1 00:00:00,000 --> 00:00:01,620 Welcome to the backup wrap up. 2 00:00:01,770 --> 00:00:05,460 The only podcast dedicated to the underappreciated heroes of 3 00:00:05,460 --> 00:00:07,589 the data center backup admins. 4 00:00:08,129 --> 00:00:11,490 We're continuing our coverage of ransomware, and today we're 5 00:00:11,490 --> 00:00:13,680 again talking about preventing it. 6 00:00:14,160 --> 00:00:18,450 We'll cover a range of preventative measures including application 7 00:00:18,450 --> 00:00:23,940 whitelisting and blacklisting, inventorying service accounts, restricting 8 00:00:23,940 --> 00:00:29,370 risky services, and the importance of establishing relationships now with red 9 00:00:29,370 --> 00:00:31,800 and blue teams as well as law enforcement. 10 00:00:32,369 --> 00:00:34,709 Let's keep ransomware out of your environment. 11 00:00:35,535 --> 00:00:39,464 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 12 00:00:39,464 --> 00:00:44,159 Backup, and I've been passionate about backup and recovery for over 30 years. 13 00:00:44,339 --> 00:00:44,849 Ever since. 14 00:00:44,849 --> 00:00:47,819 I had to tell my boss that there were no backups of the 15 00:00:47,819 --> 00:00:49,559 database that we had just lost. 16 00:00:49,859 --> 00:00:52,229 I don't want that to happen to me ever again. 17 00:00:52,319 --> 00:00:53,639 I don't want it to happen to you. 18 00:00:53,639 --> 00:00:55,349 That's why I do this podcast. 19 00:00:55,709 --> 00:01:00,029 Here we turn Unappreciated backup admins into Cyber Recovery Heroes. 20 00:01:00,359 --> 00:01:02,279 This is the backup wrap up. 21 00:01:15,245 --> 00:01:16,265 Welcome to the show. 22 00:01:17,175 --> 00:01:20,775 Before we get started, I just want to ask you to press the follow or subscribe 23 00:01:20,775 --> 00:01:24,315 button so that you can always get this show, whether you're following 24 00:01:24,345 --> 00:01:26,895 on an audio format or on YouTube. 25 00:01:27,315 --> 00:01:29,145 Uh, either way we'd love to have you. 26 00:01:29,685 --> 00:01:32,445 I'm your host, w Curtis Preston, AKA, Mr. 27 00:01:32,445 --> 00:01:35,175 Backup, and with me, I have my. 28 00:01:35,850 --> 00:01:41,410 Non-standard air conditioning installer, sympathizer Prasanna Malaiyandi. 29 00:01:41,430 --> 00:01:41,910 How's it going? 30 00:01:41,910 --> 00:01:42,500 Prasanna? 31 00:01:43,335 --> 00:01:46,035 I am doing well, Curtis, and here's a question. 32 00:01:46,215 --> 00:01:48,630 Do you have working air conditioning as of this moment? 33 00:01:50,070 --> 00:01:50,640 No, 34 00:01:54,545 --> 00:01:59,340 I do have, it's, it's at 95%. 35 00:02:00,030 --> 00:02:03,180 Um, I'm doing a very non-standard. 36 00:02:03,245 --> 00:02:04,025 I'm installing. 37 00:02:04,665 --> 00:02:10,695 One of those portable air conditioners, but I'm installing it up on the wall so 38 00:02:10,695 --> 00:02:15,105 that, because where I live, you know, I have an HOA and they won't let me 39 00:02:15,105 --> 00:02:17,025 put like a window unit air conditioner. 40 00:02:17,030 --> 00:02:17,265 Right. 41 00:02:17,265 --> 00:02:21,735 So I have the, you know, but I don't, I don't have a spot to put it on the 42 00:02:21,735 --> 00:02:23,745 floor, so I'm mounting it up on the wall. 43 00:02:23,775 --> 00:02:25,305 So it involves lots of heavy. 44 00:02:26,070 --> 00:02:30,480 Brackets and things like that, and lots of, uh, literal sweat 45 00:02:30,480 --> 00:02:33,300 equity and putting it up. 46 00:02:33,510 --> 00:02:38,460 And sadly I put it up and then, as you know, uh, had to take it down and 47 00:02:38,460 --> 00:02:43,110 put it up again because I neglected to account for the distance between the 48 00:02:43,530 --> 00:02:45,390 exhaust port and the window oopsies. 49 00:02:46,140 --> 00:02:47,405 Yeah, that's not good. 50 00:02:47,795 --> 00:02:48,215 Oopsie. 51 00:02:48,660 --> 00:02:51,180 Do you, did you also cut a hole for the cord? 52 00:02:51,795 --> 00:02:53,115 I did, I cut a hole for the, 53 00:02:53,400 --> 00:02:53,790 Okay. 54 00:02:54,255 --> 00:02:56,745 I cut a and, and I cut a very nice hole, a very nice hole for the cord. 55 00:02:56,775 --> 00:02:59,325 That was the, another mistake in the first version. 56 00:03:00,345 --> 00:03:03,045 Uh, it's what happens when you're just sort of winging it, you know? 57 00:03:03,105 --> 00:03:04,365 Like, oh, I just need a shelf. 58 00:03:04,395 --> 00:03:05,145 I just need a shelf. 59 00:03:05,145 --> 00:03:07,695 And some brackets, I bought some nice brackets, you know? 60 00:03:08,385 --> 00:03:09,555 might I recommend, 61 00:03:09,705 --> 00:03:10,155 Yeah. 62 00:03:10,335 --> 00:03:13,005 I know it's like above like a bed and things like that, that 63 00:03:13,005 --> 00:03:14,085 sometimes people sleep in. 64 00:03:14,145 --> 00:03:14,565 Yeah. 65 00:03:14,685 --> 00:03:17,720 I recommend telling people whenever they sleep to put their head on the 66 00:03:17,720 --> 00:03:19,840 other side away from the AC unit? 67 00:03:21,210 --> 00:03:23,490 Well, they can sit up. 68 00:03:23,950 --> 00:03:24,810 No, no, no. 69 00:03:24,870 --> 00:03:25,090 I'm 70 00:03:25,200 --> 00:03:25,620 What 71 00:03:25,995 --> 00:03:28,095 in case something falls. 72 00:03:28,380 --> 00:03:29,610 are you questioning? 73 00:03:29,610 --> 00:03:32,520 The structural integrity of my air conditioning unit. 74 00:03:32,865 --> 00:03:35,415 no, but just say that there we live in California. 75 00:03:35,415 --> 00:03:39,085 There might be an earthquake, it might be enough that it shakes off even 76 00:03:39,085 --> 00:03:41,005 though you do have a lip to keep it in 77 00:03:41,315 --> 00:03:41,605 Yeah. 78 00:03:42,325 --> 00:03:42,445 I. 79 00:03:43,240 --> 00:03:46,150 Yeah, I do have a lip to keep it in place. 80 00:03:46,285 --> 00:03:51,835 saying that having a 65 pound or whatever air conditioner fall on your head is 81 00:03:51,835 --> 00:03:54,715 probably a lot worse than a 65 pound air conditioner falling on your foot. 82 00:03:56,050 --> 00:03:57,280 Uh, yeah, that's probably true. 83 00:03:57,400 --> 00:03:58,060 That's probably true. 84 00:03:59,560 --> 00:04:02,080 So, uh, but thanks for that image. 85 00:04:02,170 --> 00:04:02,620 Um. 86 00:04:06,085 --> 00:04:10,495 So we're gonna continue our series in ransomware. 87 00:04:10,555 --> 00:04:14,005 Uh, this one is gonna be talking about ransomware prevention. 88 00:04:14,515 --> 00:04:17,575 In terms of other things that we can do, we've already talked about, 89 00:04:17,935 --> 00:04:21,085 um, the, you know, we've talked about protecting the backup server. 90 00:04:21,085 --> 00:04:24,985 We've talked about the, the three things that everyone 91 00:04:24,985 --> 00:04:27,265 should do to prevent ransomware. 92 00:04:27,265 --> 00:04:28,405 What are those three things? 93 00:04:28,405 --> 00:04:28,915 Prasanna? 94 00:04:30,265 --> 00:04:31,135 Patch 95 00:04:31,285 --> 00:04:31,735 Yeah. 96 00:04:32,065 --> 00:04:32,875 Patch management. 97 00:04:33,200 --> 00:04:33,400 password 98 00:04:33,775 --> 00:04:34,585 Password management. 99 00:04:34,680 --> 00:04:51,490 M-F-A-P-P-M. 100 00:04:51,685 --> 00:04:53,725 if you're not using, um. 101 00:04:54,340 --> 00:04:57,820 If you're not using MFA at this point, uh, you're gonna hear, it's 102 00:04:57,820 --> 00:05:01,120 gonna come up again in this episode, but this is in addition to that. 103 00:05:01,120 --> 00:05:03,760 In addition to all the stuff that you did to, to, you know, 104 00:05:04,000 --> 00:05:06,400 this is assuming you did that. 105 00:05:06,610 --> 00:05:07,870 What's the next step? 106 00:05:07,875 --> 00:05:11,110 These are the, please do these things. 107 00:05:11,440 --> 00:05:15,820 Um, it will also make it harder for you to be attacked by 108 00:05:15,820 --> 00:05:18,280 ransomware and the, the first one. 109 00:05:18,360 --> 00:05:21,085 could make it harder for you to also use things too. 110 00:05:21,870 --> 00:05:22,160 What 111 00:05:23,470 --> 00:05:23,800 It's 112 00:05:23,815 --> 00:05:26,065 this, this is true, right? 113 00:05:26,065 --> 00:05:31,675 A lot of times security is at war with usability, 114 00:05:32,575 --> 00:05:32,795 Yep. 115 00:05:32,965 --> 00:05:33,475 right? 