403
00:16:39,239 --> 00:16:40,859
isn't like, Hey, my VMs are back up.

404
00:16:40,859 --> 00:16:42,419
I don't need to worry
about these things anymore.

405
00:16:42,929 --> 00:16:47,909
Have you heard any cases where,
I know sometimes executives have

406
00:16:48,149 --> 00:16:51,329
sort of financial liability, right?

407
00:16:51,569 --> 00:16:53,639
Melissa Palmer: I've heard
of that trend, right?

408
00:16:53,639 --> 00:16:57,719
Like your guess what your bonus is tied to
if you get ransomware or not, and how you.

409
00:16:58,109 --> 00:17:00,779
And stuff like that, that's
starting to happen in some places.

410
00:17:01,199 --> 00:17:04,889
Um, but a lot of it comes down
to maybe the processes were

411
00:17:04,889 --> 00:17:06,839
never clearly defined upfront.

412
00:17:07,199 --> 00:17:07,409
Right.

413
00:17:07,409 --> 00:17:09,779
And that's where a lot of
the cyber insurance stuff can

414
00:17:09,779 --> 00:17:10,559
actually come in and help.

415
00:17:10,559 --> 00:17:14,069
Well, they'll be like, you need
to show us your response process.

416
00:17:14,399 --> 00:17:15,359
And they'll be like, here you go.

417
00:17:15,359 --> 00:17:17,069
And they'll be like, okay,
so where's the rest of it?

418
00:17:17,069 --> 00:17:17,789
Or something like that, right?

419
00:17:17,789 --> 00:17:18,329
Like, what, what

420
00:17:18,329 --> 00:17:18,869
happened?

421
00:17:18,929 --> 00:17:20,609
Like, this is it.

422
00:17:20,609 --> 00:17:20,969
Like here's

423
00:17:21,199 --> 00:17:21,389
a page.

424
00:17:21,389 --> 00:17:22,679
Like it's not gonna work.

425
00:17:23,069 --> 00:17:25,049
Um, and again, it comes back to.

426
00:17:26,979 --> 00:17:27,929
the old school DR test.

427
00:17:27,929 --> 00:17:30,899
Like there needs to be ransomware
recovery tests and postmortems of

428
00:17:30,899 --> 00:17:32,429
that ransomware recovery test, right?

429
00:17:32,429 --> 00:17:34,649
Like y'all need to get in room,
figure out what worked, what didn't

430
00:17:34,649 --> 00:17:35,039
work.

431
00:17:36,184 --> 00:17:40,924
W. Curtis Preston: Having done the old
school DR test, I'm curious as to how

432
00:17:41,434 --> 00:17:43,294
they do a ransomware recovery test.

433
00:17:43,294 --> 00:17:47,254
Because one of the hardest parts of
a ransomware recovery is that the

434
00:17:47,254 --> 00:17:51,124
attacker is there is still attacking,
like with a dr, you just say,

435
00:17:51,154 --> 00:17:53,314
okay, those six systems are dead.

436
00:17:53,574 --> 00:17:54,294
Melissa Palmer: So, yeah.

437
00:17:54,294 --> 00:17:54,474
So

438
00:17:54,474 --> 00:17:54,834
here's where it

439
00:17:54,834 --> 00:17:55,734
gets complicated.

440
00:17:55,734 --> 00:17:58,314
You need to test multiple
types of recoveries, right?

441
00:17:58,314 --> 00:17:59,874
So maybe I'm recovering, please.

442
00:17:59,874 --> 00:18:00,634
I, I can't.

443
00:18:01,229 --> 00:18:03,549
, I will vomit in my mouth if I say
maybe I'm recovering in place.

444
00:18:03,549 --> 00:18:04,749
I can't even like say that.

445
00:18:04,749 --> 00:18:07,299
So we're not gonna say that, but like
maybe I'm going to my second site.

446
00:18:07,299 --> 00:18:08,439
Maybe I'm going to a warm site.

447
00:18:08,439 --> 00:18:09,279
Maybe I'm going to a hot site.

448
00:18:09,279 --> 00:18:10,509
Maybe I'm going to a public cloud.

449
00:18:10,509 --> 00:18:11,649
Maybe I'm going to a VMware cloud.

450
00:18:11,979 --> 00:18:13,479
You gotta test all those, right?

451
00:18:13,484 --> 00:18:13,659
Because

452
00:18:13,659 --> 00:18:17,349
you don't know where you're going
until that incident response

453
00:18:17,379 --> 00:18:21,069
phase starts, especially when law
enforcement gets involved, right?

454
00:18:21,069 --> 00:18:23,589
So let's say stuff's really bad,
the FBI comes, and guess what?

455
00:18:24,189 --> 00:18:28,329
We are quarantining your whole
data center while we investigate.

456
00:18:28,869 --> 00:18:29,469
Then what do you do?

457
00:18:29,629 --> 00:18:30,119
Prasanna Malaiyandi: Yeah.

458
00:18:31,479 --> 00:18:32,769
You're down for business, otherwise,

459
00:18:32,784 --> 00:18:33,114
Melissa Palmer: do?

460
00:18:33,204 --> 00:18:37,404
No, you go to public cloud, you go to um,
a service provider, you go someplace else.

461
00:18:37,404 --> 00:18:39,444
So you have to have all that
ironed out ahead of time.

462
00:18:39,449 --> 00:18:42,804
You have to know that there's different
considerations for recovery from

463
00:18:43,104 --> 00:18:44,244
ransomware attack than a traditional

464
00:18:44,244 --> 00:18:44,784
disaster.

465
00:18:45,024 --> 00:18:47,034
So I guess, you know, from a
traditional disaster, like what if

466
00:18:47,034 --> 00:18:48,654
the zombies eat both data centers,

467
00:18:48,659 --> 00:18:48,864
right?

468
00:18:48,864 --> 00:18:49,854
Then you would still need to go to the

469
00:18:49,944 --> 00:18:52,374
Prasanna Malaiyandi: but people probably
aren't thinking about that though, right?

470
00:18:52,374 --> 00:18:55,434
The fact that, hey, maybe the F
B I will come quarantine, right?

471
00:18:55,434 --> 00:18:56,574
Do you have your backups offsite?

472
00:18:56,579 --> 00:18:58,494
Do you have it in someplace
that you can bring it up?

473
00:18:58,554 --> 00:19:01,644
And like you mentioned earlier, Melissa,
it's like things you should plan for ahead

474
00:19:01,649 --> 00:19:05,654
of time before you get to the point where
you are trying to recover from ransomware.

475
00:19:06,189 --> 00:19:06,789
Melissa Palmer: Exactly.

476
00:19:08,379 --> 00:19:11,109
And again, unless an organization,
so I have a couple of examples

477
00:19:11,114 --> 00:19:13,269
of, I don't wanna say Dr.

478
00:19:13,269 --> 00:19:18,549
Done wrong, but uh, I worked
for an uh, company when I was

479
00:19:18,549 --> 00:19:22,539
an intern on Wall Street and
everything was in New York City.

480
00:19:23,264 --> 00:19:26,409
and nine 11 happened and they were
a block from the World Trade Center.

481
00:19:27,369 --> 00:19:29,739
That's what they couldn't, they couldn't
do anything like they were done.

482
00:19:29,919 --> 00:19:30,189
Right.

483
00:19:30,189 --> 00:19:31,029
Like they were just done.

484
00:19:31,034 --> 00:19:33,819
So they like rebuilt their
systems in a hotel room someplace.

485
00:19:34,089 --> 00:19:34,299
Right.

486
00:19:34,299 --> 00:19:38,139
And that kicked off a huge project to
say, we actually need a second data

487
00:19:38,139 --> 00:19:40,179
center and it needs to be not around here.

488
00:19:40,659 --> 00:19:40,959
Right.

489
00:19:41,019 --> 00:19:42,999
Um, I'm also on the east coast, right?

490
00:19:42,999 --> 00:19:46,059
So New York, hurricane Sandy, we
had this hurricane roll through.

491
00:19:46,059 --> 00:19:49,329
And again, like the data centers
are like 20 miles from each other.

492
00:19:49,329 --> 00:19:49,689
Guess.

493
00:19:50,539 --> 00:19:51,309
, they both tanked.

494
00:19:51,999 --> 00:19:53,529
Um, so things like that.

495
00:19:53,529 --> 00:19:58,299
So until an organization actually has
something happen to them, it's really,

496
00:19:58,299 --> 00:20:01,059
and here's the issue, the, the, the
difference between disaster recovery

497
00:20:01,059 --> 00:20:03,669
and ransomware recovery, when we
talk about it, traditional disaster

498
00:20:03,669 --> 00:20:07,269
recovery stuff, until it happens,
it's easy to accept the risk, right?

499
00:20:07,269 --> 00:20:07,899
Well, you know what?

500
00:20:07,899 --> 00:20:12,159
It's cheaper for us to just like recover
from this disaster and be down for

501
00:20:12,159 --> 00:20:15,519
two weeks than it is to actually put
everything into place where we build a

502
00:20:15,519 --> 00:20:16,989
second site, yada, yada, yada, yada, et.

503
00:20:18,124 --> 00:20:19,749
that's because the risk is so low, right?

504
00:20:19,749 --> 00:20:21,159
And there's all kinds of equations for

505
00:20:21,159 --> 00:20:23,439
this in, you know, cybersecurity
and stuff like that.

506
00:20:23,949 --> 00:20:26,889
But when you change it to ransomware,
the risk is going to, it's going to

507
00:20:26,889 --> 00:20:28,749
happen like a probability of one.

508
00:20:28,989 --> 00:20:29,169
It

509
00:20:29,169 --> 00:20:29,829
will happen.

510
00:20:30,249 --> 00:20:31,659
Um, and that's what
people don't understand.

