1 00:00:00,000 --> 00:00:04,799 Most ransomware attacks succeed for one reason, somebody skipped the 2 00:00:04,799 --> 00:00:10,509 basics, patch management, password management, MFA or pass keys. 3 00:00:10,990 --> 00:00:16,010 These three things, do those right and you stop roughly 90% of the attacks. 4 00:00:16,629 --> 00:00:20,389 This week, Dr. Mike Saylor, Prasanna and I walk through each one, 5 00:00:20,739 --> 00:00:24,270 what it is, why it matters, and what happens when you ignore it. 6 00:00:24,379 --> 00:00:26,020 Things like WannaCry, Rackspace. 7 00:00:26,340 --> 00:00:30,070 These, stories are all real, and the lesson is the same every time. 8 00:00:30,440 --> 00:00:31,730 The basics weren't done. 9 00:00:32,150 --> 00:00:37,429 You don't need a massive budget or a fancy security stack to stop most hackers. 10 00:00:37,800 --> 00:00:39,719 You just need to do the boring stuff. 11 00:00:39,820 --> 00:00:42,980 Here we turn admins into cyber recovery heroes. 12 00:00:43,289 --> 00:00:45,109 This is the Backup Wrap Up 13 00:00:59,738 --> 00:01:01,028 Welcome to the backup wrap up. 14 00:01:01,028 --> 00:01:05,028 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have with 15 00:01:05,028 --> 00:01:10,908 me, a guy who apparently shaved last week and I didn't even notice. 16 00:01:10,918 --> 00:01:12,833 Prasanna, Prasanna Malaiyandi, how's it going? 17 00:01:12,843 --> 00:01:13,323 Prasanna. 18 00:01:14,079 --> 00:01:15,074 I am good Curtis. 19 00:01:15,074 --> 00:01:15,374 Yeah. 20 00:01:15,424 --> 00:01:19,384 my wife was very surprised after the podcast recording when she 21 00:01:19,384 --> 00:01:21,124 was like, did Curtis notice? 22 00:01:22,174 --> 00:01:25,054 of course, I. I texted you and you're like, no, or no, I think 23 00:01:25,133 --> 00:01:25,613 No. 24 00:01:25,624 --> 00:01:28,234 on the phone and you're like, no, what are you talking about? 25 00:01:28,284 --> 00:01:28,734 Yeah. 26 00:01:28,784 --> 00:01:33,304 and apparently Mike didn't notice either, so I feel somewhat better, but, yeah. 27 00:01:33,304 --> 00:01:35,224 So you've gone down to the goatee, 28 00:01:35,715 --> 00:01:35,925 Yep. 29 00:01:35,974 --> 00:01:37,809 many, many years since I've done this. 30 00:01:38,579 --> 00:01:40,469 I've seen a picture of you with the goatee. 31 00:01:40,559 --> 00:01:40,889 yeah. 32 00:01:42,149 --> 00:01:44,969 I think you should go back to your cut from college. 33 00:01:45,059 --> 00:01:45,869 That's what I think. 34 00:01:46,629 --> 00:01:47,469 The buzz cut. 35 00:01:47,589 --> 00:01:48,129 Yeah. 36 00:01:48,199 --> 00:01:49,939 I'd love to see you in the buzz cut again. 37 00:01:51,041 --> 00:01:51,521 Walked away. 38 00:01:51,689 --> 00:01:55,079 speaking of buzz cuts, Dr. Mike Sailor, how's it going, Mike? 39 00:01:56,826 --> 00:01:57,966 Going Good guys. 40 00:01:58,536 --> 00:01:59,286 It's going good. 41 00:01:59,714 --> 00:02:00,224 All right. 42 00:02:00,224 --> 00:02:03,704 So he of course, is the co-author on, learning Ransomware Response and 43 00:02:03,704 --> 00:02:05,504 Recovery, which came out last month. 44 00:02:05,774 --> 00:02:07,994 Which, uh, do you have one with you now? 45 00:02:08,054 --> 00:02:09,794 Did you, did you prepare this time? 46 00:02:10,911 --> 00:02:12,186 I did not prepare this time. 47 00:02:12,374 --> 00:02:16,934 I have yet I still don't have mine and I have yet to actually see the 48 00:02:17,024 --> 00:02:21,224 a physical printed book even like a video of a physical printed book with 49 00:02:21,284 --> 00:02:23,684 the book is gonna be the size of the thing in your background? 50 00:02:23,684 --> 00:02:24,314 Curtis? 51 00:02:25,113 --> 00:02:29,153 yeah I would dear Lord I hope not And you know what's funny is like in on the 52 00:02:29,153 --> 00:02:35,323 camera this thing looks fine but this is like this far back from me right And so 53 00:02:35,323 --> 00:02:41,243 this thing is I think it's 15 by 24 That thing is massive so yeah I surely hope not 54 00:02:41,689 --> 00:02:42,229 For those 55 00:02:42,263 --> 00:02:42,683 but 56 00:02:42,739 --> 00:02:45,829 watch us on YouTube, we do have videos out, but Curtis was just 57 00:02:45,829 --> 00:02:47,849 pointing at the title page? 58 00:02:47,849 --> 00:02:48,659 The front 59 00:02:49,008 --> 00:02:54,318 It's the cover the front cover Yeah yeah yeah And uh available at uh 60 00:02:56,568 --> 00:03:00,258 So or you can order them directly from O'Reilly for the record if you order 61 00:03:00,258 --> 00:03:06,923 directly from O'Reilly Mike and I make more um So uh there's that All right 62 00:03:07,203 --> 00:03:11,253 we're gonna talk so we're gonna jump into this week we're gonna talk about 63 00:03:11,253 --> 00:03:14,823 the title It's gonna sound I I never know exactly what the title's gonna 64 00:03:14,823 --> 00:03:19,443 be but it's gonna be something along the lines of stop 90 of the ransomware 65 00:03:19,443 --> 00:03:24,388 attacks that could possibly happen to you That's a really long title but I it 66 00:03:24,388 --> 00:03:28,508 may sound like a bold claim but I think it's pretty straightforward And Mike I'd 67 00:03:28,508 --> 00:03:30,608 like to start out this week What's that 68 00:03:30,929 --> 00:03:31,319 before you 69 00:03:31,358 --> 00:03:31,778 Yeah 70 00:03:31,889 --> 00:03:33,179 can I make a bold claim? 71 00:03:34,178 --> 00:03:34,808 claim 72 00:03:35,639 --> 00:03:35,789 A 73 00:03:35,978 --> 00:03:36,548 please 74 00:03:37,649 --> 00:03:41,399 That you can stop a hundred percent of ransomware if you 75 00:03:41,399 --> 00:03:42,134 never do anything online. 76 00:03:46,658 --> 00:03:49,148 not, I think there's still some room there for infection. 77 00:03:50,048 --> 00:03:53,088 if they do the the drop the one that we covered in the what do 78 00:03:53,088 --> 00:03:56,608 you call it when we did the MR Robot remember the drop USB stick 79 00:03:56,759 --> 00:03:57,339 Oh, that's 80 00:03:57,395 --> 00:03:58,295 Tchotchke drops. 81 00:03:58,858 --> 00:03:59,573 Yeah what's that 82 00:03:59,699 --> 00:04:00,334 you win. 83 00:04:01,065 --> 00:04:02,655 We call 'em tchotchke drops. 84 00:04:02,693 --> 00:04:08,358 Tchotchke drops Yeah Yeah So even then but what is this not do things online 85 00:04:08,358 --> 00:04:12,068 thing that you're talking about I don't know what in the world I don't even know 86 00:04:12,855 --> 00:04:15,045 Like saying you can't get sick if you don't go outside. 87 00:04:15,095 --> 00:04:15,795 that's not true either. 88 00:04:16,348 --> 00:04:20,788 Exactly all right Mike do you have a story to start us out with this week 89 00:04:20,828 --> 00:04:24,598 man, there's so many to pick from, but, from the book, we talk about WannaCry. 90 00:04:25,138 --> 00:04:28,538 and similar to kinda what we touched on here, good hygiene 91 00:04:28,538 --> 00:04:30,278 can prevent a lot of stuff. 92 00:04:30,668 --> 00:04:35,048 And I think WannaCry is an example of bad guys identified of a 93 00:04:35,048 --> 00:04:36,368 vulnerability that was out there. 94 00:04:36,368 --> 00:04:41,058 They created a. a payload and a, and an attack vector to take advantage of that, 95 00:04:41,328 --> 00:04:46,193 realizing that, there's a very large percentage of, company and organization 96 00:04:46,193 --> 00:04:52,443 populations that don't have a solid patch management program or, that it's pretty 97 00:04:52,443 --> 00:04:55,863 lax, there's a lot of organizations that, that say we have a patch program, 98 00:04:55,863 --> 00:05:00,173 but it's, 2, 3, 4 months behind, or it's gotta meet certain criteria 99 00:05:00,173 --> 00:05:01,643 and some things never get patched. 100 00:05:02,193 --> 00:05:03,633 that's what happened with WannaCry. 101 00:05:03,761 --> 00:05:04,841 found a vulnerability, 102 00:05:04,879 --> 00:05:09,639 For those of us that haven't lived the cyber world Why don't you tell us what 103 00:05:09,639 --> 00:05:12,829 was want Tory What did it make you want to cry Is that why it was called 104 00:05:12,829 --> 00:05:14,359 that And what when did it happen and 105 00:05:14,409 --> 00:05:14,709 I was 106 00:05:14,735 --> 00:05:16,175 I think there was about 200,000, 107 00:05:16,599 --> 00:05:16,839 Yeah. 108 00:05:16,919 --> 00:05:19,319 200,000 people crying in unison, 109 00:05:19,832 --> 00:05:20,322 exactly 110 00:05:20,379 --> 00:05:21,124 with WannaCry. 111 00:05:22,123 --> 00:05:25,993 I was going to say Curtis, that because there have been so many of these 112 00:05:26,113 --> 00:05:29,533 attacks over the years, it's also hard to keep like, which keep it straight 113 00:05:29,533 --> 00:05:31,243 in terms of like which one was which. 114 00:05:31,942 --> 00:05:34,007 So why don't you tell us the story of WannaCry Mike 115 00:05:35,369 --> 00:05:40,399 WannaCry, was developed, to take advantage of a vulnerability in 116 00:05:40,999 --> 00:05:43,839 SMB or a, a Windows, service. 117 00:05:44,409 --> 00:05:45,309 That had a patch. 118 00:05:45,309 --> 00:05:46,839 So Microsoft came out with a patch. 119 00:05:46,899 --> 00:05:50,739 So it was several months later that the malware, this 120 00:05:50,739 --> 00:05:52,299 attack vector really came out. 121 00:05:52,369 --> 00:05:57,389 and it was all of those organizations that did not apply that critical, patch. 122 00:05:57,389 --> 00:05:59,899 And if, if you were paying attention at all, you probably got 123 00:05:59,899 --> 00:06:02,124 an email from Microsoft saying, you really need to patch this. 124 00:06:03,064 --> 00:06:04,324 This, this vulnerability. 125 00:06:04,774 --> 00:06:08,324 or you've got automatic patches turned off, which is common too. 126 00:06:08,354 --> 00:06:10,994 'cause a lot of organizations don't want to automatically apply 127 00:06:10,994 --> 00:06:14,624 patches to production systems and have them reboot and cause issues. 128 00:06:14,624 --> 00:06:19,064 But nonetheless, bad guys found a vulnerability, took advantage of it 129 00:06:21,014 --> 00:06:22,814 several months after the fact even, 130 00:06:22,927 --> 00:06:23,227 yeah 131 00:06:23,227 --> 00:06:23,347 and. 132 00:06:23,370 --> 00:06:25,560 how many people were impacted 133 00:06:26,777 --> 00:06:31,337 not necessarily people, but sy well over 200,000 systems 134 00:06:31,387 --> 00:06:32,797 were infected with WannaCry. 135 00:06:33,470 --> 00:06:36,860 that's quite a bit that hint your comment earlier 200,000 people all 136 00:06:36,860 --> 00:06:43,465 crying out at once just like in what do you call it star Wars I I'm 137 00:06:43,517 --> 00:06:44,027 Yes, 138 00:06:44,135 --> 00:06:52,865 okay Alright but and the thing is this is yet this is one of many examples of 139 00:06:52,955 --> 00:07:01,375 hacks, of attacks that had the victims of the attack practiced basic cyber hygiene. 140 00:07:01,825 --> 00:07:05,645 They would not have, been, they would not have been victimized by this attack. 141 00:07:05,645 --> 00:07:07,655 Does that sound, is that about right? 142 00:07:08,907 --> 00:07:10,737 good chance they would not have been a victim. 143 00:07:10,737 --> 00:07:11,157 Yes. 144 00:07:11,175 --> 00:07:16,005 the only caveat that is that Ry is one of those ransomware 145 00:07:16,065 --> 00:07:17,835 malware that was also a worm. 146 00:07:18,153 --> 00:07:22,393 so as it infected a machine, it's worm like behavior was what? 147 00:07:22,633 --> 00:07:26,113 What led itself to propagate in kind of an al alternative method. 148 00:07:26,113 --> 00:07:29,863 So if you weren't vulnerable to the SMB with Microsoft, you might've been 149 00:07:29,863 --> 00:07:33,163 vulnerable some other way that this, uh, this worm was able to compromise you. 150 00:07:33,771 --> 00:07:37,131 I think back to the Rackspace hack, because that was one 151 00:07:37,131 --> 00:07:38,901 where, again, it was a patch. 152 00:07:39,261 --> 00:07:45,581 There was a patch to the vulnerability in Microsoft Exchange that, again, 153 00:07:45,581 --> 00:07:49,991 had Rackspace simply applied that patch, they would not have been, 154 00:07:50,041 --> 00:07:51,896 subject to this particular attack. 155 00:07:51,926 --> 00:07:56,456 And in this case, there was, was a workaround there was a vulnerability. 156 00:07:56,666 --> 00:07:58,766 And then there was a workaround to the vulnerability while 157 00:07:58,766 --> 00:08:00,056 they were waiting on the patch. 158 00:08:00,656 --> 00:08:06,156 But what happened is there was a, an undisclosed, a zero day additional 159 00:08:06,156 --> 00:08:10,476 vulnerability that if they had applied the patch to fix the first 160 00:08:10,546 --> 00:08:14,636 vulnerability they would not have been subject to the zero day exploit. 161 00:08:15,776 --> 00:08:21,896 But they said to themselves, uh, this is my theory, uh, is that they said, 162 00:08:21,896 --> 00:08:23,606 well, we, we put in the workaround. 163 00:08:23,606 --> 00:08:28,306 And so therefore the criticality of this patch was not, it wasn't as critical. 164 00:08:28,306 --> 00:08:30,556 And so they didn't put in the patch yet. 165 00:08:30,886 --> 00:08:33,246 And two weeks, after the. 166 00:08:33,506 --> 00:08:34,616 this exploit came out. 167 00:08:34,656 --> 00:08:38,736 they were attacked and that cost them entire business line. 168 00:08:38,926 --> 00:08:40,986 because they had to, they had to stop. 169 00:08:42,336 --> 00:08:44,106 and it, there was a, there was lawsuits. 170 00:08:44,106 --> 00:08:44,976 it was very messy. 171 00:08:46,566 --> 00:08:50,046 so let's talk about, when we talk about, cyber hygiene. 172 00:08:50,386 --> 00:08:52,766 do you want to, do you wanna just define that, Mike. 173 00:08:54,168 --> 00:08:55,818 And if I could back up just a minute. 174 00:08:55,848 --> 00:08:58,958 'cause you made a comment about mitigation, so we weren't able 175 00:08:58,958 --> 00:09:02,498 to apply the patch for whatever reason, so we mitigated the risk. 176 00:09:02,646 --> 00:09:06,216 something that I think is critically important for people to consider 177 00:09:06,216 --> 00:09:09,846 when we talk about mitigation, and this comes from my audit. 178 00:09:10,096 --> 00:09:13,586 My audit life, where I had to go and determine if people were 179 00:09:13,586 --> 00:09:16,496 following the rules, whether it was hygiene or we also called them, 180 00:09:16,546 --> 00:09:18,406 general controls or best practices. 181 00:09:18,946 --> 00:09:21,976 If they weren't, then they had to demonstrate what they were 182 00:09:21,976 --> 00:09:23,746 doing to mitigate the risk. 183 00:09:24,046 --> 00:09:30,256 Presented by the absence of doing what we expected and the audit guidance and 184 00:09:30,256 --> 00:09:33,946 what we would tell people and what people should consider is that your mitigation 185 00:09:33,946 --> 00:09:36,256 strategy should be more effective. 186 00:09:37,096 --> 00:09:39,376 Had you done it the right way to begin with. 187 00:09:39,704 --> 00:09:39,794 a 188 00:09:39,925 --> 00:09:43,375 So if the control says, do one, two, and three, and you say, I 189 00:09:43,375 --> 00:09:48,065 can't do one, two, and three, you better do 4, 5, 6, 7, 8, 9, and 10. 190 00:09:49,085 --> 00:09:54,935 Your mitigation needs to be stronger than the original control or activity. 191 00:09:55,524 --> 00:09:55,824 which 192 00:09:56,058 --> 00:09:56,338 Interesting. 193 00:09:57,444 --> 00:10:02,874 But I guess in your experience, Mike, how often were people 194 00:10:02,934 --> 00:10:04,489 able to meet that higher bar? 195 00:10:06,405 --> 00:10:10,005 if you were a regulated organization, you had to, or you failed. 196 00:10:10,429 --> 00:10:10,669 Or, 197 00:10:10,769 --> 00:10:11,009 Yep. 198 00:10:11,133 --> 00:10:15,123 often would they just say four, five and six, seven are two difficult. 199 00:10:15,303 --> 00:10:17,073 Let me just go back and implement one, two, and three. 200 00:10:19,304 --> 00:10:20,564 With a grain of salt, obviously. 201 00:10:20,564 --> 00:10:24,524 So I was a technology auditor, so I was auditing it people that generally 202 00:10:24,524 --> 00:10:25,874 don't run the business, right? 203 00:10:25,874 --> 00:10:29,904 They're being, they're given direction from the business of, we can't fix 204 00:10:29,904 --> 00:10:33,234 that thing because our website will stop working or it'll be down too 205 00:10:33,234 --> 00:10:34,554 long, we'll lose too much money. 206 00:10:34,554 --> 00:10:40,274 So businesses directing the technology, groups and infrastructure 207 00:10:40,274 --> 00:10:42,194 of what they can and can't do. 208 00:10:42,794 --> 00:10:47,964 And so when you talk to them about, you couldn't do one, two, and three, because 209 00:10:47,964 --> 00:10:49,734 it'll break things or for whatever reason. 210 00:10:49,734 --> 00:10:51,594 So what are you doing? 211 00:10:51,594 --> 00:10:52,914 we're doing four, five, and six. 212 00:10:52,914 --> 00:10:54,554 four, five and six are okay. 213 00:10:54,614 --> 00:10:58,244 I'm gonna say that's maybe effective with opportunity for improvement. 214 00:10:58,644 --> 00:11:02,794 or they're doing a whole lot or they're not doing really anything because they. 215 00:11:03,304 --> 00:11:04,024 They didn't know. 216 00:11:04,414 --> 00:11:06,004 And so those are the really, the three options. 217 00:11:06,004 --> 00:11:08,074 you fail 'cause you didn't do what you were supposed to 218 00:11:08,074 --> 00:11:11,584 and you weren't mitigating it or mitigating it effectively. 219 00:11:11,764 --> 00:11:14,164 You were mitigating it somewhat effectively, but I 220 00:11:14,164 --> 00:11:15,454 think it could be stronger. 221 00:11:15,574 --> 00:11:19,204 And that's from a, an auditor's perspective, there is that kind 222 00:11:19,204 --> 00:11:21,654 of, latitude where I can add some. 223 00:11:22,314 --> 00:11:25,264 Objectivity, or I say subjectivity. 224 00:11:25,714 --> 00:11:30,004 Uh, and then lastly, wow, you, you really, you really are, you really do understand 225 00:11:30,004 --> 00:11:31,534 that mitigation's gotta be stronger. 226 00:11:31,534 --> 00:11:33,424 And, and, but that's, that's rare. 227 00:11:33,454 --> 00:11:37,084 Very rarely did I see the mitigating controls more effective 228 00:11:37,084 --> 00:11:38,734 than the, the original controls. 229 00:11:39,327 --> 00:11:43,937 I'm glad that you, you mentioned, the comment that you made, I is one 230 00:11:43,937 --> 00:11:48,317 that we make a lot from the opposite side, and that is the backup. 231 00:11:48,317 --> 00:11:51,767 People should never be setting policy. 232 00:11:51,827 --> 00:11:57,177 They should never be determining, retention periods, RTOs and RPOs. 233 00:11:57,427 --> 00:11:59,607 you know that should never be the case. 234 00:11:59,607 --> 00:12:01,587 That should always come from the business. 235 00:12:02,687 --> 00:12:05,722 and so we say that a lot and so it, it's good to hear it just 236 00:12:05,772 --> 00:12:07,342 from a different, frame of view. 237 00:12:07,712 --> 00:12:10,552 I don't think you ever got around to defining cyber hygiene. 238 00:12:12,259 --> 00:12:13,009 So cyber hygiene. 239 00:12:13,009 --> 00:12:16,859 if we keep in our discussions, we keep coming back to the real world. 240 00:12:16,859 --> 00:12:19,019 'cause I think that helps people, relate. 241 00:12:19,419 --> 00:12:24,069 so applying real world stuff to cyber hygiene is very similar. 242 00:12:24,069 --> 00:12:24,609 if you're not. 243 00:12:25,299 --> 00:12:28,929 Keeping or maintaining your own personal hygiene, you're gonna get sick. 244 00:12:29,499 --> 00:12:33,709 so in cyber there are things that you should be doing just like in real world. 245 00:12:33,709 --> 00:12:38,349 Take your vitamins, go see a doctor, get your checkups, do healthy things. 246 00:12:38,949 --> 00:12:40,369 One, cyber, those. 247 00:12:41,059 --> 00:12:45,139 Activities are making sure that your systems aren't vulnerable. 248 00:12:45,199 --> 00:12:48,019 , And we do that through patches. 249 00:12:48,269 --> 00:12:51,419 so we subscribe to services. 250 00:12:51,449 --> 00:12:54,359 If it's a Windows machine that do it automatically, if you've got it turned 251 00:12:54,359 --> 00:12:59,009 on, It and it will check your systems to determine if there's a vulnerable, 252 00:12:59,189 --> 00:13:03,589 configuration or a patch that's out, that, that would, address a known problem. 253 00:13:04,339 --> 00:13:06,829 so patch management is very important. 254 00:13:07,459 --> 00:13:10,929 the other part of that is, who can access my stuff? 255 00:13:11,029 --> 00:13:14,209 that's me obviously, and the people that I give access to my systems. 256 00:13:14,599 --> 00:13:17,869 But then how do we know that it's really them because. 257 00:13:19,384 --> 00:13:22,614 The number one traded commodity on the dark web right now is 258 00:13:22,614 --> 00:13:24,324 access, and that's credentials. 259 00:13:24,834 --> 00:13:28,404 So how do we, you know, what's a good practice for making sure that 260 00:13:28,794 --> 00:13:32,004 you know, someone that, that I trust, uh, that their credentials 261 00:13:32,004 --> 00:13:34,764 aren't out there and someone's, you know, some bad guy's not using them. 262 00:13:34,764 --> 00:13:39,014 So that's where multifactor authentication comes in, but very similar to. 263 00:13:40,104 --> 00:13:42,654 in the real world, vitamins and all these other healthy things, you have 264 00:13:42,654 --> 00:13:44,814 to do it responsibly and appropriately. 265 00:13:44,814 --> 00:13:49,764 And MFA is definitely one of those that I think the majority of organizations just 266 00:13:49,764 --> 00:13:51,624 say we have it and they're not using it. 267 00:13:51,624 --> 00:13:51,984 Right. 268 00:13:52,704 --> 00:13:58,204 and then lastly, password management, probably, appropriately 269 00:13:58,204 --> 00:13:59,344 at the bottom of the list. 270 00:13:59,374 --> 00:14:03,244 it's still part of hygiene, but not as effective as it used to be 'cause. 271 00:14:03,719 --> 00:14:06,179 bad guys aren't trying to guess your password, they're just stealing 272 00:14:06,179 --> 00:14:08,189 it from somewhere else, right? 273 00:14:08,189 --> 00:14:11,429 your work password is probably a password you've used somewhere 274 00:14:11,429 --> 00:14:12,599 else at some point in time. 275 00:14:13,307 --> 00:14:14,057 bad guys are just 276 00:14:14,365 --> 00:14:15,995 Yeah, but that's the point of good. 277 00:14:16,700 --> 00:14:18,350 Cyber hygiene Is not doing that. 278 00:14:18,350 --> 00:14:19,490 We're gonna get to that in, in a 279 00:14:19,702 --> 00:14:23,902 So we'll get into the details of what, what a good password practice, 280 00:14:23,972 --> 00:14:26,422 would be, similar to patching and MFA. 281 00:14:26,666 --> 00:14:29,516 Mike, so these are three great sort of. 282 00:14:30,611 --> 00:14:33,731 Things you should be doing from a cyber hygiene perspective. 283 00:14:34,121 --> 00:14:38,531 but how did you come up with this list, like right, or, I know you 284 00:14:38,531 --> 00:14:41,021 and Curtis have been talking about this for a while, but like, why 285 00:14:41,021 --> 00:14:42,551 are these the three most important? 286 00:14:42,551 --> 00:14:46,931 Is it based on like scenarios you've encountered working with customers, 287 00:14:46,931 --> 00:14:48,371 helping them recover from ransomware? 288 00:14:48,371 --> 00:14:53,141 Like why should someone believe the sort of 90% of ransomware could be? 289 00:14:53,745 --> 00:14:54,885 I can jump in on that one. 290 00:14:54,885 --> 00:15:01,050 it's because of the stories that I've read over the last, so many years, it 291 00:15:01,050 --> 00:15:03,150 was always one of these three, right? 292 00:15:03,150 --> 00:15:05,520 if they had just patched the system, then they wouldn't have 293 00:15:05,520 --> 00:15:09,060 the vulnerability if they had just either not allowed the password to 294 00:15:09,060 --> 00:15:11,330 be stolen or compromised in some way. 295 00:15:11,600 --> 00:15:15,820 And then, if they were just using MFA, then even if they had the password, 296 00:15:15,820 --> 00:15:17,200 then they would've been able to get in. 297 00:15:17,320 --> 00:15:19,840 Assuming that you didn't have MFA fatigue by the employee? 298 00:15:20,834 --> 00:15:24,854 But the thing is, if they had these things when you read back on the stories, and I 299 00:15:24,854 --> 00:15:28,264 would add because we're tech technically talking about cyber hygiene here and not 300 00:15:28,264 --> 00:15:30,454 backup hygiene, but I'll add to this. 301 00:15:30,499 --> 00:15:32,329 Immutable backups, right? 302 00:15:32,329 --> 00:15:37,999 If we have that, if we have those four, then not only would you stop the, the bulk 303 00:15:37,999 --> 00:15:44,299 of the attacks, you would, also be able to respond to the 10% that, that you get. 304 00:15:44,609 --> 00:15:46,379 would your answer be any different there, Mike? 305 00:15:48,281 --> 00:15:49,481 Oh, very similar. 306 00:15:49,481 --> 00:15:53,941 So yeah, they, these three are the greatest common denominators, of 307 00:15:53,941 --> 00:15:57,611 a lot of the, if not the majority of, Incidents that are out there. 308 00:15:57,921 --> 00:16:00,761 but to Curtis's point and maybe where you were going, Prasanna. 309 00:16:00,801 --> 00:16:00,981 Yeah. 310 00:16:00,981 --> 00:16:02,391 This list could get really long. 311 00:16:02,421 --> 00:16:07,161 it's, it's not just these three and the backups, it's also network segmentation 312 00:16:07,161 --> 00:16:12,121 and turning, secure build guidelines and secure coding and, perimeter protection 313 00:16:12,121 --> 00:16:17,011 and vendor management and anti-malware and training and all those things. 