116 00:05:33,895 --> 00:05:37,825 Um, and I, I tell the following, uh, story, which I know I've told here 117 00:05:37,825 --> 00:05:41,635 before, but I remember back when I first. 118 00:05:42,190 --> 00:05:45,370 Um, you know, did backup software. 119 00:05:45,880 --> 00:05:49,120 We used this lovely thing called RSH. 120 00:05:49,120 --> 00:05:49,510 Right. 121 00:05:49,990 --> 00:05:54,220 And all you had to have was, uh, you know, an entry in, uh, 122 00:05:54,220 --> 00:05:55,900 I forgot the name of the file. 123 00:05:57,130 --> 00:06:01,870 There was a file in the, the, you know, the, your, your, your home directory, 124 00:06:01,870 --> 00:06:06,430 which even if it was root you, if you had that file, um, and, and it had 125 00:06:06,430 --> 00:06:09,670 the name of the host you were coming from in that file, you could RSH. 126 00:06:10,885 --> 00:06:13,675 As root without a password. 127 00:06:14,425 --> 00:06:23,425 And, and I happen to know that one company where I, um, installed backup software. 128 00:06:23,425 --> 00:06:27,085 One of the many that I did throughout the years, household name company. 129 00:06:27,925 --> 00:06:33,925 Um, when I got there, they had RSH as root from every Unix 130 00:06:33,925 --> 00:06:36,145 host to every other Unix host. 131 00:06:36,385 --> 00:06:38,995 And this was like a major company. 132 00:06:39,325 --> 00:06:39,595 yeah. 133 00:06:40,525 --> 00:06:43,105 Um, why, why do I bring that up? 134 00:06:43,225 --> 00:06:47,695 Um, it, it, you know, I, I just remember how much the security people hated that. 135 00:06:47,785 --> 00:06:48,145 Right? 136 00:06:48,160 --> 00:06:48,460 Yeah, 137 00:06:48,805 --> 00:06:50,935 And, but, but lemme just finish. 138 00:06:51,205 --> 00:06:56,935 But the reason was that the tool in question was our dump. 139 00:06:58,045 --> 00:07:02,875 Our dump wouldn't work if you didn't, if you couldn't RSH 140 00:07:02,875 --> 00:07:03,985 as root without a password. 141 00:07:04,420 --> 00:07:04,690 Yeah. 142 00:07:04,960 --> 00:07:06,190 Okay, so that's one side. 143 00:07:06,190 --> 00:07:09,730 Now let's go to the other extreme, right where I think you've told a 144 00:07:09,730 --> 00:07:13,960 story on the podcast before the one company you worked at where the network 145 00:07:13,960 --> 00:07:16,150 people locked down every single server. 146 00:07:16,180 --> 00:07:17,260 yeah, yeah. 147 00:07:17,440 --> 00:07:21,400 It was the most secure company that I'd ever worked at. 148 00:07:21,700 --> 00:07:26,710 It was the complete opposite of that other company and, um, 149 00:07:27,550 --> 00:07:32,015 where we, we were prepping for Y 2K and that they were really. 150 00:07:33,235 --> 00:07:35,995 It was, it was a very secure environment where they did, they did all the 151 00:07:35,995 --> 00:07:38,485 things that we asked people to do and, and you weren't able to get 152 00:07:38,485 --> 00:07:39,985 from one server to another server. 153 00:07:39,985 --> 00:07:43,315 It's like, the question was, why do you need to get from server A to server B? 154 00:07:43,885 --> 00:07:44,245 Right? 155 00:07:44,725 --> 00:07:48,385 Uh, you, you needed a reason to be able to communicate between those 156 00:07:48,385 --> 00:07:51,355 two servers and then they would open up only the port that you needed. 157 00:07:52,225 --> 00:07:56,275 And I was the, the one crazy guy that, you know, my server needed 158 00:07:56,275 --> 00:07:58,105 to talk to all the servers because. 159 00:07:59,485 --> 00:07:59,845 Backup. 160 00:08:00,265 --> 00:08:04,105 And they didn't like that, and they kept trying to shut it down. 161 00:08:04,105 --> 00:08:06,535 And then, and, and then they, and then they kept trying 162 00:08:06,540 --> 00:08:07,795 to like sniff the problem. 163 00:08:07,795 --> 00:08:13,255 The problem with net backup, uh, well, one of the problems with net backup is 164 00:08:13,255 --> 00:08:16,795 that it uses a random series of ports. 165 00:08:17,215 --> 00:08:22,825 And, um, so they did not like that and they kept shutting things down. 166 00:08:22,825 --> 00:08:27,805 And Yes, uh, it, it just, it was, uh, so let's just say this. 167 00:08:29,110 --> 00:08:34,570 This thing of security, being at war with usability is not, it's not a new problem. 168 00:08:34,990 --> 00:08:35,380 Yep. 169 00:08:35,740 --> 00:08:39,580 Um, and the first thing that I want to talk about it, it's just something that 170 00:08:39,580 --> 00:08:43,390 I want you to think about because as I recall the last time you and I talked 171 00:08:43,390 --> 00:08:46,210 about it, I think you were against it. 172 00:08:46,840 --> 00:08:47,860 Um. 173 00:08:48,595 --> 00:08:50,455 And, and, and we'll, we'll see. 174 00:08:50,635 --> 00:08:50,995 Um, 175 00:08:51,130 --> 00:08:51,400 yeah. 176 00:08:51,445 --> 00:08:54,145 that is this concept of application white listing. 177 00:08:54,865 --> 00:08:57,385 Uh, and in my notes, I have this as the silver bullet. 178 00:08:57,385 --> 00:08:58,345 And why do I say that? 179 00:08:59,545 --> 00:09:01,855 And we can argue as to whether or not it's a good silver bullet. 180 00:09:01,855 --> 00:09:03,385 But why do I say it's a silver bullet, 181 00:09:04,990 --> 00:09:09,310 Because you're basically restricting what runs in the environment. 182 00:09:09,565 --> 00:09:09,835 right? 183 00:09:09,835 --> 00:09:09,865 I. 184 00:09:10,035 --> 00:09:13,450 you control what runs, then there's less likelihood that you will be 185 00:09:13,780 --> 00:09:15,880 using something that is malicious. 186 00:09:16,480 --> 00:09:17,530 Right, right. 187 00:09:17,530 --> 00:09:24,640 So if we, if we say only, you know, Microsoft Word and SQL Server and 188 00:09:24,790 --> 00:09:27,550 SharePoint are the only things that are allowed to run on this box. 189 00:09:27,790 --> 00:09:31,990 If there's something other than that malware based, then it just 190 00:09:31,990 --> 00:09:34,750 won't be able to run because it's not whitelisted, right? 191 00:09:35,345 --> 00:09:35,635 Yeah. 192 00:09:35,650 --> 00:09:38,140 It is a giant pain in the butt. 193 00:09:39,295 --> 00:09:39,505 Geez. 194 00:09:40,345 --> 00:09:45,145 Can, can we agree that application white listing is a giant pain in the butt? 195 00:09:45,175 --> 00:09:45,715 What do you think? 196 00:09:46,420 --> 00:09:46,690 Yeah. 197 00:09:46,690 --> 00:09:47,470 No, I agree. 198 00:09:47,695 --> 00:09:48,295 Yeah. 199 00:09:49,525 --> 00:09:57,205 Is it however, something that we should think about in certain circumstances? 200 00:09:57,385 --> 00:10:03,445 For example, if you have a very well, uh, understood. 201 00:10:04,300 --> 00:10:09,700 End user community, that they all use the same 17 applications. 202 00:10:10,450 --> 00:10:10,900 Right? 203 00:10:11,475 --> 00:10:11,765 Yeah. 204 00:10:12,160 --> 00:10:17,050 And you could, you could lock it down to the same 17 applications for all of those. 205 00:10:17,050 --> 00:10:21,520 And then of course you will absolutely have some users who are special. 206 00:10:21,820 --> 00:10:24,850 Their name will probably be Curtis or Prasanna. 207 00:10:25,270 --> 00:10:28,300 'cause we always want to do stuff that's outside of the norm. 208 00:10:28,300 --> 00:10:28,660 Right. 209 00:10:29,290 --> 00:10:29,950 Um. 210 00:10:30,355 --> 00:10:33,055 You, you, you'll have a handful of power users that will end 211 00:10:33,055 --> 00:10:35,125 up with 37 other applications. 212 00:10:36,430 --> 00:10:40,825 I, I think that in those scenario, like we don't, maybe we don't have to 213 00:10:40,825 --> 00:10:45,655 do it for, well, there, there's just, there are areas where maybe it's harder 214 00:10:45,655 --> 00:10:48,475 to do than others and I'm thinking 215 00:10:48,985 --> 00:10:50,095 or functional units. 216 00:10:50,155 --> 00:10:51,145 Right, right. 217 00:10:51,295 --> 00:10:51,505 Yeah, 218 00:10:51,745 --> 00:10:55,585 Um, if there's an area where you can do this, I guess I'm 219 00:10:55,585 --> 00:10:56,935 just saying think about it. 220 00:10:57,685 --> 00:10:57,985 yeah. 221 00:10:58,210 --> 00:11:02,680 If you application white listing, I think it would be, it would go a long 222 00:11:02,680 --> 00:11:04,845 way to stopping ransomware or any 223 00:11:04,945 --> 00:11:09,535 I think there's different ways you can implement application whitelisting, 224 00:11:10,375 --> 00:11:15,745 One way is to sort of say, Hey, here is a list of approved IT applications 225 00:11:15,745 --> 00:11:19,285 that you are allowed to install and deploy, but don't necessarily prevent 226 00:11:19,290 --> 00:11:21,085 people from installing other things. 