511
00:20:31,664 --> 00:20:33,009
Like this is going to happen.

512
00:20:33,009 --> 00:20:35,379
It's not like you can say like, well,
you know, we haven't had a hundred

513
00:20:35,379 --> 00:20:37,419
years storm ever, so we'll be fine.

514
00:20:37,719 --> 00:20:39,189
Um, it's different like that.

515
00:20:39,189 --> 00:20:43,479
And a lot of people, I've actually
seen a huge uptick in people getting.

516
00:20:44,979 --> 00:20:47,319
I don't think a lot of people
are where they need to be.

517
00:20:47,679 --> 00:20:52,569
Um, but I think as people get ready
and it gets harder and harder to attack

518
00:20:52,569 --> 00:20:55,509
people because they've put like some
semblance of security in it, right?

519
00:20:55,509 --> 00:20:58,479
You're gonna go for the low-hanging
fruit, you're gonna see the people

520
00:20:58,479 --> 00:21:00,939
who aren't ready get hit harder and
you're just gonna see more and more

521
00:21:00,939 --> 00:21:03,699
attacks and the threat actors are
gonna have to get more creative.

522
00:21:04,299 --> 00:21:06,069
Prasanna Malaiyandi: So
here's a question for you.

523
00:21:07,719 --> 00:21:10,089
Normally when we think about backup
and recovery, right, it's always

524
00:21:10,089 --> 00:21:12,789
about restoring your data or your
application because there might be

525
00:21:12,789 --> 00:21:15,639
a hardware failure, an application
fault, user error, et cetera.

526
00:21:16,239 --> 00:21:19,839
Sometimes people talk about
ransomware in the same context as

527
00:21:19,844 --> 00:21:22,279
disaster recovery and sort of those

528
00:21:22,494 --> 00:21:23,784
Melissa Palmer: Ransomware is a disaster.

529
00:21:23,784 --> 00:21:23,874
I

530
00:21:24,039 --> 00:21:26,229
Prasanna Malaiyandi: but, but
here's the question though, Melissa

531
00:21:26,229 --> 00:21:32,049
is, Like you had just mentioned,
it's not the same as a flood or a

532
00:21:32,049 --> 00:21:33,849
hurricane or something like that.

533
00:21:33,849 --> 00:21:37,719
And so are we kind of pushing
ourselves and kind of giving people

534
00:21:37,719 --> 00:21:42,219
the false impression that it is
similar to those other disasters

535
00:21:42,759 --> 00:21:45,849
and things that they shouldn't worry
about versus we should be treating

536
00:21:45,849 --> 00:21:49,779
it similar to like an application
failure or user failure and treating it

537
00:21:50,589 --> 00:21:51,039
similar.

538
00:21:51,039 --> 00:21:53,439
It's like more towards that side
of the spectrum than this side.

539
00:21:54,639 --> 00:21:56,199
Melissa Palmer: and you
know, that all falls under DR

540
00:21:56,199 --> 00:21:57,399
anyway, like hardware failure

541
00:21:57,404 --> 00:21:58,149
and all that kind of stuff.

542
00:21:58,839 --> 00:22:02,919
Um, and again, in a lot of those cases,
it's easy to say, well, you know what?

543
00:22:02,919 --> 00:22:04,089
I don't really want a second site.

544
00:22:04,089 --> 00:22:04,239
It's

545
00:22:04,239 --> 00:22:06,729
just cheaper to deal with the hardware.

546
00:22:06,729 --> 00:22:07,809
It'll take we'll rush order.

547
00:22:07,809 --> 00:22:11,319
I was in a situation at a company, we'll
just rush order at a new array from

548
00:22:11,319 --> 00:22:13,179
E M C that will solve our problems.

549
00:22:13,184 --> 00:22:15,099
Like that was the plan and that happened.

550
00:22:15,489 --> 00:22:16,869
Um, so crazy stuff like that.

551
00:22:17,079 --> 00:22:19,929
But the problem, why I like to make
the analogy so much is the problem

552
00:22:19,929 --> 00:22:22,629
is when you tell someone that you
have to get ready to recover from

553
00:22:22,629 --> 00:22:24,099
ransomware, they're just like, I don't.

554
00:22:25,339 --> 00:22:25,734
what to do.

555
00:22:25,734 --> 00:22:27,654
You have to put it in some
context that kind of makes sense.

556
00:22:27,654 --> 00:22:30,444
I mean, disaster recovery is
definitely like not sexy, even though

557
00:22:30,444 --> 00:22:31,614
I've done it most in my career.

558
00:22:31,944 --> 00:22:35,214
Um, but it's something that everybody
has an inkling about at least, right?

559
00:22:35,214 --> 00:22:38,994
Everybody kind of knows that there is
usually a DR test once or twice or year a

560
00:22:38,999 --> 00:22:39,414
minimum.

561
00:22:39,714 --> 00:22:41,454
Um, so it's a way, it's a starting

562
00:22:41,454 --> 00:22:42,054
point, right?

563
00:22:42,054 --> 00:22:43,674
It's not your final
destination, but it's a starting

564
00:22:43,674 --> 00:22:43,944
point.

565
00:22:43,944 --> 00:22:44,124
It's a.

566
00:22:44,124 --> 00:22:45,324
place to start context.

567
00:22:45,504 --> 00:22:48,714
Maybe you have some playbook, some
processes that we can leverage to go build

568
00:22:48,714 --> 00:22:53,334
on top of that and say, okay, so how do
we make sure that we can recover now under

569
00:22:53,334 --> 00:22:53,544
any

570
00:22:53,569 --> 00:22:57,019
W. Curtis Preston: I like to, I like
to say that it's a subset, right?

571
00:22:57,019 --> 00:23:02,209
A DR is a subset of a ransomware
recovery, but there's so much else, right?

572
00:23:02,209 --> 00:23:05,699
And the big thing, the but, and I think
you said it already, Prasanna, but the

573
00:23:05,719 --> 00:23:10,699
big thing to me, the difference between
a DR and a ransomware attack, um, is

574
00:23:10,699 --> 00:23:14,344
that the, the disaster isn't, Right.

575
00:23:14,414 --> 00:23:16,184
You're, you're still right

576
00:23:16,209 --> 00:23:17,739
Melissa Palmer: that the disaster never

577
00:23:17,804 --> 00:23:20,114
W. Curtis Preston: a flood is
gone, you're like, okay, all

578
00:23:20,114 --> 00:23:21,584
these servers got wiped out.

579
00:23:21,584 --> 00:23:22,394
So those are the

580
00:23:22,434 --> 00:23:23,634
Melissa Palmer: because
the threat is still there.

581
00:23:23,634 --> 00:23:24,264
Just because you

582
00:23:24,264 --> 00:23:26,664
recovered from the ransomware
attacked doesn't mean they're not

583
00:23:26,664 --> 00:23:27,654
gonna hit you again, or someone else

584
00:23:27,659 --> 00:23:28,074
isn't gonna hit

585
00:23:28,094 --> 00:23:28,544
W. Curtis Preston: Right.

586
00:23:28,574 --> 00:23:30,794
Well, and, and how do you even know,

587
00:23:31,334 --> 00:23:34,924
um, You know, like when you, when
when a hurricane wipes out a data

588
00:23:34,924 --> 00:23:37,354
center, you're like, okay, those
are the servers we need to restore.

589
00:23:37,624 --> 00:23:39,724
But how do, when you walk into
your data center and there's a

590
00:23:39,724 --> 00:23:43,474
ransomware attack going on, how do
you even know which servers have

591
00:23:43,474 --> 00:23:44,854
been affected or not affected?

592
00:23:44,884 --> 00:23:45,244
Right.

593
00:23:45,244 --> 00:23:47,404
That's, that is a big part of it.

594
00:23:47,529 --> 00:23:50,139
Prasanna Malaiyandi: Yeah, and I
guess the other thing is even like you

595
00:23:50,139 --> 00:23:53,319
might see the active infection, like
things are being encrypted, et cetera,

596
00:23:53,319 --> 00:23:55,119
but it might just be lying silently.

597
00:23:55,119 --> 00:23:55,329
Right.

598
00:23:55,329 --> 00:23:57,819
We've talked about dwell
time in the past, right.

599
00:23:57,819 --> 00:23:58,089
Where it's

600
00:23:58,239 --> 00:23:58,779
Melissa Palmer: chill.

601
00:23:58,779 --> 00:24:00,309
They just chill in there for a while.

602
00:24:00,314 --> 00:24:01,209
Like, who knows?

603
00:24:01,599 --> 00:24:04,899
Um, I, I can't remember off the top of my
head, but I remember reading like a big

604
00:24:04,904 --> 00:24:07,389
name breach or something like that, or a
big name attack, and they said they were

605
00:24:07,389 --> 00:24:08,739
in the network for like six months or

606
00:24:09,019 --> 00:24:10,599
Prasanna Malaiyandi: I
think Solar Winds was like

607
00:24:10,689 --> 00:24:10,944
Melissa Palmer: was it?

608
00:24:11,004 --> 00:24:11,664
I don't remember.

609
00:24:11,664 --> 00:24:13,194
But I remember reading a couple
of them where they've been in

610
00:24:13,194 --> 00:24:15,984
there a significant period of time
and who knows what they're doing

611
00:24:15,984 --> 00:24:16,734
there, right?

612
00:24:16,734 --> 00:24:17,364
Like who knows

613
00:24:17,394 --> 00:24:18,174
unless you catch them.

614
00:24:18,264 --> 00:24:18,684
So it's about

615
00:24:18,859 --> 00:24:19,369
W. Curtis Preston: yeah.

616
00:24:19,699 --> 00:24:24,199
The meantime is something like 60
days actually is what I, what I read.

617
00:24:24,679 --> 00:24:25,249
Um,

618
00:24:25,344 --> 00:24:26,664
Melissa Palmer: be the
worst ransomware person.