314 00:16:17,441 --> 00:16:21,751 but when you look at the numbers, the statistics of incidents 315 00:16:21,751 --> 00:16:22,696 that are out there and what. 316 00:16:23,326 --> 00:16:27,376 You know what, how you boil those down to the Common denominators. 317 00:16:27,426 --> 00:16:28,561 it's primarily these three. 318 00:16:29,289 --> 00:16:34,029 Because these are, it's this is to, again, going back to the real world, in the real 319 00:16:34,029 --> 00:16:39,129 world when we talk about investing, The very first thing they tell you to do is 320 00:16:39,129 --> 00:16:41,769 to have, 90 days of an emergency fund. 321 00:16:41,919 --> 00:16:46,209 And that should be your first thing because there's no point in talking about 322 00:16:46,209 --> 00:16:50,659 4 0 1 Ks and Roth IRAs and all these things if you can't survive, losing a 323 00:16:50,659 --> 00:16:52,219 paycheck for a couple of weeks, right? 324 00:16:52,639 --> 00:16:55,809 This is the, if you're not doing these. 325 00:16:56,264 --> 00:16:57,704 Then just stop. 326 00:16:57,794 --> 00:17:01,034 in the book we said if you're not doing these three things, just stop 327 00:17:01,034 --> 00:17:05,894 reading right now and go do those three things because it will stop 90%, 328 00:17:06,104 --> 00:17:08,624 the other 10%, like everything else. 329 00:17:08,894 --> 00:17:11,354 The other 10% is the hard part, right? 330 00:17:11,354 --> 00:17:12,674 It's the more expensive part. 331 00:17:12,944 --> 00:17:17,184 But doing password management and patch management and MFA or, pass 332 00:17:17,184 --> 00:17:21,409 keys, which, we'll talk about that a little bit more, but if we do that. 333 00:17:21,684 --> 00:17:24,664 Then it's a, it's the low hanging fruit. 334 00:17:24,714 --> 00:17:29,524 that, that allows us to secure the environment, without 335 00:17:29,524 --> 00:17:31,144 massive cost or anything. 336 00:17:32,474 --> 00:17:35,634 If you're not doing these things and don't, it's like when we start talking 337 00:17:35,634 --> 00:17:39,754 about, offsite backups, there's no point in talking about offsite backups if you're 338 00:17:39,754 --> 00:17:41,404 not making backups in the first place. 339 00:17:41,410 --> 00:17:44,260 this is the, if you're not doing these things, and don't even talk to me. 340 00:17:44,260 --> 00:17:48,190 Don't even start, if you're not doing basic cyber hygiene, then, 341 00:17:48,190 --> 00:17:51,610 then there's no point in continuing on with further discussions. 342 00:17:54,290 --> 00:17:59,090 let's just talk a little bit about, when we talk about patching, how do we know, 343 00:17:59,140 --> 00:18:04,090 and we're gonna do an episode on each of these things, but just the basic thing, 344 00:18:04,090 --> 00:18:05,620 what do you think would be the easiest? 345 00:18:05,650 --> 00:18:07,180 that's what, 'cause that's what we're trying to do here. 346 00:18:07,180 --> 00:18:10,240 What would be the easiest way to make sure that we're running all 347 00:18:10,240 --> 00:18:13,540 of the appropriate patches, Mike, especially the critical ones. 348 00:18:15,562 --> 00:18:20,392 it's easy if you're organized and the first step in getting organized is doing 349 00:18:20,392 --> 00:18:25,132 an inventory of the things that you have, because, you have to work off your 350 00:18:25,162 --> 00:18:27,722 inventory to know who to get patches from. 351 00:18:28,022 --> 00:18:28,232 Right. 352 00:18:28,232 --> 00:18:28,717 Is it, is it. 353 00:18:29,482 --> 00:18:30,412 Red Hat Linux. 354 00:18:30,412 --> 00:18:31,282 Is it Windows? 355 00:18:31,282 --> 00:18:33,532 Is it third party tools? 356 00:18:33,622 --> 00:18:38,812 Adobe, uh, you know that 3D modeling tool? 357 00:18:38,812 --> 00:18:42,742 So you've gotta inventory all this stuff first and then find out if you can 358 00:18:42,742 --> 00:18:44,842 actually get notifications from them. 359 00:18:45,742 --> 00:18:47,782 For when patches are available. 360 00:18:48,212 --> 00:18:51,242 if you don't do that on the proactive side, then you're gonna 361 00:18:51,242 --> 00:18:52,502 get it on the reactive side. 362 00:18:52,532 --> 00:18:57,212 'cause hopefully part of hygiene is also your periodic vulnerability assessments. 363 00:18:57,212 --> 00:18:59,882 And if you need help with that, we can walk you through some 364 00:19:01,382 --> 00:19:03,872 free open source ways to do that. 365 00:19:03,977 --> 00:19:08,387 Every now and then you need to be scanning all of your assets for vulnerabilities. 366 00:19:08,477 --> 00:19:12,377 That's gonna turn up some configuration problems, some missing patches. 367 00:19:12,717 --> 00:19:16,697 then, alright, reactively, now I, there's a missing patch and usually it comes with 368 00:19:16,697 --> 00:19:19,097 a link from these vulnerability tools. 369 00:19:19,557 --> 00:19:22,797 so go do that and while you're doing it, find out if there's a way 370 00:19:22,797 --> 00:19:24,627 to subscribe to that information. 371 00:19:25,157 --> 00:19:27,817 It's not easy, and that's one of the reasons people don't 372 00:19:27,817 --> 00:19:28,987 do it 'cause it's not easy. 373 00:19:29,647 --> 00:19:32,647 and there are tools out there that are fairly expensive to 374 00:19:32,647 --> 00:19:34,147 do it in an automated fashion. 375 00:19:34,197 --> 00:19:39,097 it's gotta start with understanding what it is you have, and then figuring out 376 00:19:39,097 --> 00:19:42,677 where to get the information for available patches and issues with those assets. 377 00:19:43,120 --> 00:19:47,620 this is the hardest thing today versus back in the day, right? 378 00:19:47,650 --> 00:19:51,270 Back in the day, I could walk into a server room and I could literally just 379 00:19:51,300 --> 00:19:52,890 have a piece of paper and check off. 380 00:19:53,010 --> 00:19:54,660 I have this one, I have this one, I have this one. 381 00:19:54,900 --> 00:19:57,560 Now We don't have any service to point at. 382 00:19:57,770 --> 00:19:58,760 Everything's virtual. 383 00:19:58,880 --> 00:19:59,900 Everything's in the cloud. 384 00:20:00,080 --> 00:20:03,970 And we have, IAS we have PAS we have SAS, right? 385 00:20:03,970 --> 00:20:08,440 We have all of these different ways where, and I'd say the SaaS is probably the 386 00:20:08,440 --> 00:20:10,660 worst because it's so easy to propagate. 387 00:20:10,900 --> 00:20:14,600 The, to go across the, the thing and you did remind me when we 388 00:20:14,600 --> 00:20:17,150 talk about inventory, you did remind me again back in the day. 389 00:20:17,630 --> 00:20:21,080 We had, when I was the backup guy, my very first job in it. 390 00:20:22,320 --> 00:20:24,570 we had a very boring naming convention. 391 00:20:24,570 --> 00:20:31,740 We had H-P-D-B-S-V-A HP database server, a right, bbc, so on. 392 00:20:31,860 --> 00:20:37,190 And I ha I was becoming worried that I wasn't getting all the servers. 393 00:20:37,190 --> 00:20:41,120 'cause we started out, we literally, when I started at the bank, we had seven. 394 00:20:41,335 --> 00:20:45,355 Anyway, so we went from having seven servers to having 200 servers, and 395 00:20:45,355 --> 00:20:46,795 I was starting to panic that we. 396 00:20:47,080 --> 00:20:48,850 We didn't have a correct inventory. 397 00:20:48,850 --> 00:20:51,220 And but the naming convention was very helpful. 398 00:20:51,520 --> 00:20:55,790 And so I had this practice of when you had a new server, you had to give me a 399 00:20:55,790 --> 00:20:58,490 form to say, I want this server backed up. 400 00:20:58,490 --> 00:21:01,760 And I put this thing on there that said, don't consider it backed up 401 00:21:01,760 --> 00:21:03,200 until you get the form back for me. 402 00:21:03,200 --> 00:21:06,200 Signed that, said that I saw the form and I put it on the list. 403 00:21:06,320 --> 00:21:09,380 And then one day somebody handed me a form and they, it 404 00:21:09,380 --> 00:21:13,130 said H-P-D-B-S-V and I'm like. 405 00:21:14,245 --> 00:21:15,385 And they're like, yes. 406 00:21:15,445 --> 00:21:21,175 I go, so that would by, you know my inference, that means there's 407 00:21:21,175 --> 00:21:25,405 an M and an L a K somewhere. 408 00:21:25,465 --> 00:21:26,385 And they're like, yeah. 409 00:21:26,385 --> 00:21:34,030 And I'm like, I only know up to j. so I'm gonna go find K and l and m and 410 00:21:34,030 --> 00:21:35,470 and we'll start backing all of them up. 411 00:21:35,560 --> 00:21:36,820 I agree with you, Mike. 412 00:21:36,880 --> 00:21:37,810 A hundred percent. 413 00:21:37,810 --> 00:21:40,240 That inventory is absolutely the place to start. 414 00:21:40,360 --> 00:21:44,110 No, it, that's actually a pretty funny story, Curtis, but I'm not surprised. 415 00:21:44,110 --> 00:21:48,610 You always have all these great stories from working at the bank and other places. 416 00:21:48,970 --> 00:21:52,600 But Mike, I know you talked about patch management, right, 417 00:21:52,600 --> 00:21:54,400 and how to apply patches. 418 00:21:55,330 --> 00:21:59,530 is there something similar for cases where maybe patches aren't available? 419 00:21:59,530 --> 00:22:01,750 Like, it's great you have an inventory of everything that's 420 00:22:01,750 --> 00:22:05,430 there, but how do you deal with sort of, exploits that are currently 421 00:22:05,430 --> 00:22:07,620 out there before patches come out? 422 00:22:09,566 --> 00:22:12,506 So those are zero days in, in most cases. 423 00:22:12,576 --> 00:22:16,536 so zero day is something was identified today, and vendors haven't had a 424 00:22:16,536 --> 00:22:19,176 chance to respond to that with a patch. 425 00:22:19,786 --> 00:22:23,206 and I'll add real quick, sometimes the patch that's available 426 00:22:23,206 --> 00:22:26,176 becomes your zero day because it doesn't work in your environment. 427 00:22:26,636 --> 00:22:28,821 and so along with patch management, you need to develop. 428 00:22:29,756 --> 00:22:35,156 Process for testing the patch, applying it to a test machine to 429 00:22:35,156 --> 00:22:38,726 see its effects on how things run before you move it into production. 430 00:22:38,726 --> 00:22:42,146 be mindful of that too, but to your point, Prasanna about things 431 00:22:42,146 --> 00:22:47,251 that come up that don't have a fix, those mitigating controls. 432 00:22:47,251 --> 00:22:49,106 Like how do we, alright, so there in. 433 00:22:50,306 --> 00:22:52,196 So is this a public facing thing? 434 00:22:52,596 --> 00:22:54,126 do people log into it? 435 00:22:54,206 --> 00:22:58,216 is it a, prized possession of our company with, sensitive data? 436 00:22:58,486 --> 00:23:02,596 Or is it just that, that thing I could potentially turn off or isolate? 437 00:23:03,216 --> 00:23:06,666 so you've gotta do some analysis first, like what's the risk, what's the impact? 438 00:23:06,756 --> 00:23:09,006 And then respond accordingly if it's. 439 00:23:09,966 --> 00:23:11,976 Publicly accessible internet facing. 440 00:23:12,456 --> 00:23:16,686 Then put some monitoring on it, put some logging on it, try to isolate it. 441 00:23:16,756 --> 00:23:21,386 those mitigating controls in the absence of a, a true solution have to be 442 00:23:21,386 --> 00:23:23,606 assessed and applied as fast as possible. 443 00:23:25,434 --> 00:23:26,094 I like that. 444 00:23:26,299 --> 00:23:26,309 and 445 00:23:26,337 --> 00:23:26,557 so 446 00:23:26,579 --> 00:23:27,899 there are services out there. 447 00:23:27,899 --> 00:23:29,699 I ran into one not too long ago. 448 00:23:29,699 --> 00:23:33,449 It's outta New Zealand and it's, I don't have a fix for this. 449 00:23:33,809 --> 00:23:35,429 It's essentially a proxy. 450 00:23:35,789 --> 00:23:40,189 So they stand up a An internet facing version of whatever it is 451 00:23:40,549 --> 00:23:42,289 that's fed from your environment. 452 00:23:42,499 --> 00:23:47,179 And they analyze and filter all the requests for that information as a proxy. 453 00:23:47,429 --> 00:23:50,999 and you can subscribe to that until a solution is, is applied. 454 00:23:51,449 --> 00:23:52,289 So that was pretty interesting. 455 00:23:52,299 --> 00:23:52,899 I did see that. 456 00:23:53,472 --> 00:23:54,792 that's the patches world. 457 00:23:55,122 --> 00:23:57,312 Let's talk a little bit about the passwords. 458 00:23:57,622 --> 00:24:00,982 and I think we can all agree one. 459 00:24:02,032 --> 00:24:03,622 some method. 460 00:24:03,622 --> 00:24:06,082 Again, I'm a big fan of a password manager. 461 00:24:06,502 --> 00:24:08,722 But you need some method. 462 00:24:08,722 --> 00:24:14,812 So you absolutely do not ever use the same password in multiple places. 463 00:24:15,892 --> 00:24:21,082 because that is the problem is, I, and I got a, I got in a argument 464 00:24:21,082 --> 00:24:24,462 is a strong term, but I got into a discussion with a guy on. 465 00:24:25,467 --> 00:24:29,077 I think it was somebody that commented on one of our videos and where 466 00:24:29,077 --> 00:24:32,167 he was saying that he was using. 467 00:24:33,152 --> 00:24:38,242 this system where he, what he does is he has a password that he uses 468 00:24:38,242 --> 00:24:41,132 on like a small subset of systems. 469 00:24:41,462 --> 00:24:44,782 Like he has 10 passwords that he uses everywhere. 470 00:24:45,267 --> 00:24:49,467 And so his method of mitigating the risk is that he doesn't 471 00:24:49,467 --> 00:24:50,457 wanna use a password manager. 472 00:24:50,457 --> 00:24:52,017 He doesn't believe in using a password manager. 473 00:24:52,017 --> 00:24:56,157 So he has 10 passwords that he sprinkles around and he just has to 474 00:24:56,157 --> 00:24:58,357 remember, 10 passwords in his head. 475 00:24:59,477 --> 00:25:02,327 and he uses the battery horse staple method. 476 00:25:02,377 --> 00:25:03,697 which is a good method, right? 477 00:25:03,727 --> 00:25:04,027 I'm sorry. 478 00:25:04,147 --> 00:25:08,677 It is just this idea of having an password that is long but actually 479 00:25:08,677 --> 00:25:11,737 easy to remember because most of the passwords that we have that are long 480 00:25:11,737 --> 00:25:15,997 are total garbly gook and they can only be remembered by a password manager. 481 00:25:16,237 --> 00:25:20,497 So he uses that method and then he has 10 passwords and I was like, that's. 482 00:25:20,872 --> 00:25:22,912 better than using the same password everywhere. 483 00:25:23,302 --> 00:25:27,992 But if any one of those systems where you're using that same password 484 00:25:27,992 --> 00:25:30,932 are ever compromised, then you have to change the password everywhere 485 00:25:30,932 --> 00:25:32,552 where you're using that password. 486 00:25:32,762 --> 00:25:35,192 And potentially by the time you get around to doing it, 487 00:25:35,192 --> 00:25:36,632 it's already been compromised. 488 00:25:37,082 --> 00:25:41,652 And so this is just, again, my way to do this is password 489 00:25:41,652 --> 00:25:44,532 manager and I think that's the number one most recommended way. 490 00:25:45,022 --> 00:25:54,352 But besides making sure that we do not use the same password in multiple places. 491 00:25:54,652 --> 00:25:55,372 What else? 492 00:25:55,372 --> 00:25:58,797 Basic, password hygiene stuff do we need to talk about, Mike? 493 00:26:01,554 --> 00:26:04,184 I think a good term for your, your disagreement. 494 00:26:04,234 --> 00:26:07,389 and it's an older term, that you just don't hear very often is a kerfluffle. 495 00:26:07,732 --> 00:26:08,222 Careful. 496 00:26:08,459 --> 00:26:09,959 think that's a good yes. 497 00:26:10,139 --> 00:26:13,229 Uh, anyway, so back to passwords. 498 00:26:13,279 --> 00:26:17,689 I think a good practice these days, especially as we suggest passwords become 499 00:26:17,689 --> 00:26:22,759 longer and longer, and, I don't know if, if you guys realize where that came from. 500 00:26:23,849 --> 00:26:27,549 so it stemmed from the length of a password. 501 00:26:28,022 --> 00:26:28,052 okay. 502 00:26:28,863 --> 00:26:29,243 How long 503 00:26:29,439 --> 00:26:29,979 So a stem. 504 00:26:31,108 --> 00:26:31,888 compute right? 505 00:26:31,994 --> 00:26:37,314 So when Windows or Linux, Unix, encrypts a password, with, a ES 506 00:26:37,314 --> 00:26:40,854 2 56 or whatever it is, there's a ma math, there's a mathematical, 507 00:26:42,324 --> 00:26:46,404 response to how long it would take to crack a password of certain length. 508 00:26:47,344 --> 00:26:50,504 that's been defeated, by a project called Rainbow Tables. 509 00:26:51,794 --> 00:26:56,094 Rainbow tables just encrypts and captures the hash value of 510 00:26:56,124 --> 00:27:00,564 every conceivable, random known dictionary, multiple languages. 511 00:27:00,564 --> 00:27:03,774 And so it's not, I don't have to crack your password anymore, I just have to 512 00:27:03,774 --> 00:27:05,874 take your password hash and go look it up. 513 00:27:06,684 --> 00:27:08,604 And see if that's already been done. 514 00:27:08,844 --> 00:27:10,524 So it's not a math problem anymore. 515 00:27:10,574 --> 00:27:11,654 it's a research problem. 516 00:27:12,554 --> 00:27:16,704 All right, then a vulnerability came out in, with Windows. 517 00:27:16,884 --> 00:27:23,164 'cause if you had, NTLM, the hash in windows turned on, it would take 518 00:27:23,164 --> 00:27:28,414 your password hash and break it up into two eight character hashes. 519 00:27:29,594 --> 00:27:31,484 now I can crack them individually. 520 00:27:31,484 --> 00:27:34,484 Instead of cracking one large, I can do two small ones. 521 00:27:34,484 --> 00:27:35,984 And there's vulnerability associated with that. 522 00:27:35,984 --> 00:27:42,884 So now we should have greater than 16 character passwords for that reason. 523 00:27:43,074 --> 00:27:46,064 and it, and I can drive policy now, it says it's gotta be 16. 524 00:27:46,404 --> 00:27:51,054 if it has to be 16, the IT guys that have not wanted to change the LTLM 525 00:27:52,044 --> 00:27:55,664 now have to, they have to turn that off to, to generate, and so there's. 526 00:27:56,444 --> 00:27:59,624 It's political game, but also based on, some known 527 00:27:59,624 --> 00:28:01,094 vulnerabilities around passwords. 528 00:28:01,604 --> 00:28:04,874 Alright, now we've got 16 character or greater passwords. 529 00:28:04,874 --> 00:28:07,034 How are you gonna get users to remember that? 530 00:28:07,704 --> 00:28:11,094 password managers are great because it can also randomize passwords so 531 00:28:11,094 --> 00:28:12,084 you don't have to remember it anymore. 532 00:28:12,084 --> 00:28:15,564 You just log into your password manager and copy and paste. 533 00:28:16,104 --> 00:28:17,904 and so you, you don't have to remember it anymore. 534 00:28:17,904 --> 00:28:19,854 And it can be random, which is also. 535 00:28:20,529 --> 00:28:25,929 Helpful, but then not everybody can subscribe to that approach. 536 00:28:25,929 --> 00:28:28,709 So they want these password phrases now. 537 00:28:28,799 --> 00:28:32,959 And so some interesting things about password phrases, and similar to what 538 00:28:32,959 --> 00:28:37,469 Curtis was describing with, having a root password and then you know, 539 00:28:37,469 --> 00:28:40,349 something at the beginning and something at the end that's helpful, especially 540 00:28:40,349 --> 00:28:43,589 if it's, if you want the same route password for everything, and then you 541 00:28:43,589 --> 00:28:46,919 just change the front and the back depending on what you're logging into. 542 00:28:47,409 --> 00:28:51,219 'cause as a bad guy, I just need two of those to realize that's a pattern and 543 00:28:51,219 --> 00:28:55,939 I can just guess, what, what your bank password is if I don't have that already. 544 00:28:56,389 --> 00:28:58,399 so some things to think about. 545 00:28:59,084 --> 00:29:03,554 if you're logging into your bank, maybe your past phrase is, I like getting paid 546 00:29:03,554 --> 00:29:08,334 on Friday, and then at the beginning or the end, and that makes me happy. 547 00:29:08,484 --> 00:29:13,494 Or, added emotion or add a color that makes you think of, that emo it's blue. 548 00:29:13,594 --> 00:29:14,824 I think that's calming, right? 549 00:29:15,214 --> 00:29:17,194 and then change up how it felt. 550 00:29:17,267 --> 00:29:17,957 the way, Mike. 551 00:29:17,957 --> 00:29:18,167 Green. 552 00:29:18,197 --> 00:29:18,942 Green is okay. 553 00:29:18,960 --> 00:29:19,410 for money. 554 00:29:19,631 --> 00:29:19,961 red. 555 00:29:21,632 --> 00:29:23,892 So then, do some substitution. 556 00:29:24,042 --> 00:29:29,192 So instead of, ease, use threes and capitalize, the first letter 557 00:29:29,192 --> 00:29:31,352 of a word or spell it backwards. 558 00:29:31,462 --> 00:29:35,702 I had a password and man, long time, 20, 30 years ago, where it was, 559 00:29:35,762 --> 00:29:37,292 I spelled everything backwards. 560 00:29:37,742 --> 00:29:40,442 So there, there are some unique things that you can do with passwords. 561 00:29:40,442 --> 00:29:44,502 You just have to figure out which one works for you, and that 562 00:29:44,502 --> 00:29:45,912 you can be consistent with it. 563 00:29:46,452 --> 00:29:49,812 The password manager will also help you remember to, it's about time you've 564 00:29:49,812 --> 00:29:51,912 been using this password for 10 years. 565 00:29:51,962 --> 00:29:52,232 Yeah. 566 00:29:52,269 --> 00:29:52,929 time to change it. 567 00:29:52,982 --> 00:29:57,782 basically the idea is the overall overriding concept is to not 568 00:29:57,782 --> 00:30:00,512 use the same password anywhere. 569 00:30:00,922 --> 00:30:02,692 Never use the same password twice. 570 00:30:02,762 --> 00:30:08,672 and if you're not using some kind of system, my method is password manager. 571 00:30:08,952 --> 00:30:12,497 the one that you talked about, Mike, the one where you append it and pre-end 572 00:30:12,497 --> 00:30:15,977 it with something and you have this core password that used to be my method 573 00:30:16,307 --> 00:30:17,927 before I went to a password manager. 574 00:30:18,287 --> 00:30:21,747 and the, and then there's this, these other ways to have it, but. 575 00:30:22,757 --> 00:30:27,077 I can't, ima I have 500 passwords at this point, right? 576 00:30:27,857 --> 00:30:32,117 so I can't imagine, not having, a password manager at this point. 577 00:30:32,117 --> 00:30:33,677 But, so that's my way to do that. 578 00:30:33,677 --> 00:30:38,477 But the core concept is you cannot use the same password at multiple places. 579 00:30:38,477 --> 00:30:39,737 And why is that, Mike? 580 00:30:39,787 --> 00:30:41,617 we alluded it to it, a few minutes ago. 581 00:30:43,544 --> 00:30:46,424 and the reason you don't wanna use them in more than one place is because 582 00:30:46,424 --> 00:30:50,324 you've gotta rely on the security of more than one thing to make sure 583 00:30:50,324 --> 00:30:52,514 your password isn't compromised. 584 00:30:52,964 --> 00:30:57,254 And when bad guys compromise one data set, they're gonna use that data set 585 00:30:57,344 --> 00:30:59,264 across everything they can think of. 586 00:31:00,319 --> 00:31:04,789 So if I've got one of Curtis's passwords and I know he has 500 accounts out 587 00:31:04,789 --> 00:31:08,869 there, I'm gonna use that one password to try and log into 499 of those, 588 00:31:10,752 --> 00:31:11,472 And especially 589 00:31:11,659 --> 00:31:12,259 could be. 590 00:31:12,522 --> 00:31:15,582 one username is your email address, right? 591 00:31:15,632 --> 00:31:18,947 so you already know my email address and you go out there and you use the. 592 00:31:19,557 --> 00:31:20,877 Password everywhere. 593 00:31:20,977 --> 00:31:23,887 you just, you don't even need to know where I have the thing. 594 00:31:23,897 --> 00:31:24,917 you just try it. 595 00:31:24,917 --> 00:31:28,457 All the places that you have access and you're, and this is a numbers game. 596 00:31:28,457 --> 00:31:31,627 You're trying every account that you have access to with every password 597 00:31:31,627 --> 00:31:35,247 you have access to in every place that you have access to the system. 598 00:31:35,247 --> 00:31:36,537 so yeah, that's why we don't do it 599 00:31:37,509 --> 00:31:37,729 Yep. 600 00:31:37,734 --> 00:31:39,174 and how do you mitigate that? 601 00:31:39,927 --> 00:31:42,207 by using the different password in every place. 602 00:31:42,277 --> 00:31:43,927 what if they guess what if they have a password? 603 00:31:45,567 --> 00:31:49,737 You forgot you used 20 years ago and now there's an account 604 00:31:49,887 --> 00:31:51,237 that password's gonna work on. 605 00:31:51,237 --> 00:31:54,852 How do you mitigate that MFA. 606 00:31:55,025 --> 00:31:59,945 so MFA, is the final thing on our trifecta of basic cyber hygiene. 607 00:32:00,135 --> 00:32:04,105 and I'll put MFA slash pass keys, which is it's like the next thing. 608 00:32:04,135 --> 00:32:06,655 'cause we'll, as we, when we talk about MFA. 609 00:32:08,035 --> 00:32:09,955 We will mention that MFA is not perfect. 610 00:32:10,025 --> 00:32:11,605 Prasanna's already alluded to it. 611 00:32:11,605 --> 00:32:13,345 there's this thing called MFA exhaustion. 612 00:32:13,345 --> 00:32:18,595 there are other issues with it, but let's just start with what MFA is. 613 00:32:18,885 --> 00:32:21,665 Prasanna, why don't you define MFA? 614 00:32:21,665 --> 00:32:23,245 What is it, and how does it work? 615 00:32:24,066 --> 00:32:28,606 So with MFA, it's really, someone might compromise your password 616 00:32:28,606 --> 00:32:32,626 and so it's something you know and something you have, right? 617 00:32:32,626 --> 00:32:36,616 And so that something you have piece is normally, say your 618 00:32:36,616 --> 00:32:38,536 biometrics like a fingerprint. 