227 00:11:21,115 --> 00:11:25,555 You sort of use the honor system or IT policies just like everyone has, right? 228 00:11:25,555 --> 00:11:27,355 You sign a code of conduct when you join a 229 00:11:27,580 --> 00:11:27,670 right. 230 00:11:27,685 --> 00:11:27,955 right? 231 00:11:28,915 --> 00:11:30,325 Or the employee handbook, right? 232 00:11:30,580 --> 00:11:35,590 and then could we perhaps monitor for anything that is outside 233 00:11:35,590 --> 00:11:39,100 the white list and then send off the, the CLS and alerts when it 234 00:11:39,385 --> 00:11:39,655 Yep. 235 00:11:40,000 --> 00:11:40,360 Yeah. 236 00:11:41,050 --> 00:11:41,320 Yeah. 237 00:11:41,335 --> 00:11:41,605 Right. 238 00:11:41,605 --> 00:11:43,675 So you can at least start a process so you're not getting in the 239 00:11:43,675 --> 00:11:46,495 way, but at least you're having an ability to monitor and figure 240 00:11:46,500 --> 00:11:48,475 out, okay, what are people doing? 241 00:11:48,480 --> 00:11:49,465 Does this make sense? 242 00:11:49,465 --> 00:11:52,405 And maybe you also have a list of applications, because I think in 243 00:11:52,405 --> 00:11:55,825 addition to having a list of applications that you approve in that white list, 244 00:11:56,275 --> 00:11:58,915 it's also important to have a list of applications that you block. 245 00:12:00,505 --> 00:12:00,835 Yeah. 246 00:12:00,970 --> 00:12:02,950 Which is also as equally as important, 247 00:12:03,115 --> 00:12:05,395 what would, what would the name of that process be? 248 00:12:07,750 --> 00:12:09,220 Application blacklist. 249 00:12:09,295 --> 00:12:09,715 Yes. 250 00:12:09,900 --> 00:12:10,190 Okay. 251 00:12:10,370 --> 00:12:13,765 You, you said that like, it, you weren't sure. 252 00:12:13,825 --> 00:12:14,095 Yes. 253 00:12:14,095 --> 00:12:15,625 It's the opposite of a white list, right? 254 00:12:15,955 --> 00:12:17,005 Application blacklist. 255 00:12:17,005 --> 00:12:17,305 Right. 256 00:12:17,605 --> 00:12:20,245 So you could, you could have a, a series of apps. 257 00:12:20,920 --> 00:12:26,440 Um, and, and I would put a lot of the security software that is 258 00:12:26,440 --> 00:12:33,970 often installed by, um, uh, cyber attackers as, um, bl blacklisted. 259 00:12:34,120 --> 00:12:37,990 Again, there are exceptions to the blacklist where you need to install 260 00:12:37,995 --> 00:12:42,000 it, and then you want to find out who, who is actually trying to 261 00:12:42,000 --> 00:12:44,160 install such, such tools, right? 262 00:12:45,330 --> 00:12:45,870 Um. 263 00:12:47,730 --> 00:12:53,070 And I think another thing Curtis, that becomes interesting is days a lot 264 00:12:53,070 --> 00:12:54,990 of people just use SaaS application. 265 00:12:54,990 --> 00:12:58,050 So by using a SaaS application, you don't even have to worry about 266 00:12:58,050 --> 00:13:00,120 application whitelisting as much anymore. 267 00:13:00,285 --> 00:13:01,695 Isn't SaaS so great? 268 00:13:03,555 --> 00:13:05,685 There are things I don't like, as, you know, there are things I 269 00:13:05,685 --> 00:13:07,005 don't like about the SaaS world. 270 00:13:07,215 --> 00:13:12,105 I'm concern very much about all the data that's out there, but, um, but this is 271 00:13:12,105 --> 00:13:14,085 definitely a, an advantage of the SaaS. 272 00:13:14,175 --> 00:13:18,495 Uh, you know, we're, I mean, as we are talking, we are using a SaaS application. 273 00:13:18,845 --> 00:13:19,265 Mm-Hmm. 274 00:13:19,365 --> 00:13:22,755 I don't know how we would do this back in the day. 275 00:13:24,255 --> 00:13:24,705 Right. 276 00:13:25,365 --> 00:13:31,125 I guess we could, what, what was that tool that we used to O-B-O-B-C-O-B-S-O-B-S. 277 00:13:31,515 --> 00:13:37,935 We, we used to use OBS, um, and theoretically we could do that, but we 278 00:13:37,935 --> 00:13:40,185 would still need a way to see each other. 279 00:13:40,815 --> 00:13:42,290 Um, which, 280 00:13:42,410 --> 00:13:44,055 have FaceTime running in parallel. 281 00:13:44,290 --> 00:13:45,090 would be a SaaS. 282 00:13:46,005 --> 00:13:46,305 Yeah, 283 00:13:48,555 --> 00:13:48,885 Yeah. 284 00:13:51,075 --> 00:13:51,435 There. 285 00:13:51,645 --> 00:13:57,675 You know what I remember back in the very early days, I remember 286 00:13:58,125 --> 00:14:00,795 software that you used on your laptop. 287 00:14:00,795 --> 00:14:02,895 You had a piece of software running on your laptop. 288 00:14:03,105 --> 00:14:05,775 They had a piece of software running on their laptop, and those two pieces 289 00:14:05,775 --> 00:14:11,270 of software directly communicated, um, to, to webcam to each other. 290 00:14:12,345 --> 00:14:16,665 Man, those were such, so, so bad in terms of quality. 291 00:14:17,085 --> 00:14:17,475 Yeah. 292 00:14:17,595 --> 00:14:17,955 Oh yeah. 293 00:14:17,955 --> 00:14:21,915 So yeah, that the, the SaaS world makes things a lot easier. 294 00:14:22,305 --> 00:14:22,575 Um. 295 00:14:23,775 --> 00:14:25,155 All right, so enough of that. 296 00:14:25,575 --> 00:14:30,375 So now let's talk about disabling other attack vectors. 297 00:14:30,885 --> 00:14:36,465 Now, one of the things that came up when, um, we had Dwayne on with the, the, the 298 00:14:36,470 --> 00:14:41,775 red team, uh, episode, which at this point is now about five or six episodes back. 299 00:14:43,110 --> 00:14:48,090 Is this idea that there are service accounts out there that are running 300 00:14:48,090 --> 00:14:53,610 with like, no, no password default passwords are really crappy passwords. 301 00:14:53,670 --> 00:14:54,090 Right? 302 00:14:55,200 --> 00:14:56,520 What's a, what's a service account? 303 00:14:56,525 --> 00:14:57,330 Why does this matter? 304 00:14:58,170 --> 00:15:03,660 So a service account is like a special privileged account that runs on the system 305 00:15:03,900 --> 00:15:08,340 and is used for things that need to happen without necessarily user interaction. 306 00:15:09,180 --> 00:15:10,350 an example, backup. 307 00:15:10,680 --> 00:15:11,100 Right. 308 00:15:11,115 --> 00:15:13,635 So normally you have a backup service account that runs on 309 00:15:13,635 --> 00:15:17,145 the system and kicks off backups that need to happen on the system 310 00:15:17,700 --> 00:15:21,690 Do you remember the special thing he said about the backup service account? 311 00:15:22,575 --> 00:15:24,135 that it had access to everything. 312 00:15:24,570 --> 00:15:27,300 It had a access to everything without logging, 313 00:15:28,155 --> 00:15:28,425 Yeah. 314 00:15:28,635 --> 00:15:28,985 right. 315 00:15:29,325 --> 00:15:29,985 Oh, that's right. 316 00:15:30,585 --> 00:15:30,795 Right, 317 00:15:31,030 --> 00:15:31,320 Yeah. 318 00:15:31,365 --> 00:15:35,625 so it can access all the files that it wants, download all the files it wants, 319 00:15:35,625 --> 00:15:37,665 because that's what backup is, right? 320 00:15:37,665 --> 00:15:41,235 Override all the files it wants, because that's what Restore is without 321 00:15:41,325 --> 00:15:43,845 triggering any alarms of any kind. 322 00:15:45,795 --> 00:15:46,085 Yeah, 323 00:15:46,215 --> 00:15:49,695 here you have it installed with the password of backup 324 00:15:52,485 --> 00:15:57,705 or, or maybe it's installed with net backup or networker or TSM. 325 00:15:58,395 --> 00:15:59,145 Um. 326 00:15:59,730 --> 00:16:00,210 Yeah. 327 00:16:00,300 --> 00:16:01,590 Or Veeam, right? 328 00:16:01,680 --> 00:16:03,480 Uh, please, please don't do that. 329 00:16:03,960 --> 00:16:04,290 Right? 330 00:16:04,500 --> 00:16:09,360 So, so I wanna talk about, so we need to figure out how many 331 00:16:09,360 --> 00:16:11,970 service accounts are out there. 332 00:16:12,420 --> 00:16:17,010 And so there is this, uh, there is this concept of a service account inventory. 