1 00:00:00,000 --> 00:00:02,129 W. Curtis Preston: Today I am going to tell you how to stop 2 00:00:02,129 --> 00:00:07,139 most ransomware attacks using three simple but powerful methods. 3 00:00:07,530 --> 00:00:13,409 Just three simple things that will stop over 90% of all ransomware attacks, 4 00:00:14,069 --> 00:00:19,740 patch management, password management, and multi-factor authentication. 5 00:00:20,009 --> 00:00:20,669 That's it. 6 00:00:21,284 --> 00:00:26,685 I'll explain why I make this claim and then we'll give advice on how best 7 00:00:26,685 --> 00:00:32,384 to implement each of those methods in environments of different sizes. 8 00:00:32,775 --> 00:00:35,565 Let's stop ransomware in its tracks. 9 00:00:36,254 --> 00:00:40,095 By the way, if you don't know who I am, maybe this is your first episode. 10 00:00:40,095 --> 00:00:42,525 I'm w Curtis Preston, AKA, Mr. 11 00:00:42,525 --> 00:00:47,085 Backup, and I've been passionate about backup and recovery disaster recovery. 12 00:00:47,370 --> 00:00:51,599 For over 30 years, ever since I had to tell my boss that there 13 00:00:51,599 --> 00:00:55,829 were no backups of the really important database that we just lost. 14 00:00:56,340 --> 00:00:58,049 I don't want that to happen to me. 15 00:00:58,109 --> 00:00:59,699 I don't want that to happen to you. 16 00:00:59,879 --> 00:01:01,259 That's why I do this. 17 00:01:01,590 --> 00:01:06,570 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 18 00:01:07,680 --> 00:01:09,750 This is the backup wrap up. 19 00:01:13,979 --> 00:01:14,324 There we go. 20 00:01:24,400 --> 00:01:25,420 Welcome to the show. 21 00:01:26,440 --> 00:01:30,190 Hi, I'm your host, w Curtis Preston, AKA, Mr. 22 00:01:30,190 --> 00:01:35,860 Backup, and I have with me a guy that was completely worthless during my 23 00:01:35,860 --> 00:01:38,410 recent smart device implementation. 24 00:01:40,049 --> 00:01:40,914 You were of no help. 25 00:01:43,709 --> 00:01:49,169 Prasanna Malaiyandi: it's not my fault that you happen to buy some random 26 00:01:49,169 --> 00:01:56,099 smart device that was not compatible with modern wifi technologies. 27 00:01:59,054 --> 00:02:02,144 W. Curtis Preston: Yeah, well, you know, where were you? 28 00:02:02,149 --> 00:02:06,314 I'm just saying, I, I count on your, I count on your YouTube knowledge 29 00:02:06,314 --> 00:02:07,934 to pull me out of such things. 30 00:02:08,534 --> 00:02:09,884 I, I depend on you. 31 00:02:09,884 --> 00:02:12,824 I go and I do crazy things and then I'm like, oh crap. 32 00:02:12,854 --> 00:02:16,184 Uh, I wonder what, wonder if persona could get me out of this hole 33 00:02:16,524 --> 00:02:20,624 Prasanna Malaiyandi: So, so networking stuff is not YouTube, it's Reddit, but 34 00:02:21,194 --> 00:02:21,824 W. Curtis Preston: oh, really? 35 00:02:22,584 --> 00:02:22,874 Prasanna Malaiyandi: yeah. 36 00:02:23,564 --> 00:02:27,014 W. Curtis Preston: Yeah, so it turned out, so I bought a, I bought this, 37 00:02:27,644 --> 00:02:30,974 this thing called a Suvi, S-U-V-I-E. 38 00:02:31,184 --> 00:02:35,414 The, the, the full thing is I accidentally bought a previous generation, 39 00:02:35,924 --> 00:02:40,874 thanks to, in my opinion, uh, pretty crappy advertising on their part. 40 00:02:41,714 --> 00:02:46,814 And as a result, I had a device that when it went to connect to wifi, it was 41 00:02:46,874 --> 00:02:50,984 unable to sense that I have a mesh and it. 42 00:02:51,419 --> 00:02:58,829 Was identifying the two nodes in my mesh as, as two instances of the 43 00:02:58,829 --> 00:03:02,549 wifi, and it didn't hit me at first that that's what was happening. 44 00:03:03,119 --> 00:03:10,049 And so, um, uh, I, I had to troubleshoot all my own persona with no help from you. 45 00:03:11,039 --> 00:03:13,049 Prasanna Malaiyandi: Yeah, and then you texted me and you were like, 46 00:03:13,049 --> 00:03:14,459 Hey, so this is what the issue was. 47 00:03:14,459 --> 00:03:16,559 I was like, what were you even talking about? 48 00:03:16,919 --> 00:03:16,949 Oh, 49 00:03:18,299 --> 00:03:20,159 W. Curtis Preston: See, that's how little help you were. 50 00:03:20,249 --> 00:03:23,099 You didn't even remember that you didn't help me. 51 00:03:24,304 --> 00:03:27,359 Prasanna Malaiyandi: well, granted, you didn't tell me that you had wifi issues, 52 00:03:28,019 --> 00:03:28,469 W. Curtis Preston: I didn't. 53 00:03:28,859 --> 00:03:29,609 I thought I told you 54 00:03:29,729 --> 00:03:29,939 Prasanna Malaiyandi: You. 55 00:03:30,599 --> 00:03:30,869 Nope. 56 00:03:30,869 --> 00:03:35,039 You just told me that you were not able to get the app to work 57 00:03:35,889 --> 00:03:36,189 W. Curtis Preston: Right. 58 00:03:36,279 --> 00:03:38,589 Couldn't get the app to work because of the wifi issues. 59 00:03:38,589 --> 00:03:39,364 That was, that was the problem. 60 00:03:39,369 --> 00:03:39,549 Prasanna Malaiyandi: No. 61 00:03:39,909 --> 00:03:41,739 That, that piece you kind of missed. 62 00:03:41,964 --> 00:03:43,194 W. Curtis Preston: Oh, I see, I see. 63 00:03:43,194 --> 00:03:45,834 So it's my fault that you were unable to help me. 64 00:03:46,299 --> 00:03:49,329 Prasanna Malaiyandi: because, because we all know how you don't 65 00:03:49,329 --> 00:03:51,489 do so well multitasking, so, 66 00:03:54,534 --> 00:03:55,734 W. Curtis Preston: I dunno what you're talking about. 67 00:03:56,154 --> 00:03:58,644 I'm currently doing seven things right now. 68 00:03:58,704 --> 00:03:58,764 Yeah. 69 00:03:59,344 --> 00:03:59,764 Prasanna Malaiyandi: Mm-Hmm. 70 00:04:03,969 --> 00:04:05,259 But how was your meal though 71 00:04:05,919 --> 00:04:07,839 W. Curtis Preston: Uh, the mail turned out fine. 72 00:04:08,259 --> 00:04:12,729 Uh, but they will, we're working out exactly what's gonna happen 73 00:04:12,734 --> 00:04:14,469 regarding the new generation. 74 00:04:15,129 --> 00:04:15,309 Um. 75 00:04:16,674 --> 00:04:21,594 I sent them the, the images that misled me and, and, uh, my dream is that they 76 00:04:21,594 --> 00:04:24,714 do a price match, that I get the new generation for the old generation money. 77 00:04:25,014 --> 00:04:28,764 But you know, between me and you, they, they'll never see this between me and you. 78 00:04:28,764 --> 00:04:31,584 I fully expect them to charge me the difference between the two. 79 00:04:32,184 --> 00:04:36,894 Um, and we'll, we'll swap it and, um, uh, and then we'll see how it goes. 80 00:04:36,894 --> 00:04:40,674 But, uh, but today we are. 81 00:04:41,379 --> 00:04:46,179 You know, we've been talking for the last few weeks about cybersecurity 82 00:04:46,209 --> 00:04:51,279 and we've been sort of leaning up or leading up to, we've been leading 83 00:04:51,279 --> 00:04:55,329 up to this moment where we're going to start to talk about ransomware. 