619 00:32:38,536 --> 00:32:39,946 It could be your face, right? 620 00:32:39,946 --> 00:32:45,301 It could be a. Electronic token that gets generated periodically 621 00:32:45,301 --> 00:32:47,401 or some other application, right? 622 00:32:47,401 --> 00:32:52,321 That generates that such that you have a second factor, which previously was 623 00:32:52,321 --> 00:32:54,331 called sort of two-factor authentication. 624 00:32:54,751 --> 00:32:58,396 Right now it's multifactor in order to be able to say, yes, this really is me. 625 00:33:00,590 --> 00:33:03,320 I'd say the most common one is probably SMS. 626 00:33:03,760 --> 00:33:07,220 it's definitely not the best one, but it's certainly the most common, I 627 00:33:07,220 --> 00:33:09,200 think the most common use to be email. 628 00:33:09,560 --> 00:33:12,650 I really don't like email, like, in good, better, best. 629 00:33:12,650 --> 00:33:17,240 It's barely good, uh, because again, if you, uh, if somebody's 630 00:33:17,240 --> 00:33:20,180 compromised your email account, especially if it's the email account 631 00:33:20,180 --> 00:33:21,500 that you use for everything, right? 632 00:33:21,930 --> 00:33:27,490 Think SMS is actually better today than it used to be it's harder to do 633 00:33:27,490 --> 00:33:32,070 sim hacking today than it used to be, at least in, in certain circumstances. 634 00:33:32,420 --> 00:33:36,570 and then, but then, the, I think the best one that we have today that's 635 00:33:36,570 --> 00:33:41,220 available to pretty much everybody is, an authenticator type app. 636 00:33:41,220 --> 00:33:42,330 You wanna talk about that, Mike? 637 00:33:43,782 --> 00:33:44,072 Sure. 638 00:33:44,282 --> 00:33:49,592 Uh, and, and those apps are generally free, uh, and, and don't require any. 639 00:33:49,832 --> 00:33:50,912 Infrastructure changes. 640 00:33:50,912 --> 00:33:55,192 There are some, like duo, that would require some licensing and set up 641 00:33:55,192 --> 00:33:57,202 on the inside of, your organization. 642 00:33:57,662 --> 00:34:00,662 but others like the Microsoft Authenticator app, Google 643 00:34:00,662 --> 00:34:02,282 has one, they're free. 644 00:34:02,282 --> 00:34:03,572 You just get 'em in the play store. 645 00:34:03,572 --> 00:34:09,092 And then whenever you want to register your multifactor with a vendor, a 646 00:34:09,092 --> 00:34:13,742 lot of times there's like a QR code or a set up your account this way. 647 00:34:14,222 --> 00:34:18,482 Similar to a password manager, you would log into your authenticator app and it 648 00:34:18,482 --> 00:34:23,232 would show all your different accounts, which you could revoke or delete if 649 00:34:23,232 --> 00:34:24,792 you think that's compromised as well. 650 00:34:24,842 --> 00:34:31,052 And, MFA, fatigue, MFA fatigue is a real thing. 651 00:34:31,532 --> 00:34:34,022 It's more of a. It's just annoyance. 652 00:34:34,572 --> 00:34:38,412 so you log into something and you, oh, I've gotta wait for my phone to ding. 653 00:34:38,412 --> 00:34:44,812 Now what if you don't have cell phone coverage or data, wireless data? 654 00:34:45,412 --> 00:34:48,892 a lot of these authenticator apps also allow you to save. 655 00:34:49,312 --> 00:34:52,732 Backup codes, things like, so there's any number of ways 656 00:34:52,772 --> 00:34:54,632 of using what works for you. 657 00:34:55,142 --> 00:34:58,672 the important thing is to figure out something other than email, for your 658 00:34:58,672 --> 00:35:02,742 MFA if the account that you're wanting to apply MFA to will support it. 659 00:35:04,546 --> 00:35:09,496 And Mike, I know on a previous podcast you sort of mentioned one of the 660 00:35:09,496 --> 00:35:12,226 downsides with many websites, right? 661 00:35:12,256 --> 00:35:15,256 Which have MFA, and then they sort of have the remember me 662 00:35:15,256 --> 00:35:17,116 next time on this thing, right? 663 00:35:19,597 --> 00:35:22,967 So it's whether it's a website like, I don't know, 664 00:35:24,635 --> 00:35:25,345 Amazon. 665 00:35:26,025 --> 00:35:26,835 Amazon, right? 666 00:35:27,188 --> 00:35:27,608 yeah. 667 00:35:27,715 --> 00:35:32,215 remember this device, you don't want to do that because your MFA token 668 00:35:32,215 --> 00:35:33,955 is then stored in your browser. 669 00:35:34,795 --> 00:35:39,625 And so now a bad guy just asked to get you to a position or a situation where I can 670 00:35:39,745 --> 00:35:44,485 scrape that MFA token out of your browser if I already have your credentials. 671 00:35:44,815 --> 00:35:49,045 The only thing I need now is your MFA token, and now 672 00:35:49,045 --> 00:35:50,155 I can get into your account. 673 00:35:51,400 --> 00:35:55,336 So good MFA has to come with good policy and good practice. 674 00:35:56,559 --> 00:36:00,699 So the point of this episode here is just to if you're not familiar with any 675 00:36:00,699 --> 00:36:03,249 of those three things, go get familiar. 676 00:36:03,439 --> 00:36:06,769 and the best way to do that is to, log in next week and we'll 677 00:36:07,489 --> 00:36:09,139 cover each of these in detail. 678 00:36:09,499 --> 00:36:13,549 but, the idea behind MFA is that if somebody gets a hold of your password, 679 00:36:13,819 --> 00:36:16,939 they won't be able to log in because they don't have that additional factor, 680 00:36:16,939 --> 00:36:21,459 whatever it is, whether it's SMS or, an authenticator app or a token, right? 681 00:36:21,699 --> 00:36:24,899 We'll talk about these more and all of those and passwords 682 00:36:24,899 --> 00:36:29,369 and MFA have limitations and those limitations are us, right? 683 00:36:29,369 --> 00:36:33,389 It's the human, and that's why I think pass keys is the better option. 684 00:36:33,959 --> 00:36:38,379 As we move forward in the future, and I've been rolling out Pasky, 685 00:36:38,429 --> 00:36:41,729 in many places, wherever I can. 686 00:36:41,759 --> 00:36:51,049 it, I'm not sure if it's great for the average Joe, there, it can be confusing. 687 00:36:51,469 --> 00:36:54,619 PAs keys can be confusing if you don't, if you don't know what you're doing. 688 00:36:54,679 --> 00:36:55,999 But, but I. 689 00:36:56,216 --> 00:36:57,566 Did you ever use iron keys? 690 00:36:57,686 --> 00:36:58,196 Curtis? 691 00:36:58,759 --> 00:36:59,739 what's a iron key? 692 00:37:00,891 --> 00:37:10,676 So an iron key is a military grade USB, and in it, it's got its own, TPM chip. 693 00:37:11,536 --> 00:37:15,466 Its own encryption, its own password manager, its own MFA. 694 00:37:16,156 --> 00:37:21,601 And if you log into it, I think it's 20 times wrong, it self-destructs, 695 00:37:21,826 --> 00:37:23,266 it's got a little capacitor in it. 696 00:37:23,636 --> 00:37:26,906 and if you try to cut into it to get to the chips, it's also got 697 00:37:26,906 --> 00:37:28,466 a sensor and will self-destruct. 698 00:37:29,539 --> 00:37:29,809 Yeah, 699 00:37:30,086 --> 00:37:31,081 Yeah, it's pretty cool. 700 00:37:31,249 --> 00:37:33,739 that, but doesn't surprise me that you probably have. 701 00:37:34,219 --> 00:37:38,389 Um, but anyway, so the, again, this is meant to be an overview episode. 702 00:37:38,419 --> 00:37:42,189 and if some of this was confusing or frustrating or you felt like we didn't 703 00:37:42,189 --> 00:37:45,799 go into detail enough, then just, we're gonna do three more episodes where we 704 00:37:45,799 --> 00:37:47,899 go into each of these, in more detail. 705 00:37:49,039 --> 00:37:49,999 but it just. 706 00:37:50,714 --> 00:37:52,304 start looking into these three things. 707 00:37:52,304 --> 00:37:54,704 Make sure you're doing pa patch management, right? 708 00:37:54,734 --> 00:37:57,074 that some sort of automated system. 709 00:37:57,104 --> 00:37:58,994 and we're gonna start with an inventory, right? 710 00:37:58,994 --> 00:38:02,954 A physical inventory, a virtual inventory, and a, an a SaaS inventory 711 00:38:03,164 --> 00:38:06,164 of your entire environment to make sure that you know what it is you're 712 00:38:06,164 --> 00:38:07,394 supposed to be looking out after. 713 00:38:07,664 --> 00:38:10,154 You're gonna have a good password manager and you're gonna have good. 714 00:38:10,199 --> 00:38:13,514 you're gonna have an MFA or you're gonna have a passkey based system. 715 00:38:13,884 --> 00:38:18,564 because, without these three things, no point in having, like 716 00:38:18,614 --> 00:38:21,464 looking into A EDR or an XDR system. 717 00:38:21,694 --> 00:38:25,324 and, or any of the other stuff that we're talking about because it's 718 00:38:25,324 --> 00:38:28,804 like looking into a Roth IRA if you don't even have a savings account. 719 00:38:29,224 --> 00:38:31,084 With that, any final thoughts, Mike? 720 00:38:31,485 --> 00:38:33,038 Doing something's better than nothing. 721 00:38:34,048 --> 00:38:36,616 one of these and do something about it. 722 00:38:37,024 --> 00:38:37,594 absolutely. 723 00:38:37,594 --> 00:38:38,424 What about you, Prasanna? 724 00:38:39,750 --> 00:38:42,515 Well, I think the three makes sense and hopefully everyone 725 00:38:42,515 --> 00:38:43,535 is using a password manage. 726 00:38:43,835 --> 00:38:44,135 There. 727 00:38:45,244 --> 00:38:46,094 All right, Prasanna. 728 00:38:46,174 --> 00:38:46,504 Thanks. 729 00:38:46,654 --> 00:38:48,604 Thanks for, being here again as well. 730 00:38:48,634 --> 00:38:49,174 Forever. 731 00:38:49,185 --> 00:38:51,450 and look, see I shaved, just so you know. 732 00:38:51,484 --> 00:38:52,444 Yeah, absolutely. 733 00:38:52,564 --> 00:38:53,194 Absolutely. 734 00:38:53,494 --> 00:38:53,824 Alright. 735 00:38:53,824 --> 00:38:56,669 Actually, I don't know if anybody can tell, but I had my beard trimmed. 736 00:38:56,699 --> 00:38:59,579 I had a photo op yesterday, so it, my beard's all nice and trimmed. 737 00:38:59,579 --> 00:39:03,669 So anyway, or as my granddaughter said, slay. 738 00:39:04,349 --> 00:39:07,289 Um, and that is a wrap. 739 00:39:52,931 --> 00:39:53,321 All right. 740 00:39:53,591 --> 00:39:54,251 Um, 741 00:39:58,961 --> 00:40:00,251 Welcome to the backup wrap up. 742 00:40:00,251 --> 00:40:04,511 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have a, with 743 00:40:04,511 --> 00:40:10,391 me, a guy who apparently shaved last week and I didn't even notice. 744 00:40:10,401 --> 00:40:10,871 Prasanna 745 00:40:10,891 --> 00:40:11,041 Prasanna 746 00:40:11,271 --> 00:40:12,316 Malaiyandi how's it going? 747 00:40:12,326 --> 00:40:12,806 Prasanna 748 00:40:13,562 --> 00:40:14,557 I am good Curtis. 749 00:40:14,557 --> 00:40:14,857 Yeah. 750 00:40:14,857 --> 00:40:19,237 Uh, my wife was very surprised after the podcast recording when 751 00:40:19,237 --> 00:40:21,097 she was like, did Curtis notice? 752 00:40:22,147 --> 00:40:25,027 of course, I. I texted you and you're like, no, or no, I think 753 00:40:25,106 --> 00:40:25,586 No. 754 00:40:25,597 --> 00:40:28,207 on the phone and you're like, no, what are you talking about? 755 00:40:28,207 --> 00:40:29,437 And I had to send you a picture, 756 00:40:30,206 --> 00:40:30,656 Yeah. 757 00:40:30,716 --> 00:40:34,166 And, and apparently Mike, Mike didn't notice either, so I feel 758 00:40:34,166 --> 00:40:36,446 somewhat better, but, uh, yeah. 759 00:40:36,446 --> 00:40:39,086 So you, you, you've gone down to the goatee, 760 00:40:39,577 --> 00:40:39,787 Yep. 761 00:40:39,836 --> 00:40:41,816 um, and, um. 762 00:40:41,857 --> 00:40:43,692 many, many years since I've done this. 763 00:40:44,472 --> 00:40:44,692 Pre 764 00:40:44,786 --> 00:40:46,676 I've seen a picture of you with the goatee. 765 00:40:46,766 --> 00:40:47,096 Yeah. 766 00:40:47,096 --> 00:40:48,566 Pre, yeah, yeah, yeah. 767 00:40:49,826 --> 00:40:52,646 I think you should go back to your cut from college. 768 00:40:52,736 --> 00:40:53,546 That's what I think. 769 00:40:54,326 --> 00:40:54,836 The buzz. 770 00:40:54,926 --> 00:40:55,766 The buzz cut. 771 00:40:55,886 --> 00:40:56,426 Yeah. 772 00:40:56,546 --> 00:40:56,996 Yeah. 773 00:40:57,086 --> 00:40:59,036 I, I'd love to see you in the buzz cut again. 774 00:41:00,138 --> 00:41:00,618 Walked away. 775 00:41:00,836 --> 00:41:05,186 but, uh, anyway, speaking of buzz cuts, Dr. Mike Sailor, how's it going, Mike? 776 00:41:06,933 --> 00:41:08,073 Going Good guys. 777 00:41:08,643 --> 00:41:09,393 It's going good. 778 00:41:09,821 --> 00:41:10,331 All right. 779 00:41:10,331 --> 00:41:14,891 So he of course, is the co-author on, uh, uh, learning Ransomware Response 780 00:41:14,891 --> 00:41:16,781 and Recovery, which came out last month. 781 00:41:17,051 --> 00:41:19,271 Which, uh, do you have one with you now? 782 00:41:19,331 --> 00:41:21,071 Did you, did you prepare this time? 783 00:41:22,188 --> 00:41:23,463 I did not prepare this time. 784 00:41:23,651 --> 00:41:30,521 me Mike I have yet I still don't have mine and I have yet to actually see the a 785 00:41:30,521 --> 00:41:35,441 physical printed book even like a video of a physical printed book with with you know 786 00:41:35,482 --> 00:41:37,882 The book is gonna be the size of the thing in your background? 787 00:41:37,882 --> 00:41:38,512 Curtis? 788 00:41:39,311 --> 00:41:43,961 yeah I I would dear Lord dear Lord I hope not And you know what's funny is like 789 00:41:43,961 --> 00:41:49,751 in on the camera this thing looks fine but this is this is like this far back 790 00:41:49,751 --> 00:41:56,051 from me right And so this thing is like I think it's 15 by 24 That thing is massive 791 00:41:56,441 --> 00:41:59,141 Um so yeah I sure I surely hope not 792 00:41:59,587 --> 00:42:00,127 For those 793 00:42:00,161 --> 00:42:00,581 but 794 00:42:00,637 --> 00:42:04,657 watch us on YouTube, uh, we do have videos out, but Curtis was just pointing at 795 00:42:05,017 --> 00:42:08,287 the, what do you call it, the title page? 796 00:42:08,287 --> 00:42:09,097 The front 797 00:42:09,446 --> 00:42:14,756 It's the cover the front cover Yeah yeah yeah And uh available at uh 798 00:42:17,006 --> 00:42:20,696 So or you can order them directly from O'Reilly for the record if you order 799 00:42:20,696 --> 00:42:28,291 directly from O'Reilly Mike and I make more um So uh there's that All right uh 800 00:42:28,321 --> 00:42:33,301 we're gonna talk so we're gonna jump into this week we're gonna talk about the title 801 00:42:33,631 --> 00:42:36,721 It's gonna sound I I you know I never know exactly what the title's gonna be but it's 802 00:42:36,721 --> 00:42:42,151 gonna be something along the lines of stop 90 of the ransomware attacks that could 803 00:42:42,151 --> 00:42:47,976 possibly happen to you That's a really long title but um I I I you know it may 804 00:42:47,976 --> 00:42:52,386 sound like a bold claim but I I think it's pretty straightforward And Mike uh I'd 805 00:42:52,386 --> 00:42:54,486 like to start out this week What's that 806 00:42:54,807 --> 00:42:55,197 before, you 807 00:42:55,236 --> 00:42:55,656 Yeah 808 00:42:55,767 --> 00:42:57,057 can I make a bold claim? 809 00:42:58,056 --> 00:42:58,686 claim 810 00:42:59,517 --> 00:42:59,667 A 811 00:42:59,856 --> 00:43:00,426 please 812 00:43:01,527 --> 00:43:05,277 That you can stop a hundred percent of ransomware if you 813 00:43:05,277 --> 00:43:06,012 never do anything online. 814 00:43:10,536 --> 00:43:11,046 Um 815 00:43:11,248 --> 00:43:15,058 not, I think there's still some, some, some room there for infection. 816 00:43:16,008 --> 00:43:16,548 sorry. 817 00:43:16,981 --> 00:43:21,071 Well you know like if you if you if they do the um the drop you know the 818 00:43:21,101 --> 00:43:25,541 the one that we covered in the in the uh what do you call it Um when we did 819 00:43:25,601 --> 00:43:28,031 the MR Robot remember the drop USB stick 820 00:43:28,182 --> 00:43:28,762 Oh, that's 821 00:43:28,818 --> 00:43:29,718 Tchotchke drops. 822 00:43:30,281 --> 00:43:31,256 Yeah What what's that 823 00:43:31,382 --> 00:43:32,017 you win. 824 00:43:32,748 --> 00:43:34,338 We call 'em tchotchke drops. 825 00:43:34,376 --> 00:43:41,696 Tchotchke drops Yeah Yeah So even then um um but what what is this what is 826 00:43:41,696 --> 00:43:45,536 this not do things online thing that you're talking about I don't know what 827 00:43:45,536 --> 00:43:47,786 in the world Like I I don't even know 828 00:43:48,573 --> 00:43:50,763 Like saying you can't get sick if you don't go outside. 829 00:43:50,853 --> 00:43:51,643 Well, that's not true either. 830 00:43:52,196 --> 00:43:57,206 yeah Exactly all right Mike well do we do you have a story to 831 00:43:57,206 --> 00:43:58,346 start us out with this week I 832 00:43:59,898 --> 00:44:00,438 I do. 833 00:44:00,528 --> 00:44:04,578 Um, well man, there's so many to pick from, but, um, from the book, 834 00:44:04,578 --> 00:44:06,048 you know, we talk about WannaCry. 835 00:44:06,588 --> 00:44:11,388 Um, and similar to, to kinda what we touched on here, good hygiene 836 00:44:11,388 --> 00:44:13,128 can prevent a lot of stuff. 837 00:44:13,518 --> 00:44:17,898 And I think WannaCry is an example of bad guys identified of a 838 00:44:17,898 --> 00:44:19,218 vulnerability that was out there. 839 00:44:19,218 --> 00:44:19,998 They created a. 840 00:44:20,748 --> 00:44:24,318 Uh, a payload and a, and an attack vector to take advantage of that, 841 00:44:24,588 --> 00:44:29,658 realizing that, uh, there's a, a very large percentage of, uh, company and 842 00:44:29,658 --> 00:44:35,778 organization populations that don't have a, a solid patch management program or, 843 00:44:36,048 --> 00:44:39,588 uh, that it, it's pretty lax, you know, there's a lot of organizations that, 844 00:44:39,588 --> 00:44:43,488 that say we have a patch program, but it's, you know, 2, 3, 4 months behind, 845 00:44:43,848 --> 00:44:47,028 or it's gotta meet certain criteria and some things never get patched. 846 00:44:47,628 --> 00:44:49,278 Well, that's what happened with WannaCry. 847 00:44:49,406 --> 00:44:49,586 Well 848 00:44:49,728 --> 00:44:50,808 found a vulnerability, 849 00:44:50,846 --> 00:44:55,226 for those of us yeah For those of us that that you know haven't lived uh the 850 00:44:55,226 --> 00:45:00,056 the cyber world Why don't you tell us what was want Tory What you know did it 851 00:45:00,056 --> 00:45:02,786 did it make you want to cry Is that why it was called that And what you know 852 00:45:02,786 --> 00:45:04,706 when did it happen and you know what 853 00:45:04,912 --> 00:45:05,212 I was 854 00:45:05,238 --> 00:45:06,678 I think there was about 200,000, 855 00:45:07,102 --> 00:45:07,342 Yeah. 856 00:45:07,402 --> 00:45:07,522 I. 857 00:45:07,608 --> 00:45:10,008 200,000 people crying in unison, 858 00:45:10,521 --> 00:45:11,011 exactly 859 00:45:11,118 --> 00:45:12,223 uh, with WannaCry. 860 00:45:13,222 --> 00:45:17,092 I was going to say Curtis, that because there have been so many of these 861 00:45:17,212 --> 00:45:20,632 attacks over the years, it's also hard to keep like, which keep it straight 862 00:45:20,632 --> 00:45:22,342 in terms of like which one was which. 863 00:45:23,081 --> 00:45:26,166 Yeah Yeah So why don't you tell us the story of WannaCry Mike 864 00:45:27,528 --> 00:45:33,228 WannaCry, uh, was developed, uh, to take advantage of a vulnerability in 865 00:45:33,828 --> 00:45:37,428 SMB or a, uh, a Windows, uh, service. 866 00:45:37,998 --> 00:45:38,508 Um. 867 00:45:39,018 --> 00:45:39,918 That had a patch. 868 00:45:39,918 --> 00:45:41,448 So Microsoft came out with a patch. 869 00:45:41,508 --> 00:45:45,348 So it was several months later that the malware, this 870 00:45:45,348 --> 00:45:46,908 attack vector really came out. 871 00:45:46,998 --> 00:45:49,968 Um, and it was all of those organizations that did not 872 00:45:49,968 --> 00:45:52,878 apply that critical, uh, patch. 873 00:45:52,878 --> 00:45:56,328 And if, if, uh, if you were paying attention at all, you probably got 874 00:45:56,328 --> 00:45:58,553 an email from Microsoft saying, you really need to patch this. 875 00:45:59,493 --> 00:46:00,843 This, uh, this vulnerability. 876 00:46:01,293 --> 00:46:06,123 Um, or you've got automatic patches turned off, uh, which is common too. 877 00:46:06,153 --> 00:46:08,793 'cause a lot of organizations don't want to automatically apply 878 00:46:08,793 --> 00:46:12,423 patches to production systems and have them reboot and cause issues. 879 00:46:12,423 --> 00:46:16,863 But nonetheless, bad guys found a vulnerability, took advantage of it 880 00:46:18,813 --> 00:46:20,613 several months after the fact even, 881 00:46:20,726 --> 00:46:21,116 yeah And 882 00:46:21,123 --> 00:46:21,243 and. 883 00:46:21,266 --> 00:46:23,456 how many people were impacted 884 00:46:24,723 --> 00:46:31,653 Well, um, not, not necessarily people, but sy well over 200,000 systems 885 00:46:31,653 --> 00:46:33,873 were, were infected with WannaCry. 886 00:46:34,556 --> 00:46:38,786 That's that's quite a bit that hint your comment earlier 200,000 people all crying 887 00:46:38,786 --> 00:46:46,841 out at once Just like in just like in uh what do you call it Uh star Wars I I'm 888 00:46:46,893 --> 00:46:47,403 Yes, 889 00:46:47,471 --> 00:46:55,211 a Star Wars reference Um okay Alright but like and the thing is this is yet this 890 00:46:55,211 --> 00:47:06,046 is one of many many examples of hacks of attacks that had the um uh victims of 891 00:47:06,046 --> 00:47:14,446 the attack practiced basic cyber hygiene They would not have um been they they 892 00:47:14,446 --> 00:47:18,256 would not have been victimized by this attack Does that sound is that about right 893 00:47:19,508 --> 00:47:21,848 Good, good chance they would not have been a victim. 894 00:47:21,848 --> 00:47:22,268 Yes. 895 00:47:22,276 --> 00:47:23,206 Yeah yeah 896 00:47:23,378 --> 00:47:28,058 The, the, the only, the only, the only caveat that is that Ry is one of those 897 00:47:28,988 --> 00:47:31,628 ransomware malware that was also a worm. 898 00:47:31,966 --> 00:47:32,386 mm 899 00:47:32,468 --> 00:47:37,358 so as it infected a, a machine, uh, it's worm like behavior was what? 900 00:47:37,598 --> 00:47:38,198 Uh. 901 00:47:38,778 --> 00:47:42,258 What led itself to propagate in kind of an al alternative method. 902 00:47:42,258 --> 00:47:46,008 So if you weren't vulnerable to the SMB with Microsoft, you might've been 903 00:47:46,008 --> 00:47:49,308 vulnerable some other way that this, uh, this worm was able to compromise you. 904 00:47:49,916 --> 00:47:59,666 Okay Okay yeah when when I think back on uh my history I I think back um to shit 905 00:48:00,596 --> 00:48:02,096 um what's the name of the company The 906 00:48:04,631 --> 00:48:08,981 The one that uh Thank you Thank you Thank you Um I think back to 907 00:48:08,981 --> 00:48:10,986 the that was what two years ago 908 00:48:11,657 --> 00:48:12,457 I think it was two years ago. 909 00:48:12,457 --> 00:48:12,617 Yeah. 910 00:48:13,061 --> 00:48:18,221 Yeah Yeah I think back to the Rackspace hack because that was one where again 911 00:48:18,221 --> 00:48:25,331 it was a patch There was a patch to the vulnerability in Microsoft Exchange that 912 00:48:25,391 --> 00:48:31,301 uh again had Rackspace simply applied that patch they would not have been uh subject 913 00:48:31,301 --> 00:48:36,731 to this this particular attack And in this case there was um was a workaround 914 00:48:37,421 --> 00:48:40,631 there was a there was a vulnerability And then there was a workaround to the 915 00:48:40,631 --> 00:48:45,521 vulnerability while they were waiting on the patch But what happened is there was 916 00:48:45,551 --> 00:48:52,121 a um an undisclosed a zero day additional vulnerability that if they had they 917 00:48:52,121 --> 00:48:57,671 had applied the patch to fix the first the first vulnerability they would have 918 00:48:57,671 --> 00:49:04,796 been they would not have been subject to the to the zero day exploit um But they 919 00:49:04,796 --> 00:49:10,496 said to themselves uh this is my theory uh is that they said well we we put 920 00:49:10,496 --> 00:49:15,686 in the workaround And so therefore the criticality of this patch was not um you 921 00:49:15,686 --> 00:49:20,726 know it wasn't as critical And so they didn't put in the patch yet And two weeks 922 00:49:20,786 --> 00:49:26,316 uh after the You know this exploit came out Um they they were attacked and that 923 00:49:26,316 --> 00:49:32,856 cost them entire business line Right Um because they had to um they had to stop 924 00:49:34,206 --> 00:49:37,956 and it there was a there was lawsuits It was it was it was it was very very messy 925 00:49:39,546 --> 00:49:46,026 so let's talk about when we talk about uh cyber hygiene Um do you know do you want 926 00:49:46,026 --> 00:49:48,336 to do you wanna just define that uh Mike 927 00:49:49,788 --> 00:49:50,183 I will. 928 00:49:50,183 --> 00:49:51,953 And if, if I could back up just a minute. 929 00:49:51,983 --> 00:49:55,073 'cause you made a, a, a comment about mitigation, so we weren't 930 00:49:55,073 --> 00:49:58,763 able to apply the patch for whatever reason, so we mitigated the risk. 931 00:49:58,961 --> 00:49:59,311 Right 932 00:49:59,423 --> 00:50:02,543 Well, something that I think is critically important for people to 933 00:50:02,543 --> 00:50:07,103 consider when we talk about mitigation, and this comes from my, my audit. 934 00:50:07,353 --> 00:50:11,493 My audit life, uh, where, where I had to go and determine if people were 935 00:50:11,493 --> 00:50:14,643 following the rules, whether it was hygiene or we also called them, uh, 936 00:50:14,673 --> 00:50:16,533 general controls or best practices. 