333 00:16:17,625 --> 00:16:23,145 Um, and when I, when I googled that there, you know, there, there, there were 334 00:16:23,145 --> 00:16:25,305 some, uh, some things that you could do. 335 00:16:25,305 --> 00:16:29,625 Obviously they talked about things like reviewing the documentation, uh, you know, 336 00:16:29,630 --> 00:16:34,935 any documentation you have as to where you would typically install service accounts. 337 00:16:34,995 --> 00:16:39,075 Uh, there are active directory tools such as, uh, you know, PowerShell 338 00:16:39,405 --> 00:16:41,355 that you can look for, things like. 339 00:16:42,435 --> 00:16:47,655 Special account flags and two special account flags pop up. 340 00:16:47,685 --> 00:16:48,675 Do you know what they are? 341 00:16:51,225 --> 00:16:51,945 I'm gonna guess no. 342 00:16:52,575 --> 00:16:53,385 Why would you know this? 343 00:16:53,685 --> 00:16:54,135 Right? 344 00:16:54,495 --> 00:16:58,935 The two special account flags that they popped up are, don't expire. 345 00:16:58,935 --> 00:17:00,795 Password or password? 346 00:17:00,795 --> 00:17:02,295 Not required. 347 00:17:03,465 --> 00:17:03,685 Ugh. 348 00:17:04,425 --> 00:17:06,945 Password not required. 349 00:17:07,500 --> 00:17:12,210 Um, you know, look for group membership, like domain admins, enterprise admins, 350 00:17:12,600 --> 00:17:19,260 um, you know, and look for the types of applications that need service accounts. 351 00:17:19,860 --> 00:17:23,760 What kinds of applications besides backup would you think those are? 352 00:17:24,005 --> 00:17:24,355 Right, 353 00:17:25,155 --> 00:17:29,340 Anything that runs as like a Damon process right in the background on the system, 354 00:17:29,850 --> 00:17:30,240 right. 355 00:17:31,500 --> 00:17:31,980 Um. 356 00:17:32,470 --> 00:17:33,110 security software 357 00:17:33,625 --> 00:17:33,885 Right. 358 00:17:34,125 --> 00:17:39,980 Security software, ironically enough, u uses a service account antivirus. 359 00:17:40,150 --> 00:17:40,500 Right. 360 00:17:41,160 --> 00:17:43,660 Um, the, um, go ahead. 361 00:17:44,460 --> 00:17:48,330 But I think though a service account, you cannot, normally, you're not allowed 362 00:17:48,330 --> 00:17:51,090 to log in using a service account, 363 00:17:51,090 --> 00:17:51,440 Right. 364 00:17:51,570 --> 00:17:52,020 right. 365 00:17:52,290 --> 00:17:57,840 It is just for things that are already on the system to be able to operate 366 00:17:57,900 --> 00:18:00,930 with different privileges on the system. 367 00:18:01,205 --> 00:18:01,495 Yeah. 368 00:18:01,875 --> 00:18:02,265 Right. 369 00:18:02,295 --> 00:18:08,745 You can't log in like in the traditional sense, but you can log in from an 370 00:18:08,745 --> 00:18:11,955 API perspective and do the things that that thing is supposed to do. 371 00:18:13,005 --> 00:18:20,715 And so all I'm saying is figure out what those are and give them real passwords. 372 00:18:21,300 --> 00:18:27,150 If you've got accounts, service accounts that say, don't, you know, no password 373 00:18:27,150 --> 00:18:31,560 required, it seems like that is bad. 374 00:18:32,250 --> 00:18:37,020 Yeah, and I think the other thing to mention is the service accounts are 375 00:18:37,290 --> 00:18:39,540 basically on a per machine basis. 376 00:18:39,660 --> 00:18:40,110 Yes. 377 00:18:41,250 --> 00:18:43,980 So it's not like you can go look in active directory and say, Hey, where, 378 00:18:44,010 --> 00:18:45,060 what are all my service accounts? 379 00:18:45,060 --> 00:18:49,140 You have to hit every single box and say, what are the service accounts available? 380 00:18:49,145 --> 00:18:51,630 And that's why you use things like PowerShell and other things 381 00:18:52,355 --> 00:18:53,760 make sure, okay, what is there? 382 00:18:54,150 --> 00:18:57,060 And this inventory shouldn't be on a one-time basis either 383 00:18:57,470 --> 00:18:57,820 Right. 384 00:18:57,935 --> 00:18:59,250 applications get added. 385 00:18:59,250 --> 00:19:01,980 Remove systems come online, get decommissioned. 386 00:19:03,255 --> 00:19:04,875 Yeah, a very regular thing. 387 00:19:04,875 --> 00:19:07,065 You should be out there looking for new service accounts. 388 00:19:07,555 --> 00:19:14,725 So I'm hearing that the most common way that systems are compromised these 389 00:19:14,725 --> 00:19:17,635 days is, um, sole and credentials. 390 00:19:17,995 --> 00:19:19,255 What's the second? 391 00:19:21,220 --> 00:19:22,120 Most common way. 392 00:19:24,760 --> 00:19:29,080 What was that for those not watching the video version on YouTube? 393 00:19:29,530 --> 00:19:34,580 Uh, Prasanna just made a, a, I think that was, was that like a phishing reel? 394 00:19:34,580 --> 00:19:34,910 Uh, 395 00:19:34,910 --> 00:19:38,185 it's a phishing reel and then, uh, pull it back in 396 00:19:39,940 --> 00:19:41,860 um, yeah. 397 00:19:41,860 --> 00:19:47,050 phishing with a pH, uh, phishing and, uh, and spearphishing, which 398 00:19:47,050 --> 00:19:48,770 is a very specific type of phishing. 399 00:19:49,885 --> 00:19:56,065 The, and this is often via, um, email, right? 400 00:19:56,305 --> 00:20:00,985 And so another thing I'd like you to consider is, again, 401 00:20:00,985 --> 00:20:02,665 these are all optional things. 402 00:20:02,695 --> 00:20:05,905 Um, you know, some less optional I think than others. 403 00:20:06,355 --> 00:20:11,215 But this is something to consider and that is the idea of putting in some 404 00:20:11,215 --> 00:20:16,015 type of monitoring system, filtering system in your email system in 405 00:20:16,015 --> 00:20:18,715 order to, uh, see if you can catch. 406 00:20:19,390 --> 00:20:24,670 You know, use ai, um, and, and other tools to identify phishing, 407 00:20:25,930 --> 00:20:27,760 uh, attacks on the front end. 408 00:20:28,375 --> 00:20:33,925 and I believe that many of the SaaS email providers like Microsoft and 409 00:20:33,925 --> 00:20:39,955 Google have pretty extensive phishing protections already built in, but 410 00:20:40,135 --> 00:20:44,215 it doesn't mean you shouldn't use a third party solution as well. 411 00:20:44,785 --> 00:20:46,525 I think that's true everywhere, right? 412 00:20:46,525 --> 00:20:47,455 That there's often 413 00:20:47,545 --> 00:20:47,605 Yeah. 414 00:20:47,815 --> 00:20:50,815 os tools that are available, but there are, um. 415 00:20:52,570 --> 00:20:55,720 Uh, third party tools that may be more extensive. 416 00:20:55,720 --> 00:20:58,420 The question, they will also be more expensive, 417 00:20:59,425 --> 00:20:59,695 Yeah. 418 00:21:00,130 --> 00:21:01,540 Extensive and expensive. 419 00:21:02,290 --> 00:21:07,870 Um, all right, so we gotta talk about my favorite boogieman. 420 00:21:08,410 --> 00:21:09,071 What, what is it? 421 00:21:10,945 --> 00:21:12,685 Port 3 9, 2 2, I 422 00:21:12,975 --> 00:21:13,315 Is that. 423 00:21:13,735 --> 00:21:14,215 Or is it three? 424 00:21:14,215 --> 00:21:14,455 Five. 425 00:21:14,455 --> 00:21:15,025 Five, three. 426 00:21:15,505 --> 00:21:19,495 Is that the port for RDP, the Ransomware deployment Protocol? 427 00:21:20,065 --> 00:21:21,175 Um, yeah. 428 00:21:21,235 --> 00:21:21,385 I, 429 00:21:21,850 --> 00:21:22,150 Nine. 430 00:21:22,765 --> 00:21:23,185 what's that? 431 00:21:23,980 --> 00:21:24,723 3, 3, 8, 432 00:21:24,865 --> 00:21:25,495 3, 3, 8. 433 00:21:25,515 --> 00:21:27,280 get that tattooed on your forehead. 434 00:21:29,365 --> 00:21:36,595 Um, I'm, I'm suddenly, I'm thinking about, um, 2 4, 6 0 1 from, um, Les Mis, 435 00:21:37,225 --> 00:21:37,515 Yeah. 436 00:21:38,395 --> 00:21:39,145 so. 437 00:21:40,210 --> 00:21:46,450 Please shut off RDP at, at a bare minimum, restrict RDP, so that it, 438 00:21:46,510 --> 00:21:50,620 you know, so that the RDP port is only accessible via a particular network. 439 00:21:50,950 --> 00:21:54,670 And that network should only be accessible via A VPN, which 440 00:21:54,670 --> 00:21:56,350 is only accessible via MFA. 441 00:21:56,380 --> 00:21:59,860 We're gonna get back to that and, you know, restrict s and b as much as you can. 442 00:22:00,815 --> 00:22:01,775 Um, I'm sorry. 443 00:22:02,075 --> 00:22:04,595 Restrict RDP as much as you can. 444 00:22:05,015 --> 00:22:07,445 Uh, and then also, you know, I threw out SMB. 445 00:22:07,595 --> 00:22:08,675 Lemme just throw that out. 446 00:22:09,095 --> 00:22:12,965 Um, windows has a default administrative share. 