84 00:04:55,419 --> 00:04:55,779 Right. 85 00:04:55,929 --> 00:04:57,309 Um, I think we had, I. 86 00:04:57,939 --> 00:05:03,639 Three great episodes where we had the, you know, the, the red team person. 87 00:05:03,639 --> 00:05:09,159 We had a blue team person, and then we had a red team person that turned into 88 00:05:09,459 --> 00:05:12,819 a blue team software person, uh, des. 89 00:05:13,269 --> 00:05:18,879 Um, and those all give such unique perspectives in terms 90 00:05:18,879 --> 00:05:21,309 of the cybersecurity world and. 91 00:05:21,984 --> 00:05:27,654 Um, you know, how you defend yourself just in general from cybersecurity. 92 00:05:28,174 --> 00:05:32,314 And then we had a couple of episodes where we gave you a lay of the 93 00:05:32,314 --> 00:05:34,114 land from a ransomware perspective. 94 00:05:34,114 --> 00:05:38,824 And also, really importantly, I think our last, uh, episode, 95 00:05:38,824 --> 00:05:40,264 last few episodes, we, we. 96 00:05:40,999 --> 00:05:46,129 The, if, if nothing else, I, I want people to, to understand that their 97 00:05:46,129 --> 00:05:49,009 backup system is 100% under attack. 98 00:05:49,519 --> 00:05:54,279 And, um, you know, if you just wanna listen to the, the Red Team episode, 99 00:05:54,339 --> 00:05:57,969 just the last third of it, if that's all you listen to, listen to Dwayne 100 00:05:57,969 --> 00:06:03,309 talking about how much he loves when there's a backup system, and how much 101 00:06:03,609 --> 00:06:08,139 from a, from a red team perspective, he loves to have access to that and, 102 00:06:08,889 --> 00:06:16,119 and how, uh, you know, just why it's such a, a, a wonderful thing to attack. 103 00:06:16,699 --> 00:06:19,189 Prasanna Malaiyandi: So, I don't know if you read today's news, though. 104 00:06:19,189 --> 00:06:23,629 So Veeam just recently had their conference beam on, and so they 105 00:06:23,659 --> 00:06:28,219 just announced, uh, that they are offering a cloud vaulting solution 106 00:06:28,579 --> 00:06:33,499 managed by Veeam that provides immutable storage for backups 107 00:06:34,519 --> 00:06:35,179 W. Curtis Preston: Interesting. 108 00:06:35,179 --> 00:06:35,899 So 109 00:06:36,034 --> 00:06:37,129 Prasanna Malaiyandi: a as offering. 110 00:06:37,369 --> 00:06:38,479 W. Curtis Preston: as an offering. 111 00:06:39,379 --> 00:06:39,769 Prasanna Malaiyandi: Yep. 112 00:06:40,039 --> 00:06:42,289 So you pay per month based on your terabytes. 113 00:06:42,289 --> 00:06:45,979 I think it was like 60 or $80 per terabyte per month. 114 00:06:46,519 --> 00:06:52,639 And you can vault your backups into Veeam's Vault and it'll be immutable. 115 00:06:52,639 --> 00:06:53,539 It'll be stored there. 116 00:06:53,539 --> 00:06:55,789 They'll protect it, all the rest. 117 00:06:55,939 --> 00:06:58,339 So I think it's relevant to what we had been talking about 118 00:06:58,339 --> 00:06:58,759 in the last 119 00:06:58,759 --> 00:06:59,509 couple episodes. 120 00:07:00,244 --> 00:07:01,654 W. Curtis Preston: it's absolutely relevant. 121 00:07:01,684 --> 00:07:02,104 Yeah. 122 00:07:02,434 --> 00:07:04,084 The, um, that's interesting. 123 00:07:04,084 --> 00:07:08,134 I, I think, you know, this is a big step for Veeam because 124 00:07:08,134 --> 00:07:11,404 for a long time they have not. 125 00:07:11,854 --> 00:07:15,904 Really gone down the service line. 126 00:07:15,964 --> 00:07:16,504 Right. 127 00:07:16,534 --> 00:07:19,354 Uh, but I think this is definitely a good step for them. 128 00:07:20,344 --> 00:07:24,424 Um, the, um, but, but that's, you know, that's the big thing, right? 129 00:07:24,429 --> 00:07:27,634 Is that, is that we just want people to understand the degree to which 130 00:07:27,639 --> 00:07:30,214 their backup servers are under attack. 131 00:07:31,144 --> 00:07:37,594 And then I, so I, the, the title that I put up for this one was how to Stop. 132 00:07:37,939 --> 00:07:42,109 Basically 90% of all ransomware attacks or, or how to stop 133 00:07:42,109 --> 00:07:43,399 ransomware the easy way. 134 00:07:43,969 --> 00:07:51,259 Right, because, and, and you just sent me a graphic, which, um, you 135 00:07:51,259 --> 00:07:53,444 know, and why don't, why don't you talk about that graphic or, 136 00:07:53,449 --> 00:07:55,279 or the lesson from that graphic. 137 00:07:56,119 --> 00:08:01,029 Prasanna Malaiyandi: Yeah, so it was by, uh, on X or Twitter, formerly known 138 00:08:01,029 --> 00:08:07,779 as Twitter, uh, by Daniel Card, uh, who goes by the Twitter handle, Mr. 139 00:08:07,959 --> 00:08:08,709 Reboot. 140 00:08:09,339 --> 00:08:16,719 And it basically talks about how expensive things get to, uh. 141 00:08:18,294 --> 00:08:23,964 Detect or prevent ransomware or an attack and where it happens. 142 00:08:23,964 --> 00:08:31,704 So for instance, if you were trying to look at the cost of the attack, 143 00:08:31,709 --> 00:08:34,434 when you are at the recovery stage, it's at the highest because you 144 00:08:34,434 --> 00:08:36,264 now have a bunch of infrastructure. 145 00:08:36,269 --> 00:08:37,554 You're trying to recover everything. 146 00:08:37,554 --> 00:08:38,724 It's super expensive. 147 00:08:39,204 --> 00:08:40,645 But then if you go to sort of. 148 00:08:40,679 --> 00:08:41,459 Less costly. 149 00:08:41,459 --> 00:08:45,119 From there, it's like responding, so you don't need to recover, but 150 00:08:45,119 --> 00:08:49,769 you're responding, but it still has a significant cost associated with it. 151 00:08:50,159 --> 00:08:54,119 Next was around the detect side, which isn't as expensive, and then 152 00:08:54,119 --> 00:08:56,789 protect, which is the cheapest of all. 153 00:08:56,794 --> 00:09:00,454 So it's basically significantly cheaper to break a kill chain at the 154 00:09:00,454 --> 00:09:02,974 protect stage than at the recover stage. 155 00:09:02,999 --> 00:09:06,419 So how do you prevent ransomware from even coming in? 156 00:09:06,954 --> 00:09:10,009 Because it gets significantly more expensive if you've already been hit. 157 00:09:10,809 --> 00:09:14,139 W. Curtis Preston: And the thing is, if, if we look at the typical, 158 00:09:15,399 --> 00:09:18,459 uh, attack process, right? 159 00:09:18,459 --> 00:09:20,319 All you have to do is stop one. 160 00:09:20,319 --> 00:09:23,379 You know, you have to stop the kill chain somewhere along the way. 161 00:09:23,379 --> 00:09:25,299 All you have to do is stop one of those. 162 00:09:25,599 --> 00:09:29,799 So if you know, if you have good password management, you know 163 00:09:29,889 --> 00:09:33,429 you can stop them from getting the password in the first place. 164 00:09:33,429 --> 00:09:37,269 But if you've got a good MFA system, you can stop them from using a 165 00:09:37,269 --> 00:09:38,319 password that they're stolen. 