937 00:50:17,073 --> 00:50:20,103 If they weren't, then they had to demonstrate what they were 938 00:50:20,103 --> 00:50:21,873 doing to mitigate the risk. 939 00:50:22,173 --> 00:50:28,383 Presented by the absence of doing what we expected and the audit guidance and 940 00:50:28,383 --> 00:50:32,073 what we would tell people and what people should consider is that your mitigation 941 00:50:32,073 --> 00:50:34,383 strategy should be more effective. 942 00:50:35,223 --> 00:50:37,503 Had you done it the right way to begin with. 943 00:50:37,831 --> 00:50:38,051 Hmm 944 00:50:38,842 --> 00:50:38,932 a 945 00:50:39,063 --> 00:50:42,813 So if the control says, do one, two, and three, and you say, I can't 946 00:50:42,813 --> 00:50:47,403 do one, two, and three, well, you better do 4, 5, 6, 7, 8, 9, and 10. 947 00:50:48,423 --> 00:50:54,273 Your mitigation needs to be stronger than the original control or activity. 948 00:50:54,862 --> 00:50:55,162 which 949 00:50:55,396 --> 00:50:55,676 Interesting 950 00:50:56,782 --> 00:51:02,212 But I guess in your experience, Mike, how often were people 951 00:51:02,272 --> 00:51:03,827 able to meet that higher bar? 952 00:51:05,793 --> 00:51:09,543 Well, if you were a regulated organization, you had to, or you failed. 953 00:51:09,967 --> 00:51:10,597 Or, or I 954 00:51:10,743 --> 00:51:10,983 Yep. 955 00:51:11,107 --> 00:51:15,097 often would they just say four, five and six, seven are two difficult. 956 00:51:15,277 --> 00:51:17,047 Let me just go back and implement one, two, and three. 957 00:51:19,278 --> 00:51:21,798 Never, never did they do that. 958 00:51:22,428 --> 00:51:25,218 Uh, so they either so and, and it, and. 959 00:51:26,973 --> 00:51:28,233 With a grain of salt, obviously. 960 00:51:28,233 --> 00:51:32,973 So I was, I was a technology auditor, so I was auditing it people, it people that 961 00:51:32,973 --> 00:51:34,683 generally don't run the business, right? 962 00:51:34,683 --> 00:51:38,283 They're being, they're given direction from the business of, you know, we 963 00:51:38,283 --> 00:51:42,093 can't fix that thing because our website will stop working or it'll be down 964 00:51:42,093 --> 00:51:43,563 too long, we'll lose too much money. 965 00:51:43,563 --> 00:51:48,273 So businesses directing the technology, uh. 966 00:51:48,738 --> 00:51:51,978 Um, you know, groups and, and infrastructure of, of 967 00:51:51,978 --> 00:51:53,748 what they can and can't do. 968 00:51:54,348 --> 00:51:58,338 And so when, when you talk to them about, well, you, you couldn't do 969 00:51:58,338 --> 00:52:03,018 one, two, and three, so, because it'll break things or for whatever reason. 970 00:52:03,018 --> 00:52:04,878 So what are you doing? 971 00:52:04,878 --> 00:52:06,348 Well, we're doing four, five, and six. 972 00:52:06,348 --> 00:52:08,448 Well, four, five and six are kind of, okay. 973 00:52:08,508 --> 00:52:12,138 I'm gonna say that's maybe effective with opportunity for improvement. 974 00:52:12,588 --> 00:52:16,218 Uh, or they, they, they're doing a whole lot or they're not doing 975 00:52:16,218 --> 00:52:17,598 really anything because they. 976 00:52:18,108 --> 00:52:18,828 They didn't know. 977 00:52:19,218 --> 00:52:20,808 And so those are the really, the three options. 978 00:52:20,808 --> 00:52:23,028 You, you fail 'cause you didn't do what you were supposed to 979 00:52:23,028 --> 00:52:26,538 and you weren't mitigating it or mitigating it effectively. 980 00:52:26,718 --> 00:52:29,118 You were mitigating it somewhat effectively, but I 981 00:52:29,118 --> 00:52:30,408 think it could be stronger. 982 00:52:30,528 --> 00:52:34,788 And that's from a, an auditor's perspective, there is that kind of, uh, 983 00:52:34,818 --> 00:52:37,428 latitude where I can, I can add some. 984 00:52:38,088 --> 00:52:41,778 Objectivity, um, or I say subjectivity. 985 00:52:42,228 --> 00:52:46,518 Uh, and then lastly, wow, you, you really, you really are, you really do understand 986 00:52:46,518 --> 00:52:48,048 that mitigation's gotta be stronger. 987 00:52:48,048 --> 00:52:49,938 And, and, but that's, that's rare. 988 00:52:49,968 --> 00:52:53,598 Very rarely did I see the mitigating controls more effective 989 00:52:53,598 --> 00:52:55,248 than the, the original controls. 990 00:52:55,841 --> 00:53:01,736 I'm glad that you you mentioned um the the the the the comment that you made 991 00:53:02,366 --> 00:53:07,286 I is one that we make a lot from the opposite side and that is the backup 992 00:53:07,286 --> 00:53:13,676 People should never be setting policy They should never be determining you know 993 00:53:13,676 --> 00:53:20,096 retention periods uh RTOs and RPOs Uh you know that that should never be the 994 00:53:20,096 --> 00:53:25,686 case That should always come from the business Um and so we we we say that a 995 00:53:25,686 --> 00:53:30,006 lot and so it it's good to hear it just from a from a from a different uh frame 996 00:53:30,006 --> 00:53:36,996 of view Um uh I don't think you ever got around to defining defining cyber hygiene 997 00:53:38,703 --> 00:53:39,453 So cyber hygiene. 998 00:53:39,453 --> 00:53:44,523 I mean, if, if we keep in, in our, in our, uh, in our discussions, we 999 00:53:44,523 --> 00:53:45,933 keep coming back to the real world. 1000 00:53:45,933 --> 00:53:49,143 'cause I think that's helped, that helps people, uh, relate. 1001 00:53:49,593 --> 00:53:54,483 Uh, so applying real world stuff to cyber hygiene is very similar. 1002 00:53:54,483 --> 00:53:55,293 If you, if you're not. 1003 00:53:55,983 --> 00:53:59,613 Keeping or maintaining your own personal hygiene, you're gonna get sick. 1004 00:54:00,183 --> 00:54:03,273 Um, or, or people are gonna think you're sick, one of the two. 1005 00:54:03,723 --> 00:54:08,583 Uh, so in cyber there are things that you should be doing just 1006 00:54:08,583 --> 00:54:09,753 like in real, in real world. 1007 00:54:09,753 --> 00:54:15,303 Take your vitamins, go see a doctor, get your checkups, uh, do healthy things. 1008 00:54:15,903 --> 00:54:17,703 One, cyber, those, those. 1009 00:54:18,393 --> 00:54:22,473 Activities are making sure that your systems aren't vulnerable. 1010 00:54:22,533 --> 00:54:28,023 So, uh, inoculating them for, in, in, uh, kind of as a, an analogy there. 1011 00:54:28,053 --> 00:54:31,113 Uh, and we do that through patches. 1012 00:54:31,413 --> 00:54:35,133 Uh, so we, we subscribe to services. 1013 00:54:35,163 --> 00:54:37,413 If it's a Windows machine that do it automatically, if 1014 00:54:37,413 --> 00:54:39,573 you've got it turned on, um. 1015 00:54:40,023 --> 00:54:43,713 It and it will check your systems to determine if there's a vulnerable, 1016 00:54:43,893 --> 00:54:47,913 uh, configuration or a, a, a patch that's out, that, that would, 1017 00:54:48,003 --> 00:54:50,223 um, address a, a known problem. 1018 00:54:50,973 --> 00:54:54,423 Um, so patch management is very important. 1019 00:54:55,053 --> 00:54:59,793 Um, the other part of that is, well, who can access my stuff? 1020 00:54:59,943 --> 00:55:03,483 Uh, that's me obviously, and the people that I give access to my systems. 1021 00:55:03,873 --> 00:55:07,143 But then how do we know that it's really them because. 1022 00:55:08,658 --> 00:55:12,258 The number one traded commodity on the dark web web right now is 1023 00:55:12,258 --> 00:55:13,968 access, and that's credentials. 1024 00:55:14,478 --> 00:55:18,048 So how do we, you know, what's a good practice for making sure that 1025 00:55:18,438 --> 00:55:21,648 you know, someone that, that I trust, uh, that their credentials 1026 00:55:21,648 --> 00:55:24,408 aren't out there and someone's, you know, some bad guy's not using them. 1027 00:55:24,408 --> 00:55:26,718 So that's, that's where multifactor authentication 1028 00:55:26,718 --> 00:55:29,178 comes in, but very similar to. 1029 00:55:30,318 --> 00:55:33,018 You know, in the real world, vitamins and all these other healthy things, you have 1030 00:55:33,018 --> 00:55:35,178 to do it responsibly and appropriately. 1031 00:55:35,178 --> 00:55:40,128 And MFA is definitely one of those that I think the majority of organizations just 1032 00:55:40,128 --> 00:55:41,988 say we have it and they're not using it. 1033 00:55:41,988 --> 00:55:42,348 Right. 1034 00:55:43,068 --> 00:55:50,718 Um, and then lastly, you know, password management, um, probably, um, 1035 00:55:50,808 --> 00:55:52,608 appropriately at the bottom of the list. 1036 00:55:52,638 --> 00:55:56,778 Uh, it's still part of hygiene, but not as effective as it used to be 'cause. 1037 00:55:57,303 --> 00:55:59,583 You know, bad guys aren't trying to guess your password, they're just 1038 00:55:59,583 --> 00:56:01,983 stealing it from somewhere else, right? 1039 00:56:01,983 --> 00:56:05,493 Your, your work password is probably a password you've used somewhere 1040 00:56:05,493 --> 00:56:06,663 else at some point in time. 1041 00:56:07,391 --> 00:56:07,691 Well I 1042 00:56:07,773 --> 00:56:08,523 bad guys are just 1043 00:56:08,831 --> 00:56:12,821 Yeah but that but that's the point of of good Cyber hygiene Right Is 1044 00:56:12,821 --> 00:56:15,671 not doing that Right We're gonna get to I think we'll get to that in in a 1045 00:56:15,933 --> 00:56:16,323 right. 1046 00:56:16,323 --> 00:56:16,593 Yep. 1047 00:56:16,593 --> 00:56:19,713 So we'll get into the details of what, uh, what a good password 1048 00:56:20,133 --> 00:56:24,843 practice, uh, uh, would be, uh, similar to patching and, and MFA. 1049 00:56:25,087 --> 00:56:27,937 Mike, so these are three great sort of. 1050 00:56:29,032 --> 00:56:32,152 Things you should be doing from a cyber hygiene perspective. 1051 00:56:32,542 --> 00:56:37,702 Um, but how did you come up with this list, like right, or, I know 1052 00:56:37,702 --> 00:56:40,372 you and Curtis have been talking about this for a while, but like, why 1053 00:56:40,372 --> 00:56:41,902 are these the three most important? 1054 00:56:41,902 --> 00:56:46,282 Is it based on like scenarios you've encountered working with customers, 1055 00:56:46,282 --> 00:56:47,722 helping them recover from ransomware? 1056 00:56:47,722 --> 00:56:52,492 Like why should someone believe the sort of 90% of ransomware could be? 1057 00:56:53,096 --> 00:56:58,826 I can jump in on that one I mean it it's because it of the stories that 1058 00:56:58,826 --> 00:57:04,286 I've read over the last you know so many years it it was always it was always 1059 00:57:04,286 --> 00:57:08,366 one of these three right If if if they had just patched the system then they 1060 00:57:08,366 --> 00:57:12,206 wouldn't have the vulnerability if they had just either not allowed the password 1061 00:57:12,206 --> 00:57:17,636 to be stolen or if they had the if or or compromised in some way And then uh 1062 00:57:17,666 --> 00:57:23,731 if if if that had happened if they had just had MFA And you know in uh you know 1063 00:57:24,541 --> 00:57:29,131 what's the word I'm looking for Um if they if they were just using MFA then 1064 00:57:29,131 --> 00:57:32,971 then even if they had the password then they would've been able to get in Right 1065 00:57:33,127 --> 00:57:35,647 Assuming that you didn't have MFA fatigue by the employee? 1066 00:57:36,641 --> 00:57:41,141 But yeah we're we're gonna get to that We'll get to that But the the thing 1067 00:57:41,141 --> 00:57:45,041 is if if if they had these things when you when you read back on the stories 1068 00:57:45,131 --> 00:57:48,761 and I would add like because we're tech technically talking about cyber 1069 00:57:48,761 --> 00:57:52,976 hygiene here and not backup hygiene but I'll add to this Immutable backups 1070 00:57:53,246 --> 00:57:58,826 right If we have that if we have those four then um not only would you stop 1071 00:57:58,826 --> 00:58:04,616 the you know the bulk of the attacks you would uh also be able to respond 1072 00:58:04,616 --> 00:58:08,966 to the 10 that that you get Uh would your answer be any different there Mike 1073 00:58:10,868 --> 00:58:12,068 Oh, very similar. 1074 00:58:12,068 --> 00:58:17,318 So yeah, they, these three are the greatest common denominators, uh, of, of 1075 00:58:17,318 --> 00:58:19,538 a lot of the, if not the majority of, uh. 1076 00:58:20,093 --> 00:58:21,533 Incidents that are out there. 1077 00:58:21,893 --> 00:58:25,073 Uh, but to Curtis's point and maybe where you were going, Prasanna Yeah. 1078 00:58:25,073 --> 00:58:26,483 This list could get really long. 1079 00:58:26,513 --> 00:58:30,743 It's, it's, you know, it's not just these three and the backups, it's also network 1080 00:58:30,743 --> 00:58:34,733 segmentation and turning, you know, secure build guidelines and secure coding 1081 00:58:34,733 --> 00:58:40,553 and, uh, you know, perimeter protection and vendor management and anti-malware 1082 00:58:40,553 --> 00:58:42,443 and training and all those things. 1083 00:58:42,923 --> 00:58:47,873 Uh, but when you look at the numbers, uh, the statistics of incidents 1084 00:58:47,873 --> 00:58:48,828 that are out there and, and what. 1085 00:58:49,458 --> 00:58:53,058 You know what, how you boil those down to the common denominate. 1086 00:58:53,388 --> 00:58:54,828 Common denominators. 1087 00:58:54,828 --> 00:58:56,593 It's, it's primarily these three. 1088 00:58:57,321 --> 00:59:02,451 Because these are it's like this is to again going back to the real world this 1089 00:59:02,451 --> 00:59:10,151 is the um I This is the have in in the real world when we talk about investing 1090 00:59:11,021 --> 00:59:15,521 The very first thing they tell you to do is to have uh you know 90 days of 1091 00:59:15,521 --> 00:59:20,021 of an emergency fund And that should be your first thing because there's no 1092 00:59:20,021 --> 00:59:24,221 point in talking about like you know 4 0 1 Ks and Roth IRAs and all these things 1093 00:59:24,431 --> 00:59:28,541 if you can't survive uh you know losing a paycheck for a couple of weeks right 1094 00:59:28,961 --> 00:59:36,106 This is the um if you're not doing these Then just stop Like you know in the book 1095 00:59:36,106 --> 00:59:39,766 we said like if you're not doing these three things just stop reading right now 1096 00:59:39,766 --> 00:59:46,036 and go do those three things because it will stop 90 the other 10 like everything 1097 00:59:46,036 --> 00:59:51,106 else The other 10 is the is the hard part right It's the more expensive part 1098 00:59:51,376 --> 00:59:56,956 But doing password management and patch management and and MFA or um uh pass 1099 00:59:56,956 --> 01:00:01,636 keys which we'll we'll talk about that a little bit more but if if we do that 1100 01:00:01,911 --> 01:00:07,581 Then it it's it's a it's the low hanging fruit Um you know that that allows 1101 01:00:07,581 --> 01:00:15,501 us to secure the the environment um without without massive cost or anything 1102 01:00:16,881 --> 01:00:19,341 weird I I still hear your your fan 1103 01:00:19,497 --> 01:00:20,247 came back on. 1104 01:00:20,691 --> 01:00:23,631 Yeah it just came back on even though we have the noise reduction on 1105 01:00:24,348 --> 01:00:29,268 And there, there's zero change on my side, so there's no extra noise or anything. 1106 01:00:29,966 --> 01:00:31,646 And then it and then it just left 1107 01:00:32,298 --> 01:00:34,213 It's like a power surge or something. 1108 01:00:34,353 --> 01:00:34,733 I'm not sure. 1109 01:00:36,446 --> 01:00:42,896 I got nothing Um I So weird Um all right Well luckily it was me that was talking 1110 01:00:42,896 --> 01:00:48,626 so I could mute it out Um yeah so this this is like this is the if you're not 1111 01:00:48,626 --> 01:00:52,016 doing these things and don't it's like it's like when we start talking about 1112 01:00:52,406 --> 01:00:56,186 uh offsite backups there's no point in talking about offsite backups if you're 1113 01:00:56,186 --> 01:01:01,251 not making backups in the first place Right Right This is the this is the if 1114 01:01:01,251 --> 01:01:04,611 you're not doing these things and don't even talk to me Don't even start if you're 1115 01:01:04,611 --> 01:01:09,951 not doing basic cyber hygiene then um then there's no point in in continuing 1116 01:01:09,951 --> 01:01:11,871 on with with further discussions 1117 01:01:14,601 --> 01:01:20,576 Uh let's see here Um all right so I Let's just let's just talk a little bit about 1118 01:01:20,876 --> 01:01:25,106 when we talk about patching how do we know uh and we're gonna do an episode 1119 01:01:25,106 --> 01:01:29,726 on each of these things but just the basic thing what what do you think would 1120 01:01:29,726 --> 01:01:32,576 be the easiest That that's what cause that's what we're trying to do here What 1121 01:01:32,576 --> 01:01:36,206 would be the easiest way to make sure that we're running all of the appropriate 1122 01:01:36,206 --> 01:01:38,756 patches Mike especially the critical ones 1123 01:01:40,828 --> 01:01:45,568 It's, it's easy if you're organized and the first step in getting organized is 1124 01:01:45,568 --> 01:01:50,488 doing an inventory of the things that you have, because, you know, patch, 1125 01:01:52,648 --> 01:01:56,518 you have to work off your inventory to know who, who to get patches from. 1126 01:01:56,818 --> 01:01:57,028 Right. 1127 01:01:57,028 --> 01:01:57,513 Is it, is it. 1128 01:01:58,278 --> 01:01:59,208 Red Hat Linux. 1129 01:01:59,208 --> 01:02:00,078 Is it Windows? 1130 01:02:00,078 --> 01:02:02,328 Is it third party tools? 1131 01:02:02,418 --> 01:02:07,608 Adobe, uh, you know that 3D modeling tool? 1132 01:02:07,608 --> 01:02:08,898 You use AutoCAD? 1133 01:02:09,048 --> 01:02:09,678 What is it? 1134 01:02:09,678 --> 01:02:13,608 So you've gotta inventory all this stuff first and then find out if you can 1135 01:02:13,608 --> 01:02:15,708 actually get notifications from them. 1136 01:02:16,608 --> 01:02:18,648 For when patches are available. 1137 01:02:19,128 --> 01:02:22,338 Uh, if you don't do that on the proactive side, then you're gonna 1138 01:02:22,338 --> 01:02:23,598 get it on the reactive side. 1139 01:02:23,628 --> 01:02:28,308 'cause hopefully part of hygiene is also your periodic vulnerability assessments. 1140 01:02:28,308 --> 01:02:32,208 And if, if you need help with that, we can, we can walk you through some 1141 01:02:33,708 --> 01:02:36,198 free open source ways to do that. 1142 01:02:36,263 --> 01:02:36,483 But. 1143 01:02:37,578 --> 01:02:41,988 Every now and then you need to be scanning all of your assets for vulnerabilities. 1144 01:02:42,078 --> 01:02:45,978 That's gonna turn up some configuration problems, some missing patches. 1145 01:02:46,368 --> 01:02:49,668 Well then, alright, reactively, now I, well there's a missing patch 1146 01:02:49,668 --> 01:02:53,058 and usually it comes with a link from these vulnerability tools. 1147 01:02:53,568 --> 01:02:57,078 Uh, so go do that and while you're doing it, find out if there's a way 1148 01:02:57,078 --> 01:02:58,908 to subscribe to that information. 1149 01:02:59,448 --> 01:03:00,168 Um, so. 1150 01:03:01,458 --> 01:03:02,118 Easy. 1151 01:03:02,208 --> 01:03:05,658 It's not easy, but organi, and that's one of the reasons people 1152 01:03:05,658 --> 01:03:07,008 don't do it 'cause it's not easy. 1153 01:03:07,668 --> 01:03:11,448 Um, and there are tools out there that are fairly expensive to 1154 01:03:11,448 --> 01:03:12,948 do it in an automated fashion. 1155 01:03:12,948 --> 01:03:15,438 And then somewhere in between there's managed services and other 1156 01:03:15,438 --> 01:03:19,638 things, but it's gotta start with understanding what it is you have, 1157 01:03:20,328 --> 01:03:24,168 uh, and then figuring out where to get the information for available patches 1158 01:03:24,168 --> 01:03:26,118 and issues with those, those assets. 1159 01:03:26,561 --> 01:03:32,201 this is the hardest thing today versus back in the day right Back in the day I 1160 01:03:32,201 --> 01:03:35,621 could walk into a server room and I could I could literally just have a piece of 1161 01:03:35,621 --> 01:03:39,851 paper and check off I have this one I have this one I have this one Now we have 1162 01:03:39,856 --> 01:03:44,386 a We don't have any service to point at Everything's virtual Everything's in the 1163 01:03:44,386 --> 01:03:50,986 cloud And we have we have you know um IAS we have PAS we have SAS right We have all 1164 01:03:50,986 --> 01:03:55,846 of these different ways where uh and and I'd say the SaaS is probably the worst 1165 01:03:55,846 --> 01:04:02,676 because it's so easy to to propagate Um The you know to to go across the um the 1166 01:04:02,676 --> 01:04:06,366 thing and and you did you did remind me when we talk about inventory you did 1167 01:04:06,366 --> 01:04:11,346 remind me again back in the day We had uh when I was the backup guy my very first 1168 01:04:11,346 --> 01:04:19,286 job in it We had we had a very boring naming convention We had H-P-D-B-S-V-A 1169 01:04:19,316 --> 01:04:28,586 HP database server a right bbc so on And I ha I was I was becoming worried that I 1170 01:04:28,586 --> 01:04:32,066 wasn't getting all the servers cause we started out we literally when I started 1171 01:04:32,156 --> 01:04:38,371 at the bank we had seven Servers at T three B twos by the way for those you 1172 01:04:38,371 --> 01:04:43,531 know that's what we had which was for the record the first computer designed to run 1173 01:04:43,591 --> 01:04:49,411 Unix so they were old right Anyway so we went from having seven servers to having 1174 01:04:49,441 --> 01:04:53,866 like 200 servers and I was starting to panic that we We didn't have a correct 1175 01:04:53,866 --> 01:04:59,656 inventory And so um but the the naming convention was very helpful And so I had 1176 01:04:59,656 --> 01:05:04,996 this this practice of when you had a new server you had to give me a form to say I 1177 01:05:04,996 --> 01:05:09,016 want this server backed up And I put this thing on there that said don't consider 1178 01:05:09,016 --> 01:05:12,616 it backed up until you get the form back for me Signed that said that I saw the 1179 01:05:12,616 --> 01:05:16,786 form and I put it on the list And then one day somebody handed me a form and they 1180 01:05:16,936 --> 01:05:26,361 it said like H-P-D-B-S-V and I'm like And they're like yes I go so that would by by 1181 01:05:26,361 --> 01:05:34,341 you know my inference that means there's an M and an L a K somewhere And they're 1182 01:05:34,341 --> 01:05:42,526 like well yeah And I'm like I only know up to j So so I'm gonna go find K and l 1183 01:05:42,526 --> 01:05:47,596 and m and uh and we'll start backing all of them up I agree with you Mike A hundred 1184 01:05:47,596 --> 01:05:51,376 percent That inventory is absolutely the place to start And Prasanna you were 1185 01:05:51,376 --> 01:05:53,626 about to say something before I waxed up 1186 01:05:54,457 --> 01:05:58,207 No, it, that's actually a pretty funny story, Curtis, but I'm not surprised. 1187 01:05:58,207 --> 01:06:02,707 You always have all these great stories from working at the bank and other places. 1188 01:06:03,067 --> 01:06:06,697 But Mike, I know you talked about patch management, right, 1189 01:06:06,697 --> 01:06:08,497 and how to apply patches. 1190 01:06:09,427 --> 01:06:13,627 is there something similar for cases where maybe patches aren't available? 1191 01:06:13,627 --> 01:06:16,177 Like, it's great you have an inventory of everything that's there, but 1192 01:06:16,177 --> 01:06:20,287 how do you deal with sort of, um, exploits that are currently out 1193 01:06:20,287 --> 01:06:22,237 there before patches come out? 1194 01:06:24,183 --> 01:06:27,123 So those are zero days in, in most cases. 1195 01:06:27,243 --> 01:06:31,353 Uh, so zero day is something was identified today, and vendors haven't had 1196 01:06:31,353 --> 01:06:34,053 a chance to respond to that with a patch. 1197 01:06:34,713 --> 01:06:39,933 Um, well, and, and I'll add real quick, sometimes the patch that's 1198 01:06:39,933 --> 01:06:43,413 available becomes your zero day because it doesn't work in your environment. 1199 01:06:43,923 --> 01:06:46,378 Uh, and so along with patch management, you need to develop. 1200 01:06:47,313 --> 01:06:52,713 Process for testing the patch, applying it to a test machine to 1201 01:06:52,713 --> 01:06:56,283 see its effects on how things run before you move it into production. 1202 01:06:56,283 --> 01:07:00,723 So, uh, be mindful of that too, but to your point, Prasanna about things 1203 01:07:00,723 --> 01:07:06,603 that come up that don't have a, a fix, uh, those mitigating controls. 1204 01:07:06,603 --> 01:07:08,458 Like how do we, alright, so there in. 1205 01:07:09,708 --> 01:07:10,728 It does depend. 1206 01:07:10,728 --> 01:07:12,618 So is this a public facing thing? 1207 01:07:13,068 --> 01:07:14,808 Uh, do people log into it? 1208 01:07:14,838 --> 01:07:18,438 Is it a, is it a, you know, prized possession of our company 1209 01:07:18,468 --> 01:07:20,118 with, you know, sensitive data? 1210 01:07:20,388 --> 01:07:24,498 Or is it just that, that thing I could potentially turn off or isolate? 1211 01:07:25,158 --> 01:07:27,888 Um, so you've gotta do some analysis first, like what's 1212 01:07:27,888 --> 01:07:29,178 the risk, what's the impact? 1213 01:07:29,268 --> 01:07:31,518 And then respond accordingly if it's. 1214 01:07:32,478 --> 01:07:34,488 Publicly accessible internet facing. 1215 01:07:34,968 --> 01:07:39,198 Then put some monitoring on it, put some logging on it, try to isolate it. 1216 01:07:39,318 --> 01:07:43,098 Uh, those mitigating controls in the absence of a, uh, a true 1217 01:07:43,098 --> 01:07:46,668 solution have to be assessed and applied as fast as possible. 