447 00:22:13,865 --> 00:22:15,125 What's up with that? 448 00:22:15,995 --> 00:22:16,505 Right? 449 00:22:16,525 --> 00:22:17,605 it admin dollar? 450 00:22:18,215 --> 00:22:19,235 Yeah. 451 00:22:20,065 --> 00:22:28,645 Um, that's what it's, and, and, and you can access the entire, uh, c drive, right? 452 00:22:29,245 --> 00:22:30,955 Um, turn that sucker off. 453 00:22:30,955 --> 00:22:32,395 Why, why is it there? 454 00:22:32,695 --> 00:22:34,315 Um, you know, why is it there? 455 00:22:34,315 --> 00:22:35,665 Why is it on by default? 456 00:22:36,385 --> 00:22:39,835 I, you know, I, I'm sure you know if you've got, by the way, if 457 00:22:39,835 --> 00:22:44,305 you disagree with me, uh, feel free to do so in the comments. 458 00:22:44,305 --> 00:22:48,325 I would love to hear, uh, why the default administrative share. 459 00:22:48,790 --> 00:22:55,810 Is not just fundamentally evil like RDP, um, but this is an s and b share 460 00:22:55,840 --> 00:22:58,780 that is on by default in Windows server. 461 00:22:59,170 --> 00:23:00,910 Uh, and when Windows desktop 462 00:23:01,975 --> 00:23:02,335 Is it? 463 00:23:02,340 --> 00:23:03,775 Isn't it at Windows desktop though? 464 00:23:03,940 --> 00:23:04,510 Yes. 465 00:23:04,570 --> 00:23:05,320 'cause I've used it. 466 00:23:06,895 --> 00:23:09,985 Okay, because, so I was recently setting up my mom's new 467 00:23:10,105 --> 00:23:10,525 Mm-Hmm 468 00:23:10,525 --> 00:23:10,915 windows 469 00:23:11,195 --> 00:23:11,615 mm-Hmm. 470 00:23:12,325 --> 00:23:15,595 And when I went, because I was copying data over and I went to go 471 00:23:15,595 --> 00:23:21,085 access it another laptop, and it basically said sharing is disabled. 472 00:23:23,260 --> 00:23:24,040 Network sharing. 473 00:23:24,755 --> 00:23:26,465 That's a good question, right. 474 00:23:26,675 --> 00:23:29,975 Um, I'm not a Windows person. 475 00:23:30,125 --> 00:23:30,425 Uh, I. 476 00:23:30,590 --> 00:23:31,130 Neither am I. 477 00:23:31,220 --> 00:23:33,235 It took me a while and I wanted to pull out my hair, 478 00:23:33,335 --> 00:23:33,815 Yeah. 479 00:23:33,995 --> 00:23:38,795 But, um, the, um, you should tell your mom to upgrade to a real computer. 480 00:23:39,365 --> 00:23:39,785 Um, 481 00:23:40,505 --> 00:23:41,365 she likes her windows. 482 00:23:41,555 --> 00:23:42,045 Laptops. 483 00:23:42,145 --> 00:23:43,245 I'm not gonna argue with her. 484 00:23:44,435 --> 00:23:48,335 uh, yeah, uh, I know a lot of people like windows. 485 00:23:48,395 --> 00:23:50,915 I just, you know, I close windows whenever I can. 486 00:23:51,905 --> 00:23:52,445 Anyway. 487 00:23:52,505 --> 00:23:57,755 Um, so the next thing, uh, let's talk about, and I, I alluded to 488 00:23:57,755 --> 00:24:00,245 it already, and that is if your. 489 00:24:00,665 --> 00:24:06,125 Normal workday process requires A VPN. 490 00:24:08,825 --> 00:24:11,465 What do you think about having an MFA on that VPN? 491 00:24:12,055 --> 00:24:13,130 Oh, you definitely should. 492 00:24:13,775 --> 00:24:15,185 Yeah, this is 493 00:24:15,200 --> 00:24:15,350 but, 494 00:24:15,770 --> 00:24:17,435 of, of everything on this list. 495 00:24:17,615 --> 00:24:24,545 If you are allowing computers outside your company to access your company resources, 496 00:24:25,535 --> 00:24:30,215 and you're not using A VPN and you're not using MFA for that VPNI, you know, this. 497 00:24:30,815 --> 00:24:31,745 I, I don't know what to say. 498 00:24:31,760 --> 00:24:33,410 I have the question for you. 499 00:24:33,605 --> 00:24:34,055 Okay. 500 00:24:35,885 --> 00:24:41,765 Is it still technically considered MFA if you have an OTP in 501 00:24:41,765 --> 00:24:43,325 order to be able to log into 502 00:24:43,415 --> 00:24:48,035 I think, yeah, I think the, the OTP, um, you know, uh, I think 503 00:24:48,035 --> 00:24:53,255 that, well, assuming that OTP has, uh, MFA built into it, right? 504 00:24:53,795 --> 00:24:54,305 Um. 505 00:24:54,395 --> 00:24:56,285 it's like an RSA token, right? 506 00:24:57,080 --> 00:24:57,650 Yeah. 507 00:24:57,740 --> 00:24:58,070 Yeah. 508 00:24:58,070 --> 00:25:04,550 I mean, so I'm assuming, I, I'd assume that if you're using Okta or something 509 00:25:04,550 --> 00:25:08,120 like that, that you are going to enforce 510 00:25:08,810 --> 00:25:09,295 MFA. 511 00:25:09,530 --> 00:25:10,790 on your entire environment. 512 00:25:10,790 --> 00:25:12,200 If you do, I'm, I'm good. 513 00:25:12,290 --> 00:25:16,610 I'm just saying if you're remotely letting people access stuff inside 514 00:25:16,615 --> 00:25:20,870 your computing environment and you're not using MFA, uh, you know. 515 00:25:21,205 --> 00:25:21,495 Yeah. 516 00:25:22,190 --> 00:25:24,590 That's like you're asking for it kind of thing, right? 517 00:25:25,550 --> 00:25:28,280 Going back to what you previously said about credential stuffing 518 00:25:28,595 --> 00:25:30,785 Yes, exactly right. 519 00:25:30,785 --> 00:25:31,770 Why is that, by the way? 520 00:25:31,830 --> 00:25:33,485 What, what do you mean by that statement you just made? 521 00:25:34,665 --> 00:25:39,945 Because if you don't have MFA, then someone might compromise credentials 522 00:25:39,945 --> 00:25:44,895 somewhere else and say a user happens to reuse their passwords, they have access 523 00:25:44,895 --> 00:25:48,970 to your environment because they're able to connect via VPN without requiring MFA. 524 00:25:49,275 --> 00:25:49,810 There you go. 525 00:25:50,595 --> 00:25:52,335 But I wanna add one thing to 526 00:25:52,740 --> 00:25:53,030 Yeah. 527 00:25:53,325 --> 00:26:00,135 Even with MFA, train your users not to get hit by MFA fatigue. 528 00:26:00,320 --> 00:26:00,610 Yeah. 529 00:26:00,900 --> 00:26:01,140 Right. 530 00:26:01,140 --> 00:26:05,670 We've seen so many attacks where the attacker bombards the system 531 00:26:05,670 --> 00:26:08,100 with MFA requests and then the user's like, fine, fine. 532 00:26:08,100 --> 00:26:08,550 I give up. 533 00:26:08,555 --> 00:26:09,570 I don't know what's going on. 534 00:26:09,885 --> 00:26:10,215 Yeah. 535 00:26:10,230 --> 00:26:11,105 like, okay, it's me. 536 00:26:11,775 --> 00:26:12,195 Yeah. 537 00:26:12,270 --> 00:26:16,425 This, this goes back to the stuff that we talked about last week, about training 538 00:26:16,425 --> 00:26:18,105 the people that work in your environment. 539 00:26:18,135 --> 00:26:18,495 Right? 540 00:26:18,915 --> 00:26:24,000 Um, let them know what MFA, you know, an MFA fatigue attack is, and 541 00:26:24,030 --> 00:26:24,210 Yeah. 542 00:26:24,345 --> 00:26:27,165 to watch for it and to not, I. 543 00:26:27,165 --> 00:26:29,805 Respond to it the way that you just described. 544 00:26:29,805 --> 00:26:30,105 Yeah, yeah. 545 00:26:30,105 --> 00:26:30,465 Whatever. 546 00:26:30,465 --> 00:26:31,455 Just leave me alone, you know? 547 00:26:31,575 --> 00:26:31,905 Or 548 00:26:31,965 --> 00:26:33,495 that's what happened with the Okta attack, 549 00:26:33,825 --> 00:26:34,365 Yes. 550 00:26:34,515 --> 00:26:34,815 Yeah. 551 00:26:34,965 --> 00:26:35,600 many months ago. 552 00:26:35,805 --> 00:26:36,165 Yeah. 553 00:26:37,515 --> 00:26:43,665 Um, so here's another one that, that the link that you shared 554 00:26:43,670 --> 00:26:45,105 me, I think is fascinating. 555 00:26:45,195 --> 00:26:49,695 Um, the next thing I have on the list is reputable antivirus 556 00:26:49,695 --> 00:26:51,615 or anti-malware software. 557 00:26:51,615 --> 00:26:53,385 Uh, what, what did that article talk about? 558 00:26:54,240 --> 00:26:54,510 Yeah. 559 00:26:54,510 --> 00:26:57,660 So this was an article which happened to be published today. 560 00:26:57,660 --> 00:26:58,650 We're recording this. 561 00:26:58,980 --> 00:27:04,920 Um, and it was from the register, uh, and it basically said that. 562 00:27:05,805 --> 00:27:07,815 More than half the people. 563 00:27:08,025 --> 00:27:12,435 Even though antivirus tools are available on the operating system, 564 00:27:12,510 --> 00:27:12,870 Mm-Hmm. 565 00:27:13,005 --> 00:27:16,275 install third party antivirus solutions. 