166 00:09:38,319 --> 00:09:42,489 So that's kind of what I wanted to talk about is when you look 167 00:09:42,494 --> 00:09:47,179 at all of the stories, all of the ransomware attacks, the ones that 168 00:09:47,179 --> 00:09:56,509 go into how the attack happened in detail almost always come down to. 169 00:09:57,914 --> 00:10:03,409 Uh, you know, when I read it, I say, well, gee, if the customer had 170 00:10:03,409 --> 00:10:08,599 just done A, B or C, they would've stopped this ransomware attack. 171 00:10:08,899 --> 00:10:10,219 So this is what I'm saying. 172 00:10:10,429 --> 00:10:13,189 If you wanna stop ransomware attacks the easy way. 173 00:10:13,429 --> 00:10:18,059 If you wanna stop 90 plus percent of ransomware attacks, stop all of the stupid 174 00:10:18,059 --> 00:10:22,199 ones and then spend your time, effort, and money on stopping the harder ones. 175 00:10:22,479 --> 00:10:23,199 Prasanna Malaiyandi: Hard ones. 176 00:10:23,489 --> 00:10:24,784 W. Curtis Preston: There was this great moment. 177 00:10:25,739 --> 00:10:31,889 During Dwayne's, um, recording where he talked about, he had this 178 00:10:31,889 --> 00:10:35,669 analogy and he said it's, it's as if we're in this field and there's 179 00:10:35,669 --> 00:10:37,619 this door in the middle of the field. 180 00:10:37,649 --> 00:10:41,159 And I go, gee, I can't go through this door. 181 00:10:41,669 --> 00:10:42,359 Um. 182 00:10:42,884 --> 00:10:44,654 You know, I guess I can't do anything. 183 00:10:45,134 --> 00:10:47,774 And he's like, or I could just go around the door. 184 00:10:48,284 --> 00:10:55,304 Um, the, the, um, what, what I'm saying is that if you don't do these three 185 00:10:55,304 --> 00:11:01,124 things that we're going to talk about, honestly there's no point because 186 00:11:01,124 --> 00:11:03,884 it's essentially you have, you have, it's like you have this open field. 187 00:11:04,034 --> 00:11:07,454 You're spending your time trying to figure out how to lock this door. 188 00:11:07,754 --> 00:11:09,704 Meanwhile, you have this wide open field. 189 00:11:10,064 --> 00:11:12,434 There's just literally no point in in doing that. 190 00:11:13,354 --> 00:11:13,644 Prasanna Malaiyandi: yeah. 191 00:11:14,239 --> 00:11:17,689 Or another thing I would think about similarly is like in a house, right? 192 00:11:18,709 --> 00:11:24,289 You're not going to go spend all this time on cameras and alarms and 193 00:11:24,289 --> 00:11:29,209 everything else when you leave the front door unlocked every day, or you don't 194 00:11:29,214 --> 00:11:30,379 even have a lock on your front door. 195 00:11:30,669 --> 00:11:32,014 W. Curtis Preston: Exactly, exactly. 196 00:11:32,204 --> 00:11:37,184 You know, thi this article that just got sent to me this morning, uh, it, it, 197 00:11:37,184 --> 00:11:41,474 it's an interesting story and I don't want to go too much into the full story. 198 00:11:41,594 --> 00:11:44,384 Why don't, why don't you give a, a, a brief summary of where we 199 00:11:44,384 --> 00:11:46,994 got to this point with this story. 200 00:11:47,729 --> 00:11:48,089 Prasanna Malaiyandi: Yeah. 201 00:11:48,089 --> 00:11:49,709 So we. 202 00:11:50,129 --> 00:11:54,209 Somehow, so this all initially started with a Ticketmaster Live Nation breach 203 00:11:54,659 --> 00:11:59,639 and all their users' data was stolen and they kind of pointed the finger 204 00:11:59,639 --> 00:12:05,879 saying Snowflake was the one that was attacked and breached and lost the data. 205 00:12:05,879 --> 00:12:09,329 Snowflake came back and said, Hey, it's not us. 206 00:12:09,329 --> 00:12:14,009 There's other, someone's sort of gotten the customer credentials 207 00:12:14,729 --> 00:12:16,979 and are now using that to then. 208 00:12:17,384 --> 00:12:20,204 Pilfer data from their Snowflake instance. 209 00:12:20,864 --> 00:12:22,844 And so it's not the Snowflake side. 210 00:12:22,844 --> 00:12:26,054 And so they're warning their other customers, Hey, by the way, uh, 211 00:12:26,114 --> 00:12:29,144 make sure that you're looking after things so you don't lose your data. 212 00:12:29,144 --> 00:12:32,924 In fact, uh, just as we're recording this, advanced Auto Supply, which is an 213 00:12:32,924 --> 00:12:36,434 auto parts store, also had their data breach from their Snowflake instance. 214 00:12:37,349 --> 00:12:40,829 W. Curtis Preston: Yeah, so I, I do feel like there's a 215 00:12:40,829 --> 00:12:42,899 piece to that puzzle missing. 216 00:12:42,959 --> 00:12:47,189 Like if it, it, it would, it would. 217 00:12:48,839 --> 00:12:54,089 I, I'm inferring from what I'm reading, that maybe somewhere there is a 218 00:12:54,089 --> 00:13:01,799 list of, of Snowflake accounts and passwords, um, which would suggest some, 219 00:13:02,039 --> 00:13:04,019 uh, fault on the part of Snowflake. 220 00:13:04,019 --> 00:13:08,249 But what they are saying is that Snowflake is definitely saying that 221 00:13:08,249 --> 00:13:13,349 they're seeing a, uh, a surge of attacks on customers of its cloud platform. 222 00:13:13,919 --> 00:13:17,099 But my point of that whole story is that. 223 00:13:17,819 --> 00:13:20,214 All of these attacks would be stopped by one of the three things 224 00:13:20,214 --> 00:13:21,334 that we're gonna talk about today. 225 00:13:21,854 --> 00:13:25,904 Prasanna Malaiyandi: They did say that Snowflake was attacked and employees 226 00:13:25,904 --> 00:13:31,754 credentials were used, but it was only used to access a demo account, which 227 00:13:31,754 --> 00:13:34,274 of course did not have one of the three things we're about to talk about. 228 00:13:34,414 --> 00:13:35,434 W. Curtis Preston: Gotcha, gotcha. 229 00:13:36,104 --> 00:13:39,284 Prasanna Malaiyandi: it wasn't production customer data, it was just a demo account. 230 00:13:39,624 --> 00:13:43,074 W. Curtis Preston: Hey, you got robbed, but uh, they only took your empty wallet. 231 00:13:43,134 --> 00:13:45,264 Um, you know, something like that. 232 00:13:46,074 --> 00:13:54,084 But, um, all right, so how do we stop basically ransomware the easy way? 233 00:13:54,084 --> 00:13:58,524 How do we stop 90% of ransomware attacks? 234 00:13:58,854 --> 00:13:59,394 And I. 235 00:13:59,754 --> 00:14:04,794 The thing is, frequent listeners to this podcast are going to know immediately 236 00:14:04,794 --> 00:14:08,814 where I'm going, and I apologize for repeating myself, but sometimes you gotta 237 00:14:08,814 --> 00:14:12,324 say things over and over and over again, and the very first thing that I'm gonna 238 00:14:12,329 --> 00:14:15,744 talk about is patch management, right? 239 00:14:16,014 --> 00:14:22,824 Um, when, when we think back on the list of cloud hacks. 