1218 01:07:48,496 --> 01:07:49,581 I like that Um 1219 01:07:49,803 --> 01:07:49,813 and 1220 01:07:49,841 --> 01:07:50,061 so 1221 01:07:50,083 --> 01:07:52,518 there, there are, there are services out there. 1222 01:07:52,518 --> 01:07:54,318 I ran into one not too long ago. 1223 01:07:54,318 --> 01:07:58,068 It's outta New Zealand and it's, I don't have a fix for this. 1224 01:07:58,428 --> 01:08:00,048 It's essentially a proxy. 1225 01:08:00,408 --> 01:08:03,678 So they, they stand up a uh, um. 1226 01:08:04,083 --> 01:08:08,733 An internet facing version of whatever it is that's fed from your environment. 1227 01:08:08,943 --> 01:08:13,623 And they analyze and filter all the requests for that information as a proxy. 1228 01:08:13,923 --> 01:08:18,903 Uh, and, and you can, you can subscribe to that until a solution is, uh, is applied. 1229 01:08:19,353 --> 01:08:20,193 So that was pretty interesting. 1230 01:08:20,193 --> 01:08:21,123 I did, I did see that. 1231 01:08:21,746 --> 01:08:27,296 Yeah that's that does sound interesting uh from the so that's the the patches 1232 01:08:27,296 --> 01:08:31,286 world and again we're gonna do an episode on each of these three Uh but that's the 1233 01:08:31,286 --> 01:08:36,986 patches world Let's talk a little bit about the passwords Um and and I think we 1234 01:08:36,986 --> 01:08:44,696 can all agree one some method Again I'm I'm a big fan of of password management 1235 01:08:44,696 --> 01:08:51,926 like a password manager But you need some method So you absolutely do not ever 1236 01:08:51,956 --> 01:08:58,916 use the same password in multiple places because that is the problem is uh I and 1237 01:08:58,916 --> 01:09:04,526 I got a I got a um I got in a argument is a is a strong term but I got into a 1238 01:09:04,526 --> 01:09:09,161 discussion with a with a guy on I think it was somebody that commented on one 1239 01:09:09,161 --> 01:09:18,476 of our videos and um where he was saying that he was using Uh this system where 1240 01:09:18,476 --> 01:09:25,646 he what he does is he he has a password that he uses on like a a small subset 1241 01:09:25,646 --> 01:09:32,161 of systems Like he has like 10 passwords that he uses everywhere And so his method 1242 01:09:32,161 --> 01:09:36,511 of like mitigating the risk is that he doesn't wanna use a password manager 1243 01:09:36,511 --> 01:09:40,171 He doesn't believe in using a password manager So he has like 10 passwords that 1244 01:09:40,171 --> 01:09:46,351 he sprinkles around and he just has to remember uh 10 passwords in his head um 1245 01:09:46,351 --> 01:09:51,751 and he uses the the battery horse staple method Um right which is which is a good 1246 01:09:51,751 --> 01:09:55,656 method right Uh for those of you who don't know what I'm talking about This is 1247 01:09:55,656 --> 01:10:01,416 the um the idea of what we're gonna talk more about I'm sorry It is just this idea 1248 01:10:01,416 --> 01:10:06,576 of having an password that is long but actually easy to remember because most of 1249 01:10:06,576 --> 01:10:10,716 the passwords that we have that are long are total garbly gook and they can only 1250 01:10:10,716 --> 01:10:14,676 be remembered by a password manager So he uses that method and then he has like 1251 01:10:14,676 --> 01:10:19,721 10 passwords and I was like well that's Again better than nothing better than 1252 01:10:19,721 --> 01:10:25,901 using the same password everywhere But if if there's avol if there if if any one 1253 01:10:25,901 --> 01:10:29,801 of those systems where you're using that same password are ever compromised then 1254 01:10:29,801 --> 01:10:33,581 you have to change the password everywhere where you're using that password And 1255 01:10:33,581 --> 01:10:37,331 potentially by the time you get around to doing it it's already been compromised 1256 01:10:37,781 --> 01:10:44,201 And um so this is just again my way to do this is password manager and I think 1257 01:10:44,201 --> 01:10:51,321 that's the number one most recommended way But besides making sure that we do 1258 01:10:51,321 --> 01:10:59,691 not use the same password in multiple places What else Basic uh password hygiene 1259 01:10:59,691 --> 01:11:00,956 stuff do we need to talk about Mike 1260 01:11:03,763 --> 01:11:07,618 Real quick, I think a good term for your, uh, your disagreement. 1261 01:11:07,678 --> 01:11:10,738 Uh, and it's an older term, uh, that, that you just don't hear 1262 01:11:10,738 --> 01:11:11,933 very often is a kerfluffle. 1263 01:11:12,276 --> 01:11:12,766 Careful 1264 01:11:13,053 --> 01:11:14,853 I think that's a good yes. 1265 01:11:15,033 --> 01:11:18,633 Uh, anyway, so back to back to passwords. 1266 01:11:18,693 --> 01:11:23,103 Uh, I think a good practice these days, especially as we suggest passwords 1267 01:11:23,103 --> 01:11:27,423 become longer and longer, and, uh, I don't know if, if, uh, if, if you 1268 01:11:27,423 --> 01:11:29,583 guys realize where that came from. 1269 01:11:30,723 --> 01:11:35,223 Uh, so it stemmed from the, the, the length of a password. 1270 01:11:35,696 --> 01:11:35,726 okay 1271 01:11:36,537 --> 01:11:36,917 How long 1272 01:11:37,113 --> 01:11:37,653 So a stem. 1273 01:11:38,782 --> 01:11:39,562 compute right? 1274 01:11:39,668 --> 01:11:39,848 So that's. 1275 01:11:40,248 --> 01:11:42,288 A combination of things, right? 1276 01:11:42,288 --> 01:11:48,858 So when, when Windows or, or Linux, Unix, uh, encrypts a password, uh, with, 1277 01:11:48,858 --> 01:11:53,088 you know, a ES 2 56 or whatever it is, there's a ma math, there's a mathematical, 1278 01:11:54,558 --> 01:12:00,828 um, response to how long it would take to crack a password of certain length. 1279 01:12:01,818 --> 01:12:05,358 Well, that's been defeated, uh, by a project called Rainbow Tables. 1280 01:12:06,648 --> 01:12:11,598 Rainbow tables just encrypts and, and captures the, the hash value 1281 01:12:11,598 --> 01:12:16,308 of every conceivable, random known dictionary, multiple languages. 1282 01:12:16,308 --> 01:12:19,518 And so it's not, I don't have to crack your password anymore, I just have to 1283 01:12:19,518 --> 01:12:21,618 take your password hash and go look it up. 1284 01:12:22,428 --> 01:12:24,348 And see if that's already been done. 1285 01:12:24,588 --> 01:12:26,268 So it's not a math problem anymore. 1286 01:12:26,268 --> 01:12:28,698 It's, it's a, it's a, it's a research problem. 1287 01:12:29,598 --> 01:12:34,248 All right, well then a vulnerability came out in, uh, with Windows. 1288 01:12:34,428 --> 01:12:43,248 'cause if you had, uh, um, NTLM, the, the hash in windows turned on, it would 1289 01:12:43,248 --> 01:12:48,768 take your password hash and break it up into two eight character hashes. 1290 01:12:49,998 --> 01:12:52,458 Well, now I can, I can crack them individually. 1291 01:12:52,458 --> 01:12:55,458 Instead of cracking one large, I can do two small ones. 1292 01:12:55,458 --> 01:12:56,958 And there's vulnerability associated with that. 1293 01:12:56,958 --> 01:13:03,858 So now we should have greater than 16 character passwords for that reason. 1294 01:13:04,098 --> 01:13:07,818 And, and it, and you know, I can drive policy now, it says it's gotta be 16. 1295 01:13:08,208 --> 01:13:14,238 Well, if it has to be 16, the IT guys that have not wanted to change the LTLM now 1296 01:13:14,238 --> 01:13:17,898 have to, they have to turn that off to, to generate, you know, and so there's. 1297 01:13:18,678 --> 01:13:22,908 It's political game, but also based on, um, some known 1298 01:13:22,908 --> 01:13:24,378 vulnerabilities around passwords. 1299 01:13:24,888 --> 01:13:28,248 Alright, well now we've got 16 character or greater passwords. 1300 01:13:28,248 --> 01:13:30,408 How are you gonna get users to remember that? 1301 01:13:31,128 --> 01:13:32,388 Password hackers are great. 1302 01:13:32,448 --> 01:13:36,078 Uh, password managers are great because it can also randomize passwords so 1303 01:13:36,078 --> 01:13:37,068 you don't have to remember it anymore. 1304 01:13:37,068 --> 01:13:40,548 You just log into your password manager and copy and paste. 1305 01:13:41,088 --> 01:13:43,638 Um, and so you, you don't have to remember it anymore. 1306 01:13:43,638 --> 01:13:45,588 And it can be random, which is also. 1307 01:13:46,263 --> 01:13:51,663 Helpful, but then not everybody can subscribe to that approach. 1308 01:13:51,663 --> 01:13:54,783 So they, they want these password phrases now. 1309 01:13:54,873 --> 01:13:58,923 And so some interesting things about password phrases, uh, and similar to 1310 01:13:58,923 --> 01:14:03,573 what Curtis was describing with, you know, having a root password and then 1311 01:14:03,843 --> 01:14:06,483 you know, something at the beginning and something at the end that's helpful, 1312 01:14:06,483 --> 01:14:10,023 especially if it's, if you want the same route password for everything, and then 1313 01:14:10,023 --> 01:14:13,473 you just change the front and the back depending on what you're logging into. 1314 01:14:14,013 --> 01:14:16,353 Uh, that can be troublesome though. 1315 01:14:16,383 --> 01:14:19,443 'cause as a bad guy, I just need two of those to realize that's a pattern 1316 01:14:19,983 --> 01:14:25,563 and I can just kind of guess, uh, what, uh, what, what your bank password 1317 01:14:25,563 --> 01:14:27,153 is if, if I don't have that already. 1318 01:14:27,603 --> 01:14:31,113 Um, so some things to think about. 1319 01:14:31,848 --> 01:14:35,958 Um, you know, if you're logging into your bank, maybe your past phrase is, 1320 01:14:36,348 --> 01:14:42,078 uh, I like getting paid on Friday, and then at the beginning or the end, uh, 1321 01:14:42,288 --> 01:14:44,598 you know, uh, and that makes me happy. 1322 01:14:44,748 --> 01:14:49,248 Or, you know, added emotion or add a, add a color that makes you think 1323 01:14:49,248 --> 01:14:51,318 of, you know, that emo it's blue. 1324 01:14:51,408 --> 01:14:53,238 Uh, I think that's calming, right? 1325 01:14:53,628 --> 01:14:56,598 Uh, and then, and then change up how it felt. 1326 01:14:56,671 --> 01:14:57,721 the way Mike I was gonna 1327 01:14:57,768 --> 01:14:57,978 Green. 1328 01:14:58,008 --> 01:14:58,753 Green is okay. 1329 01:14:58,771 --> 01:14:59,461 for for money 1330 01:14:59,682 --> 01:15:00,012 red. 1331 01:15:01,683 --> 01:15:04,473 So then, you know, do some substitution. 1332 01:15:04,623 --> 01:15:10,233 So instead of, you know, ease, use threes and capitalize, you know, the first 1333 01:15:10,323 --> 01:15:12,873 letter of a word or spell it backwards. 1334 01:15:12,963 --> 01:15:18,213 Um, I had a password and man, long time, 20, 30 years ago, uh, where it 1335 01:15:18,213 --> 01:15:20,073 was, I spelled everything backwards. 1336 01:15:20,523 --> 01:15:21,063 Um. 1337 01:15:22,968 --> 01:15:25,668 So there, there are some unique things that you can do with passwords. 1338 01:15:25,668 --> 01:15:29,988 You just have to figure out which one works for you, uh, and that 1339 01:15:29,988 --> 01:15:31,398 you can be consistent with it. 1340 01:15:31,938 --> 01:15:35,298 The password manager will also help you remember to, it's about time you've 1341 01:15:35,298 --> 01:15:37,398 been using this password for 10 years. 1342 01:15:37,398 --> 01:15:37,698 Now 1343 01:15:39,791 --> 01:15:40,061 Yeah 1344 01:15:40,098 --> 01:15:40,758 time to change it. 1345 01:15:40,841 --> 01:15:44,771 you if you do use it in multiple places right It was like Hey you you've used 1346 01:15:44,771 --> 01:15:49,061 this password elsewhere I'm I'm a big fan of password Brandon I know 1347 01:15:49,171 --> 01:15:51,101 Prasanna You have one right What 1348 01:15:51,907 --> 01:15:54,547 do, should we wait to talk about this on the 1349 01:15:55,001 --> 01:15:58,751 Yeah Yeah you're right You're right you're right Yeah Yeah All right So yeah 1350 01:15:58,751 --> 01:16:04,361 so basically the idea is the the the overall overriding concept is to not use 1351 01:16:04,361 --> 01:16:10,381 the same password anywhere Never use the same password twice And and if you're not 1352 01:16:10,381 --> 01:16:18,161 using some kind of system my method is password manager Um you know the the the 1353 01:16:18,181 --> 01:16:21,931 the one that you talked about Mike the the one where you append it and pre-end 1354 01:16:21,931 --> 01:16:25,621 it with with something and you have this core password that used to be my method 1355 01:16:25,951 --> 01:16:31,021 before I went to a password manager Um and the the you know and then there's there's 1356 01:16:31,021 --> 01:16:38,261 this these other ways to to have it but I I can't ima I have like 500 passwords 1357 01:16:38,261 --> 01:16:45,941 at this point right so I can't imagine um not having uh a password manager at 1358 01:16:45,941 --> 01:16:50,141 this point But so that's that's my way to do that But the core concept is you 1359 01:16:50,141 --> 01:16:54,971 cannot use the same password at multiple places And why is that Mike We we kind 1360 01:16:54,971 --> 01:16:57,431 of alluded it to it uh a few minutes ago 1361 01:16:59,408 --> 01:17:02,018 You remember, we call those coincidental passwords. 1362 01:17:02,768 --> 01:17:05,738 Uh, and and the reason you don't wanna use them in more than one place 1363 01:17:05,738 --> 01:17:09,848 is because you've gotta rely on the security of more than one thing to make 1364 01:17:09,848 --> 01:17:12,278 sure your password isn't compromised. 1365 01:17:12,728 --> 01:17:17,018 And when bad guys compromise one data set, they're gonna use that data set 1366 01:17:17,108 --> 01:17:19,028 across everything they can think of. 1367 01:17:20,083 --> 01:17:24,553 So if I've got one of Curtis's passwords and I know he has 500 accounts out 1368 01:17:24,553 --> 01:17:28,633 there, I'm gonna use that one password to try and log into 499 of those, 1369 01:17:30,516 --> 01:17:31,236 And especially 1370 01:17:31,423 --> 01:17:32,023 could be. 1371 01:17:32,286 --> 01:17:37,146 one username is your email address right So you so you already know my email 1372 01:17:37,146 --> 01:17:41,701 address and you go out there and you use the Password everywhere You know you 1373 01:17:41,701 --> 01:17:45,841 just you don't even need to know where I have the thing You just you just try 1374 01:17:45,841 --> 01:17:49,531 it All the places that you have access and you're and this is a numbers game 1375 01:17:49,531 --> 01:17:53,281 You're trying every every account that you have access to with every password 1376 01:17:53,281 --> 01:17:58,261 you have access to in every place that you have access to the the system Right 1377 01:17:58,651 --> 01:18:00,601 Um so yeah that's why we don't do it 1378 01:18:01,573 --> 01:18:01,793 Yep. 1379 01:18:01,798 --> 01:18:03,298 And, and how do you mitigate that? 1380 01:18:04,051 --> 01:18:06,841 by using the different password in every place Right 1381 01:18:07,163 --> 01:18:08,548 Well, well, how so? 1382 01:18:08,548 --> 01:18:10,588 What if, what if they guess what if they have a password? 1383 01:18:12,228 --> 01:18:16,848 You forgot you used 20 years ago and now there's an account that 1384 01:18:16,998 --> 01:18:18,348 that password's gonna work on. 1385 01:18:18,348 --> 01:18:21,963 How do you mitigate that MFA. 1386 01:18:22,136 --> 01:18:30,491 Oh okay I was I I should have known this answer Dammit Uh yeah So yeah so so MFA 1387 01:18:30,491 --> 01:18:35,441 uh you know is the final thing on our on our on our trifecta of of basic cyber 1388 01:18:35,441 --> 01:18:41,081 hygiene And I and I'll put MFA slash slash um you know pass keys which is like it's 1389 01:18:41,081 --> 01:18:47,111 like the next thing cause we'll as we when we talk about MFA We will mention that 1390 01:18:47,111 --> 01:18:50,801 MFA is not perfect Uh Prasanna's already alluded to it You know there's this thing 1391 01:18:50,801 --> 01:18:55,151 called MFA exhaustion There are there are other issues with it but let's just 1392 01:18:55,151 --> 01:19:02,711 start with what MFA is Um uh Prasanna why don't why don't why don't you define MFA 1393 01:19:02,711 --> 01:19:04,661 What is it you know and how does it work 1394 01:19:05,482 --> 01:19:05,752 Sure. 1395 01:19:05,932 --> 01:19:10,612 So with MFA, it's really, Mike said, someone might compromise your 1396 01:19:10,612 --> 01:19:15,262 password and so it's something you know and something you have, right? 1397 01:19:15,262 --> 01:19:19,252 And so that something you have piece is normally, say your 1398 01:19:19,252 --> 01:19:21,172 biometrics like a fingerprint. 1399 01:19:21,172 --> 01:19:22,582 It could be your face, right? 1400 01:19:22,582 --> 01:19:27,937 It could be a. Electronic token that gets generated periodically 1401 01:19:27,937 --> 01:19:30,037 or some other application, right? 1402 01:19:30,037 --> 01:19:34,957 That generates that such that you have a second factor, which previously was 1403 01:19:34,957 --> 01:19:36,967 called sort of two-factor authentication. 1404 01:19:37,387 --> 01:19:41,032 Right now it's multifactor in order to be able to say, yes, this really is me. 1405 01:19:43,226 --> 01:19:45,091 The most common one I'd say 1406 01:19:48,176 --> 01:19:53,336 I'd say the most common one is probably SMS Um it's definitely not the best 1407 01:19:53,336 --> 01:19:57,266 one uh but it's certainly the most common I think the most common use to 1408 01:19:57,266 --> 01:20:03,566 be email I really don't like email like in good better best It's barely good uh 1409 01:20:03,596 --> 01:20:07,646 because again if you uh if somebody's compromised your email account especially 1410 01:20:07,646 --> 01:20:12,626 if it's the email account that you use for everything right Um SMS is not as 1411 01:20:12,626 --> 01:20:20,446 good because SMSI think SMS is actually better today than it used to be uh it's 1412 01:20:20,446 --> 01:20:26,056 harder to do sim hacking today than it than it used to be uh at least in in 1413 01:20:26,056 --> 01:20:32,416 certain circumstances Um and then but then uh the I think the best one that 1414 01:20:32,416 --> 01:20:37,846 we have today that's available to pretty much everybody is uh an authenticator 1415 01:20:37,846 --> 01:20:39,856 type app You wanna talk about that Mike 1416 01:20:41,308 --> 01:20:41,598 Sure. 1417 01:20:41,808 --> 01:20:47,118 Uh, and, and those apps are generally free, uh, and, and don't require any. 1418 01:20:47,358 --> 01:20:48,438 Infrastructure changes. 1419 01:20:48,438 --> 01:20:53,268 There are some, uh, like duo, uh, that would require some licensing and set up 1420 01:20:53,268 --> 01:20:55,518 on the inside of, uh, your organization. 1421 01:20:56,028 --> 01:20:59,508 Um, but others like the Microsoft Authenticator app, uh, 1422 01:20:59,538 --> 01:21:01,458 Google has one, they're free. 1423 01:21:01,458 --> 01:21:02,748 You just get 'em in the play store. 1424 01:21:02,748 --> 01:21:08,268 And then whenever you want to register your multifactor with a vendor, a 1425 01:21:08,268 --> 01:21:12,918 lot of times there's like a QR code or a set up your account this way. 1426 01:21:13,398 --> 01:21:13,938 Um. 1427 01:21:14,913 --> 01:21:19,173 Similar to a password manager, you would log into your authenticator app and it 1428 01:21:19,173 --> 01:21:24,213 would show all your different accounts, uh, which you could revoke or delete if 1429 01:21:24,213 --> 01:21:25,773 you think that's compromised as well. 1430 01:21:25,773 --> 01:21:28,683 So you can manage it that way, but pretty, pretty straightforward. 1431 01:21:28,953 --> 01:21:32,853 And, you know, MFA, uh, 1432 01:21:35,253 --> 01:21:39,753 um, fatigue, MFA fatigue is a real thing. 1433 01:21:40,233 --> 01:21:42,723 It's more of a. It's just annoyance. 1434 01:21:43,323 --> 01:21:47,463 Uh, so you log into something and you, oh, I've gotta wait for my phone to ding. 1435 01:21:47,463 --> 01:21:52,983 Now what if, what if you don't have cell phone coverage or data, 1436 01:21:53,253 --> 01:21:54,963 uh, you know, wireless data? 1437 01:21:55,563 --> 01:21:59,823 Um, a lot of these authenticator apps also allow you to save. 1438 01:22:00,243 --> 01:22:04,563 Backup codes, um, things like, so there's, there's any number of ways 1439 01:22:04,563 --> 01:22:06,753 of, of using what works for you. 1440 01:22:07,263 --> 01:22:12,033 Um, the important thing is to figure out something other than email, um, for your 1441 01:22:12,033 --> 01:22:18,063 MFA if, if the, the account that you're wanting to apply MFA to will support it. 1442 01:22:19,867 --> 01:22:24,817 And Mike, I know on a previous podcast you sort of mentioned one of the 1443 01:22:24,817 --> 01:22:27,547 downsides with many websites, right? 1444 01:22:27,577 --> 01:22:30,577 Which have MFA, and then they sort of have the remember me 1445 01:22:30,577 --> 01:22:32,437 next time on this thing, right? 1446 01:22:34,968 --> 01:22:35,298 Right. 1447 01:22:35,298 --> 01:22:40,938 So it, it's, it's whether it's a website like, um, I don't know, 1448 01:22:42,606 --> 01:22:44,426 Amazon I was gonna 1449 01:22:44,493 --> 01:22:45,303 Amazon, right? 1450 01:22:45,656 --> 01:22:46,076 yeah 1451 01:22:46,233 --> 01:22:52,173 either one of those, there is a, remember, it's, it's, remember this device, um, 1452 01:22:52,773 --> 01:22:56,613 you don't want to do that because your MFA token is then stored in your browser. 1453 01:22:57,453 --> 01:23:02,283 And so now a bad guy just asked to get you to a position or a situation where I can 1454 01:23:02,403 --> 01:23:07,143 scrape that MFA token out of your browser if I already have your credentials. 1455 01:23:07,473 --> 01:23:11,703 The only thing I need now is your MFA token, and now 1456 01:23:11,703 --> 01:23:12,813 I can get into your account. 1457 01:23:14,058 --> 01:23:14,568 So 1458 01:23:16,938 --> 01:23:22,698 I was gonna say, so MFA good MFA has to come with good policy and good practice. 1459 01:23:23,921 --> 01:23:28,361 So the the the point of this episode here is just to just if you're not familiar 1460 01:23:28,361 --> 01:23:33,371 with any of those three things go get familiar Um and the best way to do that 1461 01:23:33,371 --> 01:23:41,741 is to uh log in next week and we'll cover each of these in detail Um but uh You 1462 01:23:41,741 --> 01:23:45,821 know the idea between behind MFA is that if somebody gets a hold of your password 1463 01:23:46,091 --> 01:23:49,211 they won't be able to log in because they don't have that additional factor 1464 01:23:49,211 --> 01:23:54,731 whatever it is whether it's SMS or or um you know an authenticator app or a token 1465 01:23:54,731 --> 01:24:00,941 right We'll talk about these more and and all of those and passwords and MFA have 1466 01:24:00,971 --> 01:24:05,741 limitations and those limitations are us right It's the human and that's why 1467 01:24:05,741 --> 01:24:10,961 I think pass keys is the better option As we move forward in the future and I 1468 01:24:11,021 --> 01:24:19,451 I've been rolling out Pasky uh in many places wherever I can Uh it I'm not sure 1469 01:24:19,451 --> 01:24:30,431 if if it's great for like the average Joe there it can be confusing Um PAs 1470 01:24:30,431 --> 01:24:35,501 keys can be confusing if you don't if you don't know what you're doing But um but I 1471 01:24:35,718 --> 01:24:37,068 Did you ever use iron keys? 1472 01:24:37,188 --> 01:24:37,698 Curtis? 1473 01:24:38,261 --> 01:24:40,626 Uh what's a iron key 1474 01:24:41,778 --> 01:24:50,988 So an iron key is a, it's a military grade USB, and uh, in it, it's 1475 01:24:50,988 --> 01:24:53,083 got its own, you know, TPM chip. 1476 01:24:53,943 --> 01:24:57,873 Its own encryption, its own password manager, its own MFA. 1477 01:24:58,563 --> 01:25:04,008 And if you log into it, I think it's 20 times wrong, it self-destructs, 1478 01:25:04,233 --> 01:25:05,673 it's got a little capacitor in it. 1479 01:25:06,093 --> 01:25:11,223 It like, it'll smoke, uh, and if you try to cut into it to get to the chips, it's 1480 01:25:11,223 --> 01:25:13,233 also got a sensor and will self-destruct. 1481 01:25:14,306 --> 01:25:14,576 Yeah 1482 01:25:14,853 --> 01:25:15,848 Yeah, it's pretty cool. 1483 01:25:16,016 --> 01:25:18,506 that, but doesn't surprise me that you probably have. 1484 01:25:18,986 --> 01:25:23,156 Um, but anyway, so the, again, this is meant to be an overview episode. 1485 01:25:23,186 --> 01:25:27,686 Um, and if some of this was, was confusing or frustrating or you 1486 01:25:27,686 --> 01:25:31,436 felt like we didn't go into detail enough, then just, uh, we're gonna do 1487 01:25:31,436 --> 01:25:34,946 three more episodes where we go into each of these, uh, in more detail. 1488 01:25:36,086 --> 01:25:37,046 but it just. 1489 01:25:37,811 --> 01:25:39,701 You know, start looking into these three things. 1490 01:25:39,701 --> 01:25:42,131 Password man, regular password management. 1491 01:25:42,341 --> 01:25:43,961 I'm gonna start with that Inventory, right? 1492 01:25:43,961 --> 01:25:46,691 Make sure you have an inventory of everything, both your physical, your 1493 01:25:46,691 --> 01:25:48,731 virtual, and your, and your cloud systems. 1494 01:25:48,731 --> 01:25:49,121 What, 1495 01:25:49,147 --> 01:25:50,287 Wait, you said 1496 01:25:50,321 --> 01:25:50,711 what? 1497 01:25:51,037 --> 01:25:52,057 You meant patch management? 1498 01:25:53,021 --> 01:25:53,741 Oh, did I say that? 1499 01:25:53,741 --> 01:25:54,071 Okay. 1500 01:25:54,251 --> 01:25:54,641 All right. 1501 01:25:56,051 --> 01:25:59,171 So again, uh, you know, summary here, we've got three things here, right? 1502 01:25:59,171 --> 01:26:02,441 Make sure you're doing pa uh, uh, patch management, right? 1503 01:26:02,471 --> 01:26:05,051 Uh, that some sort of automated system. 