566 00:27:16,410 --> 00:27:16,860 Yeah. 567 00:27:17,865 --> 00:27:21,825 And one of the things that I found at the very bottom of this article, 568 00:27:21,825 --> 00:27:27,255 which I thought was interesting, they said malware writers, the first thing 569 00:27:27,255 --> 00:27:30,345 that they do is they'll probably go and test against the standard tools. 570 00:27:30,525 --> 00:27:30,825 Right. 571 00:27:31,965 --> 00:27:36,285 And by having a third party, you're now adding an additional layer of defense to 572 00:27:36,285 --> 00:27:41,145 protect you against being attacked and being, uh, infected by these malware. 573 00:27:41,475 --> 00:27:41,955 Yeah. 574 00:27:42,465 --> 00:27:45,615 You know, and those tools are, they're just like any of these tools. 575 00:27:45,615 --> 00:27:46,875 Nothing is. 576 00:27:47,865 --> 00:27:49,485 Um, what's that? 577 00:27:50,175 --> 00:27:51,195 Nothing is perfect, 578 00:27:51,195 --> 00:27:59,205 Yeah, nothing is perfect, but, um, you know, you know, maybe I'm an old 579 00:27:59,205 --> 00:28:03,225 schooler here and I, I believe in the concept of these third party tools. 580 00:28:03,945 --> 00:28:04,245 Um, 581 00:28:04,275 --> 00:28:07,755 another stat which I will call out, said that, 582 00:28:07,935 --> 00:28:08,295 oh, 583 00:28:08,535 --> 00:28:08,955 when they 584 00:28:09,255 --> 00:28:10,305 I don't like the stat. 585 00:28:10,365 --> 00:28:10,545 I don't. 586 00:28:12,345 --> 00:28:13,635 they looked at the statistics. 587 00:28:13,965 --> 00:28:20,025 They found that twice the number of people had third party software for if they 588 00:28:20,025 --> 00:28:25,485 were in the age group of 65 and above, versus in the age group of 45 and below. 589 00:28:27,045 --> 00:28:28,785 To that, I just wanna say bleep, 590 00:28:32,205 --> 00:28:33,795 uh, whatever. 591 00:28:34,545 --> 00:28:35,895 Um, all right. 592 00:28:36,735 --> 00:28:37,560 The, the final. 593 00:28:37,650 --> 00:28:39,480 But antivirus is important though, 594 00:28:39,585 --> 00:28:40,845 Antivirus is important. 595 00:28:40,875 --> 00:28:41,235 Yeah. 596 00:28:41,235 --> 00:28:42,735 Antivirus, anti-malware. 597 00:28:42,915 --> 00:28:53,505 Um, the, um, um, the next group of things that I want to talk about are, again, 598 00:28:53,565 --> 00:29:00,555 this isn't so much preventing, um, you know, preventing an attack as much as 599 00:29:00,555 --> 00:29:05,055 it is, you know, preparing for one. 600 00:29:05,085 --> 00:29:06,255 Well, no. 601 00:29:06,315 --> 00:29:06,555 Yeah. 602 00:29:06,555 --> 00:29:07,095 I guess this is. 603 00:29:07,295 --> 00:29:07,775 preventing, 604 00:29:07,785 --> 00:29:09,735 This is all also preventing, nevermind. 605 00:29:09,840 --> 00:29:10,170 yeah. 606 00:29:10,305 --> 00:29:13,305 The, the next group of things are, are a little bit different. 607 00:29:13,425 --> 00:29:16,905 And that is this idea of proactively going and doing things 608 00:29:17,685 --> 00:29:20,085 to see, to see what you can see. 609 00:29:20,145 --> 00:29:20,535 Right? 610 00:29:20,625 --> 00:29:24,015 Uh, and the first is this concept of an automated pen test. 611 00:29:24,015 --> 00:29:24,615 What is that? 612 00:29:25,650 --> 00:29:27,600 So a pen test is a penetration 613 00:29:27,840 --> 00:29:28,260 Mm-Hmm. 614 00:29:28,500 --> 00:29:34,680 where you can hire a company, you can procure software, where it will basically 615 00:29:34,680 --> 00:29:39,540 test your network, your systems, to see are there any common vulnerabilities? 616 00:29:39,900 --> 00:29:41,040 Are ports closed? 617 00:29:41,100 --> 00:29:43,260 Do you have RDP exposed to the internet? 618 00:29:43,710 --> 00:29:46,650 Things like that to help you understand, okay, where are 619 00:29:46,650 --> 00:29:48,090 the gaps in my systems today? 620 00:29:48,505 --> 00:29:48,955 Right. 621 00:29:48,955 --> 00:29:57,895 And, and they range, um, everywhere from like, uh, 29, 9, 9, you know, uh, 622 00:29:58,405 --> 00:29:59,820 we'll do a pen test of your company. 623 00:30:01,265 --> 00:30:04,655 And I don't mean to imply that there's no value there, but there's definitely less 624 00:30:04,655 --> 00:30:07,295 value there than the the, the next option. 625 00:30:07,300 --> 00:30:09,635 And that is this concept of a red team. 626 00:30:09,995 --> 00:30:13,955 Again, we had Dwayne Lalo on here from Pulsar Security. 627 00:30:13,955 --> 00:30:15,515 They are a red team, right? 628 00:30:15,515 --> 00:30:18,185 It's a fascinating episode, by the way, if you didn't, if you didn't 629 00:30:18,530 --> 00:30:18,750 Mm. 630 00:30:18,995 --> 00:30:19,925 take a look at that. 631 00:30:19,955 --> 00:30:25,805 Uh, it's about, I don't know, six weeks or so ago at this point, the 632 00:30:25,805 --> 00:30:30,875 idea that this is for those of you that have seen the movie sneakers, 633 00:30:31,055 --> 00:30:33,425 this is the guys in the movie sneakers. 634 00:30:33,635 --> 00:30:37,235 Those of you that haven't seen the movie sneakers, go watch the movie sneakers. 635 00:30:37,310 --> 00:30:37,490 it. 636 00:30:38,165 --> 00:30:38,675 It's. 637 00:30:39,200 --> 00:30:41,720 It ages actually pretty well. 638 00:30:42,170 --> 00:30:45,470 There's some stuff in there, just like any movie that centers around computers. 639 00:30:45,470 --> 00:30:50,750 There's some stuff in there that's complete bs, but, you know, um, 640 00:30:51,185 --> 00:30:54,245 You're not gonna recommend hackers or the net 641 00:30:54,470 --> 00:31:00,080 no, I'm not gonna recommend Hackers or the net or swordfish. 642 00:31:00,470 --> 00:31:04,640 Um, the net that, oh man, can't even. 643 00:31:05,570 --> 00:31:07,400 You remember it was about hitting the escape button. 644 00:31:07,400 --> 00:31:09,320 You remember how the escape button was like the 645 00:31:11,480 --> 00:31:13,220 uh, Sandra Bullock, right? 646 00:31:13,310 --> 00:31:14,270 Wasn't that Sandra Bullock? 647 00:31:14,270 --> 00:31:14,540 Yeah. 648 00:31:14,840 --> 00:31:15,170 Yeah. 649 00:31:16,040 --> 00:31:21,020 Um, interestingly enough that when you, when you, when you bring up those three 650 00:31:21,020 --> 00:31:23,720 movies, the only thing I remember, the pretty girls that were in those 651 00:31:23,720 --> 00:31:28,160 three movies, I don't, and the fact that the computer stuff was, was crap. 652 00:31:28,640 --> 00:31:29,000 Right? 653 00:31:29,570 --> 00:31:30,890 Um, anyway. 654 00:31:32,735 --> 00:31:34,235 Somehow I got distracted. 655 00:31:34,235 --> 00:31:34,655 What? 656 00:31:34,715 --> 00:31:35,975 Where were we talking about? 657 00:31:36,155 --> 00:31:36,365 red 658 00:31:36,395 --> 00:31:38,045 We were talking about red teams, right? 659 00:31:38,255 --> 00:31:44,765 So this is a professional team whose job it is to infiltrate 660 00:31:44,765 --> 00:31:47,675 your environment at your request. 661 00:31:48,095 --> 00:31:50,345 And this is hardcore stuff, right? 662 00:31:51,290 --> 00:31:53,360 Yeah, they're think like the hackers, right? 663 00:31:53,360 --> 00:31:53,570 They 664 00:31:53,765 --> 00:31:53,975 Yeah. 665 00:31:54,380 --> 00:31:56,330 almost ethical hackers if you think about it. 666 00:31:56,445 --> 00:31:56,735 Yeah. 667 00:31:56,855 --> 00:31:57,245 Yeah. 668 00:31:57,815 --> 00:32:01,145 Um, I remember Dwayne said that they kind of backed away from that 669 00:32:01,145 --> 00:32:05,555 term that they use, they use, um, I forgot what the term that they use 670 00:32:05,735 --> 00:32:08,675 instead, but basically Yeah, yeah. 671 00:32:08,735 --> 00:32:11,615 That, that there, there's like a more all inclusive term that 672 00:32:11,615 --> 00:32:13,685 they now use, but the, um. 673 00:32:15,965 --> 00:32:20,675 This is a company that you hire that is going to do all sorts of things to 674 00:32:20,675 --> 00:32:23,195 try to break into your environment. 675 00:32:23,765 --> 00:32:30,335 And, um, I, I remember one of his stories was about they hacked this 676 00:32:30,335 --> 00:32:34,835 company via a TV that was in the lobby. 677 00:32:35,105 --> 00:32:35,585 Right. 678 00:32:36,065 --> 00:32:41,735 And they did it by going and getting, they got, they figured out what the TV was. 679 00:32:41,735 --> 00:32:43,655 They figured out the brand of the tv. 680 00:32:44,180 --> 00:32:47,390 And then they went and got that TV and they tore it apart and then, you 681 00:32:47,390 --> 00:32:49,700 know, um, this is hardcore stuff. 