240 00:14:23,859 --> 00:14:27,249 We covered a few, uh, weeks ago. 241 00:14:27,909 --> 00:14:29,859 I remember at least one of them. 242 00:14:29,859 --> 00:14:33,849 The Rackspace one was based on a, a patch. 243 00:14:33,849 --> 00:14:35,889 Can you think were, were any of the other ones? 244 00:14:37,134 --> 00:14:39,504 Prasanna Malaiyandi: I think that was the only one that I 245 00:14:39,519 --> 00:14:39,909 W. Curtis Preston: Okay. 246 00:14:40,509 --> 00:14:45,789 Um, but just in those 10 stories that we had, one of them and a 247 00:14:45,789 --> 00:14:50,229 really big one that basically took out an entire business line. 248 00:14:51,564 --> 00:14:58,164 Um, what if they had simply followed standard patch management procedures 249 00:14:58,164 --> 00:15:03,834 and put in their patches at a, you know, especially critical 250 00:15:03,834 --> 00:15:04,194 patches. 251 00:15:04,974 --> 00:15:11,784 So I think, I think if you just follow the CVE system and what it suggests, then 252 00:15:12,384 --> 00:15:13,884 I think you'd be in a much better place. 253 00:15:13,884 --> 00:15:15,084 Why don't you talk about what that is? 254 00:15:15,894 --> 00:15:19,074 Prasanna Malaiyandi: Yeah, so the CVE is critical vulnerabilities and 255 00:15:19,074 --> 00:15:24,534 exposure, and it's a public database, if you will, where you have vendors 256 00:15:24,534 --> 00:15:30,204 with known issues that then get cataloged and then it can be tracked 257 00:15:30,209 --> 00:15:32,304 and they assign a severity to these. 258 00:15:32,304 --> 00:15:35,214 So if you look at the levels. 259 00:15:36,054 --> 00:15:42,864 There is part of the common vulnerability scoring system that they look at. 260 00:15:42,864 --> 00:15:44,964 So it's how critical is it? 261 00:15:45,324 --> 00:15:48,894 Um, how likely is it, how many people get impacted and all the rest, and it 262 00:15:48,894 --> 00:15:53,514 goes everywhere from low all the way up at the highest level is critical. 263 00:15:53,514 --> 00:15:56,709 And critical is like a nine and a 10 on their scale of zero through 10. 264 00:15:57,059 --> 00:15:57,409 W. Curtis Preston: Right. 265 00:15:58,329 --> 00:16:02,709 Prasanna Malaiyandi: And so those ones that are either actively exploited 266 00:16:02,709 --> 00:16:07,869 or very common to access, um, those are the ones that usually get like 267 00:16:07,869 --> 00:16:12,969 a higher critical severity, which pretty much means as a vendor or a 268 00:16:13,209 --> 00:16:15,609 customer using that piece of software. 269 00:16:15,609 --> 00:16:17,139 You wanna fix that pretty quickly. 270 00:16:17,139 --> 00:16:21,819 Like if there was a VMware ESXI bug. 271 00:16:23,469 --> 00:16:25,239 Takeover of the system. 272 00:16:25,299 --> 00:16:27,284 That's probably something you want to patch pretty rapidly. 273 00:16:27,999 --> 00:16:28,749 W. Curtis Preston: Right, right. 274 00:16:29,079 --> 00:16:34,924 Which is what happened with the exchange vulnerability that there wa 275 00:16:34,924 --> 00:16:37,029 there, it, it's a little complicated. 276 00:16:37,034 --> 00:16:40,359 If you want the full story, go listen to that episode about Rackspace. 277 00:16:40,839 --> 00:16:43,569 But there, there were two different vulnerabilities. 278 00:16:44,379 --> 00:16:48,999 There was one that they had made a workaround for that. 279 00:16:49,059 --> 00:16:54,189 Um, which is why I think if I'm guessing what the Rackspace 280 00:16:54,189 --> 00:16:55,539 had done, the workaround. 281 00:16:56,199 --> 00:16:58,809 Um, and because they had done the workaround, maybe they 282 00:16:58,809 --> 00:17:02,529 didn't feel the need to put the patch in as they didn't feel. 283 00:17:03,129 --> 00:17:08,829 Um, you know, it, it, it, it lowered its criticality, but because they 284 00:17:08,829 --> 00:17:14,259 didn't patch the previous, um, vulnerability there turned out to be a 285 00:17:14,264 --> 00:17:18,819 new vulnerability that that patch would've fixed, but they didn't fix it, right? 286 00:17:18,819 --> 00:17:24,339 So I'm just, it's like if you just put in the patches when they become 287 00:17:24,339 --> 00:17:30,159 available, and, um, and of course being a show that we, we are, 288 00:17:30,189 --> 00:17:32,199 what, what do I often say about. 289 00:17:32,604 --> 00:17:33,624 Putting in patches, 290 00:17:33,624 --> 00:17:36,954 . Prasanna Malaiyandi: Don't forget about your backup system for patch management, 291 00:17:36,959 --> 00:17:41,154 because everyone always thinks about production or end user devices, but 292 00:17:41,154 --> 00:17:42,894 they always forget about backup systems. 293 00:17:42,894 --> 00:17:42,954 I. 294 00:17:43,314 --> 00:17:45,594 W. Curtis Preston: Yeah, I, I would actually put that even stronger. 295 00:17:45,599 --> 00:17:50,034 I would put the backup system at the front of the line, um, maybe, um. 296 00:17:50,599 --> 00:17:52,879 Well, you know, it, it, it depends, right? 297 00:17:52,879 --> 00:17:54,949 It depends on the kind of patch, right? 298 00:17:54,949 --> 00:17:58,729 Obviously, if it's a, if it's an exchange vulnerability patch, the, uh, 299 00:17:58,759 --> 00:18:00,829 backup system is gonna be last in line. 300 00:18:01,219 --> 00:18:07,129 But, uh, if, uh, or even not even in the line, but if it's a remote code 301 00:18:07,129 --> 00:18:13,159 execution against windows, um, or, you know, something like that, then 302 00:18:13,159 --> 00:18:16,669 I, I would think that your last line of defense should be your first line 303 00:18:16,669 --> 00:18:19,249 of, of where pat patches should go. 304 00:18:20,094 --> 00:18:20,364 Prasanna Malaiyandi: Yeah. 305 00:18:20,544 --> 00:18:24,054 The one thing I do want to talk about Curtis, that I don't think 306 00:18:24,054 --> 00:18:28,854 we've normally talked about is patch management only works if you know 307 00:18:28,854 --> 00:18:30,024 what's running in your environment. 308 00:18:31,014 --> 00:18:36,264 So make sure you have a good inventory of software packages that are used at 309 00:18:36,264 --> 00:18:40,314 your company, including all the random ones that people might install, and 310 00:18:40,314 --> 00:18:44,754 maybe you do have an application process as part of it approved applications, 311 00:18:45,504 --> 00:18:48,714 because that's the only way you're gonna be able to tell what's actually in my 312 00:18:48,714 --> 00:18:52,854 environment and do I have everything patched and updated as needed. 313 00:18:53,424 --> 00:18:53,784 W. Curtis Preston: Yeah. 314 00:18:53,789 --> 00:18:56,184 And there are tools that can help you do that, right? 