619
00:24:26,664 --> 00:24:28,554
I'd be like, let's go, let's go.

620
00:24:28,554 --> 00:24:30,354
It's like, no, you're
not supposed to do that.

621
00:24:30,354 --> 00:24:30,654
You gotta

622
00:24:30,654 --> 00:24:32,544
take your time and traverse

623
00:24:32,544 --> 00:24:33,774
through the network and get ad.

624
00:24:33,954 --> 00:24:35,784
I'd be like, let's go encrypt VMware.

625
00:24:35,784 --> 00:24:36,714
Let's go.

626
00:24:37,014 --> 00:24:38,334
I'd be caught so fast.

627
00:24:38,544 --> 00:24:39,684
Or maybe I wouldn't, maybe I.

628
00:24:41,589 --> 00:24:44,169
Prasanna Malaiyandi: You're only caught
if someone's monitoring and watching.

629
00:24:44,279 --> 00:24:44,799
Right Melissa?

630
00:24:45,474 --> 00:24:45,924
Melissa Palmer: Right.

631
00:24:45,924 --> 00:24:46,344
And you need

632
00:24:46,344 --> 00:24:47,784
to be looking for the right things.

633
00:24:48,874 --> 00:24:49,084
W. Curtis Preston: Yeah.

634
00:24:49,084 --> 00:24:53,794
As soon as you encrypt a, a vm, uh,
you're gonna set off alarm or two.

635
00:24:54,394 --> 00:24:58,465
Um, but I, I think you encrypt,
I think you encrypt a lot of

636
00:24:58,470 --> 00:25:00,694
files that no one's looking at.

637
00:25:00,814 --> 00:25:01,204
Right.

638
00:25:01,564 --> 00:25:03,094
But the moment you start

639
00:25:03,249 --> 00:25:04,479
Melissa Palmer: Once
you hit the the thing,

640
00:25:04,599 --> 00:25:06,279
the only thing is you'll hit.

641
00:25:06,609 --> 00:25:10,029
You'll hopefully you'll be caught as
soon as you start encrypting the VMs.

642
00:25:10,329 --> 00:25:12,009
You do them all at once,
so it doesn't matter.

643
00:25:13,204 --> 00:25:13,354
W. Curtis Preston: Yeah.

644
00:25:13,354 --> 00:25:13,594
Right.

645
00:25:13,594 --> 00:25:14,074
Cuz it's,

646
00:25:14,094 --> 00:25:14,954
Melissa Palmer: I got all of 'em.

647
00:25:14,954 --> 00:25:17,364
It doesn't matter that you caught me
doing the first one, I did them all.

648
00:25:17,754 --> 00:25:21,024
Um, but yeah, so generally they're
in their wreaking havoc, steal maybe

649
00:25:21,294 --> 00:25:24,084
exfiltrating data, doing some stuff
before they go encryption habit.

650
00:25:24,114 --> 00:25:26,304
Or maybe like, I've heard cases
recently where they don't even

651
00:25:26,304 --> 00:25:27,594
bother, like encrypting stuff.

652
00:25:27,594 --> 00:25:28,854
They're just stealing
data at this point and

653
00:25:28,854 --> 00:25:30,514
be like, by the way, look what we have.

654
00:25:31,014 --> 00:25:33,924
Prasanna Malaiyandi: Is that
easier by the way, to steal data?

655
00:25:33,924 --> 00:25:37,584
Because it seems that you can sort of
fly under the radar if you just steal

656
00:25:37,584 --> 00:25:40,404
data because people will probably,
maybe they notice, maybe they don't,

657
00:25:40,409 --> 00:25:42,414
but it's not as obvious as, say,

658
00:25:42,474 --> 00:25:42,824
Melissa Palmer: It

659
00:25:42,824 --> 00:25:45,394
is definitely not as obvious
as encrypting stuff, I'm like

660
00:25:45,399 --> 00:25:46,924
this weird monitoring nerd too.

661
00:25:46,924 --> 00:25:48,824
I had like this monitoring
fetish at Veeam.

662
00:25:48,844 --> 00:25:50,014
It was very strange.

663
00:25:50,524 --> 00:25:53,884
Um, so like, I would like really
hone in on like what to look

664
00:25:53,884 --> 00:25:55,714
for to catch that too, right?

665
00:25:56,104 --> 00:25:57,664
But not everybody is crazy like me.

666
00:25:58,084 --> 00:25:58,594
Um,

667
00:25:59,894 --> 00:26:00,914
W. Curtis Preston: I think, I think,

668
00:26:01,604 --> 00:26:02,384
yeah, I do.

669
00:26:03,044 --> 00:26:07,754
To answer your question, Prasanna, I do
think that exfiltration as an overall

670
00:26:07,754 --> 00:26:16,034
process is easier in that if you can get
any data out that there's a, there's a

671
00:26:16,034 --> 00:26:18,674
much higher chance that they will respond.

672
00:26:18,824 --> 00:26:20,144
That they will pay the ransom.

673
00:26:20,414 --> 00:26:20,774
Right?

674
00:26:20,774 --> 00:26:22,304
Because backups aren't gonna help.

675
00:26:22,744 --> 00:26:24,154
Melissa Palmer: I'm looking
at my black hat over there.

676
00:26:24,154 --> 00:26:26,404
I'm wondering if I should like, put it
on for this discussion or something.

677
00:26:26,974 --> 00:26:27,484
Um,

678
00:26:27,544 --> 00:26:32,014
like you would probably like see like,
all right, like if I'm a bad person,

679
00:26:32,224 --> 00:26:33,754
I'm not a bad person, I'm a good person.

680
00:26:34,354 --> 00:26:36,094
Um, like they start small,

681
00:26:36,094 --> 00:26:36,304
right?

682
00:26:36,304 --> 00:26:38,014
They grab a file here and
there and they see if they

683
00:26:38,434 --> 00:26:39,454
Prasanna Malaiyandi: if anyone notices.

684
00:26:39,519 --> 00:26:40,564
Melissa Palmer: this, grab that, right?

685
00:26:40,564 --> 00:26:42,844
Like, you don't go and just be
like, oh look, here's the final.

686
00:26:43,699 --> 00:26:46,299
25 million gigabytes of MP3s.

687
00:26:46,299 --> 00:26:47,239
I'm gonna take it all at once.

688
00:26:47,239 --> 00:26:48,799
No, they're like picky and choosy.

689
00:26:48,799 --> 00:26:50,269
They try to find the sensitive data.

690
00:26:50,269 --> 00:26:51,349
They take a little bit here and there.

691
00:26:51,589 --> 00:26:53,299
Maybe they only need to
grab a couple spreadsheets.

692
00:26:53,299 --> 00:26:53,539
Right?

693
00:26:53,539 --> 00:26:54,139
It's not like,

694
00:26:54,619 --> 00:26:57,019
I think there's this misnomer that like
they get in there and I'm just gonna

695
00:26:57,024 --> 00:26:58,849
start downloading massive chunks of

696
00:26:58,854 --> 00:26:59,389
data.

697
00:26:59,714 --> 00:26:59,894
W. Curtis Preston: well,

698
00:26:59,894 --> 00:27:01,574
that's the whole point of

699
00:27:01,759 --> 00:27:03,259
Melissa Palmer: so you could
exfiltrate a vm, just like

700
00:27:03,259 --> 00:27:04,789
download the vmd K and be like,

701
00:27:04,814 --> 00:27:06,284
W. Curtis Preston: yeah, exactly.

702
00:27:06,469 --> 00:27:06,529
Melissa Palmer: ad.

703
00:27:06,709 --> 00:27:06,919
Have a

704
00:27:06,919 --> 00:27:07,369
nice life

705
00:27:08,284 --> 00:27:13,289
W. Curtis Preston: that's that whole phase
of the, um, the initial phase of an attack

706
00:27:13,589 --> 00:27:19,259
is trying to expand out, seeing what
you can find out, seeing if you can find

707
00:27:19,259 --> 00:27:21,989
a spreadsheet called customer database

708
00:27:22,249 --> 00:27:22,429
Melissa Palmer: You know?

709
00:27:22,429 --> 00:27:22,759
Right.

710
00:27:23,019 --> 00:27:24,269
W. Curtis Preston: xls , right.

711
00:27:25,889 --> 00:27:26,239
Um,

712
00:27:26,879 --> 00:27:27,359
or like.

713
00:27:27,469 --> 00:27:30,199
Melissa Palmer: you might not bother
encrypting everything, but if you

714
00:27:30,199 --> 00:27:33,769
can't find much, you say, all right,
I'll steal some stuff and tell 'em I

715
00:27:33,769 --> 00:27:36,529
have some files, but I won't tell them
what I'll hope that'll make them pay.

716
00:27:36,529 --> 00:27:36,949
And I'll just

717
00:27:36,949 --> 00:27:38,449
go, you know, encrypt some stuff while.

718
00:27:39,919 --> 00:27:40,909
Which is more illegal?

719
00:27:40,909 --> 00:27:42,259
Is one more legal than the other?

720
00:27:43,279 --> 00:27:45,229
Prasanna Malaiyandi: I think
they both are pretty bad,

721
00:27:45,349 --> 00:27:46,999
Melissa Palmer: is one more
illegal than the other?

722
00:27:48,254 --> 00:27:49,754
W. Curtis Preston: Well,
they're both extortion.

723
00:27:50,539 --> 00:27:51,139
Melissa Palmer: Yeah,

724
00:27:51,884 --> 00:27:52,634
W. Curtis Preston: the act,

725
00:27:53,264 --> 00:27:53,714
The act

726
00:27:53,719 --> 00:27:56,209
Melissa Palmer: but if you're actually
exfiltrating, you're stealing it.

727
00:27:56,294 --> 00:27:56,684
W. Curtis Preston: yeah.