682 00:32:49,730 --> 00:32:51,170 insecure wifi 683 00:32:51,290 --> 00:32:51,740 Yeah, 684 00:32:51,830 --> 00:32:52,310 in it that 685 00:32:52,370 --> 00:32:54,590 yeah, yeah. 686 00:32:54,710 --> 00:33:01,580 Um, and uh, this involves, this involves things like, uh, it could be phy, there's 687 00:33:01,585 --> 00:33:03,860 also physical, uh, penetration tests. 688 00:33:03,860 --> 00:33:04,220 Right. 689 00:33:04,220 --> 00:33:09,290 So, you know, I remember, um, uh, listening to Kevin Mitnick, 690 00:33:09,290 --> 00:33:10,310 which I know not everybody. 691 00:33:10,700 --> 00:33:15,710 Uh, liked or appreciates Kevin Mitnick, but, uh, I, I did learn 692 00:33:15,710 --> 00:33:21,440 a lot from his talk and it was, uh, this, it, it was about him. 693 00:33:22,250 --> 00:33:24,080 Um, basically, I. 694 00:33:25,445 --> 00:33:27,365 Going into a building. 695 00:33:27,845 --> 00:33:32,075 It was like a, it was like a commercial building and he went into the bathroom 696 00:33:32,075 --> 00:33:36,245 and he just waited into the bathroom for some other person to come and he 697 00:33:36,545 --> 00:33:41,735 used his badge scanner, which works up to like six feet away or something. 698 00:33:41,740 --> 00:33:42,515 And he's sitting in a. 699 00:33:42,555 --> 00:33:46,425 Bathroom skull waiting for some other kind of coat. 700 00:33:46,875 --> 00:33:49,965 And then he is scanning the guy's badge and then he uses that 701 00:33:49,965 --> 00:33:51,105 badge to get into the building. 702 00:33:51,315 --> 00:33:51,555 Right. 703 00:33:51,555 --> 00:33:54,855 This is the, you know, this is some, some, some hardcore stuff. 704 00:33:55,490 --> 00:33:56,645 It's like something outta Hollywood. 705 00:33:56,835 --> 00:33:57,255 Yeah. 706 00:33:57,255 --> 00:34:01,245 It is like something outta Hollywood, but the, you know, these are people that this 707 00:34:01,245 --> 00:34:04,665 is what they do and, um, they enjoy it. 708 00:34:04,665 --> 00:34:05,475 They're good at it. 709 00:34:05,475 --> 00:34:08,175 And you should definitely look into the concept of a red team. 710 00:34:08,895 --> 00:34:10,875 Now, what about a blue team? 711 00:34:12,870 --> 00:34:15,840 They're the ones who are trying to protect your environment 712 00:34:16,215 --> 00:34:16,635 Right? 713 00:34:16,950 --> 00:34:18,210 potential attackers. 714 00:34:18,375 --> 00:34:18,825 Right. 715 00:34:19,575 --> 00:34:21,045 And so. 716 00:34:21,510 --> 00:34:22,470 They're like the defense. 717 00:34:22,890 --> 00:34:23,190 Right. 718 00:34:23,190 --> 00:34:23,400 Yeah. 719 00:34:23,400 --> 00:34:26,700 They are the defense and they're also the ones that you would bring 720 00:34:26,700 --> 00:34:29,070 in when you have a cyber attack. 721 00:34:29,370 --> 00:34:29,760 Right? 722 00:34:29,760 --> 00:34:30,060 Yep. 723 00:34:30,780 --> 00:34:34,560 Um, and so one of the things that I talk a lot about is that 724 00:34:34,560 --> 00:34:36,450 you need to establish that. 725 00:34:36,600 --> 00:34:40,500 Um, and again, another one of the, another one of the experts that we've 726 00:34:40,500 --> 00:34:46,290 had on here that uh, is from a blue team is Mike Sailor from Black Swan 727 00:34:46,290 --> 00:34:51,865 Security, and we're gonna have, we're gonna have him on some more, and I. 728 00:34:51,975 --> 00:34:58,425 He, uh, he talks a lot about, he's been in many of these attacks 729 00:34:58,725 --> 00:35:00,465 and he completely agrees with me. 730 00:35:00,465 --> 00:35:01,215 Of course he does. 731 00:35:01,245 --> 00:35:02,295 'cause this is what he does. 732 00:35:02,655 --> 00:35:05,955 That now is the time to form a relationship with the blue team. 733 00:35:05,955 --> 00:35:11,685 Why would, if, if there's somebody that I would call in, in the time 734 00:35:11,685 --> 00:35:14,565 of a cyber attack, why would I want to get a relationship with them now? 735 00:35:15,780 --> 00:35:18,960 Because a cyber attack attack is very stressful. 736 00:35:20,145 --> 00:35:23,865 You'd rather have that relationship prebuilt so you understand what's 737 00:35:23,865 --> 00:35:27,825 expected, what each person is gonna do, the roles and responsibilities 738 00:35:27,830 --> 00:35:30,705 such that when you do have that cyber attack, everyone can just be 739 00:35:30,705 --> 00:35:32,325 like, okay, let's go, go, go, go, go. 740 00:35:32,330 --> 00:35:33,405 Everyone knows what they need to do. 741 00:35:34,170 --> 00:35:34,500 Yeah. 742 00:35:34,500 --> 00:35:39,000 You know, uh, the analogy that I'm gonna use is gonna be kind of funny and, 743 00:35:39,000 --> 00:35:42,240 and I know you know this story, but it has nothing to do with cyber attack. 744 00:35:44,220 --> 00:35:47,070 The time, the time to get a relationship with somebody like 745 00:35:47,070 --> 00:35:49,230 this is before you need them. 746 00:35:49,440 --> 00:35:49,920 Right. 747 00:35:50,370 --> 00:35:54,600 And I'm thinking about the time that I cut into the main supply line of my 748 00:35:54,600 --> 00:35:59,880 house, uh, the water sup, the water, the, the water main for my house. 749 00:36:00,480 --> 00:36:05,910 And uh, this was when I was replacing my front yard. 750 00:36:05,940 --> 00:36:08,100 I have a 400 square foot front yard. 751 00:36:08,190 --> 00:36:08,460 Right? 752 00:36:08,460 --> 00:36:11,430 It is very, you know, it's California, so my yard is not that big. 753 00:36:12,225 --> 00:36:18,165 And, uh, I was digging it up to put down, um, you know, the, I was 754 00:36:18,165 --> 00:36:19,695 gonna put down artificial turf. 755 00:36:20,445 --> 00:36:24,765 And it's kind of funny that when you put our artificial turf, the first 756 00:36:24,765 --> 00:36:27,885 thing you have to do is you have to dig up the yard and you have to, you 757 00:36:27,885 --> 00:36:32,835 dig down like six inches and then you put paver, uh, uh, base there. 758 00:36:33,075 --> 00:36:35,115 So you basically pave your yard. 759 00:36:35,715 --> 00:36:38,145 And then on top of that you put an inch of sand. 760 00:36:38,145 --> 00:36:39,465 And then on top of that you put the grass. 761 00:36:39,465 --> 00:36:39,735 Now. 762 00:36:40,470 --> 00:36:43,260 I was digging and I knew where my water main was. 763 00:36:44,070 --> 00:36:48,210 And the really funny thing is, was I don't want to damage my water main while 764 00:36:48,210 --> 00:36:51,810 I'm doing this, but I'm not a hundred percent sure what a water main is. 765 00:36:51,810 --> 00:36:54,600 So I'm just gonna dig around my water main to find my water main, to 766 00:36:54,600 --> 00:36:55,920 make sure I don't hit my water main. 767 00:36:56,280 --> 00:36:59,250 In the process, process of doing that, I hit my water main. 768 00:36:59,490 --> 00:37:01,020 Now, what does this have to do with this? 769 00:37:01,530 --> 00:37:05,250 The point was that I knew exactly where to go because there was, there's 770 00:37:05,250 --> 00:37:07,320 a guy that lives that way, like. 771 00:37:07,950 --> 00:37:12,870 300 yards from my house, and I went right to that guy's house and I was like, 772 00:37:12,960 --> 00:37:15,900 um, you know, I just did this thing. 773 00:37:16,500 --> 00:37:24,270 Luckily, luckily, I will say it was on the, on the other side of the valve that 774 00:37:24,315 --> 00:37:24,645 off. 775 00:37:24,690 --> 00:37:30,180 the water department supplies, because if I had broken it on their side, then that 776 00:37:30,180 --> 00:37:32,070 would've been a, a whole different thing. 777 00:37:32,070 --> 00:37:32,400 Right. 778 00:37:32,730 --> 00:37:32,940 Yeah. 779 00:37:33,000 --> 00:37:36,450 But, uh, it was, I remember it was like a Sunday. 780 00:37:37,350 --> 00:37:41,010 And, and by the way, cyber attacks never come when it's convenient. 781 00:37:41,010 --> 00:37:42,420 They do it on purpose, right? 782 00:37:42,420 --> 00:37:46,440 They, they, there, there will be a bunch of cyber attacks, uh, tomorrow. 783 00:37:47,095 --> 00:37:47,315 Yep. 784 00:37:47,820 --> 00:37:51,210 Uh, we're in the US tomorrow, the, the day we're recording this, tomorrow is 785 00:37:51,210 --> 00:37:56,040 July 4th, and there will be a bunch of, uh, a lot of people have a four day 786 00:37:56,040 --> 00:38:00,480 weekend because, um, you know, I think, I think it should be a federal law that 787 00:38:00,485 --> 00:38:05,580 July 4th, can't fall on a Thursday, but it is, it's on a Thursday tomorrow, so 788 00:38:05,580 --> 00:38:08,160 a lot of people will just take Friday off, so they have a four day weekend. 