315 00:18:56,664 --> 00:19:02,574 Um, software, inventory tools, um, for, you know, for a fee, they will go out 316 00:19:02,574 --> 00:19:06,924 and figure out if you, if you have a complete, you know, I was gonna say 317 00:19:06,924 --> 00:19:08,184 Greenfield, but that's not the right, 318 00:19:08,724 --> 00:19:10,614 I complete Wild, wild West. 319 00:19:10,674 --> 00:19:11,394 I remember. 320 00:19:11,604 --> 00:19:12,444 I remember. 321 00:19:12,504 --> 00:19:13,224 Um. 322 00:19:13,884 --> 00:19:18,864 You know, a friend of the pod that, um, he hasn't been on the pod, but 323 00:19:18,869 --> 00:19:23,694 he is definitely a friend of the pod that the first thing I did with 324 00:19:23,694 --> 00:19:28,044 him, we, we were trying to, uh, he was a client and the first thing I 325 00:19:28,044 --> 00:19:30,984 did with him, I was like, well, what do you have in your environment? 326 00:19:30,984 --> 00:19:32,604 He is like, I don't know. 327 00:19:33,174 --> 00:19:33,624 Right. 328 00:19:33,864 --> 00:19:38,004 And uh, here's the crazy part is that I don't know if I've had 329 00:19:38,004 --> 00:19:39,354 this conversation with you before. 330 00:19:39,774 --> 00:19:42,504 What Microsoft. 331 00:19:43,104 --> 00:19:51,834 Tool did I install to inventory this guy's environment in terms of tell me how many 332 00:19:51,834 --> 00:19:57,144 different boxes, what the network topology was, um, you know, the IP addresses 333 00:19:57,149 --> 00:19:58,314 and the switches and all this stuff. 334 00:19:58,624 --> 00:20:01,864 What Microsoft tool did I install to do this discovery? 335 00:20:01,894 --> 00:20:05,164 And by the way, the tool was very expensive at the time. 336 00:20:05,164 --> 00:20:07,809 It was like, it was like $10,000 337 00:20:07,894 --> 00:20:08,644 Prasanna Malaiyandi: you did tell me. 338 00:20:09,339 --> 00:20:09,759 W. Curtis Preston: mm-Hmm. 339 00:20:11,179 --> 00:20:11,539 Yeah. 340 00:20:12,229 --> 00:20:13,309 And um, 341 00:20:13,369 --> 00:20:13,659 Prasanna Malaiyandi: Yeah. 342 00:20:14,479 --> 00:20:16,549 W. Curtis Preston: and the thing is it more than paid for itself? 343 00:20:17,089 --> 00:20:19,489 People that use Vizio now are, they're like, what? 344 00:20:19,489 --> 00:20:21,319 Vizio was a network discovery tool. 345 00:20:21,469 --> 00:20:23,839 Yes, that's exactly what it was. 346 00:20:24,019 --> 00:20:25,159 And the fact that they just. 347 00:20:25,699 --> 00:20:27,349 I don't know, they just put that part to bed. 348 00:20:27,349 --> 00:20:29,119 Maybe it was just too hard to maintain or something. 349 00:20:29,359 --> 00:20:36,949 But we gave that customer their first networked apology map using Vizio. 350 00:20:37,219 --> 00:20:39,199 Um, was a be, it was a beautiful thing. 351 00:20:40,009 --> 00:20:43,879 So you're right, uh, you've got to have the system inventory, you've got to 352 00:20:43,879 --> 00:20:48,109 have the OS inventory, the application inventory so that you know, and then 353 00:20:48,109 --> 00:20:50,239 there are patch management systems. 354 00:20:51,109 --> 00:20:53,329 That can help you, uh, 355 00:20:53,659 --> 00:20:55,069 navigate this, this 356 00:20:55,429 --> 00:20:57,949 Prasanna Malaiyandi: can I, can I go one more step beyond that too? 357 00:20:58,039 --> 00:20:58,399 W. Curtis Preston: Sure. 358 00:20:59,359 --> 00:21:03,049 Prasanna Malaiyandi: Uh, in addition to applications, I think you should 359 00:21:03,049 --> 00:21:08,209 also consider things that you are using in your code development. 360 00:21:08,899 --> 00:21:11,269 For instance, what libraries are you pulling from? 361 00:21:11,269 --> 00:21:13,429 What open source packages are you pulling from? 362 00:21:13,429 --> 00:21:16,999 Because even though you may not consider that part of your application, 363 00:21:17,239 --> 00:21:18,829 developers are building and testing. 364 00:21:18,829 --> 00:21:23,304 I don't know if you heard about this issue that, um, someone had done a. 365 00:21:24,319 --> 00:21:27,769 Long con operation on an open source package. 366 00:21:27,919 --> 00:21:28,939 I dunno if you heard about this. 367 00:21:29,539 --> 00:21:36,619 And they basically took over maintaining a very popular compression library that 368 00:21:36,709 --> 00:21:41,629 a ton of software packages use a lot of Linux open distribution software. 369 00:21:42,019 --> 00:21:45,019 And they had put a back door into it because they realized 370 00:21:45,079 --> 00:21:47,359 that library is also used by SSH. 371 00:21:47,359 --> 00:21:52,159 A random developer who works at Microsoft, noticed that the latency had 372 00:21:52,159 --> 00:21:57,529 increased by like 600 millisecond, like milliseconds, and he had traced it back 373 00:21:57,529 --> 00:22:01,009 and found out that someone had backdoored this common open source software. 374 00:22:01,009 --> 00:22:02,869 I will, I think we should attach a link. 375 00:22:02,869 --> 00:22:05,589 I I, there's a podcast that goes over this, which is. 376 00:22:05,979 --> 00:22:06,729 Amazing. 377 00:22:07,299 --> 00:22:08,859 So we will put a link to that, but yeah. 378 00:22:09,219 --> 00:22:09,579 W. Curtis Preston: Yeah. 379 00:22:09,579 --> 00:22:16,659 So all, all software, all tools, all libraries, um, and tools that you're 380 00:22:16,659 --> 00:22:18,459 using to make that software right. 381 00:22:19,089 --> 00:22:22,329 Um, yeah, that would become quite an inventory over time. 382 00:22:23,229 --> 00:22:25,479 But that's your job. 383 00:22:25,839 --> 00:22:26,289 Right? 384 00:22:26,679 --> 00:22:32,499 Um, and, uh, all it, you know, you know, they talk a lot like, like in terrorism. 385 00:22:32,559 --> 00:22:36,309 The, you know, if you're, if you're trying to prevent terrorism, you have to 386 00:22:36,314 --> 00:22:37,419 be right a hundred percent of the time. 387 00:22:37,419 --> 00:22:38,859 They only have to be right once, right? 388 00:22:39,159 --> 00:22:41,409 They only have to get into one of these tools. 389 00:22:42,024 --> 00:22:44,004 And they are well equipped. 390 00:22:44,004 --> 00:22:45,534 You know, we can talk about the dark web. 391 00:22:45,534 --> 00:22:46,434 They're well equipped. 392 00:22:46,434 --> 00:22:47,454 They're well connected. 393 00:22:47,454 --> 00:22:49,974 They're, well, you know, they, they know what they're doing. 394 00:22:50,454 --> 00:22:53,604 Uh, and they share, uh, they share tools. 395 00:22:53,604 --> 00:22:55,374 So you need to do the same thing. 396 00:22:56,064 --> 00:23:00,534 So the first thing is patch management, and the first thing is patch management. 397 00:23:00,594 --> 00:23:02,664 What is going to be the second thing? 398 00:23:02,664 --> 00:23:03,174 Persona? 399 00:23:04,209 --> 00:23:09,459 Prasanna Malaiyandi: So it's your favorite topic, Curtis, which is around passwords. 