728
00:27:57,164 --> 00:27:59,384
That's gonna depend on where this happens.

729
00:27:59,984 --> 00:28:03,224
Uh, whether or not exfiltrating
the data is a different crime.

730
00:28:04,074 --> 00:28:05,414
And damaging the data.

731
00:28:06,284 --> 00:28:11,354
Um, but, uh, but in the, the extortion
happens on both sides, right?

732
00:28:11,354 --> 00:28:11,624
And that's

733
00:28:11,624 --> 00:28:12,674
definitely illegal in

734
00:28:12,904 --> 00:28:13,114
Melissa Palmer: that

735
00:28:13,214 --> 00:28:13,634
W. Curtis Preston: pretty much

736
00:28:13,634 --> 00:28:14,474
every jurisdiction

737
00:28:14,524 --> 00:28:15,184
Melissa Palmer: legal kids.

738
00:28:15,319 --> 00:28:19,099
Prasanna Malaiyandi: Yeah, so
we talked about, so we talked

739
00:28:19,099 --> 00:28:20,329
about incident response.

740
00:28:21,169 --> 00:28:23,699
You've now been hit by
a ransomware attack.

741
00:28:24,894 --> 00:28:27,199
in, then let's just take
VMware environments, right?

742
00:28:27,229 --> 00:28:31,309
So what do you see people doing
like, or what are things that they

743
00:28:31,309 --> 00:28:33,109
should be doing that they're not?

744
00:28:33,499 --> 00:28:34,939
Like, how do they even approach

745
00:28:34,954 --> 00:28:36,304
Melissa Palmer: Yeah, so he,

746
00:28:36,319 --> 00:28:38,179
Prasanna Malaiyandi: VMware
environment gets encrypted Now, what

747
00:28:39,424 --> 00:28:40,834
Melissa Palmer: Um, to me it's trash.

748
00:28:42,064 --> 00:28:44,764
I would throw it away and start
over, like, I'm not even joking.

749
00:28:44,764 --> 00:28:45,284
Throw it

750
00:28:45,434 --> 00:28:45,884
W. Curtis Preston: No, not

751
00:28:46,049 --> 00:28:47,989
Prasanna Malaiyandi: and,
and, and, and how much?

752
00:28:48,934 --> 00:28:51,424
And and how much would you, when you
say throw it away, are you talking about

753
00:28:51,424 --> 00:28:55,684
throwing away the virtual machines,
throwing away the ESXi servers, the.

754
00:28:55,699 --> 00:28:59,539
Melissa Palmer: the host, wipe the
storage array, wipe it all and start over.

755
00:29:00,169 --> 00:29:02,119
Um, and, and here's the thing, right?

756
00:29:02,119 --> 00:29:04,119
So like, you know, I, I like it.

757
00:29:04,124 --> 00:29:09,139
I have this weird side of me that also
does like weird blogging stuff, right?

758
00:29:09,139 --> 00:29:11,119
And like, I like SEO and stuff like that.

759
00:29:11,629 --> 00:29:14,779
And even my career at Veeam people are
like, how do I back up my VMware host?

760
00:29:15,894 --> 00:29:17,449
you don't, they're like, what do you mean?

761
00:29:17,449 --> 00:29:21,109
I'm like, you don't, um, you
automate the build process

762
00:29:21,109 --> 00:29:22,039
and the configuration, right?

763
00:29:22,039 --> 00:29:23,929
You don't actually back up
your host and restore it.

764
00:29:23,929 --> 00:29:24,409
It's, you

765
00:29:24,904 --> 00:29:25,534
Prasanna Malaiyandi: You just rebuild

766
00:29:25,639 --> 00:29:25,849
Melissa Palmer: thing.

767
00:29:25,849 --> 00:29:28,009
It's a clean install and you configure it.

768
00:29:28,609 --> 00:29:31,699
Um, so that's what people need
to be testing to is how I would

769
00:29:31,699 --> 00:29:34,159
actually recover is almost misnomer.

770
00:29:34,164 --> 00:29:35,209
Cuz Prasannally I would trash it.

771
00:29:35,599 --> 00:29:38,569
Um, how do I re rapidly
rebuild a VMware environment?

772
00:29:38,719 --> 00:29:39,409
And that's something.

773
00:29:40,159 --> 00:29:41,869
People don't do every day, right?

774
00:29:41,874 --> 00:29:44,719
Like that stuff runs like you
might have not even reinstalled.

775
00:29:44,719 --> 00:29:45,289
You could have just been

776
00:29:45,289 --> 00:29:49,399
upgrading for the last like 10 years and
like, whatever, probably not 10, probably

777
00:29:49,404 --> 00:29:50,839
four or five years, you'll get a new host.

778
00:29:50,839 --> 00:29:51,139
I don't know.

779
00:29:51,139 --> 00:29:51,589
It depends.

780
00:29:51,949 --> 00:29:57,259
Um, so that's something that
people don't practice and don't do.

781
00:29:57,859 --> 00:29:59,969
Um, and you can actually do that all.

782
00:30:00,944 --> 00:30:03,994
for the most part, um, in a
nested virtualization environment.

783
00:30:03,994 --> 00:30:05,224
Get all your processes down stuff.

784
00:30:05,224 --> 00:30:07,894
So it's a pretty low co I mean, you
should test on your physical hardware

785
00:30:07,894 --> 00:30:12,004
at some point for any drivers and stuff,
but it's actually a relatively low

786
00:30:12,694 --> 00:30:14,374
cost and effort thing to figure out.

787
00:30:14,374 --> 00:30:15,664
It's not rocket science.

788
00:30:15,904 --> 00:30:19,174
Prasanna Malaiyandi: But when you do
this testing, wouldn't you also want to

789
00:30:19,179 --> 00:30:21,034
involve, say like your networking team,

790
00:30:21,144 --> 00:30:22,744
Melissa Palmer: Yes,
you would wanna, any of

791
00:30:22,744 --> 00:30:24,544
this testing, you wanna involve anybody?

792
00:30:24,574 --> 00:30:25,924
Everybody, right?

793
00:30:25,924 --> 00:30:27,364
Everybody should be involved in this.

794
00:30:28,424 --> 00:30:28,969
everybody.

795
00:30:28,969 --> 00:30:31,519
And that's I think, one of the biggest
problems we see that they're not,

796
00:30:32,264 --> 00:30:33,404
W. Curtis Preston: So when you say,

797
00:30:33,439 --> 00:30:36,239
Melissa Palmer: They're like,
I don't have time to do this.

798
00:30:36,914 --> 00:30:39,404
W. Curtis Preston: when you say
rebuild the VMware environment,

799
00:30:40,214 --> 00:30:43,154
um, obviously you're talking about
vm, you know, wiping the hosts and,

800
00:30:43,159 --> 00:30:44,294
and the storage and all of that.

801
00:30:44,864 --> 00:30:49,634
When we get to the phase of
actually bringing back VMs,

802
00:30:50,009 --> 00:30:50,619
Melissa Palmer: Mm-hmm.

803
00:30:51,254 --> 00:30:52,814
W. Curtis Preston: what
way would you do that?

804
00:30:54,574 --> 00:30:57,634
Melissa Palmer: Um, so most backup
software these days have something

805
00:30:57,634 --> 00:31:02,884
built in where it'll actually scan for
ransomware as you are restoring, right?

806
00:31:02,944 --> 00:31:04,564
And find the ransomware if it's there.

807
00:31:04,564 --> 00:31:06,004
Cause at that point, you know
what you're infected with,

808
00:31:06,009 --> 00:31:07,234
so you know what to look for.

809
00:31:07,714 --> 00:31:11,674
Um, so I would be either scanning it
or, you know, if you have really good.

810
00:31:12,419 --> 00:31:14,854
and then you can decide how you're
gonna fix it, or you're just gonna go

811
00:31:14,854 --> 00:31:16,654
back to an earlier point or whatever.

812
00:31:16,924 --> 00:31:19,804
Um, you know, some people are really good
with the IR stuff and say, we know the

813
00:31:19,804 --> 00:31:23,104
ransomware came in this date, this time we
are absolutely a million percent certain

814
00:31:23,109 --> 00:31:26,734
because we have all these logs go back to
the last known good restore point, right?

815
00:31:27,184 --> 00:31:28,324
Um, so it really depends.

816
00:31:28,324 --> 00:31:32,704
But the backup people gonna
be a big part of that, right?

817
00:31:32,704 --> 00:31:33,214
Because it's gonna be

818
00:31:33,464 --> 00:31:34,754
W. Curtis Preston: Y Yeah, I,

819
00:31:35,224 --> 00:31:36,034
Melissa Palmer: do they have built in?

820
00:31:36,524 --> 00:31:39,404
W. Curtis Preston: this is something
I put a lot of thought into lately

821
00:31:39,554 --> 00:31:43,244
of if the meantime of a, of a.

822
00:31:44,084 --> 00:31:47,384
Infection is 60 days, and
some of them are twice that,

823
00:31:48,284 --> 00:31:54,134
um, the, the idea of of saying, oh, well
we got, we got infected December 1st,

824
00:31:54,374 --> 00:31:56,114
so we're gonna restore to December 1st.

825
00:31:56,144 --> 00:31:56,564
That's a

826
00:31:56,599 --> 00:31:58,639
Melissa Palmer: That doesn't,
it doesn't always work.

827
00:31:58,639 --> 00:32:00,679
In some cases it might,
in some cases it won't.

828
00:32:00,679 --> 00:32:01,369
And then you're going

829
00:32:01,369 --> 00:32:02,719
back to scanning,

830
00:32:03,164 --> 00:32:05,354
W. Curtis Preston: So you've got,
you've got to, I think in most

831
00:32:05,354 --> 00:32:08,924
cases, if many, if not most cases,
you're gonna do a restoring.