789 00:38:08,565 --> 00:38:10,635 This is when cyber attacks happened, right? 790 00:38:10,635 --> 00:38:14,805 So it was a Sunday afternoon and luckily I had, I had already established a 791 00:38:14,805 --> 00:38:17,835 relationship with this plumber guy, and I went over and I just knocked 792 00:38:17,835 --> 00:38:23,025 on his door and I'm like, I realize it's five o'clock on a Sunday and 793 00:38:23,025 --> 00:38:30,375 you're clearly having dinner with your family, but I just blew up my house so. 794 00:38:31,035 --> 00:38:32,475 Could you help me please? 795 00:38:32,760 --> 00:38:35,820 anything he could do that would be awesome. 796 00:38:36,210 --> 00:38:40,800 And he came over and, uh, repaired my water main, you know, I had to, 797 00:38:40,860 --> 00:38:44,790 we had to dig a big hole, a much bigger hole to get access to the pipe. 798 00:38:44,970 --> 00:38:45,260 Yeah. 799 00:38:45,450 --> 00:38:48,390 And, um, you know, and he repaired it. 800 00:38:48,870 --> 00:38:53,520 And then, uh, he said, uh, I was like, how much do I owe you? 801 00:38:53,520 --> 00:38:56,190 I was prepared for 500 bucks. 802 00:38:57,360 --> 00:38:58,080 Or more. 803 00:38:58,530 --> 00:39:02,310 And he said 150 bucks because he did it like off the clock 804 00:39:02,310 --> 00:39:03,780 and you know, his own thing. 805 00:39:03,780 --> 00:39:06,630 And I was like, dude, you know where, where do I sign? 806 00:39:06,840 --> 00:39:07,200 Right? 807 00:39:09,750 --> 00:39:11,100 You're like, thank you for saving me. 808 00:39:11,445 --> 00:39:11,735 Yeah. 809 00:39:11,760 --> 00:39:14,610 you know, calling a plumber for an emergency repair on 810 00:39:14,610 --> 00:39:16,200 a Sunday AF in the evening. 811 00:39:17,415 --> 00:39:18,355 It was gonna cost him. 812 00:39:18,450 --> 00:39:20,700 least 400 bucks before they even do anything. 813 00:39:21,225 --> 00:39:21,615 Yeah. 814 00:39:21,615 --> 00:39:26,445 And so this is what I'm saying is like, just get a relationship now. 815 00:39:26,505 --> 00:39:29,385 Get a relationship now with your local FBI department. 816 00:39:29,775 --> 00:39:33,225 Uh, by the way, Mike talked about that a lot. 817 00:39:33,225 --> 00:39:33,495 What? 818 00:39:33,705 --> 00:39:34,635 InfraGard? 819 00:39:34,665 --> 00:39:34,695 InfraGard 820 00:39:36,765 --> 00:39:39,225 was the name of the IBM, I'm sorry. 821 00:39:39,525 --> 00:39:40,785 The IRS. 822 00:39:44,650 --> 00:39:44,870 Ah. 823 00:39:45,595 --> 00:39:46,135 Not the I. 824 00:39:48,690 --> 00:39:55,290 Meant to, uh, help, uh, people combat cyber crime and, um, you know, look 825 00:39:55,290 --> 00:39:59,580 into InfraGard, get a relationship with the FBI get, uh, and or whatever 826 00:39:59,580 --> 00:40:00,960 it is where you happen to live. 827 00:40:01,580 --> 00:40:01,870 Yeah. 828 00:40:01,980 --> 00:40:05,970 And, um, but now's the time to do that. 829 00:40:06,810 --> 00:40:07,770 Any further thoughts on that? 830 00:40:09,105 --> 00:40:09,435 No. 831 00:40:09,435 --> 00:40:14,085 I think, yeah, having those pre-established relationships especially 832 00:40:14,085 --> 00:40:16,515 as these blue teams, red teams, right? 833 00:40:16,515 --> 00:40:19,935 They're probably keeping up to date on the latest of what's happening out there, so 834 00:40:19,980 --> 00:40:20,370 Yeah. 835 00:40:20,510 --> 00:40:22,485 also a great resource for that too. 836 00:40:22,830 --> 00:40:23,160 Yeah. 837 00:40:23,160 --> 00:40:27,330 You wanna, you wanna have them on speed dial, right? 838 00:40:27,335 --> 00:40:27,480 Like, 839 00:40:27,975 --> 00:40:28,245 Yeah. 840 00:40:28,560 --> 00:40:31,440 you get the thing, you make the call, they're on their way. 841 00:40:31,440 --> 00:40:36,060 Not, not, you know, I'm having a Google Blue, blue teams or cyber. 842 00:40:38,280 --> 00:40:40,740 Who do I call when I have a ransomware attack? 843 00:40:41,010 --> 00:40:42,810 Um, that's not the time to be doing that. 844 00:40:42,810 --> 00:40:43,560 It's already stressful. 845 00:40:43,605 --> 00:40:44,145 Busters. 846 00:40:44,970 --> 00:40:45,390 What's that? 847 00:40:46,665 --> 00:40:47,925 You said, who are you gonna call when you have a 848 00:40:48,360 --> 00:40:48,810 Oh, Gus 849 00:40:48,855 --> 00:40:50,115 said, ghost busters. 850 00:40:51,690 --> 00:40:54,780 that, that's a old joke, man. 851 00:40:55,020 --> 00:40:56,880 You know, you're dating yourself. 852 00:40:56,880 --> 00:40:56,940 Um, 853 00:40:59,395 --> 00:41:00,420 that's a good movie though. 854 00:41:01,705 --> 00:41:05,670 Movie, um, ruined by later attempts at. 855 00:41:07,365 --> 00:41:08,415 Sequels, but whatever, 856 00:41:08,610 --> 00:41:09,030 go there. 857 00:41:09,030 --> 00:41:09,390 We shall 858 00:41:09,615 --> 00:41:10,425 we should not go there. 859 00:41:10,425 --> 00:41:10,725 Alright. 860 00:41:10,725 --> 00:41:11,205 Good movie. 861 00:41:11,685 --> 00:41:13,125 All right, well, this has been a good episode. 862 00:41:13,125 --> 00:41:17,205 Further things that you can do to prevent ransomware and to prepare 863 00:41:17,205 --> 00:41:20,985 yourself to be able to defend ransomware if and when it happens, 864 00:41:20,985 --> 00:41:22,935 although it's more a win than an F. 865 00:41:23,535 --> 00:41:25,005 Uh, any final thoughts? 866 00:41:25,005 --> 00:41:25,655 Prasanna? 867 00:41:26,475 --> 00:41:28,815 No, uh, was a great conversation. 868 00:41:28,820 --> 00:41:30,255 I'm dying in the heat out here. 869 00:41:30,285 --> 00:41:32,565 Uh, we're in our middle of our heat wave, so 870 00:41:32,835 --> 00:41:34,455 What, what's temperature outside right now? 871 00:41:35,325 --> 00:41:36,405 I think it's 103. 872 00:41:37,875 --> 00:41:39,525 Uh, and what's the temperature inside? 873 00:41:40,395 --> 00:41:41,715 Uh, about 84. 874 00:41:41,835 --> 00:41:43,575 I really should turn on the air conditioner. 875 00:41:44,385 --> 00:41:47,205 Um, so you, you wanna know what the temperature is 876 00:41:47,205 --> 00:41:48,315 outside Where I am right now. 877 00:41:50,145 --> 00:41:51,285 75? 878 00:41:51,885 --> 00:41:59,205 75 is exactly what it's, that is San Diego versus the Bay Area. 879 00:41:59,865 --> 00:42:03,945 Um, you know, in a nutshell, um. 880 00:42:04,590 --> 00:42:06,630 Yeah, just different parts of the Bay Area, right? 881 00:42:06,630 --> 00:42:09,900 Because certain parts of the Bay Area can be quite cold, actually. 882 00:42:10,035 --> 00:42:13,995 I was looking at the thing they said up in San Francisco. 883 00:42:14,355 --> 00:42:16,665 It's in the sixties, like low sixties, 884 00:42:18,120 --> 00:42:18,390 Yeah. 885 00:42:18,615 --> 00:42:22,095 if you go to the East Bay, uh, Livermore Pleasant in that 886 00:42:22,100 --> 00:42:23,895 area, it's I think 108 degrees. 887 00:42:24,300 --> 00:42:30,060 Well, coldest winter I ever spent was the summer in San Francisco, mark Twain. 888 00:42:31,830 --> 00:42:32,160 All right. 889 00:42:32,160 --> 00:42:33,750 Well thanks a lot Pana. 890 00:42:33,780 --> 00:42:35,550 Thank you to the listeners. 891 00:42:35,610 --> 00:42:39,180 Uh, I hope you're getting something outta this and remember to hit that 892 00:42:39,180 --> 00:42:43,350 subscribe or follow button so that you can, um, you can get us every time. 893 00:42:43,800 --> 00:42:46,230 And um, that is a wrap. 894 00:42:49,140 --> 00:42:53,820 The backup wrap up is written, recorded, and produced by me w Curtis Preston. 895 00:42:54,390 --> 00:42:55,860 If you need backup or Dr. 896 00:42:55,860 --> 00:42:59,490 Consulting content generation or expert witness work, 897 00:42:59,790 --> 00:43:01,770 check out backup central.com. 898 00:43:02,490 --> 00:43:05,610 You can also find links from my O'Reilly Books on the same website. 899 00:43:06,270 --> 00:43:10,260 Remember, this is an independent podcast and any opinions that 900 00:43:10,260 --> 00:43:14,160 you hear are those of the speaker and not necessarily an employer. 901 00:43:15,090 --> 00:43:15,780 Thanks for listening.