400 00:23:09,999 --> 00:23:13,929 And I know we talked about credential stuffing just recently with the Salesforce 401 00:23:13,929 --> 00:23:17,649 attack, but yeah, passwords are. 402 00:23:17,694 --> 00:23:21,024 It's critical because every system uses a different password. 403 00:23:21,024 --> 00:23:24,114 Even if you use single sign-on and all the rest, right? 404 00:23:24,114 --> 00:23:27,204 You still have a password and it gets worse with single sign-on, 405 00:23:27,204 --> 00:23:29,904 because once you're into one system, you can get into everything else. 406 00:23:30,444 --> 00:23:37,284 So having strong passwords and also using a password manager so 407 00:23:37,314 --> 00:23:42,054 you're not just doing variations of the same password depending on 408 00:23:42,054 --> 00:23:43,554 the system you're logging into. 409 00:23:44,104 --> 00:23:45,244 So password management. 410 00:23:45,244 --> 00:23:46,594 Password management is key. 411 00:23:46,864 --> 00:23:52,564 Making sure that you have a system, and I'm kind of 412 00:23:52,564 --> 00:23:57,124 indifferent if it's a cloud-based system or a local based system. 413 00:23:57,154 --> 00:24:00,184 I know Curtis, you like Cloud-based password managers. 414 00:24:00,604 --> 00:24:05,044 I would say every corporation can decide what makes sense for their environment. 415 00:24:06,439 --> 00:24:09,589 W. Curtis Preston: Yeah, I mean, I, I, I'm not, I, I think I'm 416 00:24:09,679 --> 00:24:12,714 similar to you in that I, uh. 417 00:24:13,249 --> 00:24:15,919 I'm not hard, fast one or the other. 418 00:24:17,239 --> 00:24:22,849 For me, it's cloud-based, because for me, I don't want to maintain 419 00:24:22,939 --> 00:24:24,859 the, the keys to my kingdom. 420 00:24:24,864 --> 00:24:29,449 I don't wanna maintain the system that is, you know, to 421 00:24:29,449 --> 00:24:30,529 you it's the other way around. 422 00:24:30,534 --> 00:24:33,709 You're like, oh, I want maintain the keys to my, yeah, it's 423 00:24:33,709 --> 00:24:34,699 a personal preference thing. 424 00:24:34,699 --> 00:24:38,209 I don't think there's, um, again, as long as you do your 425 00:24:38,209 --> 00:24:41,239 due diligence and you don't use. 426 00:24:41,734 --> 00:24:47,644 A password service that has been hacked multiple times. 427 00:24:52,504 --> 00:24:54,214 As long as you don't do that. 428 00:24:54,694 --> 00:24:57,934 Um, and you look at, you look at the design of the password, you look at 429 00:24:57,939 --> 00:24:59,734 how they're storing the passwords. 430 00:25:00,154 --> 00:25:02,434 Are passwords ever stored in clear text? 431 00:25:02,434 --> 00:25:04,444 You know, where are the passwords encrypted? 432 00:25:04,444 --> 00:25:05,524 Where are they decrypted? 433 00:25:05,944 --> 00:25:07,744 Uh, you look at all those things. 434 00:25:08,599 --> 00:25:10,699 Prasanna Malaiyandi: And it's not just the password, it's even URLs. 435 00:25:12,454 --> 00:25:13,594 W. Curtis Preston: Right, right. 436 00:25:13,624 --> 00:25:14,284 Are they storing? 437 00:25:14,284 --> 00:25:14,494 Yeah. 438 00:25:14,524 --> 00:25:18,694 'cause that was, um, that was something that came out in one 439 00:25:18,694 --> 00:25:19,804 of the recent hacks, right? 440 00:25:19,804 --> 00:25:21,364 That, that one of the things that they were able to 441 00:25:21,439 --> 00:25:22,519 Prasanna Malaiyandi: Which they fixed now. 442 00:25:22,894 --> 00:25:23,824 W. Curtis Preston: which they have fixed. 443 00:25:23,829 --> 00:25:24,124 Yeah. 444 00:25:24,799 --> 00:25:25,069 Prasanna Malaiyandi: Yep. 445 00:25:26,584 --> 00:25:27,874 W. Curtis Preston: I'm still not gonna use them. 446 00:25:28,354 --> 00:25:29,044 Um, but, 447 00:25:30,379 --> 00:25:31,159 Prasanna Malaiyandi: But, but, but, but, 448 00:25:32,134 --> 00:25:32,374 W. Curtis Preston: go ahead. 449 00:25:32,629 --> 00:25:35,509 Prasanna Malaiyandi: but I think when you are using a password manager, 450 00:25:35,509 --> 00:25:41,809 and I know we've talked about this also on the podcast with Sue, um, is 451 00:25:42,199 --> 00:25:46,759 make sure you have a backup of your password manager as well, right? 452 00:25:46,759 --> 00:25:49,849 Going back and talking about the inventory, right? 453 00:25:49,879 --> 00:25:52,279 Your password manager is your keys to your kingdom. 454 00:25:52,819 --> 00:25:55,489 If you don't have access to your password manager, you're a little screwed. 455 00:25:56,374 --> 00:25:56,764 W. Curtis Preston: Yeah. 456 00:25:56,974 --> 00:25:57,184 Yeah. 457 00:25:57,184 --> 00:25:59,254 You need, yeah, there, there's a great episode. 458 00:25:59,254 --> 00:26:00,454 Like how do you, how do you. 459 00:26:01,369 --> 00:26:05,899 Um, w what happens when you lose everything, right, when you lose 460 00:26:05,899 --> 00:26:06,979 all the keys to the kingdom? 461 00:26:07,249 --> 00:26:10,369 Uh, and, and by the way, uh, the one that I happen to use, which is 462 00:26:10,369 --> 00:26:16,819 Dashlane, they recently, uh, created a, an additional like doomsday key. 463 00:26:17,359 --> 00:26:20,419 That you can use in addition to all of the others. 464 00:26:20,479 --> 00:26:25,519 And the, the doomsday key, my problem, same, same as her problem, my problem 465 00:26:25,524 --> 00:26:29,029 has always been okay, if I create the doomsday key, where do I put that? 466 00:26:29,959 --> 00:26:30,409 Right? 467 00:26:31,009 --> 00:26:35,479 Um, and, you know, this is where friends and family, I think come into play. 468 00:26:35,479 --> 00:26:35,809 Right. 469 00:26:35,839 --> 00:26:44,749 Um, but I, I was really happy to see when we had, um, you know what, what 470 00:26:44,749 --> 00:26:45,199 now? 471 00:26:46,249 --> 00:26:49,069 Prasanna Malaiyandi: I was thinking friends and family who can make 472 00:26:49,069 --> 00:26:52,249 sure they know they can keep that safely and know where it exists. 473 00:26:52,924 --> 00:26:53,524 W. Curtis Preston: Yes. 474 00:26:53,584 --> 00:26:54,184 Yes. 475 00:26:54,544 --> 00:26:55,234 Uh, agreed. 476 00:26:55,324 --> 00:26:57,514 Um, yeah. 477 00:26:57,934 --> 00:27:00,754 Um, choose, choose Wisely. 478 00:27:01,654 --> 00:27:05,074 The, you know, the other part about Dwayne's interview that I really liked 479 00:27:05,224 --> 00:27:08,704 was when we got to the part about password management, and he was Oh, yeah, yeah. 480 00:27:08,704 --> 00:27:10,414 He's like, yes, I'm, I'm a hundred percent on. 481 00:27:10,594 --> 00:27:11,914 I was really worried that he'd be like. 482 00:27:12,059 --> 00:27:12,419 Okay. 483 00:27:12,419 --> 00:27:14,999 No people that know what they're doing, don't wanna use password management. 484 00:27:15,119 --> 00:27:16,259 I was really ready for that. 485 00:27:16,259 --> 00:27:17,249 But no, 486 00:27:17,279 --> 00:27:18,869 Dwayne was on board. 487 00:27:19,819 --> 00:27:22,399 Prasanna Malaiyandi: but I think there are two things that you should be careful of 488 00:27:22,404 --> 00:27:24,019 though, even with the password manager. 