1504 01:26:05,081 --> 01:26:07,721 Uh, and, and we're gonna start with an inventory, right? 1505 01:26:07,721 --> 01:26:11,681 A physical inventory, a virtual inventory, and a, an a SaaS inventory 1506 01:26:11,891 --> 01:26:14,891 of your entire environment to make sure that you know what it is you're 1507 01:26:14,891 --> 01:26:16,121 supposed to be looking out after. 1508 01:26:16,391 --> 01:26:18,881 You're gonna have a good password manager and you're gonna have good. 1509 01:26:18,926 --> 01:26:22,916 Um, you're gonna have an MFA or you're gonna have a, a passkey based system. 1510 01:26:23,336 --> 01:26:29,216 Uh, because, uh, without these three things, no point in having, you know, like 1511 01:26:29,216 --> 01:26:35,426 looking into an EEDM or, uh, I'm sorry, EDM looking into A EDR or an XDR system. 1512 01:26:35,696 --> 01:26:39,956 Um, and, um, you know, or, or you know, any, any of the other stuff 1513 01:26:39,956 --> 01:26:44,006 that we're talking about because it's like looking into a Roth IRA if you 1514 01:26:44,006 --> 01:26:45,266 don't even have a savings account. 1515 01:26:45,686 --> 01:26:46,046 Right. 1516 01:26:46,076 --> 01:26:50,436 Um, so, With that, uh, any final thoughts, Mike? 1517 01:26:52,625 --> 01:26:54,178 Doing something's better than nothing. 1518 01:26:55,188 --> 01:26:55,998 one of these and 1519 01:26:56,796 --> 01:26:57,186 yeah, 1520 01:26:57,318 --> 01:26:58,278 do something about it. 1521 01:26:58,686 --> 01:26:59,256 absolutely. 1522 01:26:59,256 --> 01:27:00,086 What about you, Prasanna 1523 01:27:01,412 --> 01:27:04,177 Well, I think the three makes sense and hopefully everyone 1524 01:27:04,177 --> 01:27:05,197 is using a password manage. 1525 01:27:05,497 --> 01:27:05,797 There. 1526 01:27:06,906 --> 01:27:07,236 I'm, 1527 01:27:07,248 --> 01:27:09,108 I've got a story about password management. 1528 01:27:09,171 --> 01:27:10,056 Please, please, 1529 01:27:10,068 --> 01:27:16,823 we were doing a, a red team on a, a brick and mortar nationwide retail. 1530 01:27:17,437 --> 01:27:17,857 Sorry. 1531 01:27:17,981 --> 01:27:18,281 Yeah. 1532 01:27:18,397 --> 01:27:21,277 we save this for the actual password manager episode? 1533 01:27:23,201 --> 01:27:23,651 Yeah, maybe 1534 01:27:23,853 --> 01:27:25,323 Sure it is a password 1535 01:27:25,871 --> 01:27:26,471 besides 1536 01:27:26,493 --> 01:27:27,063 management. 1537 01:27:27,191 --> 01:27:27,971 it's so weird. 1538 01:27:27,971 --> 01:27:32,561 The, the, the, the thing came on there for about 30 seconds and then went off again, 1539 01:27:33,311 --> 01:27:34,611 and you don't hear anything on your end. 1540 01:27:35,848 --> 01:27:37,023 Nothing changes here. 1541 01:27:37,023 --> 01:27:38,583 It's completely quiet in this room. 1542 01:27:40,256 --> 01:27:41,276 That's so weird. 1543 01:27:42,356 --> 01:27:45,386 Uh, a, it's a, what do they call it? 1544 01:27:45,386 --> 01:27:47,876 It's ghost and Shell, um, all right. 1545 01:27:48,746 --> 01:27:49,916 Uh, all right. 1546 01:27:50,182 --> 01:27:51,742 that up is 'cause we're already at 48 minutes. 1547 01:27:51,742 --> 01:27:52,192 So, 1548 01:27:52,286 --> 01:27:53,066 Yeah, yeah, yeah. 1549 01:27:53,246 --> 01:27:56,336 Well, we're gonna cut, we're gonna cut some of this out pretty much 1550 01:27:56,366 --> 01:27:57,626 half the time that Mike talks. 1551 01:27:57,626 --> 01:27:58,256 We're just cut it out. 1552 01:27:59,066 --> 01:27:59,426 anyway. 1553 01:28:01,721 --> 01:28:02,981 All right, Prasanna Thanks. 1554 01:28:03,131 --> 01:28:05,261 Thanks for, uh, being here again as well. 1555 01:28:05,291 --> 01:28:05,831 Forever. 1556 01:28:05,842 --> 01:28:08,107 and look, see I shaved, just so you know. 1557 01:28:08,141 --> 01:28:09,101 Yeah, absolutely. 1558 01:28:09,221 --> 01:28:09,851 Absolutely. 1559 01:28:10,151 --> 01:28:10,481 Alright. 1560 01:28:10,481 --> 01:28:12,971 Actually, I, I don't know if anybody can tell, but I, I had 1561 01:28:12,971 --> 01:28:14,201 my, I had my beard trimmed. 1562 01:28:14,231 --> 01:28:17,111 I had a photo op yesterday, so it, my beard's all nice and trimmed. 1563 01:28:17,111 --> 01:28:24,821 So anyway, or as my granddaughter said, slay Um, and that is a wrap. 1564 01:28:26,411 --> 01:28:27,191 Why do I stop? 1565 01:28:27,986 --> 01:28:28,276 Okay. 1566 01:28:30,295 --> 01:28:35,095 Most ransomware attacks succeed for one reason, somebody skipped the 1567 01:28:35,095 --> 01:28:40,805 basics, patch management, password management, MFA or pass keys. 1568 01:28:41,285 --> 01:28:46,305 These three things, do those right and you stop roughly 90% of the attacks. 1569 01:28:46,925 --> 01:28:50,605 This week, Dr. Mike Saylor, uh, Prasanna and I walk through each 1570 01:28:50,605 --> 01:28:54,795 one, what it is, why it matters, and what happens when you ignore it. 1571 01:28:54,905 --> 01:28:56,545 Things like WannaCry, Rackspace. 1572 01:28:56,865 --> 01:29:00,665 These, uh, stories are all real, and the lesson is the same every time. 1573 01:29:01,035 --> 01:29:02,325 The basics weren't done. 1574 01:29:02,745 --> 01:29:08,025 You don't need a massive budget or a fancy security stack to stop most hackers. 1575 01:29:08,395 --> 01:29:10,315 You just need to do the boring stuff. 1576 01:29:10,415 --> 01:29:13,575 Here we turn admins into cyber recovery heroes. 1577 01:29:13,885 --> 01:29:15,705 This is the Backup Wrap Up 1578 01:29:20,448 --> 01:29:20,838 All right. 1579 01:29:21,108 --> 01:29:21,768 Um, 1580 01:29:26,478 --> 01:29:27,768 Welcome to the backup wrap up. 1581 01:29:27,768 --> 01:29:32,028 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have a, with 1582 01:29:32,028 --> 01:29:37,908 me, a guy who apparently shaved last week and I didn't even notice. 1583 01:29:37,918 --> 01:29:38,388 Prasanna 1584 01:29:38,408 --> 01:29:38,558 Prasanna 1585 01:29:38,788 --> 01:29:39,833 Malaiyandi how's it going? 1586 01:29:39,843 --> 01:29:40,323 Prasanna 1587 01:29:41,079 --> 01:29:42,074 I am good Curtis. 1588 01:29:42,074 --> 01:29:42,374 Yeah. 1589 01:29:42,374 --> 01:29:46,754 Uh, my wife was very surprised after the podcast recording when 1590 01:29:46,754 --> 01:29:48,614 she was like, did Curtis notice? 1591 01:29:49,664 --> 01:29:52,544 of course, I. I texted you and you're like, no, or no, I think 1592 01:29:52,623 --> 01:29:53,103 No. 1593 01:29:53,114 --> 01:29:55,724 on the phone and you're like, no, what are you talking about? 1594 01:29:55,724 --> 01:29:56,954 And I had to send you a picture, 1595 01:29:57,723 --> 01:29:58,173 Yeah. 1596 01:29:58,233 --> 01:30:01,683 And, and apparently Mike, Mike didn't notice either, so I feel 1597 01:30:01,683 --> 01:30:03,963 somewhat better, but, uh, yeah. 1598 01:30:03,963 --> 01:30:06,603 So you, you, you've gone down to the goatee, 1599 01:30:07,094 --> 01:30:07,304 Yep. 1600 01:30:07,353 --> 01:30:09,333 um, and, um. 1601 01:30:09,374 --> 01:30:11,209 many, many years since I've done this. 1602 01:30:11,989 --> 01:30:12,209 Pre 1603 01:30:12,303 --> 01:30:14,193 I've seen a picture of you with the goatee. 1604 01:30:14,283 --> 01:30:14,613 Yeah. 1605 01:30:14,613 --> 01:30:16,083 Pre, yeah, yeah, yeah. 1606 01:30:17,343 --> 01:30:20,163 I think you should go back to your cut from college. 1607 01:30:20,253 --> 01:30:21,063 That's what I think. 1608 01:30:21,843 --> 01:30:22,353 The buzz. 1609 01:30:22,443 --> 01:30:23,283 The buzz cut. 1610 01:30:23,403 --> 01:30:23,943 Yeah. 1611 01:30:24,063 --> 01:30:24,513 Yeah. 1612 01:30:24,603 --> 01:30:26,553 I, I'd love to see you in the buzz cut again. 1613 01:30:27,655 --> 01:30:28,135 Walked away. 1614 01:30:28,353 --> 01:30:32,703 but, uh, anyway, speaking of buzz cuts, Dr. Mike Sailor, how's it going, Mike? 1615 01:30:34,450 --> 01:30:35,590 Going Good guys. 1616 01:30:36,160 --> 01:30:36,910 It's going good. 1617 01:30:37,338 --> 01:30:37,848 All right. 1618 01:30:37,848 --> 01:30:42,408 So he of course, is the co-author on, uh, uh, learning Ransomware Response 1619 01:30:42,408 --> 01:30:44,298 and Recovery, which came out last month. 1620 01:30:44,568 --> 01:30:46,788 Which, uh, do you have one with you now? 1621 01:30:46,848 --> 01:30:48,588 Did you, did you prepare this time? 1622 01:30:49,705 --> 01:30:50,980 I did not prepare this time. 1623 01:30:51,168 --> 01:30:58,038 me Mike I have yet I still don't have mine and I have yet to actually see the a 1624 01:30:58,038 --> 01:31:02,958 physical printed book even like a video of a physical printed book with with you know 1625 01:31:02,999 --> 01:31:05,399 The book is gonna be the size of the thing in your background? 1626 01:31:05,399 --> 01:31:06,029 Curtis? 1627 01:31:06,828 --> 01:31:11,478 yeah I I would dear Lord dear Lord I hope not And you know what's funny is like 1628 01:31:11,478 --> 01:31:17,268 in on the camera this thing looks fine but this is this is like this far back 1629 01:31:17,268 --> 01:31:23,568 from me right And so this thing is like I think it's 15 by 24 That thing is massive 1630 01:31:23,958 --> 01:31:26,658 Um so yeah I sure I surely hope not 1631 01:31:27,104 --> 01:31:27,644 For those 1632 01:31:27,678 --> 01:31:28,098 but 1633 01:31:28,154 --> 01:31:32,174 watch us on YouTube, uh, we do have videos out, but Curtis was just pointing at 1634 01:31:32,534 --> 01:31:35,804 the, what do you call it, the title page? 1635 01:31:35,804 --> 01:31:36,614 The front 1636 01:31:36,963 --> 01:31:42,273 It's the cover the front cover Yeah yeah yeah And uh available at uh 1637 01:31:44,523 --> 01:31:48,213 So or you can order them directly from O'Reilly for the record if you order 1638 01:31:48,213 --> 01:31:55,808 directly from O'Reilly Mike and I make more um So uh there's that All right uh 1639 01:31:55,838 --> 01:32:00,818 we're gonna talk so we're gonna jump into this week we're gonna talk about the title 1640 01:32:01,148 --> 01:32:04,238 It's gonna sound I I you know I never know exactly what the title's gonna be but it's 1641 01:32:04,238 --> 01:32:09,668 gonna be something along the lines of stop 90 of the ransomware attacks that could 1642 01:32:09,668 --> 01:32:15,493 possibly happen to you That's a really long title but um I I I you know it may 1643 01:32:15,493 --> 01:32:19,903 sound like a bold claim but I I think it's pretty straightforward And Mike uh I'd 1644 01:32:19,903 --> 01:32:22,003 like to start out this week What's that 1645 01:32:22,324 --> 01:32:22,714 before, you 1646 01:32:22,753 --> 01:32:23,173 Yeah 1647 01:32:23,284 --> 01:32:24,574 can I make a bold claim? 1648 01:32:25,573 --> 01:32:26,203 claim 1649 01:32:27,034 --> 01:32:27,184 A 1650 01:32:27,373 --> 01:32:27,943 please 1651 01:32:29,044 --> 01:32:32,794 That you can stop a hundred percent of ransomware if you 1652 01:32:32,794 --> 01:32:33,529 never do anything online. 1653 01:32:38,053 --> 01:32:38,563 Um 1654 01:32:38,765 --> 01:32:42,575 not, I think there's still some, some, some room there for infection. 1655 01:32:43,525 --> 01:32:44,065 sorry. 1656 01:32:44,498 --> 01:32:48,588 Well you know like if you if you if they do the um the drop you know the 1657 01:32:48,618 --> 01:32:53,058 the one that we covered in the in the uh what do you call it Um when we did 1658 01:32:53,118 --> 01:32:55,548 the MR Robot remember the drop USB stick 1659 01:32:55,699 --> 01:32:56,279 Oh, that's 1660 01:32:56,335 --> 01:32:57,235 Tchotchke drops. 1661 01:32:57,798 --> 01:32:58,773 Yeah What what's that 1662 01:32:58,899 --> 01:32:59,534 you win. 1663 01:33:00,265 --> 01:33:01,855 We call 'em tchotchke drops. 1664 01:33:01,893 --> 01:33:09,213 Tchotchke drops Yeah Yeah So even then um um but what what is this what is 1665 01:33:09,213 --> 01:33:13,053 this not do things online thing that you're talking about I don't know what 1666 01:33:13,053 --> 01:33:15,303 in the world Like I I don't even know 1667 01:33:16,090 --> 01:33:18,280 Like saying you can't get sick if you don't go outside. 1668 01:33:18,370 --> 01:33:19,160 Well, that's not true either. 1669 01:33:19,713 --> 01:33:24,723 yeah Exactly all right Mike well do we do you have a story to 1670 01:33:24,723 --> 01:33:25,863 start us out with this week I 1671 01:33:27,415 --> 01:33:27,955 I do. 1672 01:33:28,045 --> 01:33:32,095 Um, well man, there's so many to pick from, but, um, from the book, 1673 01:33:32,095 --> 01:33:33,565 you know, we talk about WannaCry. 1674 01:33:34,105 --> 01:33:38,905 Um, and similar to, to kinda what we touched on here, good hygiene 1675 01:33:38,905 --> 01:33:40,645 can prevent a lot of stuff. 1676 01:33:41,035 --> 01:33:45,415 And I think WannaCry is an example of bad guys identified of a 1677 01:33:45,415 --> 01:33:46,735 vulnerability that was out there. 1678 01:33:46,735 --> 01:33:47,515 They created a. 1679 01:33:48,265 --> 01:33:51,835 Uh, a payload and a, and an attack vector to take advantage of that, 1680 01:33:52,105 --> 01:33:57,175 realizing that, uh, there's a, a very large percentage of, uh, company and 1681 01:33:57,175 --> 01:34:03,295 organization populations that don't have a, a solid patch management program or, 1682 01:34:03,565 --> 01:34:07,105 uh, that it, it's pretty lax, you know, there's a lot of organizations that, 1683 01:34:07,105 --> 01:34:11,005 that say we have a patch program, but it's, you know, 2, 3, 4 months behind, 1684 01:34:11,365 --> 01:34:14,545 or it's gotta meet certain criteria and some things never get patched. 1685 01:34:15,145 --> 01:34:16,795 Well, that's what happened with WannaCry. 1686 01:34:16,923 --> 01:34:17,103 Well 1687 01:34:17,245 --> 01:34:18,325 found a vulnerability, 1688 01:34:18,363 --> 01:34:22,743 for those of us yeah For those of us that that you know haven't lived uh the 1689 01:34:22,743 --> 01:34:27,573 the cyber world Why don't you tell us what was want Tory What you know did it 1690 01:34:27,573 --> 01:34:30,303 did it make you want to cry Is that why it was called that And what you know 1691 01:34:30,303 --> 01:34:32,223 when did it happen and you know what 1692 01:34:32,429 --> 01:34:32,729 I was 1693 01:34:32,755 --> 01:34:34,195 I think there was about 200,000, 1694 01:34:34,619 --> 01:34:34,859 Yeah. 1695 01:34:34,919 --> 01:34:35,039 I. 1696 01:34:35,125 --> 01:34:37,525 200,000 people crying in unison, 1697 01:34:38,038 --> 01:34:38,528 exactly 1698 01:34:38,635 --> 01:34:39,740 uh, with WannaCry. 1699 01:34:40,739 --> 01:34:44,609 I was going to say Curtis, that because there have been so many of these 1700 01:34:44,729 --> 01:34:48,149 attacks over the years, it's also hard to keep like, which keep it straight 1701 01:34:48,149 --> 01:34:49,859 in terms of like which one was which. 1702 01:34:50,598 --> 01:34:53,683 Yeah Yeah So why don't you tell us the story of WannaCry Mike 1703 01:34:55,045 --> 01:35:00,745 WannaCry, uh, was developed, uh, to take advantage of a vulnerability in 1704 01:35:01,345 --> 01:35:04,945 SMB or a, uh, a Windows, uh, service. 1705 01:35:05,515 --> 01:35:06,025 Um. 1706 01:35:06,535 --> 01:35:07,435 That had a patch. 1707 01:35:07,435 --> 01:35:08,965 So Microsoft came out with a patch. 1708 01:35:09,025 --> 01:35:12,865 So it was several months later that the malware, this 1709 01:35:12,865 --> 01:35:14,425 attack vector really came out. 1710 01:35:14,515 --> 01:35:17,485 Um, and it was all of those organizations that did not 1711 01:35:17,485 --> 01:35:20,395 apply that critical, uh, patch. 1712 01:35:20,395 --> 01:35:23,845 And if, if, uh, if you were paying attention at all, you probably got 1713 01:35:23,845 --> 01:35:26,070 an email from Microsoft saying, you really need to patch this. 1714 01:35:27,010 --> 01:35:28,360 This, uh, this vulnerability. 1715 01:35:28,810 --> 01:35:33,640 Um, or you've got automatic patches turned off, uh, which is common too. 1716 01:35:33,670 --> 01:35:36,310 'cause a lot of organizations don't want to automatically apply 1717 01:35:36,310 --> 01:35:39,940 patches to production systems and have them reboot and cause issues. 1718 01:35:39,940 --> 01:35:44,380 But nonetheless, bad guys found a vulnerability, took advantage of it 1719 01:35:46,330 --> 01:35:48,130 several months after the fact even, 1720 01:35:48,243 --> 01:35:48,633 yeah And 1721 01:35:48,640 --> 01:35:48,760 and. 1722 01:35:48,783 --> 01:35:50,973 how many people were impacted 1723 01:35:52,240 --> 01:35:59,170 Well, um, not, not necessarily people, but sy well over 200,000 systems 1724 01:35:59,170 --> 01:36:01,390 were, were infected with WannaCry. 1725 01:36:02,073 --> 01:36:06,303 That's that's quite a bit that hint your comment earlier 200,000 people all crying 1726 01:36:06,303 --> 01:36:14,358 out at once Just like in just like in uh what do you call it Uh star Wars I I'm 1727 01:36:14,410 --> 01:36:14,920 Yes, 1728 01:36:14,988 --> 01:36:22,728 a Star Wars reference Um okay Alright but like and the thing is this is yet this 1729 01:36:22,728 --> 01:36:33,563 is one of many many examples of hacks of attacks that had the um uh victims of 1730 01:36:33,563 --> 01:36:41,963 the attack practiced basic cyber hygiene They would not have um been they they 1731 01:36:41,963 --> 01:36:45,773 would not have been victimized by this attack Does that sound is that about right 1732 01:36:47,025 --> 01:36:49,365 Good, good chance they would not have been a victim. 1733 01:36:49,365 --> 01:36:49,785 Yes. 1734 01:36:49,793 --> 01:36:50,723 Yeah yeah 1735 01:36:50,895 --> 01:36:55,575 The, the, the only, the only, the only caveat that is that Ry is one of those 1736 01:36:56,505 --> 01:36:59,145 ransomware malware that was also a worm. 1737 01:36:59,483 --> 01:36:59,903 mm 1738 01:36:59,985 --> 01:37:04,875 so as it infected a, a machine, uh, it's worm like behavior was what? 1739 01:37:05,115 --> 01:37:05,715 Uh. 1740 01:37:06,295 --> 01:37:09,775 What led itself to propagate in kind of an al alternative method. 1741 01:37:09,775 --> 01:37:13,525 So if you weren't vulnerable to the SMB with Microsoft, you might've been 1742 01:37:13,525 --> 01:37:16,825 vulnerable some other way that this, uh, this worm was able to compromise you. 1743 01:37:17,433 --> 01:37:27,183 Okay Okay yeah when when I think back on uh my history I I think back um to shit 1744 01:37:28,113 --> 01:37:29,613 um what's the name of the company The 1745 01:37:32,148 --> 01:37:36,498 The one that uh Thank you Thank you Thank you Um I think back to 1746 01:37:36,498 --> 01:37:38,503 the that was what two years ago 1747 01:37:39,174 --> 01:37:39,974 I think it was two years ago. 1748 01:37:39,974 --> 01:37:40,134 Yeah. 1749 01:37:40,578 --> 01:37:45,738 Yeah Yeah I think back to the Rackspace hack because that was one where again 1750 01:37:45,738 --> 01:37:52,848 it was a patch There was a patch to the vulnerability in Microsoft Exchange that 1751 01:37:52,908 --> 01:37:58,818 uh again had Rackspace simply applied that patch they would not have been uh subject 1752 01:37:58,818 --> 01:38:04,248 to this this particular attack And in this case there was um was a workaround 1753 01:38:04,938 --> 01:38:08,148 there was a there was a vulnerability And then there was a workaround to the 1754 01:38:08,148 --> 01:38:13,038 vulnerability while they were waiting on the patch But what happened is there was 1755 01:38:13,068 --> 01:38:19,638 a um an undisclosed a zero day additional vulnerability that if they had they 1756 01:38:19,638 --> 01:38:25,188 had applied the patch to fix the first the first vulnerability they would have 1757 01:38:25,188 --> 01:38:32,313 been they would not have been subject to the to the zero day exploit um But they 1758 01:38:32,313 --> 01:38:38,013 said to themselves uh this is my theory uh is that they said well we we put 1759 01:38:38,013 --> 01:38:43,203 in the workaround And so therefore the criticality of this patch was not um you 1760 01:38:43,203 --> 01:38:48,243 know it wasn't as critical And so they didn't put in the patch yet And two weeks 1761 01:38:48,303 --> 01:38:53,833 uh after the You know this exploit came out Um they they were attacked and that 1762 01:38:53,833 --> 01:39:00,373 cost them entire business line Right Um because they had to um they had to stop 1763 01:39:01,723 --> 01:39:05,473 and it there was a there was lawsuits It was it was it was it was very very messy 1764 01:39:07,063 --> 01:39:13,543 so let's talk about when we talk about uh cyber hygiene Um do you know do you want 1765 01:39:13,543 --> 01:39:15,853 to do you wanna just define that uh Mike 1766 01:39:17,305 --> 01:39:17,700 I will. 1767 01:39:17,700 --> 01:39:19,470 And if, if I could back up just a minute. 1768 01:39:19,500 --> 01:39:22,590 'cause you made a, a, a comment about mitigation, so we weren't 1769 01:39:22,590 --> 01:39:26,280 able to apply the patch for whatever reason, so we mitigated the risk. 1770 01:39:26,478 --> 01:39:26,828 Right 1771 01:39:26,940 --> 01:39:30,060 Well, something that I think is critically important for people to 1772 01:39:30,060 --> 01:39:34,620 consider when we talk about mitigation, and this comes from my, my audit. 1773 01:39:34,870 --> 01:39:39,010 My audit life, uh, where, where I had to go and determine if people were 1774 01:39:39,010 --> 01:39:42,160 following the rules, whether it was hygiene or we also called them, uh, 1775 01:39:42,190 --> 01:39:44,050 general controls or best practices. 1776 01:39:44,590 --> 01:39:47,620 If they weren't, then they had to demonstrate what they were 1777 01:39:47,620 --> 01:39:49,390 doing to mitigate the risk. 1778 01:39:49,690 --> 01:39:55,900 Presented by the absence of doing what we expected and the audit guidance and 1779 01:39:55,900 --> 01:39:59,590 what we would tell people and what people should consider is that your mitigation 1780 01:39:59,590 --> 01:40:01,900 strategy should be more effective. 1781 01:40:02,740 --> 01:40:05,020 Had you done it the right way to begin with. 1782 01:40:05,348 --> 01:40:05,568 Hmm 1783 01:40:06,359 --> 01:40:06,449 a 1784 01:40:06,580 --> 01:40:10,330 So if the control says, do one, two, and three, and you say, I can't 1785 01:40:10,330 --> 01:40:14,920 do one, two, and three, well, you better do 4, 5, 6, 7, 8, 9, and 10. 1786 01:40:15,940 --> 01:40:21,790 Your mitigation needs to be stronger than the original control or activity. 1787 01:40:22,379 --> 01:40:22,679 which 1788 01:40:22,913 --> 01:40:23,193 Interesting 1789 01:40:24,299 --> 01:40:29,729 But I guess in your experience, Mike, how often were people 1790 01:40:29,789 --> 01:40:31,344 able to meet that higher bar? 1791 01:40:33,310 --> 01:40:37,060 Well, if you were a regulated organization, you had to, or you failed. 1792 01:40:37,484 --> 01:40:38,114 Or, or I 1793 01:40:38,260 --> 01:40:38,500 Yep. 1794 01:40:38,624 --> 01:40:42,614 often would they just say four, five and six, seven are two difficult. 1795 01:40:42,794 --> 01:40:44,564 Let me just go back and implement one, two, and three. 1796 01:40:46,795 --> 01:40:49,315 Never, never did they do that. 1797 01:40:49,945 --> 01:40:52,735 Uh, so they either so and, and it, and. 1798 01:40:54,490 --> 01:40:55,750 With a grain of salt, obviously. 1799 01:40:55,750 --> 01:41:00,490 So I was, I was a technology auditor, so I was auditing it people, it people that 1800 01:41:00,490 --> 01:41:02,200 generally don't run the business, right? 1801 01:41:02,200 --> 01:41:05,800 They're being, they're given direction from the business of, you know, we 1802 01:41:05,800 --> 01:41:09,610 can't fix that thing because our website will stop working or it'll be down 1803 01:41:09,610 --> 01:41:11,080 too long, we'll lose too much money. 1804 01:41:11,080 --> 01:41:15,790 So businesses directing the technology, uh. 1805 01:41:16,255 --> 01:41:19,495 Um, you know, groups and, and infrastructure of, of 1806 01:41:19,495 --> 01:41:21,265 what they can and can't do. 1807 01:41:21,865 --> 01:41:25,855 And so when, when you talk to them about, well, you, you couldn't do 1808 01:41:25,855 --> 01:41:30,535 one, two, and three, so, because it'll break things or for whatever reason. 1809 01:41:30,535 --> 01:41:32,395 So what are you doing? 1810 01:41:32,395 --> 01:41:33,865 Well, we're doing four, five, and six. 1811 01:41:33,865 --> 01:41:35,965 Well, four, five and six are kind of, okay. 1812 01:41:36,025 --> 01:41:39,655 I'm gonna say that's maybe effective with opportunity for improvement. 1813 01:41:40,105 --> 01:41:43,735 Uh, or they, they, they're doing a whole lot or they're not doing 1814 01:41:43,735 --> 01:41:45,115 really anything because they. 1815 01:41:45,625 --> 01:41:46,345 They didn't know. 1816 01:41:46,735 --> 01:41:48,325 And so those are the really, the three options. 1817 01:41:48,325 --> 01:41:50,545 You, you fail 'cause you didn't do what you were supposed to 1818 01:41:50,545 --> 01:41:54,055 and you weren't mitigating it or mitigating it effectively. 1819 01:41:54,235 --> 01:41:56,635 You were mitigating it somewhat effectively, but I 1820 01:41:56,635 --> 01:41:57,925 think it could be stronger. 1821 01:41:58,045 --> 01:42:02,305 And that's from a, an auditor's perspective, there is that kind of, uh, 1822 01:42:02,335 --> 01:42:04,945 latitude where I can, I can add some. 1823 01:42:05,605 --> 01:42:09,295 Objectivity, um, or I say subjectivity. 1824 01:42:09,745 --> 01:42:14,035 Uh, and then lastly, wow, you, you really, you really are, you really do understand 1825 01:42:14,035 --> 01:42:15,565 that mitigation's gotta be stronger. 1826 01:42:15,565 --> 01:42:17,455 And, and, but that's, that's rare. 1827 01:42:17,485 --> 01:42:21,115 Very rarely did I see the mitigating controls more effective 1828 01:42:21,115 --> 01:42:22,765 than the, the original controls. 