832
00:32:10,104 --> 00:32:10,279
Melissa Palmer: Yeah.

833
00:32:10,309 --> 00:32:12,409
I've seen kind of almost like
two stage recoveries too.

834
00:32:12,414 --> 00:32:15,979
Like get the bare minimum of stuff
something up and run something

835
00:32:15,979 --> 00:32:17,419
online up and running, right.

836
00:32:17,599 --> 00:32:20,089
To restore services and then
do the full recovery later.

837
00:32:20,359 --> 00:32:22,639
So you're not, you might be like,
all right, so you know what?

838
00:32:22,819 --> 00:32:25,519
We can roll these servers
back to December 29th.

839
00:32:25,879 --> 00:32:27,649
We can use the newest
copy of the database.

840
00:32:27,649 --> 00:32:31,459
We can mash it together and make
it work and serve our customers

841
00:32:31,519 --> 00:32:33,409
while we're actually restoring
everything the right way.

842
00:32:33,654 --> 00:32:34,454
Prasanna Malaiyandi: Rackspace,

843
00:32:34,579 --> 00:32:35,939
Melissa Palmer: So it did that.

844
00:32:36,139 --> 00:32:40,759
W. Curtis Preston: Prasanna.

845
00:32:40,784 --> 00:32:41,084
Yeah.

846
00:32:41,779 --> 00:32:42,139
Melissa Palmer: you okay?

847
00:32:42,139 --> 00:32:43,429
You were eating another sip of tea there.

848
00:32:43,814 --> 00:32:46,724
W. Curtis Preston: It's what I thought
of when you, when you, as soon as

849
00:32:46,724 --> 00:32:48,824
she said that, I, yeah, I know.

850
00:32:48,974 --> 00:32:49,334
Yeah.

851
00:32:49,394 --> 00:32:50,624
Just make sure.

852
00:32:51,044 --> 00:32:55,454
Unlike Rackspace, just make sure
that you thought of this beforehand.

853
00:32:55,904 --> 00:32:56,264
Right.

854
00:32:56,269 --> 00:33:00,614
The only way that this is gonna work
is if you identify what are the three

855
00:33:00,619 --> 00:33:05,624
services that need to be up right away
so that we can function as a company and

856
00:33:05,624 --> 00:33:08,744
what are the other 20, 5,000 services

857
00:33:08,794 --> 00:33:11,014
Melissa Palmer: That kind of, um,
that ties almost more into like

858
00:33:11,074 --> 00:33:12,994
the business con, you know, B C D R

859
00:33:13,139 --> 00:33:13,739
W. Curtis Preston: Yeah.

860
00:33:14,099 --> 00:33:14,639
Yeah,

861
00:33:14,794 --> 00:33:15,484
Melissa Palmer: continuity sort.

862
00:33:15,484 --> 00:33:18,544
Like what are our key applications
and what level of, what do we have

863
00:33:18,544 --> 00:33:21,904
to do to get those online First comes
back to our RPOs and RTOs, right?

864
00:33:22,499 --> 00:33:22,919
W. Curtis Preston: yeah,

865
00:33:24,304 --> 00:33:25,114
Melissa Palmer: it's, it's,

866
00:33:25,119 --> 00:33:26,194
the thing is, it's, such a

867
00:33:26,194 --> 00:33:29,314
big discussion that unless you've
had it cross-functionally with the

868
00:33:29,694 --> 00:33:31,834
business owners and the app owners,
and the infrastructure owners and the

869
00:33:32,254 --> 00:33:33,424
security team, you're not in a good.

870
00:33:34,694 --> 00:33:35,024
W. Curtis Preston: Yeah.

871
00:33:35,084 --> 00:33:38,384
I, I think, I think it's, it's just,
it's one thing to have a discussion,

872
00:33:38,384 --> 00:33:46,934
again, going to Dr versus rr, um, is
that it's one thing to go, well, what

873
00:33:46,934 --> 00:33:48,344
are the servers we're gonna do first?

874
00:33:48,349 --> 00:33:51,644
And what are, what are the servers
that we're gonna do three hours later?

875
00:33:52,514 --> 00:33:54,734
It's a whole other thing to say, what
are the servers we're gonna do the

876
00:33:54,734 --> 00:33:58,604
first couple of days, and what are
the servers we're gonna do next week?

877
00:33:58,874 --> 00:33:59,354
Right.

878
00:33:59,594 --> 00:33:59,774
I,

879
00:33:59,824 --> 00:34:00,934
Melissa Palmer: And that,
that's the problem, right?

880
00:34:00,934 --> 00:34:03,694
You don't know until it happens.

881
00:34:03,694 --> 00:34:04,234
Like if,

882
00:34:04,234 --> 00:34:07,924
if you, if it's your whole
environment is done right.

883
00:34:08,194 --> 00:34:11,194
That is very different than, oh,
we know, just, they just did this

884
00:34:11,194 --> 00:34:12,974
subset of servers or whatever.

885
00:34:12,974 --> 00:34:13,454
It's,

886
00:34:13,459 --> 00:34:18,079
and like we were, um, The
company I worked for a company

887
00:34:18,079 --> 00:34:19,219
that I no longer worked there.

888
00:34:19,219 --> 00:34:22,969
It was a pr uh, I was a customer and they
had a, a very, they were one of the first

889
00:34:22,969 --> 00:34:27,439
really, really big ransomware attacks
in the news, and it was like a disaster.

890
00:34:27,439 --> 00:34:29,719
I was like, wow, I'm glad I'm
not on the VMware team anymore

891
00:34:29,719 --> 00:34:31,009
there when this is going down.

892
00:34:31,009 --> 00:34:31,279
Right.

893
00:34:31,669 --> 00:34:35,479
Um, , but it really depends and
you don't know what's gonna happen.

894
00:34:35,479 --> 00:34:37,669
The only thing you can do is be
as prepared as possible, right?

895
00:34:37,669 --> 00:34:39,049
Test different recovery methods.

896
00:34:39,469 --> 00:34:43,549
Um, and I love RPOs and RTOs in saying
that we can meet them under a testing

897
00:34:43,549 --> 00:34:46,999
scenario, but in the real world, we
don't know that that's gonna happen.

898
00:34:48,319 --> 00:34:48,809
W. Curtis Preston: Yeah.

899
00:34:49,384 --> 00:34:51,814
Prasanna Malaiyandi: One of the things
on the podcast we talked about a couple

900
00:34:51,814 --> 00:34:56,449
days ago was, Like Tom was mentioning,
oh yeah, you just shut down your

901
00:34:56,449 --> 00:35:00,739
network and you start figuring out,
okay, what was affected but in what?

902
00:35:00,799 --> 00:35:02,629
And you prevent everything
go from going in and out.

903
00:35:02,634 --> 00:35:04,579
And I was like, but
how do you communicate?

904
00:35:04,579 --> 00:35:04,849
Right?

905
00:35:04,849 --> 00:35:08,929
And he's like, yeah, make sure you have
ahead of time, sort of use cell phones.

906
00:35:08,959 --> 00:35:10,009
iMessage can work.

907
00:35:10,009 --> 00:35:13,639
You can set up a separate Slack
instance completely outside of

908
00:35:13,639 --> 00:35:15,559
the corporate environment, right?

909
00:35:15,969 --> 00:35:18,929
Whatever it is to keep that
ongoing communications.

910
00:35:19,309 --> 00:35:22,099
Melissa Palmer: like, uh, how am I
supposed to use Microsoft Teams to

911
00:35:22,099 --> 00:35:23,539
communicate with a security team?

912
00:35:23,719 --> 00:35:25,039
Well, that might be Office 365.

913
00:35:25,039 --> 00:35:26,719
That might be, okay, that's a bad example.

914
00:35:26,864 --> 00:35:28,964
W. Curtis Preston: Yeah, as long as
you have a, as long as you have a,

915
00:35:28,969 --> 00:35:31,184
um, an internet connection, right?

916
00:35:31,904 --> 00:35:33,814
Um, which is pretty easy

917
00:35:33,814 --> 00:35:34,094
to get

918
00:35:34,174 --> 00:35:34,384
Melissa Palmer: but

919
00:35:34,384 --> 00:35:35,404
like who has people's

920
00:35:35,404 --> 00:35:36,724
phone numbers these days?

921
00:35:36,866 --> 00:35:39,221
W. Curtis Preston: people with
incident response plans, that's who

922
00:35:39,261 --> 00:35:39,711
Melissa Palmer: yeah, that's

923
00:35:39,756 --> 00:35:42,636
Prasanna Malaiyandi: But But aren't
there issues though, where ransomware

924
00:35:42,636 --> 00:35:46,836
actors might still have access to
your Slack instance and be monitoring

925
00:35:46,836 --> 00:35:48,306
what's going on from an incident

926
00:35:48,306 --> 00:35:48,516
Melissa Palmer: I've

927
00:35:48,516 --> 00:35:48,966
seen that.

928
00:35:48,966 --> 00:35:49,176
I've

929
00:35:49,176 --> 00:35:49,776
seen that.

930
00:35:49,776 --> 00:35:52,806
I've seen, I have seen that happen
where like, they still had access.

931
00:35:52,806 --> 00:35:53,406
It was teams.

932
00:35:53,411 --> 00:35:53,796
I think

933
00:35:53,796 --> 00:35:54,606
they still had access.

934
00:35:54,606 --> 00:35:55,866
They were watching the IR

935
00:35:55,871 --> 00:35:58,116
stuff happen as they were
still in there hanging out.

936
00:35:58,121 --> 00:36:01,956
It's like, oh yeah, Y again,

937
00:36:02,056 --> 00:36:03,466
W. Curtis Preston:
ransomware stuff is bad.

938
00:36:03,496 --> 00:36:06,436
Melissa, I'm just gonna take that stance.