489 00:27:24,569 --> 00:27:25,049 W. Curtis Preston: Talk to me. 490 00:27:25,339 --> 00:27:25,399 Prasanna Malaiyandi: so. 491 00:27:26,119 --> 00:27:32,179 The first is if you are storing it in like a web browser or other 492 00:27:32,179 --> 00:27:33,979 things that auto fills your password, 493 00:27:34,384 --> 00:27:34,804 W. Curtis Preston: Mm-Hmm. 494 00:27:35,749 --> 00:27:38,419 Prasanna Malaiyandi: be a little careful of that because if someone compromises 495 00:27:38,419 --> 00:27:43,669 your device and they have access to your web browser, it could now automatically 496 00:27:43,669 --> 00:27:46,609 start filling in your passwords to things like your backup system 497 00:27:47,044 --> 00:27:47,404 W. Curtis Preston: Yeah. 498 00:27:47,839 --> 00:27:49,609 Prasanna Malaiyandi: active directory and other things like that. 499 00:27:49,609 --> 00:27:50,869 So be careful. 500 00:27:51,469 --> 00:27:53,659 W. Curtis Preston: Yeah, which is, and thanks for bringing it up, which 501 00:27:53,659 --> 00:27:56,569 is why, you know, good, better, best. 502 00:27:56,779 --> 00:28:01,639 A browser-based password manager is better than no password manager, 503 00:28:01,939 --> 00:28:04,489 but I am not a fan of browser based. 504 00:28:04,579 --> 00:28:08,389 Um, meaning the, the password manager built into Chrome or. 505 00:28:08,719 --> 00:28:12,769 Firefox or, um, you know, what's the other one? 506 00:28:13,264 --> 00:28:13,924 What's the, 507 00:28:14,599 --> 00:28:15,439 Prasanna Malaiyandi: Safari. 508 00:28:15,784 --> 00:28:16,339 W. Curtis Preston: no, no, no. 509 00:28:16,339 --> 00:28:18,259 Well, there's Safari, but what's the Microsoft one? 510 00:28:19,304 --> 00:28:19,594 Prasanna Malaiyandi: edge. 511 00:28:20,209 --> 00:28:20,689 W. Curtis Preston: Edge? 512 00:28:20,719 --> 00:28:20,959 Yeah. 513 00:28:21,019 --> 00:28:25,879 Literally, by the way, edge just passed some milestone of where 514 00:28:25,879 --> 00:28:28,129 like it's now 15% or something. 515 00:28:28,879 --> 00:28:29,119 I dunno. 516 00:28:29,119 --> 00:28:30,229 They're very excited about that. 517 00:28:30,259 --> 00:28:34,399 Anyway, I'm not a fan of password managers built into the thing because 518 00:28:34,399 --> 00:28:35,749 of exactly what you talked about. 519 00:28:35,749 --> 00:28:36,109 Right. 520 00:28:36,379 --> 00:28:41,509 Um, it's really easy, for example, to, if I've got physical access to 521 00:28:41,514 --> 00:28:47,299 your device, it's really easy for me to hack into it and to, to eventually 522 00:28:47,299 --> 00:28:51,319 get to log in as you, and now I can open up your browser and then poof. 523 00:28:51,319 --> 00:28:52,459 I'm, I'm everywhere. 524 00:28:52,459 --> 00:28:54,709 Prasanna Malaiyandi: Yeah, which is why your password manager should 525 00:28:54,709 --> 00:28:59,479 either require biometric authentication or a password, a master password 526 00:28:59,479 --> 00:29:00,859 in order to open it to use it. 527 00:29:01,279 --> 00:29:01,879 W. Curtis Preston: Exactly. 528 00:29:01,879 --> 00:29:04,164 By the way, when we say password management, we mean, I. 529 00:29:04,734 --> 00:29:09,894 The overall system of, of, of making sure that passwords have a sufficient 530 00:29:09,894 --> 00:29:14,634 length, making sure that you separate, we, we believe strongly in separating 531 00:29:14,634 --> 00:29:18,204 the backup system, passwords, usernames, and passwords from the 532 00:29:18,204 --> 00:29:19,644 production, usernames and passwords. 533 00:29:19,649 --> 00:29:24,564 We do not believe in separate or, or sharing this with 534 00:29:24,564 --> 00:29:25,974 something like active directory. 535 00:29:26,709 --> 00:29:29,649 Um, you know, or, or even Okta, right? 536 00:29:29,649 --> 00:29:32,079 Between, uh, the two systems. 537 00:29:32,079 --> 00:29:36,609 I believe that they should be 100% separate and, uh, that there should be a 538 00:29:36,609 --> 00:29:40,839 separate sort of doomsday based password management system for the backup system. 539 00:29:41,319 --> 00:29:41,349 I. 540 00:29:41,349 --> 00:29:43,734 Because of exactly what we're talking about, right? 541 00:29:44,184 --> 00:29:50,274 If your active directory or Okta or whatever you're using is compromised, 542 00:29:50,454 --> 00:29:52,614 you are locked out of your backup system. 543 00:29:52,854 --> 00:29:55,344 And more importantly, they have access to your backup system. 544 00:29:55,974 --> 00:29:59,094 So, uh, that's why I think it should be a separate system. 545 00:30:00,654 --> 00:30:03,174 Any final thoughts on password management before we move on to the 546 00:30:03,174 --> 00:30:07,044 one that, I don't know why everybody doesn't have it on everything, but 547 00:30:08,934 --> 00:30:09,174 Prasanna Malaiyandi: Yeah. 548 00:30:09,174 --> 00:30:09,744 No, I'm ready. 549 00:30:09,744 --> 00:30:10,554 What's the next one, Curtis? 550 00:30:11,799 --> 00:30:14,259 W. Curtis Preston: Multifactor authentication. 551 00:30:15,999 --> 00:30:23,019 How do d does not everybody have multifactor authentication on everything, 552 00:30:23,859 --> 00:30:28,434 including Ticketmaster, right? 553 00:30:29,769 --> 00:30:33,579 The Live Nation thing that we, the, the story that we talked about in 554 00:30:33,579 --> 00:30:36,659 the beginning, if you read that full story, you get down to the 555 00:30:36,659 --> 00:30:41,129 part where basically Snowflake says, Hey, we're seeing a significant 556 00:30:41,129 --> 00:30:42,989 increase in attacks on our accounts. 557 00:30:43,349 --> 00:30:48,029 Please enable multifactor authentication to which I want to say what. 558 00:30:49,349 --> 00:30:49,739 Right. 559 00:30:50,009 --> 00:30:54,059 Uh, you know, I a I asked two questions and, and we're gonna, we 560 00:30:54,059 --> 00:30:55,319 gotta define it and everything, right? 561 00:30:55,319 --> 00:30:55,559 But. 562 00:30:57,344 --> 00:31:00,914 Question number one, a company like LiveNation, how do they not already 563 00:31:00,914 --> 00:31:06,344 have MFA turned on on anything that matters, number one and number two. 564 00:31:07,074 --> 00:31:15,224 How service providers don't enforce MFAI, you're see, you are seeing this, right? 565 00:31:15,224 --> 00:31:17,534 Can you think of a, of. 566 00:31:18,134 --> 00:31:20,504 Of a servers that you've used where they've come on and 567 00:31:20,504 --> 00:31:21,734 they say You have to use MFA. 568 00:31:21,734 --> 00:31:24,614 Prasanna Malaiyandi: Well, I think the one I could think of is, and I don't 569 00:31:24,614 --> 00:31:27,764 know if it's a systems configurations, but typically if you use an SSO, 570 00:31:28,124 --> 00:31:31,094 single sign-on provider, right? 