1829 01:42:23,358 --> 01:42:29,253 I'm glad that you you mentioned um the the the the the comment that you made 1830 01:42:29,883 --> 01:42:34,803 I is one that we make a lot from the opposite side and that is the backup 1831 01:42:34,803 --> 01:42:41,193 People should never be setting policy They should never be determining you know 1832 01:42:41,193 --> 01:42:47,613 retention periods uh RTOs and RPOs Uh you know that that should never be the 1833 01:42:47,613 --> 01:42:53,203 case That should always come from the business Um and so we we we say that a 1834 01:42:53,203 --> 01:42:57,523 lot and so it it's good to hear it just from a from a from a different uh frame 1835 01:42:57,523 --> 01:43:04,513 of view Um uh I don't think you ever got around to defining defining cyber hygiene 1836 01:43:06,220 --> 01:43:06,970 So cyber hygiene. 1837 01:43:06,970 --> 01:43:12,040 I mean, if, if we keep in, in our, in our, uh, in our discussions, we 1838 01:43:12,040 --> 01:43:13,450 keep coming back to the real world. 1839 01:43:13,450 --> 01:43:16,660 'cause I think that's helped, that helps people, uh, relate. 1840 01:43:17,110 --> 01:43:22,000 Uh, so applying real world stuff to cyber hygiene is very similar. 1841 01:43:22,000 --> 01:43:22,810 If you, if you're not. 1842 01:43:23,500 --> 01:43:27,130 Keeping or maintaining your own personal hygiene, you're gonna get sick. 1843 01:43:27,700 --> 01:43:30,790 Um, or, or people are gonna think you're sick, one of the two. 1844 01:43:31,240 --> 01:43:36,100 Uh, so in cyber there are things that you should be doing just 1845 01:43:36,100 --> 01:43:37,270 like in real, in real world. 1846 01:43:37,270 --> 01:43:42,820 Take your vitamins, go see a doctor, get your checkups, uh, do healthy things. 1847 01:43:43,420 --> 01:43:45,220 One, cyber, those, those. 1848 01:43:45,910 --> 01:43:49,990 Activities are making sure that your systems aren't vulnerable. 1849 01:43:50,050 --> 01:43:55,540 So, uh, inoculating them for, in, in, uh, kind of as a, an analogy there. 1850 01:43:55,570 --> 01:43:58,630 Uh, and we do that through patches. 1851 01:43:58,930 --> 01:44:02,650 Uh, so we, we subscribe to services. 1852 01:44:02,680 --> 01:44:04,930 If it's a Windows machine that do it automatically, if 1853 01:44:04,930 --> 01:44:07,090 you've got it turned on, um. 1854 01:44:07,540 --> 01:44:11,230 It and it will check your systems to determine if there's a vulnerable, 1855 01:44:11,410 --> 01:44:15,430 uh, configuration or a, a, a patch that's out, that, that would, 1856 01:44:15,520 --> 01:44:17,740 um, address a, a known problem. 1857 01:44:18,490 --> 01:44:21,940 Um, so patch management is very important. 1858 01:44:22,570 --> 01:44:27,310 Um, the other part of that is, well, who can access my stuff? 1859 01:44:27,460 --> 01:44:31,000 Uh, that's me obviously, and the people that I give access to my systems. 1860 01:44:31,390 --> 01:44:34,660 But then how do we know that it's really them because. 1861 01:44:36,175 --> 01:44:39,775 The number one traded commodity on the dark web web right now is 1862 01:44:39,775 --> 01:44:41,485 access, and that's credentials. 1863 01:44:41,995 --> 01:44:45,565 So how do we, you know, what's a good practice for making sure that 1864 01:44:45,955 --> 01:44:49,165 you know, someone that, that I trust, uh, that their credentials 1865 01:44:49,165 --> 01:44:51,925 aren't out there and someone's, you know, some bad guy's not using them. 1866 01:44:51,925 --> 01:44:54,235 So that's, that's where multifactor authentication 1867 01:44:54,235 --> 01:44:56,695 comes in, but very similar to. 1868 01:44:57,835 --> 01:45:00,535 You know, in the real world, vitamins and all these other healthy things, you have 1869 01:45:00,535 --> 01:45:02,695 to do it responsibly and appropriately. 1870 01:45:02,695 --> 01:45:07,645 And MFA is definitely one of those that I think the majority of organizations just 1871 01:45:07,645 --> 01:45:09,505 say we have it and they're not using it. 1872 01:45:09,505 --> 01:45:09,865 Right. 1873 01:45:10,585 --> 01:45:18,235 Um, and then lastly, you know, password management, um, probably, um, 1874 01:45:18,325 --> 01:45:20,125 appropriately at the bottom of the list. 1875 01:45:20,155 --> 01:45:24,295 Uh, it's still part of hygiene, but not as effective as it used to be 'cause. 1876 01:45:24,820 --> 01:45:27,100 You know, bad guys aren't trying to guess your password, they're just 1877 01:45:27,100 --> 01:45:29,500 stealing it from somewhere else, right? 1878 01:45:29,500 --> 01:45:33,010 Your, your work password is probably a password you've used somewhere 1879 01:45:33,010 --> 01:45:34,180 else at some point in time. 1880 01:45:34,908 --> 01:45:35,208 Well I 1881 01:45:35,290 --> 01:45:36,040 bad guys are just 1882 01:45:36,348 --> 01:45:40,338 Yeah but that but that's the point of of good Cyber hygiene Right Is 1883 01:45:40,338 --> 01:45:43,188 not doing that Right We're gonna get to I think we'll get to that in in a 1884 01:45:43,450 --> 01:45:43,840 right. 1885 01:45:43,840 --> 01:45:44,110 Yep. 1886 01:45:44,110 --> 01:45:47,230 So we'll get into the details of what, uh, what a good password 1887 01:45:47,650 --> 01:45:52,360 practice, uh, uh, would be, uh, similar to patching and, and MFA. 1888 01:45:52,604 --> 01:45:55,454 Mike, so these are three great sort of. 1889 01:45:56,549 --> 01:45:59,669 Things you should be doing from a cyber hygiene perspective. 1890 01:46:00,059 --> 01:46:05,219 Um, but how did you come up with this list, like right, or, I know 1891 01:46:05,219 --> 01:46:07,889 you and Curtis have been talking about this for a while, but like, why 1892 01:46:07,889 --> 01:46:09,419 are these the three most important? 1893 01:46:09,419 --> 01:46:13,799 Is it based on like scenarios you've encountered working with customers, 1894 01:46:13,799 --> 01:46:15,239 helping them recover from ransomware? 1895 01:46:15,239 --> 01:46:20,009 Like why should someone believe the sort of 90% of ransomware could be? 1896 01:46:20,613 --> 01:46:26,343 I can jump in on that one I mean it it's because it of the stories that 1897 01:46:26,343 --> 01:46:31,803 I've read over the last you know so many years it it was always it was always 1898 01:46:31,803 --> 01:46:35,883 one of these three right If if if they had just patched the system then they 1899 01:46:35,883 --> 01:46:39,723 wouldn't have the vulnerability if they had just either not allowed the password 1900 01:46:39,723 --> 01:46:45,153 to be stolen or if they had the if or or compromised in some way And then uh 1901 01:46:45,183 --> 01:46:51,248 if if if that had happened if they had just had MFA And you know in uh you know 1902 01:46:52,058 --> 01:46:56,648 what's the word I'm looking for Um if they if they were just using MFA then 1903 01:46:56,648 --> 01:47:00,488 then even if they had the password then they would've been able to get in Right 1904 01:47:00,644 --> 01:47:03,164 Assuming that you didn't have MFA fatigue by the employee? 1905 01:47:04,158 --> 01:47:08,658 But yeah we're we're gonna get to that We'll get to that But the the thing 1906 01:47:08,658 --> 01:47:12,558 is if if if they had these things when you when you read back on the stories 1907 01:47:12,648 --> 01:47:16,278 and I would add like because we're tech technically talking about cyber 1908 01:47:16,278 --> 01:47:20,493 hygiene here and not backup hygiene but I'll add to this Immutable backups 1909 01:47:20,763 --> 01:47:26,343 right If we have that if we have those four then um not only would you stop 1910 01:47:26,343 --> 01:47:32,133 the you know the bulk of the attacks you would uh also be able to respond 1911 01:47:32,133 --> 01:47:36,483 to the 10 that that you get Uh would your answer be any different there Mike 1912 01:47:38,385 --> 01:47:39,585 Oh, very similar. 1913 01:47:39,585 --> 01:47:44,835 So yeah, they, these three are the greatest common denominators, uh, of, of 1914 01:47:44,835 --> 01:47:47,055 a lot of the, if not the majority of, uh. 1915 01:47:47,610 --> 01:47:49,050 Incidents that are out there. 1916 01:47:49,410 --> 01:47:52,590 Uh, but to Curtis's point and maybe where you were going, Prasanna Yeah. 1917 01:47:52,590 --> 01:47:54,000 This list could get really long. 1918 01:47:54,030 --> 01:47:58,260 It's, it's, you know, it's not just these three and the backups, it's also network 1919 01:47:58,260 --> 01:48:02,250 segmentation and turning, you know, secure build guidelines and secure coding 1920 01:48:02,250 --> 01:48:08,070 and, uh, you know, perimeter protection and vendor management and anti-malware 1921 01:48:08,070 --> 01:48:09,960 and training and all those things. 1922 01:48:10,440 --> 01:48:15,390 Uh, but when you look at the numbers, uh, the statistics of incidents 1923 01:48:15,390 --> 01:48:16,345 that are out there and, and what. 1924 01:48:16,975 --> 01:48:20,575 You know what, how you boil those down to the common denominate. 1925 01:48:20,905 --> 01:48:22,345 Common denominators. 1926 01:48:22,345 --> 01:48:24,110 It's, it's primarily these three. 1927 01:48:24,838 --> 01:48:29,968 Because these are it's like this is to again going back to the real world this 1928 01:48:29,968 --> 01:48:37,668 is the um I This is the have in in the real world when we talk about investing 1929 01:48:38,538 --> 01:48:43,038 The very first thing they tell you to do is to have uh you know 90 days of 1930 01:48:43,038 --> 01:48:47,538 of an emergency fund And that should be your first thing because there's no 1931 01:48:47,538 --> 01:48:51,738 point in talking about like you know 4 0 1 Ks and Roth IRAs and all these things 1932 01:48:51,948 --> 01:48:56,058 if you can't survive uh you know losing a paycheck for a couple of weeks right 1933 01:48:56,478 --> 01:49:03,623 This is the um if you're not doing these Then just stop Like you know in the book 1934 01:49:03,623 --> 01:49:07,283 we said like if you're not doing these three things just stop reading right now 1935 01:49:07,283 --> 01:49:13,553 and go do those three things because it will stop 90 the other 10 like everything 1936 01:49:13,553 --> 01:49:18,623 else The other 10 is the is the hard part right It's the more expensive part 1937 01:49:18,893 --> 01:49:24,473 But doing password management and patch management and and MFA or um uh pass 1938 01:49:24,473 --> 01:49:29,153 keys which we'll we'll talk about that a little bit more but if if we do that 1939 01:49:29,428 --> 01:49:35,098 Then it it's it's a it's the low hanging fruit Um you know that that allows 1940 01:49:35,098 --> 01:49:43,018 us to secure the the environment um without without massive cost or anything 1941 01:49:44,398 --> 01:49:46,858 weird I I still hear your your fan 1942 01:49:47,014 --> 01:49:47,764 came back on. 1943 01:49:48,208 --> 01:49:51,148 Yeah it just came back on even though we have the noise reduction on 1944 01:49:51,865 --> 01:49:56,785 And there, there's zero change on my side, so there's no extra noise or anything. 1945 01:49:57,483 --> 01:49:59,163 And then it and then it just left 1946 01:49:59,815 --> 01:50:01,730 It's like a power surge or something. 1947 01:50:01,870 --> 01:50:02,250 I'm not sure. 1948 01:50:03,963 --> 01:50:10,413 I got nothing Um I So weird Um all right Well luckily it was me that was talking 1949 01:50:10,413 --> 01:50:16,143 so I could mute it out Um yeah so this this is like this is the if you're not 1950 01:50:16,143 --> 01:50:19,533 doing these things and don't it's like it's like when we start talking about 1951 01:50:19,923 --> 01:50:23,703 uh offsite backups there's no point in talking about offsite backups if you're 1952 01:50:23,703 --> 01:50:28,768 not making backups in the first place Right Right This is the this is the if 1953 01:50:28,768 --> 01:50:32,128 you're not doing these things and don't even talk to me Don't even start if you're 1954 01:50:32,128 --> 01:50:37,468 not doing basic cyber hygiene then um then there's no point in in continuing 1955 01:50:37,468 --> 01:50:39,388 on with with further discussions 1956 01:50:42,118 --> 01:50:48,093 Uh let's see here Um all right so I Let's just let's just talk a little bit about 1957 01:50:48,393 --> 01:50:52,623 when we talk about patching how do we know uh and we're gonna do an episode 1958 01:50:52,623 --> 01:50:57,243 on each of these things but just the basic thing what what do you think would 1959 01:50:57,243 --> 01:51:00,093 be the easiest That that's what cause that's what we're trying to do here What 1960 01:51:00,093 --> 01:51:03,723 would be the easiest way to make sure that we're running all of the appropriate 1961 01:51:03,723 --> 01:51:06,273 patches Mike especially the critical ones 1962 01:51:08,345 --> 01:51:13,085 It's, it's easy if you're organized and the first step in getting organized is 1963 01:51:13,085 --> 01:51:18,005 doing an inventory of the things that you have, because, you know, patch, 1964 01:51:20,165 --> 01:51:24,035 you have to work off your inventory to know who, who to get patches from. 1965 01:51:24,335 --> 01:51:24,545 Right. 1966 01:51:24,545 --> 01:51:25,030 Is it, is it. 1967 01:51:25,795 --> 01:51:26,725 Red Hat Linux. 1968 01:51:26,725 --> 01:51:27,595 Is it Windows? 1969 01:51:27,595 --> 01:51:29,845 Is it third party tools? 1970 01:51:29,935 --> 01:51:35,125 Adobe, uh, you know that 3D modeling tool? 1971 01:51:35,125 --> 01:51:36,415 You use AutoCAD? 1972 01:51:36,565 --> 01:51:37,195 What is it? 1973 01:51:37,195 --> 01:51:41,125 So you've gotta inventory all this stuff first and then find out if you can 1974 01:51:41,125 --> 01:51:43,225 actually get notifications from them. 1975 01:51:44,125 --> 01:51:46,165 For when patches are available. 1976 01:51:46,645 --> 01:51:49,855 Uh, if you don't do that on the proactive side, then you're gonna 1977 01:51:49,855 --> 01:51:51,115 get it on the reactive side. 1978 01:51:51,145 --> 01:51:55,825 'cause hopefully part of hygiene is also your periodic vulnerability assessments. 1979 01:51:55,825 --> 01:51:59,725 And if, if you need help with that, we can, we can walk you through some 1980 01:52:01,225 --> 01:52:03,715 free open source ways to do that. 1981 01:52:03,780 --> 01:52:04,000 But. 1982 01:52:05,095 --> 01:52:09,505 Every now and then you need to be scanning all of your assets for vulnerabilities. 1983 01:52:09,595 --> 01:52:13,495 That's gonna turn up some configuration problems, some missing patches. 1984 01:52:13,885 --> 01:52:17,185 Well then, alright, reactively, now I, well there's a missing patch 1985 01:52:17,185 --> 01:52:20,575 and usually it comes with a link from these vulnerability tools. 1986 01:52:21,085 --> 01:52:24,595 Uh, so go do that and while you're doing it, find out if there's a way 1987 01:52:24,595 --> 01:52:26,425 to subscribe to that information. 1988 01:52:26,965 --> 01:52:27,685 Um, so. 1989 01:52:28,975 --> 01:52:29,635 Easy. 1990 01:52:29,725 --> 01:52:33,175 It's not easy, but organi, and that's one of the reasons people 1991 01:52:33,175 --> 01:52:34,525 don't do it 'cause it's not easy. 1992 01:52:35,185 --> 01:52:38,965 Um, and there are tools out there that are fairly expensive to 1993 01:52:38,965 --> 01:52:40,465 do it in an automated fashion. 1994 01:52:40,465 --> 01:52:42,955 And then somewhere in between there's managed services and other 1995 01:52:42,955 --> 01:52:47,155 things, but it's gotta start with understanding what it is you have, 1996 01:52:47,845 --> 01:52:51,685 uh, and then figuring out where to get the information for available patches 1997 01:52:51,685 --> 01:52:53,635 and issues with those, those assets. 1998 01:52:54,078 --> 01:52:59,718 this is the hardest thing today versus back in the day right Back in the day I 1999 01:52:59,718 --> 01:53:03,138 could walk into a server room and I could I could literally just have a piece of 2000 01:53:03,138 --> 01:53:07,368 paper and check off I have this one I have this one I have this one Now we have 2001 01:53:07,373 --> 01:53:11,903 a We don't have any service to point at Everything's virtual Everything's in the 2002 01:53:11,903 --> 01:53:18,503 cloud And we have we have you know um IAS we have PAS we have SAS right We have all 2003 01:53:18,503 --> 01:53:23,363 of these different ways where uh and and I'd say the SaaS is probably the worst 2004 01:53:23,363 --> 01:53:30,193 because it's so easy to to propagate Um The you know to to go across the um the 2005 01:53:30,193 --> 01:53:33,883 thing and and you did you did remind me when we talk about inventory you did 2006 01:53:33,883 --> 01:53:38,863 remind me again back in the day We had uh when I was the backup guy my very first 2007 01:53:38,863 --> 01:53:46,803 job in it We had we had a very boring naming convention We had H-P-D-B-S-V-A 2008 01:53:46,833 --> 01:53:56,103 HP database server a right bbc so on And I ha I was I was becoming worried that I 2009 01:53:56,103 --> 01:53:59,583 wasn't getting all the servers cause we started out we literally when I started 2010 01:53:59,673 --> 01:54:05,888 at the bank we had seven Servers at T three B twos by the way for those you 2011 01:54:05,888 --> 01:54:11,048 know that's what we had which was for the record the first computer designed to run 2012 01:54:11,108 --> 01:54:16,928 Unix so they were old right Anyway so we went from having seven servers to having 2013 01:54:16,958 --> 01:54:21,383 like 200 servers and I was starting to panic that we We didn't have a correct 2014 01:54:21,383 --> 01:54:27,173 inventory And so um but the the naming convention was very helpful And so I had 2015 01:54:27,173 --> 01:54:32,513 this this practice of when you had a new server you had to give me a form to say I 2016 01:54:32,513 --> 01:54:36,533 want this server backed up And I put this thing on there that said don't consider 2017 01:54:36,533 --> 01:54:40,133 it backed up until you get the form back for me Signed that said that I saw the 2018 01:54:40,133 --> 01:54:44,303 form and I put it on the list And then one day somebody handed me a form and they 2019 01:54:44,453 --> 01:54:53,878 it said like H-P-D-B-S-V and I'm like And they're like yes I go so that would by by 2020 01:54:53,878 --> 01:55:01,858 you know my inference that means there's an M and an L a K somewhere And they're 2021 01:55:01,858 --> 01:55:10,043 like well yeah And I'm like I only know up to j So so I'm gonna go find K and l 2022 01:55:10,043 --> 01:55:15,113 and m and uh and we'll start backing all of them up I agree with you Mike A hundred 2023 01:55:15,113 --> 01:55:18,893 percent That inventory is absolutely the place to start And Prasanna you were 2024 01:55:18,893 --> 01:55:21,143 about to say something before I waxed up 2025 01:55:21,974 --> 01:55:25,724 No, it, that's actually a pretty funny story, Curtis, but I'm not surprised. 2026 01:55:25,724 --> 01:55:30,224 You always have all these great stories from working at the bank and other places. 2027 01:55:30,584 --> 01:55:34,214 But Mike, I know you talked about patch management, right, 2028 01:55:34,214 --> 01:55:36,014 and how to apply patches. 2029 01:55:36,944 --> 01:55:41,144 is there something similar for cases where maybe patches aren't available? 2030 01:55:41,144 --> 01:55:43,694 Like, it's great you have an inventory of everything that's there, but 2031 01:55:43,694 --> 01:55:47,804 how do you deal with sort of, um, exploits that are currently out 2032 01:55:47,804 --> 01:55:49,754 there before patches come out? 2033 01:55:51,700 --> 01:55:54,640 So those are zero days in, in most cases. 2034 01:55:54,760 --> 01:55:58,870 Uh, so zero day is something was identified today, and vendors haven't had 2035 01:55:58,870 --> 01:56:01,570 a chance to respond to that with a patch. 2036 01:56:02,230 --> 01:56:07,450 Um, well, and, and I'll add real quick, sometimes the patch that's 2037 01:56:07,450 --> 01:56:10,930 available becomes your zero day because it doesn't work in your environment. 2038 01:56:11,440 --> 01:56:13,895 Uh, and so along with patch management, you need to develop. 2039 01:56:14,830 --> 01:56:20,230 Process for testing the patch, applying it to a test machine to 2040 01:56:20,230 --> 01:56:23,800 see its effects on how things run before you move it into production. 2041 01:56:23,800 --> 01:56:28,240 So, uh, be mindful of that too, but to your point, Prasanna about things 2042 01:56:28,240 --> 01:56:34,120 that come up that don't have a, a fix, uh, those mitigating controls. 2043 01:56:34,120 --> 01:56:35,975 Like how do we, alright, so there in. 2044 01:56:37,225 --> 01:56:38,245 It does depend. 2045 01:56:38,245 --> 01:56:40,135 So is this a public facing thing? 2046 01:56:40,585 --> 01:56:42,325 Uh, do people log into it? 2047 01:56:42,355 --> 01:56:45,955 Is it a, is it a, you know, prized possession of our company 2048 01:56:45,985 --> 01:56:47,635 with, you know, sensitive data? 2049 01:56:47,905 --> 01:56:52,015 Or is it just that, that thing I could potentially turn off or isolate? 2050 01:56:52,675 --> 01:56:55,405 Um, so you've gotta do some analysis first, like what's 2051 01:56:55,405 --> 01:56:56,695 the risk, what's the impact? 2052 01:56:56,785 --> 01:56:59,035 And then respond accordingly if it's. 2053 01:56:59,995 --> 01:57:02,005 Publicly accessible internet facing. 2054 01:57:02,485 --> 01:57:06,715 Then put some monitoring on it, put some logging on it, try to isolate it. 2055 01:57:06,835 --> 01:57:10,615 Uh, those mitigating controls in the absence of a, uh, a true 2056 01:57:10,615 --> 01:57:14,185 solution have to be assessed and applied as fast as possible. 2057 01:57:16,013 --> 01:57:17,098 I like that Um 2058 01:57:17,320 --> 01:57:17,330 and 2059 01:57:17,358 --> 01:57:17,578 so 2060 01:57:17,600 --> 01:57:20,035 there, there are, there are services out there. 2061 01:57:20,035 --> 01:57:21,835 I ran into one not too long ago. 2062 01:57:21,835 --> 01:57:25,585 It's outta New Zealand and it's, I don't have a fix for this. 2063 01:57:25,945 --> 01:57:27,565 It's essentially a proxy. 2064 01:57:27,925 --> 01:57:31,195 So they, they stand up a uh, um. 2065 01:57:31,600 --> 01:57:36,250 An internet facing version of whatever it is that's fed from your environment. 2066 01:57:36,460 --> 01:57:41,140 And they analyze and filter all the requests for that information as a proxy. 2067 01:57:41,440 --> 01:57:46,420 Uh, and, and you can, you can subscribe to that until a solution is, uh, is applied. 2068 01:57:46,870 --> 01:57:47,710 So that was pretty interesting. 2069 01:57:47,710 --> 01:57:48,640 I did, I did see that. 2070 01:57:49,263 --> 01:57:54,813 Yeah that's that does sound interesting uh from the so that's the the patches 2071 01:57:54,813 --> 01:57:58,803 world and again we're gonna do an episode on each of these three Uh but that's the 2072 01:57:58,803 --> 01:58:04,503 patches world Let's talk a little bit about the passwords Um and and I think we 2073 01:58:04,503 --> 01:58:12,213 can all agree one some method Again I'm I'm a big fan of of password management 2074 01:58:12,213 --> 01:58:19,443 like a password manager But you need some method So you absolutely do not ever 2075 01:58:19,473 --> 01:58:26,433 use the same password in multiple places because that is the problem is uh I and 2076 01:58:26,433 --> 01:58:32,043 I got a I got a um I got in a argument is a is a strong term but I got into a 2077 01:58:32,043 --> 01:58:36,678 discussion with a with a guy on I think it was somebody that commented on one 2078 01:58:36,678 --> 01:58:45,993 of our videos and um where he was saying that he was using Uh this system where 2079 01:58:45,993 --> 01:58:53,163 he what he does is he he has a password that he uses on like a a small subset 2080 01:58:53,163 --> 01:58:59,678 of systems Like he has like 10 passwords that he uses everywhere And so his method 2081 01:58:59,678 --> 01:59:04,028 of like mitigating the risk is that he doesn't wanna use a password manager 2082 01:59:04,028 --> 01:59:07,688 He doesn't believe in using a password manager So he has like 10 passwords that 2083 01:59:07,688 --> 01:59:13,868 he sprinkles around and he just has to remember uh 10 passwords in his head um 2084 01:59:13,868 --> 01:59:19,268 and he uses the the battery horse staple method Um right which is which is a good 2085 01:59:19,268 --> 01:59:23,173 method right Uh for those of you who don't know what I'm talking about This is 2086 01:59:23,173 --> 01:59:28,933 the um the idea of what we're gonna talk more about I'm sorry It is just this idea 2087 01:59:28,933 --> 01:59:34,093 of having an password that is long but actually easy to remember because most of 2088 01:59:34,093 --> 01:59:38,233 the passwords that we have that are long are total garbly gook and they can only 2089 01:59:38,233 --> 01:59:42,193 be remembered by a password manager So he uses that method and then he has like 2090 01:59:42,193 --> 01:59:47,238 10 passwords and I was like well that's Again better than nothing better than 2091 01:59:47,238 --> 01:59:53,418 using the same password everywhere But if if there's avol if there if if any one 2092 01:59:53,418 --> 01:59:57,318 of those systems where you're using that same password are ever compromised then 2093 01:59:57,318 --> 02:00:01,098 you have to change the password everywhere where you're using that password And 2094 02:00:01,098 --> 02:00:04,848 potentially by the time you get around to doing it it's already been compromised 2095 02:00:05,298 --> 02:00:11,718 And um so this is just again my way to do this is password manager and I think 2096 02:00:11,718 --> 02:00:18,838 that's the number one most recommended way But besides making sure that we do 2097 02:00:18,838 --> 02:00:27,208 not use the same password in multiple places What else Basic uh password hygiene 2098 02:00:27,208 --> 02:00:28,473 stuff do we need to talk about Mike 2099 02:00:31,280 --> 02:00:35,135 Real quick, I think a good term for your, uh, your disagreement. 