939
00:36:06,741 --> 00:36:07,401
Melissa Palmer: bad.

940
00:36:07,401 --> 00:36:10,311
It's bad, and you don't know what's
gonna happen until it happens.

941
00:36:10,311 --> 00:36:12,801
Which is why, and it ties back
to incident response, right?

942
00:36:12,801 --> 00:36:16,191
And having an incident response firm
on retainer that does this every day.

943
00:36:16,521 --> 00:36:16,761
Right?

944
00:36:16,761 --> 00:36:20,721
Because I, I don't care how good,
even if, like, okay, let's say

945
00:36:20,721 --> 00:36:25,641
you drop Melissa into X, Y, Z
company and you put her in charge.

946
00:36:26,116 --> 00:36:28,456
W. Curtis Preston: Do are you gonna
repel down a rope from a helicopter?

947
00:36:28,456 --> 00:36:28,816
Because that

948
00:36:28,881 --> 00:36:31,131
Melissa Palmer: Yes, I'm gonna
repel down a rope from a helicopter,

949
00:36:31,131 --> 00:36:34,941
drop me in, right, and say,
Melissa, get ready for ransomware,

950
00:36:35,031 --> 00:36:36,741
and six months later you hit me.

951
00:36:37,731 --> 00:36:40,581
I would like to say that I'll be able
to recover, but I don't know that.

952
00:36:41,916 --> 00:36:42,036
I don't know.

953
00:36:42,036 --> 00:36:45,336
That doesn't matter how good you
are, you're not doing this every

954
00:36:45,336 --> 00:36:46,416
day, right?

955
00:36:46,476 --> 00:36:50,346
Like, so unless you're doing this every
day, cuz every attack is different.

956
00:36:50,351 --> 00:36:52,386
It's gonna be like, what have these
people seen in the other events?

957
00:36:52,391 --> 00:36:54,606
What, what ransomware
gang have you been hit by?

958
00:36:54,606 --> 00:36:55,026
Right?

959
00:36:55,446 --> 00:36:58,416
So I can put everything into
place that I think I will need

960
00:36:58,416 --> 00:36:59,376
to make sure that we recover.

961
00:36:59,376 --> 00:37:01,266
And yeah, honestly, we'd
probably recover all our data.

962
00:37:01,266 --> 00:37:03,546
I don't know if we meet
our RPOs and our tails.

963
00:37:03,716 --> 00:37:06,186
I, I, I'm pretty sure I could get all
the data to the recoverable point,

964
00:37:06,186 --> 00:37:09,036
but what was Exfiltrated, how did
they get in all that kind of stuff.

965
00:37:10,831 --> 00:37:12,141
you don't know, which is why
you have to call the pros.

966
00:37:12,141 --> 00:37:13,551
You have to call the people
that do this every day.

967
00:37:13,641 --> 00:37:19,731
Prasanna Malaiyandi: Is there sort of a
standard ransomware recovery test, but.

968
00:37:20,766 --> 00:37:22,956
That kind of outlines like,
Hey, here are the thing.

969
00:37:22,956 --> 00:37:26,196
Because I can imagine, say
you can't afford, the pros

970
00:37:26,256 --> 00:37:27,396
say you can't afford the pros.

971
00:37:27,396 --> 00:37:27,756
Right?

972
00:37:28,416 --> 00:37:32,586
Is there sort of a, here are the
testing scenarios you should be thinking

973
00:37:32,586 --> 00:37:36,036
about, or here are the things that
sort of get shot in the head when a

974
00:37:36,036 --> 00:37:38,736
ransomware recovery or ransomware hits.

975
00:37:39,351 --> 00:37:42,381
Melissa Palmer: Um, Google
tabletop exercises like ransomware

976
00:37:42,381 --> 00:37:43,431
recovery, disaster recovery,

977
00:37:43,431 --> 00:37:44,601
tabletop exercises.

978
00:37:44,606 --> 00:37:44,691
Right?

979
00:37:44,691 --> 00:37:45,531
That's a good place to start.

980
00:37:45,531 --> 00:37:48,171
I've thought about doing like a
dungeon and dragon style type,

981
00:37:48,171 --> 00:37:49,401
like ransomware recovery thing.

982
00:37:49,401 --> 00:37:49,491
I

983
00:37:49,491 --> 00:37:50,601
Prasanna Malaiyandi:
With the actual people.

984
00:37:50,601 --> 00:37:52,671
Yeah, with like you get
the networking security

985
00:37:52,761 --> 00:37:53,811
Melissa Palmer: think that would be

986
00:37:53,816 --> 00:37:54,801
fun and useful.

987
00:37:54,801 --> 00:37:55,251
And you know what?

988
00:37:55,251 --> 00:37:57,561
When you make things fun,
people actually pay a.

989
00:37:58,021 --> 00:37:58,441
Prasanna Malaiyandi: Yep.

990
00:37:58,711 --> 00:37:58,806
Melissa Palmer: right?

991
00:37:58,806 --> 00:38:02,886
So like, if I get you all in terms and
be like, today we are going to talk

992
00:38:02,886 --> 00:38:07,206
about ransomware recovery and have a
mock simulation of what would happen.

993
00:38:07,356 --> 00:38:11,946
Be like, okay, you're a Paladin,
you're a warrior, uh, you're a ma.

994
00:38:12,996 --> 00:38:16,116
Uh, an adult black dragon just
showed up and encrypted your VMs.

995
00:38:16,121 --> 00:38:16,806
What are you doing?

996
00:38:16,811 --> 00:38:17,226
Right?

997
00:38:17,376 --> 00:38:17,706
Like,

998
00:38:18,066 --> 00:38:19,296
you're gonna have so much fun,

999
00:38:19,296 --> 00:38:21,726
you're gonna remember it, and
it's gonna work out a lot better.

1000
00:38:21,801 --> 00:38:22,011
Prasanna Malaiyandi: Yeah.

1001
00:38:23,641 --> 00:38:24,331
W. Curtis Preston: I like that.

1002
00:38:24,361 --> 00:38:24,901
Yeah.

1003
00:38:25,021 --> 00:38:28,561
Um, by the way, one of the things, you
know, we talked a lot about prepping.

1004
00:38:29,191 --> 00:38:32,551
One of the things that I think
also in terms of, we talked

1005
00:38:32,551 --> 00:38:33,961
about exfiltration monitoring.

1006
00:38:34,561 --> 00:38:38,461
I also, uh, like the idea, and
we talked about it on a couple of

1007
00:38:38,461 --> 00:38:44,791
different episodes, this idea of,
um, Something on your d n s side

1008
00:38:44,941 --> 00:38:48,571
that would notice when you start
talking to really weird domain names.

1009
00:38:48,996 --> 00:38:49,596
Melissa Palmer: Yeah, that's a

1010
00:38:49,596 --> 00:38:49,956
big one.

1011
00:38:49,956 --> 00:38:51,096
And there's all these lists.

1012
00:38:51,156 --> 00:38:56,316
Um, a lot of these researchers will just
like tweet like, by the way, domains

1013
00:38:56,316 --> 00:38:57,576
looking a little hot, a little suss.

1014
00:38:57,581 --> 00:38:58,716
You might wanna block that stuff.

1015
00:38:59,196 --> 00:38:59,766
Um, so yeah,

1016
00:38:59,766 --> 00:38:59,946
there's

1017
00:38:59,946 --> 00:39:02,886
these lists of these like known bad
domains and ips and stuff like that too.

1018
00:39:03,031 --> 00:39:03,481
W. Curtis Preston: Right.

1019
00:39:03,931 --> 00:39:04,291
Yeah.

1020
00:39:04,291 --> 00:39:09,121
And, and the other, uh,
but I, I do think that if.

1021
00:39:10,876 --> 00:39:16,516
If you implement exfiltration monitoring,
if you have a specific exfiltration

1022
00:39:16,516 --> 00:39:20,776
monitoring, I think you could stop mo
or, or notice it quickly and stop it.

1023
00:39:21,226 --> 00:39:25,576
Um, but what I'm hearing from
others is that not everybody

1024
00:39:25,576 --> 00:39:26,686
can afford such a thing.

1025
00:39:27,136 --> 00:39:27,556
Right.

1026
00:39:27,736 --> 00:39:29,516
Um, that, that,

1027
00:39:29,586 --> 00:39:31,086
Melissa Palmer: lot of people
can't afford it or they don't

1028
00:39:31,086 --> 00:39:32,526
have the skill set to build it

1029
00:39:32,526 --> 00:39:33,756
themselves, and you

1030
00:39:33,756 --> 00:39:35,946
really wanna be building and
maintaining your own security systems.

1031
00:39:36,356 --> 00:39:36,636
Probably not.

1032
00:39:37,141 --> 00:39:38,881
W. Curtis Preston: No,
but a lot of people do,

1033
00:39:39,396 --> 00:39:40,716
Melissa Palmer: Yeah,
because they have no choice.

1034
00:39:40,716 --> 00:39:41,496
It's better than nothing.

1035
00:39:42,006 --> 00:39:42,426
Like I've done

1036
00:39:42,426 --> 00:39:45,036
some weird stuff with some weird software
because it was better than nothing.

1037
00:39:45,546 --> 00:39:49,026
Um, it, it, it's really a
difficult point to be in.

1038
00:39:49,026 --> 00:39:53,916
And it's kind of like, you know, you
all these people put out these, um, all

1039
00:39:53,916 --> 00:39:56,586
these, uh, security companies will do
all this research of like, here's the

1040
00:39:56,591 --> 00:39:59,796
top ways they're getting in and blah,
blah, blah, and all this kind of stuff.

1041
00:40:00,156 --> 00:40:01,866
Um, there's a lot of marketing
that goes into it, but

1042
00:40:01,866 --> 00:40:02,976
there's a lot of truth, right?