2100 02:00:35,195 --> 02:00:38,255 Uh, and it's an older term, uh, that, that you just don't hear 2101 02:00:38,255 --> 02:00:39,450 very often is a kerfluffle. 2102 02:00:39,793 --> 02:00:40,283 Careful 2103 02:00:40,570 --> 02:00:42,370 I think that's a good yes. 2104 02:00:42,550 --> 02:00:46,150 Uh, anyway, so back to back to passwords. 2105 02:00:46,210 --> 02:00:50,620 Uh, I think a good practice these days, especially as we suggest passwords 2106 02:00:50,620 --> 02:00:54,940 become longer and longer, and, uh, I don't know if, if, uh, if, if you 2107 02:00:54,940 --> 02:00:57,100 guys realize where that came from. 2108 02:00:58,240 --> 02:01:02,740 Uh, so it stemmed from the, the, the length of a password. 2109 02:01:03,213 --> 02:01:03,243 okay 2110 02:01:04,054 --> 02:01:04,434 How long 2111 02:01:04,630 --> 02:01:05,170 So a stem. 2112 02:01:06,299 --> 02:01:07,079 compute right? 2113 02:01:07,185 --> 02:01:07,365 So that's. 2114 02:01:07,765 --> 02:01:09,805 A combination of things, right? 2115 02:01:09,805 --> 02:01:16,375 So when, when Windows or, or Linux, Unix, uh, encrypts a password, uh, with, 2116 02:01:16,375 --> 02:01:20,605 you know, a ES 2 56 or whatever it is, there's a ma math, there's a mathematical, 2117 02:01:22,075 --> 02:01:28,345 um, response to how long it would take to crack a password of certain length. 2118 02:01:29,335 --> 02:01:32,875 Well, that's been defeated, uh, by a project called Rainbow Tables. 2119 02:01:34,165 --> 02:01:39,115 Rainbow tables just encrypts and, and captures the, the hash value 2120 02:01:39,115 --> 02:01:43,825 of every conceivable, random known dictionary, multiple languages. 2121 02:01:43,825 --> 02:01:47,035 And so it's not, I don't have to crack your password anymore, I just have to 2122 02:01:47,035 --> 02:01:49,135 take your password hash and go look it up. 2123 02:01:49,945 --> 02:01:51,865 And see if that's already been done. 2124 02:01:52,105 --> 02:01:53,785 So it's not a math problem anymore. 2125 02:01:53,785 --> 02:01:56,215 It's, it's a, it's a, it's a research problem. 2126 02:01:57,115 --> 02:02:01,765 All right, well then a vulnerability came out in, uh, with Windows. 2127 02:02:01,945 --> 02:02:10,765 'cause if you had, uh, um, NTLM, the, the hash in windows turned on, it would 2128 02:02:10,765 --> 02:02:16,285 take your password hash and break it up into two eight character hashes. 2129 02:02:17,515 --> 02:02:19,975 Well, now I can, I can crack them individually. 2130 02:02:19,975 --> 02:02:22,975 Instead of cracking one large, I can do two small ones. 2131 02:02:22,975 --> 02:02:24,475 And there's vulnerability associated with that. 2132 02:02:24,475 --> 02:02:31,375 So now we should have greater than 16 character passwords for that reason. 2133 02:02:31,615 --> 02:02:35,335 And, and it, and you know, I can drive policy now, it says it's gotta be 16. 2134 02:02:35,725 --> 02:02:41,755 Well, if it has to be 16, the IT guys that have not wanted to change the LTLM now 2135 02:02:41,755 --> 02:02:45,415 have to, they have to turn that off to, to generate, you know, and so there's. 2136 02:02:46,195 --> 02:02:50,425 It's political game, but also based on, um, some known 2137 02:02:50,425 --> 02:02:51,895 vulnerabilities around passwords. 2138 02:02:52,405 --> 02:02:55,765 Alright, well now we've got 16 character or greater passwords. 2139 02:02:55,765 --> 02:02:57,925 How are you gonna get users to remember that? 2140 02:02:58,645 --> 02:02:59,905 Password hackers are great. 2141 02:02:59,965 --> 02:03:03,595 Uh, password managers are great because it can also randomize passwords so 2142 02:03:03,595 --> 02:03:04,585 you don't have to remember it anymore. 2143 02:03:04,585 --> 02:03:08,065 You just log into your password manager and copy and paste. 2144 02:03:08,605 --> 02:03:11,155 Um, and so you, you don't have to remember it anymore. 2145 02:03:11,155 --> 02:03:13,105 And it can be random, which is also. 2146 02:03:13,780 --> 02:03:19,180 Helpful, but then not everybody can subscribe to that approach. 2147 02:03:19,180 --> 02:03:22,300 So they, they want these password phrases now. 2148 02:03:22,390 --> 02:03:26,440 And so some interesting things about password phrases, uh, and similar to 2149 02:03:26,440 --> 02:03:31,090 what Curtis was describing with, you know, having a root password and then 2150 02:03:31,360 --> 02:03:34,000 you know, something at the beginning and something at the end that's helpful, 2151 02:03:34,000 --> 02:03:37,540 especially if it's, if you want the same route password for everything, and then 2152 02:03:37,540 --> 02:03:40,990 you just change the front and the back depending on what you're logging into. 2153 02:03:41,530 --> 02:03:43,870 Uh, that can be troublesome though. 2154 02:03:43,900 --> 02:03:46,960 'cause as a bad guy, I just need two of those to realize that's a pattern 2155 02:03:47,500 --> 02:03:53,080 and I can just kind of guess, uh, what, uh, what, what your bank password 2156 02:03:53,080 --> 02:03:54,670 is if, if I don't have that already. 2157 02:03:55,120 --> 02:03:58,630 Um, so some things to think about. 2158 02:03:59,365 --> 02:04:03,475 Um, you know, if you're logging into your bank, maybe your past phrase is, 2159 02:04:03,865 --> 02:04:09,595 uh, I like getting paid on Friday, and then at the beginning or the end, uh, 2160 02:04:09,805 --> 02:04:12,115 you know, uh, and that makes me happy. 2161 02:04:12,265 --> 02:04:16,765 Or, you know, added emotion or add a, add a color that makes you think 2162 02:04:16,765 --> 02:04:18,835 of, you know, that emo it's blue. 2163 02:04:18,925 --> 02:04:20,755 Uh, I think that's calming, right? 2164 02:04:21,145 --> 02:04:24,115 Uh, and then, and then change up how it felt. 2165 02:04:24,188 --> 02:04:25,238 the way Mike I was gonna 2166 02:04:25,285 --> 02:04:25,495 Green. 2167 02:04:25,525 --> 02:04:26,270 Green is okay. 2168 02:04:26,288 --> 02:04:26,978 for for money 2169 02:04:27,199 --> 02:04:27,529 red. 2170 02:04:29,200 --> 02:04:31,990 So then, you know, do some substitution. 2171 02:04:32,140 --> 02:04:37,750 So instead of, you know, ease, use threes and capitalize, you know, the first 2172 02:04:37,840 --> 02:04:40,390 letter of a word or spell it backwards. 2173 02:04:40,480 --> 02:04:45,730 Um, I had a password and man, long time, 20, 30 years ago, uh, where it 2174 02:04:45,730 --> 02:04:47,590 was, I spelled everything backwards. 2175 02:04:48,040 --> 02:04:48,580 Um. 2176 02:04:50,485 --> 02:04:53,185 So there, there are some unique things that you can do with passwords. 2177 02:04:53,185 --> 02:04:57,505 You just have to figure out which one works for you, uh, and that 2178 02:04:57,505 --> 02:04:58,915 you can be consistent with it. 2179 02:04:59,455 --> 02:05:02,815 The password manager will also help you remember to, it's about time you've 2180 02:05:02,815 --> 02:05:04,915 been using this password for 10 years. 2181 02:05:04,915 --> 02:05:05,215 Now 2182 02:05:07,308 --> 02:05:07,578 Yeah 2183 02:05:07,615 --> 02:05:08,275 time to change it. 2184 02:05:08,358 --> 02:05:12,288 you if you do use it in multiple places right It was like Hey you you've used 2185 02:05:12,288 --> 02:05:16,578 this password elsewhere I'm I'm a big fan of password Brandon I know 2186 02:05:16,688 --> 02:05:18,618 Prasanna You have one right What 2187 02:05:19,424 --> 02:05:22,064 do, should we wait to talk about this on the 2188 02:05:22,518 --> 02:05:26,268 Yeah Yeah you're right You're right you're right Yeah Yeah All right So yeah 2189 02:05:26,268 --> 02:05:31,878 so basically the idea is the the the overall overriding concept is to not use 2190 02:05:31,878 --> 02:05:37,898 the same password anywhere Never use the same password twice And and if you're not 2191 02:05:37,898 --> 02:05:45,678 using some kind of system my method is password manager Um you know the the the 2192 02:05:45,698 --> 02:05:49,448 the one that you talked about Mike the the one where you append it and pre-end 2193 02:05:49,448 --> 02:05:53,138 it with with something and you have this core password that used to be my method 2194 02:05:53,468 --> 02:05:58,538 before I went to a password manager Um and the the you know and then there's there's 2195 02:05:58,538 --> 02:06:05,778 this these other ways to to have it but I I can't ima I have like 500 passwords 2196 02:06:05,778 --> 02:06:13,458 at this point right so I can't imagine um not having uh a password manager at 2197 02:06:13,458 --> 02:06:17,658 this point But so that's that's my way to do that But the core concept is you 2198 02:06:17,658 --> 02:06:22,488 cannot use the same password at multiple places And why is that Mike We we kind 2199 02:06:22,488 --> 02:06:24,948 of alluded it to it uh a few minutes ago 2200 02:06:26,925 --> 02:06:29,535 You remember, we call those coincidental passwords. 2201 02:06:30,285 --> 02:06:33,255 Uh, and and the reason you don't wanna use them in more than one place 2202 02:06:33,255 --> 02:06:37,365 is because you've gotta rely on the security of more than one thing to make 2203 02:06:37,365 --> 02:06:39,795 sure your password isn't compromised. 2204 02:06:40,245 --> 02:06:44,535 And when bad guys compromise one data set, they're gonna use that data set 2205 02:06:44,625 --> 02:06:46,545 across everything they can think of. 2206 02:06:47,600 --> 02:06:52,070 So if I've got one of Curtis's passwords and I know he has 500 accounts out 2207 02:06:52,070 --> 02:06:56,150 there, I'm gonna use that one password to try and log into 499 of those, 2208 02:06:58,033 --> 02:06:58,753 And especially 2209 02:06:58,940 --> 02:06:59,540 could be. 2210 02:06:59,803 --> 02:07:04,663 one username is your email address right So you so you already know my email 2211 02:07:04,663 --> 02:07:09,218 address and you go out there and you use the Password everywhere You know you 2212 02:07:09,218 --> 02:07:13,358 just you don't even need to know where I have the thing You just you just try 2213 02:07:13,358 --> 02:07:17,048 it All the places that you have access and you're and this is a numbers game 2214 02:07:17,048 --> 02:07:20,798 You're trying every every account that you have access to with every password 2215 02:07:20,798 --> 02:07:25,778 you have access to in every place that you have access to the the system Right 2216 02:07:26,168 --> 02:07:28,118 Um so yeah that's why we don't do it 2217 02:07:29,090 --> 02:07:29,310 Yep. 2218 02:07:29,315 --> 02:07:30,815 And, and how do you mitigate that? 2219 02:07:31,568 --> 02:07:34,358 by using the different password in every place Right 2220 02:07:34,680 --> 02:07:36,065 Well, well, how so? 2221 02:07:36,065 --> 02:07:38,105 What if, what if they guess what if they have a password? 2222 02:07:39,745 --> 02:07:44,365 You forgot you used 20 years ago and now there's an account that 2223 02:07:44,515 --> 02:07:45,865 that password's gonna work on. 2224 02:07:45,865 --> 02:07:49,480 How do you mitigate that MFA. 2225 02:07:49,653 --> 02:07:58,008 Oh okay I was I I should have known this answer Dammit Uh yeah So yeah so so MFA 2226 02:07:58,008 --> 02:08:02,958 uh you know is the final thing on our on our on our trifecta of of basic cyber 2227 02:08:02,958 --> 02:08:08,598 hygiene And I and I'll put MFA slash slash um you know pass keys which is like it's 2228 02:08:08,598 --> 02:08:14,628 like the next thing cause we'll as we when we talk about MFA We will mention that 2229 02:08:14,628 --> 02:08:18,318 MFA is not perfect Uh Prasanna's already alluded to it You know there's this thing 2230 02:08:18,318 --> 02:08:22,668 called MFA exhaustion There are there are other issues with it but let's just 2231 02:08:22,668 --> 02:08:30,228 start with what MFA is Um uh Prasanna why don't why don't why don't you define MFA 2232 02:08:30,228 --> 02:08:32,178 What is it you know and how does it work 2233 02:08:32,999 --> 02:08:33,269 Sure. 2234 02:08:33,449 --> 02:08:38,129 So with MFA, it's really, Mike said, someone might compromise your 2235 02:08:38,129 --> 02:08:42,779 password and so it's something you know and something you have, right? 2236 02:08:42,779 --> 02:08:46,769 And so that something you have piece is normally, say your 2237 02:08:46,769 --> 02:08:48,689 biometrics like a fingerprint. 2238 02:08:48,689 --> 02:08:50,099 It could be your face, right? 2239 02:08:50,099 --> 02:08:55,454 It could be a. Electronic token that gets generated periodically 2240 02:08:55,454 --> 02:08:57,554 or some other application, right? 2241 02:08:57,554 --> 02:09:02,474 That generates that such that you have a second factor, which previously was 2242 02:09:02,474 --> 02:09:04,484 called sort of two-factor authentication. 2243 02:09:04,904 --> 02:09:08,549 Right now it's multifactor in order to be able to say, yes, this really is me. 2244 02:09:10,743 --> 02:09:12,608 The most common one I'd say 2245 02:09:15,693 --> 02:09:20,853 I'd say the most common one is probably SMS Um it's definitely not the best 2246 02:09:20,853 --> 02:09:24,783 one uh but it's certainly the most common I think the most common use to 2247 02:09:24,783 --> 02:09:31,083 be email I really don't like email like in good better best It's barely good uh 2248 02:09:31,113 --> 02:09:35,163 because again if you uh if somebody's compromised your email account especially 2249 02:09:35,163 --> 02:09:40,143 if it's the email account that you use for everything right Um SMS is not as 2250 02:09:40,143 --> 02:09:47,963 good because SMSI think SMS is actually better today than it used to be uh it's 2251 02:09:47,963 --> 02:09:53,573 harder to do sim hacking today than it than it used to be uh at least in in 2252 02:09:53,573 --> 02:09:59,933 certain circumstances Um and then but then uh the I think the best one that 2253 02:09:59,933 --> 02:10:05,363 we have today that's available to pretty much everybody is uh an authenticator 2254 02:10:05,363 --> 02:10:07,373 type app You wanna talk about that Mike 2255 02:10:08,825 --> 02:10:09,115 Sure. 2256 02:10:09,325 --> 02:10:14,635 Uh, and, and those apps are generally free, uh, and, and don't require any. 2257 02:10:14,875 --> 02:10:15,955 Infrastructure changes. 2258 02:10:15,955 --> 02:10:20,785 There are some, uh, like duo, uh, that would require some licensing and set up 2259 02:10:20,785 --> 02:10:23,035 on the inside of, uh, your organization. 2260 02:10:23,545 --> 02:10:27,025 Um, but others like the Microsoft Authenticator app, uh, 2261 02:10:27,055 --> 02:10:28,975 Google has one, they're free. 2262 02:10:28,975 --> 02:10:30,265 You just get 'em in the play store. 2263 02:10:30,265 --> 02:10:35,785 And then whenever you want to register your multifactor with a vendor, a 2264 02:10:35,785 --> 02:10:40,435 lot of times there's like a QR code or a set up your account this way. 2265 02:10:40,915 --> 02:10:41,455 Um. 2266 02:10:42,430 --> 02:10:46,690 Similar to a password manager, you would log into your authenticator app and it 2267 02:10:46,690 --> 02:10:51,730 would show all your different accounts, uh, which you could revoke or delete if 2268 02:10:51,730 --> 02:10:53,290 you think that's compromised as well. 2269 02:10:53,290 --> 02:10:56,200 So you can manage it that way, but pretty, pretty straightforward. 2270 02:10:56,470 --> 02:11:00,370 And, you know, MFA, uh, 2271 02:11:02,770 --> 02:11:07,270 um, fatigue, MFA fatigue is a real thing. 2272 02:11:07,750 --> 02:11:10,240 It's more of a. It's just annoyance. 2273 02:11:10,840 --> 02:11:14,980 Uh, so you log into something and you, oh, I've gotta wait for my phone to ding. 2274 02:11:14,980 --> 02:11:20,500 Now what if, what if you don't have cell phone coverage or data, 2275 02:11:20,770 --> 02:11:22,480 uh, you know, wireless data? 2276 02:11:23,080 --> 02:11:27,340 Um, a lot of these authenticator apps also allow you to save. 2277 02:11:27,760 --> 02:11:32,080 Backup codes, um, things like, so there's, there's any number of ways 2278 02:11:32,080 --> 02:11:34,270 of, of using what works for you. 2279 02:11:34,780 --> 02:11:39,550 Um, the important thing is to figure out something other than email, um, for your 2280 02:11:39,550 --> 02:11:45,580 MFA if, if the, the account that you're wanting to apply MFA to will support it. 2281 02:11:47,384 --> 02:11:52,334 And Mike, I know on a previous podcast you sort of mentioned one of the 2282 02:11:52,334 --> 02:11:55,064 downsides with many websites, right? 2283 02:11:55,094 --> 02:11:58,094 Which have MFA, and then they sort of have the remember me 2284 02:11:58,094 --> 02:11:59,954 next time on this thing, right? 2285 02:12:02,485 --> 02:12:02,815 Right. 2286 02:12:02,815 --> 02:12:08,455 So it, it's, it's whether it's a website like, um, I don't know, 2287 02:12:10,123 --> 02:12:11,943 Amazon I was gonna 2288 02:12:12,010 --> 02:12:12,820 Amazon, right? 2289 02:12:13,173 --> 02:12:13,593 yeah 2290 02:12:13,750 --> 02:12:19,690 either one of those, there is a, remember, it's, it's, remember this device, um, 2291 02:12:20,290 --> 02:12:24,130 you don't want to do that because your MFA token is then stored in your browser. 2292 02:12:24,970 --> 02:12:29,800 And so now a bad guy just asked to get you to a position or a situation where I can 2293 02:12:29,920 --> 02:12:34,660 scrape that MFA token out of your browser if I already have your credentials. 2294 02:12:34,990 --> 02:12:39,220 The only thing I need now is your MFA token, and now 2295 02:12:39,220 --> 02:12:40,330 I can get into your account. 2296 02:12:41,575 --> 02:12:42,085 So 2297 02:12:44,455 --> 02:12:50,215 I was gonna say, so MFA good MFA has to come with good policy and good practice. 2298 02:12:51,438 --> 02:12:55,878 So the the the point of this episode here is just to just if you're not familiar 2299 02:12:55,878 --> 02:13:00,888 with any of those three things go get familiar Um and the best way to do that 2300 02:13:00,888 --> 02:13:09,258 is to uh log in next week and we'll cover each of these in detail Um but uh You 2301 02:13:09,258 --> 02:13:13,338 know the idea between behind MFA is that if somebody gets a hold of your password 2302 02:13:13,608 --> 02:13:16,728 they won't be able to log in because they don't have that additional factor 2303 02:13:16,728 --> 02:13:22,248 whatever it is whether it's SMS or or um you know an authenticator app or a token 2304 02:13:22,248 --> 02:13:28,458 right We'll talk about these more and and all of those and passwords and MFA have 2305 02:13:28,488 --> 02:13:33,258 limitations and those limitations are us right It's the human and that's why 2306 02:13:33,258 --> 02:13:38,478 I think pass keys is the better option As we move forward in the future and I 2307 02:13:38,538 --> 02:13:46,968 I've been rolling out Pasky uh in many places wherever I can Uh it I'm not sure 2308 02:13:46,968 --> 02:13:57,948 if if it's great for like the average Joe there it can be confusing Um PAs 2309 02:13:57,948 --> 02:14:03,018 keys can be confusing if you don't if you don't know what you're doing But um but I 2310 02:14:03,235 --> 02:14:04,585 Did you ever use iron keys? 2311 02:14:04,705 --> 02:14:05,215 Curtis? 2312 02:14:05,778 --> 02:14:08,143 Uh what's a iron key 2313 02:14:09,295 --> 02:14:18,505 So an iron key is a, it's a military grade USB, and uh, in it, it's 2314 02:14:18,505 --> 02:14:20,600 got its own, you know, TPM chip. 2315 02:14:21,460 --> 02:14:25,390 Its own encryption, its own password manager, its own MFA. 2316 02:14:26,080 --> 02:14:31,525 And if you log into it, I think it's 20 times wrong, it self-destructs, 2317 02:14:31,750 --> 02:14:33,190 it's got a little capacitor in it. 2318 02:14:33,610 --> 02:14:38,740 It like, it'll smoke, uh, and if you try to cut into it to get to the chips, it's 2319 02:14:38,740 --> 02:14:40,750 also got a sensor and will self-destruct. 2320 02:14:41,823 --> 02:14:42,093 Yeah 2321 02:14:42,370 --> 02:14:43,365 Yeah, it's pretty cool. 2322 02:14:43,533 --> 02:14:46,023 that, but doesn't surprise me that you probably have. 2323 02:14:46,503 --> 02:14:50,673 Um, but anyway, so the, again, this is meant to be an overview episode. 2324 02:14:50,703 --> 02:14:55,203 Um, and if some of this was, was confusing or frustrating or you 2325 02:14:55,203 --> 02:14:58,953 felt like we didn't go into detail enough, then just, uh, we're gonna do 2326 02:14:58,953 --> 02:15:02,463 three more episodes where we go into each of these, uh, in more detail. 2327 02:15:03,603 --> 02:15:04,563 but it just. 2328 02:15:05,328 --> 02:15:07,218 You know, start looking into these three things. 2329 02:15:07,218 --> 02:15:09,648 Password man, regular password management. 2330 02:15:09,858 --> 02:15:11,478 I'm gonna start with that Inventory, right? 2331 02:15:11,478 --> 02:15:14,208 Make sure you have an inventory of everything, both your physical, your 2332 02:15:14,208 --> 02:15:16,248 virtual, and your, and your cloud systems. 2333 02:15:16,248 --> 02:15:16,638 What, 2334 02:15:16,664 --> 02:15:17,804 Wait, you said 2335 02:15:17,838 --> 02:15:18,228 what? 2336 02:15:18,554 --> 02:15:19,574 You meant patch management? 2337 02:15:20,538 --> 02:15:21,258 Oh, did I say that? 2338 02:15:21,258 --> 02:15:21,588 Okay. 2339 02:15:21,768 --> 02:15:22,158 All right. 2340 02:15:23,568 --> 02:15:26,688 So again, uh, you know, summary here, we've got three things here, right? 2341 02:15:26,688 --> 02:15:29,958 Make sure you're doing pa uh, uh, patch management, right? 2342 02:15:29,988 --> 02:15:32,568 Uh, that some sort of automated system. 2343 02:15:32,598 --> 02:15:35,238 Uh, and, and we're gonna start with an inventory, right? 2344 02:15:35,238 --> 02:15:39,198 A physical inventory, a virtual inventory, and a, an a SaaS inventory 2345 02:15:39,408 --> 02:15:42,408 of your entire environment to make sure that you know what it is you're 2346 02:15:42,408 --> 02:15:43,638 supposed to be looking out after. 2347 02:15:43,908 --> 02:15:46,398 You're gonna have a good password manager and you're gonna have good. 2348 02:15:46,443 --> 02:15:50,433 Um, you're gonna have an MFA or you're gonna have a, a passkey based system. 2349 02:15:50,853 --> 02:15:56,733 Uh, because, uh, without these three things, no point in having, you know, like 2350 02:15:56,733 --> 02:16:02,943 looking into an EEDM or, uh, I'm sorry, EDM looking into A EDR or an XDR system. 2351 02:16:03,213 --> 02:16:07,473 Um, and, um, you know, or, or you know, any, any of the other stuff 2352 02:16:07,473 --> 02:16:11,523 that we're talking about because it's like looking into a Roth IRA if you 2353 02:16:11,523 --> 02:16:12,783 don't even have a savings account. 2354 02:16:13,203 --> 02:16:13,563 Right. 2355 02:16:13,593 --> 02:16:17,953 Um, so, With that, uh, any final thoughts, Mike? 2356 02:16:20,142 --> 02:16:21,695 Doing something's better than nothing. 2357 02:16:22,705 --> 02:16:23,515 one of these and 2358 02:16:24,313 --> 02:16:24,703 yeah, 2359 02:16:24,835 --> 02:16:25,795 do something about it. 2360 02:16:26,203 --> 02:16:26,773 absolutely. 2361 02:16:26,773 --> 02:16:27,603 What about you, Prasanna 2362 02:16:28,929 --> 02:16:31,694 Well, I think the three makes sense and hopefully everyone 2363 02:16:31,694 --> 02:16:32,714 is using a password manage. 2364 02:16:33,014 --> 02:16:33,314 There. 2365 02:16:34,423 --> 02:16:34,753 I'm, 2366 02:16:34,765 --> 02:16:36,625 I've got a story about password management. 2367 02:16:36,688 --> 02:16:37,573 Please, please, 2368 02:16:37,585 --> 02:16:44,340 we were doing a, a red team on a, a brick and mortar nationwide retail. 2369 02:16:44,954 --> 02:16:45,374 Sorry. 2370 02:16:45,498 --> 02:16:45,798 Yeah. 2371 02:16:45,914 --> 02:16:48,794 we save this for the actual password manager episode? 2372 02:16:50,718 --> 02:16:51,168 Yeah, maybe 2373 02:16:51,370 --> 02:16:52,840 Sure it is a password 2374 02:16:53,388 --> 02:16:53,988 besides 2375 02:16:54,010 --> 02:16:54,580 management. 2376 02:16:54,708 --> 02:16:55,488 it's so weird. 2377 02:16:55,488 --> 02:17:00,078 The, the, the, the thing came on there for about 30 seconds and then went off again, 2378 02:17:00,828 --> 02:17:02,128 and you don't hear anything on your end. 2379 02:17:03,365 --> 02:17:04,540 Nothing changes here. 2380 02:17:04,540 --> 02:17:06,100 It's completely quiet in this room. 2381 02:17:07,773 --> 02:17:08,793 That's so weird. 2382 02:17:09,873 --> 02:17:12,903 Uh, a, it's a, what do they call it? 2383 02:17:12,903 --> 02:17:15,393 It's ghost and Shell, um, all right. 2384 02:17:16,263 --> 02:17:17,433 Uh, all right. 2385 02:17:17,699 --> 02:17:19,259 that up is 'cause we're already at 48 minutes. 2386 02:17:19,259 --> 02:17:19,709 So, 2387 02:17:19,803 --> 02:17:20,583 Yeah, yeah, yeah. 2388 02:17:20,763 --> 02:17:23,853 Well, we're gonna cut, we're gonna cut some of this out pretty much 2389 02:17:23,883 --> 02:17:25,143 half the time that Mike talks. 2390 02:17:25,143 --> 02:17:25,773 We're just cut it out. 2391 02:17:26,583 --> 02:17:26,943 anyway. 2392 02:17:29,238 --> 02:17:30,498 All right, Prasanna Thanks. 2393 02:17:30,648 --> 02:17:32,778 Thanks for, uh, being here again as well. 2394 02:17:32,808 --> 02:17:33,348 Forever. 2395 02:17:33,359 --> 02:17:35,624 and look, see I shaved, just so you know. 2396 02:17:35,658 --> 02:17:36,618 Yeah, absolutely. 2397 02:17:36,738 --> 02:17:37,368 Absolutely. 2398 02:17:37,668 --> 02:17:37,998 Alright. 2399 02:17:37,998 --> 02:17:40,488 Actually, I, I don't know if anybody can tell, but I, I had 2400 02:17:40,488 --> 02:17:41,718 my, I had my beard trimmed. 2401 02:17:41,748 --> 02:17:44,628 I had a photo op yesterday, so it, my beard's all nice and trimmed. 2402 02:17:44,628 --> 02:17:52,338 So anyway, or as my granddaughter said, slay Um, and that is a wrap. 2403 02:17:53,928 --> 02:17:54,708 Why do I stop? 2404 02:17:55,503 --> 02:17:55,793 Okay.