1043
00:40:03,006 --> 00:40:03,876
So like, I.

1044
00:40:04,811 --> 00:40:07,011
. The big thing was the people
for a long time, the people

1045
00:40:07,011 --> 00:40:08,481
let it in, you know, multi.

1046
00:40:08,961 --> 00:40:11,031
Where was it when, when this
whole Cisco thing happened?

1047
00:40:11,031 --> 00:40:13,821
That was like, um, mfa, right?

1048
00:40:13,821 --> 00:40:13,911
They

1049
00:40:13,911 --> 00:40:15,861
got in through their mfa cuz
they kept spamming of them.

1050
00:40:15,861 --> 00:40:16,431
Eventually they said

1051
00:40:16,431 --> 00:40:18,411
yes because like, stop calling me at 11

1052
00:40:18,411 --> 00:40:19,131
o'clock at night.

1053
00:40:19,851 --> 00:40:23,646
Um, . Now they're saying, oh, it's more
vulnerabilities than people, right?

1054
00:40:23,646 --> 00:40:26,616
So honestly, I feel like the
people might be easier to deal

1055
00:40:26,616 --> 00:40:27,786
with in the vulnerabilities.

1056
00:40:27,906 --> 00:40:28,326
I don't know.

1057
00:40:28,836 --> 00:40:31,506
Um, because then it's gonna
be like testing the patches.

1058
00:40:31,511 --> 00:40:32,436
Can we patch everything?

1059
00:40:32,436 --> 00:40:33,456
Can we remediate everything?

1060
00:40:33,461 --> 00:40:36,906
It's, it's just like, what are the
areas that you can find within your

1061
00:40:36,906 --> 00:40:41,976
own organization to be quick wins
because you wanna prove that you can

1062
00:40:41,976 --> 00:40:45,246
win to your management so you get
more money and can do more projects.

1063
00:40:45,246 --> 00:40:45,426
So you

1064
00:40:45,426 --> 00:40:48,906
need like a balance of quick
wins to prove progress and high.

1065
00:40:50,061 --> 00:40:50,076
right?

1066
00:40:50,081 --> 00:40:52,506
What are the things that I can
implement that will have the

1067
00:40:52,506 --> 00:40:54,126
most impact to reduce the risk?

1068
00:40:54,126 --> 00:40:55,926
And you're never gonna
get the risk to zero.

1069
00:40:55,926 --> 00:40:59,826
I, there's um, a lot of people say
that, like assume breach, right?

1070
00:40:59,826 --> 00:41:01,326
Like assume they're gonna get in so we

1071
00:41:01,326 --> 00:41:02,436
can do all this security stuff.

1072
00:41:02,441 --> 00:41:03,606
We can do all this backup.

1073
00:41:03,816 --> 00:41:06,306
And backup is basically assuming
they're gonna get in, right?

1074
00:41:06,311 --> 00:41:06,546
Like, we're

1075
00:41:06,546 --> 00:41:09,066
not backing this stuff up cuz we
think our security is so great.

1076
00:41:09,066 --> 00:41:11,886
Like we're assuming that it's the last
line of defense, we're gonna need it.

1077
00:41:12,666 --> 00:41:15,786
Um, so a lot of it is just
trying to mitigate what you.

1078
00:41:17,061 --> 00:41:19,551
in a way that makes sense for your
organization, because we can't

1079
00:41:19,551 --> 00:41:22,791
have everybody working 20 hour
days doing this either, or they're

1080
00:41:22,791 --> 00:41:24,141
gonna be too fried to make mistakes

1081
00:41:24,141 --> 00:41:25,671
and people are a problem.

1082
00:41:26,391 --> 00:41:27,561
Um, it, it's difficult.

1083
00:41:27,591 --> 00:41:29,211
It really is hard for any organization.

1084
00:41:29,211 --> 00:41:34,071
It's what can I do with what
resources I have and cya, right?

1085
00:41:34,071 --> 00:41:38,061
If I'm, I'd probably be doing a lot
of cya when, you know, they tell you

1086
00:41:38,061 --> 00:41:39,531
it's too expensive, you can't do that.

1087
00:41:39,531 --> 00:41:40,701
Well, you better have that documented.

1088
00:41:40,701 --> 00:41:42,561
So when you get ransomware,
not like, Melissa, why

1089
00:41:42,561 --> 00:41:44,121
didn't you put in that security system?

1090
00:41:44,126 --> 00:41:45,141
You told me we didn't have the.

1091
00:41:45,496 --> 00:41:48,586
W. Curtis Preston: You don't know what's
the current hot way that they're gonna,

1092
00:41:48,976 --> 00:41:50,146
they're, they're gonna attack you.

1093
00:41:50,386 --> 00:41:53,266
You can't stop all, uh, vulnerabilities.

1094
00:41:53,296 --> 00:41:58,966
You can't stop all stupid user things
that stupid users are gonna do.

1095
00:41:59,536 --> 00:42:07,171
Um, and, um, And, and so you, I do think
you, you have to assume breach, right?

1096
00:42:07,321 --> 00:42:11,491
And so you do have to do some things
in your network that are going to

1097
00:42:11,491 --> 00:42:14,281
tell you when the bad guys are here.

1098
00:42:14,851 --> 00:42:17,611
Um, and that we stop it

1099
00:42:17,611 --> 00:42:19,141
as quickly as we can.

1100
00:42:19,811 --> 00:42:21,071
Melissa Palmer: Can we
make a movie about this?

1101
00:42:21,071 --> 00:42:21,581
Please?

1102
00:42:22,241 --> 00:42:22,971
Like that would be

1103
00:42:22,971 --> 00:42:23,251
really cool.

1104
00:42:23,331 --> 00:42:23,691
W. Curtis Preston: Nobody.

1105
00:42:23,991 --> 00:42:24,651
It'll only be

1106
00:42:24,796 --> 00:42:25,496
Melissa Palmer: I'm gonna watch it

1107
00:42:25,916 --> 00:42:28,586
I'm gonna have chat, G
b T, write me a movie.

1108
00:42:28,706 --> 00:42:30,686
I've had to write me
ransomware, hallmark movies.

1109
00:42:30,686 --> 00:42:34,556
I kid you not, I'm just saying

1110
00:42:35,426 --> 00:42:36,416
have to entertain myself.

1111
00:42:36,416 --> 00:42:36,806
How now?

1112
00:42:37,271 --> 00:42:37,661
Prasanna Malaiyandi: Wait,

1113
00:42:37,836 --> 00:42:38,466
W. Curtis Preston: my wife would

1114
00:42:38,471 --> 00:42:42,696
watch it if we make it a
krama, make it a Korean drama.

1115
00:42:42,936 --> 00:42:43,626
Um,

1116
00:42:43,796 --> 00:42:44,036
Melissa Palmer: be good.

1117
00:42:44,036 --> 00:42:45,746
Or like a Bollywood ransomware story.

1118
00:42:45,816 --> 00:42:48,966
W. Curtis Preston: yeah, I, there
was a ransomware attack and a

1119
00:42:48,996 --> 00:42:51,786
krama that, uh, I dunno if you
saw, there's one called Startup.

1120
00:42:52,446 --> 00:42:56,976
Um, and, uh, there, there's
a, there's a, a really big

1121
00:42:56,976 --> 00:42:59,226
incubator in Korea in this movie.

1122
00:42:59,556 --> 00:43:03,936
Um, and this group of people,
they, they do a startup there and.

1123
00:43:04,461 --> 00:43:07,221
Right at the crucial moment they
get, they get a ransomware attack.

1124
00:43:07,641 --> 00:43:11,631
Um, and, and it was because
some people did some dumb stuff.

1125
00:43:11,631 --> 00:43:13,521
They cut some corners,
you know, and so they got

1126
00:43:14,276 --> 00:43:14,546
Prasanna Malaiyandi: They got.

1127
00:43:14,781 --> 00:43:16,221
W. Curtis Preston: and
the tech wasn't bad.

1128
00:43:16,701 --> 00:43:17,151
Right.

1129
00:43:17,241 --> 00:43:21,561
Um, there, I, I've actually seen
a lot of, there was, uh, the good

1130
00:43:21,561 --> 00:43:26,961
doctor, that's the one with the guy
that has, he's on the spectrum anyway.

1131
00:43:26,961 --> 00:43:27,681
They got, they got,

1132
00:43:28,251 --> 00:43:29,481
they got, they got a ransomware

1133
00:43:29,481 --> 00:43:30,051
attack.

1134
00:43:30,506 --> 00:43:30,686
Melissa Palmer: Grey's

1135
00:43:30,686 --> 00:43:30,986
Anatomy

1136
00:43:31,041 --> 00:43:32,781
W. Curtis Preston: Uh,
Grey's Anatomy did one.

1137
00:43:32,871 --> 00:43:35,931
Uh, the good doctor did one
and the tech wasn't bad.

1138
00:43:36,381 --> 00:43:36,801
Right.

1139
00:43:36,861 --> 00:43:40,551
Uh, I just, I just hate it when it's
like, like, when you watch, I dunno if you

1140
00:43:40,551 --> 00:43:42,261
ever watch, did you ever watch the Net?

1141
00:43:42,926 --> 00:43:43,496
Melissa Palmer: Yeah.

1142
00:43:43,586 --> 00:43:44,036
Yeah.

1143
00:43:44,141 --> 00:43:44,561
Prasanna Malaiyandi: Yep.

1144
00:43:44,571 --> 00:43:45,051
W. Curtis Preston: That tech

1145
00:43:45,146 --> 00:43:48,416
Melissa Palmer: Look, all I know is I
was, I don't know, maybe there's some

1146
00:43:48,416 --> 00:43:51,956
Hallmark movies going on in my house and
it was on in the other room when I was

1147
00:43:51,956 --> 00:43:53,396
cooking dinner and my ears perked up.

1148
00:43:53,401 --> 00:43:55,316
Cause I heard something
about an engineer and it was

1149
00:43:55,321 --> 00:43:56,786
the dude who was the engineer.

1150
00:43:56,846 --> 00:43:58,886
I was like, oh, I had hopes for this one.

1151
00:43:58,886 --> 00:44:03,266
So Hallmark, if you are listening to
this, I would love to be your female

1152
00:44:03,271 --> 00:44:06,026
lead in a I think that would be so much.

1153
00:44:07,856 --> 00:44:08,936
Come on, come on.

1154
00:44:09,296 --> 00:44:10,016
Happy ending.

1155
00:44:10,016 --> 00:44:10,406
They, we,

1156
00:44:10,646 --> 00:44:11,306
we recover from

1157
00:44:11,461 --> 00:44:13,581
W. Curtis Preston: question is,
how can you incorporate a small

1158
00:44:13,581 --> 00:44:17,661
town with a business that's,
you know, on its last legs?

1159
00:44:17,691 --> 00:44:17,811
And

1160
00:44:17,846 --> 00:44:18,476
Melissa Palmer: Totally.

1161
00:44:18,596 --> 00:44:18,926
Prasanna Malaiyandi: That would

1162
00:44:18,926 --> 00:44:19,496
work.

1163
00:44:19,526 --> 00:44:20,016
Yeah.

1164
00:44:20,151 --> 00:44:22,821
W. Curtis Preston: instead of a ran,
instead of a, uh, you know, a big

1165
00:44:22,821 --> 00:44:26,001
bookstore coming into town to shut
down your little bookstore, it's

1166
00:44:26,361 --> 00:44:29,571
the ransomware attack shuts down
the little, the little bookstore in

1167
00:44:29,696 --> 00:44:31,166
Prasanna Malaiyandi: Or
it could be at a doctor's

1168
00:44:31,221 --> 00:44:31,791
W. Curtis Preston: And,

1169
00:44:32,246 --> 00:44:32,636
Melissa Palmer: Yeah.

1170
00:44:33,506 --> 00:44:34,436
Or local hospital.

1171
00:44:34,436 --> 00:44:34,616
We could

1172
00:44:34,616 --> 00:44:35,366
do local hospital.

1173
00:44:35,366 --> 00:44:35,886
That would be fine.

1174
00:44:36,656 --> 00:44:37,736
Small town hospital

1175
00:44:37,736 --> 00:44:38,696
only thing for miles.

1176
00:44:39,446 --> 00:44:44,096
W. Curtis Preston: It's, it's the big
city girl that knows, um, that knows

1177
00:44:44,096 --> 00:44:46,046
about ransomware to rescue the little

1178
00:44:46,106 --> 00:44:49,316
Melissa Palmer: big city girl, leaves
her job at a software company, goes back

1179
00:44:49,316 --> 00:44:52,556
to her hometown to go out on her own.

1180
00:44:53,666 --> 00:44:53,996
just

1181
00:44:54,116 --> 00:44:57,776
W. Curtis Preston: Um, can you tell I've
seen a Hallmark movie or show a show

1182
00:44:57,791 --> 00:44:59,366
Melissa Palmer: I, it's
my guilty pleasure.

1183
00:44:59,436 --> 00:45:03,786
I'm just gonna say that, uh, around
Christmas there was a thing going around.

1184
00:45:03,786 --> 00:45:05,766
It was like Hallmark movie generator,

1185
00:45:05,916 --> 00:45:08,076
and I looked at it and
I went, this is my life.

1186
00:45:08,136 --> 00:45:08,946
Oh my goodness.

1187
00:45:08,946 --> 00:45:10,356
I'm a Hallmark movie.

1188
00:45:10,386 --> 00:45:11,856
This is so cool.

1189
00:45:12,456 --> 00:45:16,086
W. Curtis Preston: They are kind of
predictable as storylines, but, but yet

1190
00:45:16,086 --> 00:45:18,456
they've yet to have a ransomware attack.

1191
00:45:18,831 --> 00:45:19,371
Melissa Palmer: Come on.

1192
00:45:19,866 --> 00:45:20,616
W. Curtis Preston: I'm behind that.

1193
00:45:21,741 --> 00:45:22,101
Yeah.

1194
00:45:23,391 --> 00:45:27,111
Well on that note, um, speaking
of disappointing, um, you

1195
00:45:27,111 --> 00:45:29,991
know, if you folks like this

1196
00:45:29,991 --> 00:45:31,011
episode, I think there's

1197
00:45:31,011 --> 00:45:31,161
some,

1198
00:45:31,671 --> 00:45:35,421
I, uh, uh, I think, no, I
think this was a good episode.

1199
00:45:35,451 --> 00:45:38,001
Um, and I like, I think,
you know, we covered a lot.

1200
00:45:38,211 --> 00:45:39,321
We also had a little bit of fun.

1201
00:45:39,381 --> 00:45:39,981
I love that.

1202
00:45:39,981 --> 00:45:43,601
That's actually my favorite kind of
episode where we, if it's just straight

1203
00:45:43,606 --> 00:45:45,231
talk the whole time, it's boring.

1204
00:45:45,471 --> 00:45:47,001
Um, and.

1205
00:45:48,006 --> 00:45:48,996
This was good.

1206
00:45:49,026 --> 00:45:50,076
Uh, good, good.

1207
00:45:50,076 --> 00:45:51,036
Smattering of both.

1208
00:45:51,666 --> 00:45:55,686
So, um, I think the one thing we're
getting away from this is the best way

1209
00:45:55,686 --> 00:45:59,466
to respond to a ransomware attack is
to respond to it before it happens.

1210
00:45:59,781 --> 00:46:00,291
Melissa Palmer: Yes.

1211
00:46:00,696 --> 00:46:01,146
W. Curtis Preston: Right.

1212
00:46:01,386 --> 00:46:05,736
Talk to people, talk to, you know,
talk to a incident response team.

1213
00:46:05,736 --> 00:46:08,016
A cyber insurance company's a
good way to get one of those.

1214
00:46:08,316 --> 00:46:15,006
Um, you know, uh, do all the, the, those,
the ransomware recovery scenarios, right?

1215
00:46:15,006 --> 00:46:19,146
All the different scenarios from a, the,
the backup and recovery standpoint, right?

1216
00:46:19,206 --> 00:46:24,876
Um, and, um, and do some kind
of monitoring, logging, logging.

1217
00:46:26,121 --> 00:46:28,461
Saving your logs, getting
the logs, logging log.

1218
00:46:28,971 --> 00:46:30,721
I can't, I can't say that.

1219
00:46:31,831 --> 00:46:32,361
I can't

1220
00:46:32,361 --> 00:46:32,661
say it that

1221
00:46:32,676 --> 00:46:33,126
Prasanna Malaiyandi: lugging.

1222
00:46:33,981 --> 00:46:35,061
W. Curtis Preston: Yeah, log, logging.

1223
00:46:35,061 --> 00:46:36,321
Logging, I can't, I don't know.

1224
00:46:36,561 --> 00:46:38,211
My tongue doesn't do that anyway.

1225
00:46:38,271 --> 00:46:43,821
Um, and then also some kind of monitoring
for what's going on in your environment.

1226
00:46:43,911 --> 00:46:47,441
That would set off
alarms when a ransomware.

1227
00:46:48,096 --> 00:46:50,046
You know, initial phase is happening.

1228
00:46:50,286 --> 00:46:53,676
Uh, cuz that's the key to start
to stopping it, is to stop it.

1229
00:46:53,766 --> 00:46:53,976
Melissa Palmer: Yep.

1230
00:46:53,981 --> 00:46:54,186
Get it.

1231
00:46:54,671 --> 00:46:55,161
Prasanna Malaiyandi: Yeah,

1232
00:46:55,566 --> 00:46:56,226
W. Curtis Preston: absolutely.

1233
00:46:57,006 --> 00:46:58,026
Well, thanks Melissa

1234
00:46:58,491 --> 00:46:59,061
Melissa Palmer: Thank you.

1235
00:47:00,216 --> 00:47:03,186
W. Curtis Preston: and uh, thanks Prasanna
despite the fact that you were the

1236
00:47:03,186 --> 00:47:04,626
cause of all of our technical problems.

1237
00:47:05,421 --> 00:47:06,351
Prasanna Malaiyandi: I'm sorry.

1238
00:47:06,381 --> 00:47:07,401
Hopefully not.

1239
00:47:07,461 --> 00:47:08,301
Melissa Palmer: Sounds like a Hallmark

1240
00:47:08,586 --> 00:47:08,736
Prasanna Malaiyandi: I

1241
00:47:08,751 --> 00:47:09,111
Melissa Palmer: Sounds like a

1242
00:47:09,111 --> 00:47:10,131
Hallmark movie, just saying

1243
00:47:10,316 --> 00:47:11,156
W. Curtis Preston: We'll see this.

1244
00:47:11,736 --> 00:47:14,616
Prasanna Malaiyandi: Thanks Curtis,
and enjoy your vacation, Curtis, and

1245
00:47:14,616 --> 00:47:16,236
thanks Melissa for joining us again.

1246
00:47:16,811 --> 00:47:17,441
Melissa Palmer: my pleasure.

1247
00:47:17,866 --> 00:47:20,116
W. Curtis Preston: We want to say
thank you to our listeners as well.

1248
00:47:20,146 --> 00:47:22,666
It's been a great year, 2023.

1249
00:47:22,906 --> 00:47:25,726
So I hope you enjoyed this repeat episode.

1250
00:47:25,726 --> 00:47:27,796
That was so popular earlier in the year.

1251
00:47:28,246 --> 00:47:30,976
And again, we just want to thank you.

1252
00:47:31,216 --> 00:47:32,626
That is a wrap.