571 00:31:31,124 --> 00:31:35,444 Normally they do require, uh, MFA. 572 00:31:35,784 --> 00:31:38,334 W. Curtis Preston: Right in that same line, uh, the first thing that came to 573 00:31:38,334 --> 00:31:40,974 my mind was my password manager, right? 574 00:31:41,034 --> 00:31:47,994 You, you, any decent password manager is going to require MFA, right? 575 00:31:48,474 --> 00:31:55,039 Um, I'm pretty sure actually Gmail logging into Google now requires MFA. 576 00:31:55,434 --> 00:31:55,794 Right. 577 00:31:56,274 --> 00:31:57,714 Um, and 578 00:31:58,239 --> 00:31:58,689 Prasanna Malaiyandi: so. 579 00:31:58,749 --> 00:31:59,139 Yeah. 580 00:32:00,369 --> 00:32:01,749 Yeah, I think it does now. 581 00:32:03,129 --> 00:32:06,399 W. Curtis Preston: Yeah, and, and I like the way theirs is. 582 00:32:06,399 --> 00:32:09,999 It's, it's very emphasis on the m right? 583 00:32:09,999 --> 00:32:13,329 It's like we know that you're logged into YouTube on. 584 00:32:14,619 --> 00:32:15,339 Your phone. 585 00:32:15,339 --> 00:32:19,419 So we're gonna send you a, you know, a, this like thing that you have to 586 00:32:19,419 --> 00:32:22,449 respond to in the YouTube app, right? 587 00:32:22,449 --> 00:32:24,699 Or sometimes they'll do it through Gmail, right? 588 00:32:24,879 --> 00:32:26,709 They, they emphasis on the multi. 589 00:32:26,949 --> 00:32:29,799 So we, we've been talking about multifactor authentication 590 00:32:29,799 --> 00:32:32,979 now for a couple minutes just in case there's somebody that 591 00:32:33,039 --> 00:32:34,749 doesn't actually know what it is. 592 00:32:34,749 --> 00:32:37,149 Do you, do you wanna like, give an overview? 593 00:32:37,974 --> 00:32:38,154 Prasanna Malaiyandi: Yeah. 594 00:32:38,154 --> 00:32:38,394 Yeah. 595 00:32:38,394 --> 00:32:43,494 So multifactor authentication is basically saying that in order for you to gain 596 00:32:43,494 --> 00:32:49,164 access to an account or to log in, it's not just good enough to have a single 597 00:32:49,164 --> 00:32:51,144 factor, which is usually your password. 598 00:32:51,444 --> 00:32:53,214 You need to have multiple factors. 599 00:32:53,219 --> 00:32:55,074 Usually that other factor could. 600 00:32:55,304 --> 00:32:57,104 Vary depending on company. 601 00:32:57,524 --> 00:33:01,334 Sometimes it could be I receive a text message and I now need 602 00:33:01,334 --> 00:33:03,674 to enter a code into the system. 603 00:33:03,704 --> 00:33:09,224 It could be I need to enter a code that is part of an authentication 604 00:33:09,224 --> 00:33:11,444 app that generates one time codes. 605 00:33:11,804 --> 00:33:16,574 It could be I need to use my face and my biometrics as a sort 606 00:33:16,574 --> 00:33:18,314 of second way to authenticate. 607 00:33:19,424 --> 00:33:20,354 Um. 608 00:33:20,714 --> 00:33:27,014 I guess technically you could receive postal mail with a code, which I 609 00:33:27,179 --> 00:33:29,189 W. Curtis Preston: IRS does MFA with postal. 610 00:33:29,339 --> 00:33:32,639 If you've never set up the, the way you get set up, the first 611 00:33:32,644 --> 00:33:36,599 time, they use the mail system as a, as you say, it's a little slow. 612 00:33:37,664 --> 00:33:37,724 Prasanna Malaiyandi: yeah. 613 00:33:38,534 --> 00:33:40,544 Sometimes you might get a voice call, right? 614 00:33:40,544 --> 00:33:41,894 Where they're like, Hey, here's your code. 615 00:33:42,899 --> 00:33:43,769 W. Curtis Preston: Right, right. 616 00:33:44,184 --> 00:33:45,714 Prasanna Malaiyandi: I think those are the main ways. 617 00:33:45,744 --> 00:33:50,064 Oh, the other way is sometimes you might get a code texted 618 00:33:50,064 --> 00:33:52,284 to like a recovery account 619 00:33:53,664 --> 00:33:54,024 W. Curtis Preston: Yeah, 620 00:33:54,054 --> 00:33:54,324 there's 621 00:33:54,329 --> 00:33:54,594 that. 622 00:33:54,774 --> 00:33:55,644 Prasanna Malaiyandi: have to use. 623 00:33:55,854 --> 00:33:58,704 W. Curtis Preston: Also there are, I don't think, did you mention tokens? 624 00:33:58,709 --> 00:34:00,384 Like physical tokens? 625 00:34:01,134 --> 00:34:03,204 Prasanna Malaiyandi: Oh no, I didn't mention the physical tokens. 626 00:34:03,844 --> 00:34:08,674 W. Curtis Preston: So there are also physical devices that are available. 627 00:34:08,734 --> 00:34:13,864 Um, you know, they're much more affordable than they used to be, right? 628 00:34:14,164 --> 00:34:16,564 And basically they are one time password generated. 629 00:34:16,564 --> 00:34:20,164 They just constantly generating a, a, a little, you know, 630 00:34:20,164 --> 00:34:21,934 six or eight digit number. 631 00:34:22,339 --> 00:34:23,894 Prasanna Malaiyandi: I think the popular one is are called 632 00:34:25,009 --> 00:34:25,369 W. Curtis Preston: Yeah. 633 00:34:25,399 --> 00:34:27,259 UBK is a, is a very popular one. 634 00:34:27,289 --> 00:34:29,389 There is definitely the good, better, best. 635 00:34:30,409 --> 00:34:37,009 Um, what, what I'm saying is please, please, for anything that matters, I'm not 636 00:34:37,014 --> 00:34:38,809 gonna push you to do it for everything. 637 00:34:39,289 --> 00:34:40,819 Um, you know, like if someone. 638 00:34:41,374 --> 00:34:43,144 Hacks my Spotify account. 639 00:34:43,144 --> 00:34:46,714 I, I, I don't know what damage they could possibly do, right? 640 00:34:47,074 --> 00:34:53,224 But if someone hacks my, um, my Verizon account, they could buy 641 00:34:53,229 --> 00:34:55,144 new phones on my behalf, right? 642 00:34:55,144 --> 00:35:00,424 They, you know, a bank account, um, you know, an email account, you know, 643 00:35:00,634 --> 00:35:03,634 especially email account, because email accounts are often used as 644 00:35:03,634 --> 00:35:05,464 a multifactor for other accounts. 645 00:35:05,614 --> 00:35:06,664 I don't like that, but. 646 00:35:08,614 --> 00:35:09,364 Prasanna Malaiyandi: Convenient. 647 00:35:09,379 --> 00:35:12,799 W. Curtis Preston: only way that's offered by some accounts, um, 648 00:35:13,459 --> 00:35:18,259 please enable MFA on anything that matters in your organization. 649 00:35:18,859 --> 00:35:22,399 Think about your, and the thing is, it's just, we've gone 650 00:35:22,399 --> 00:35:25,009 so long without this, right? 651 00:35:25,009 --> 00:35:29,059 We've gone so long where all you need is the password to log into SSH. 652 00:35:29,479 --> 00:35:30,769 You can enable. 653 00:35:31,279 --> 00:35:37,609 Uh, both on Windows and on Linux or or other Unix platforms, you can enable 654 00:35:37,609 --> 00:35:40,309 MFA to be able to log into the system. 655 00:35:40,309 --> 00:35:44,684 And all I'm saying is please do that and go through, go through that, that, 656 00:35:44,809 --> 00:35:46,729 that inventory that you talked about. 657 00:35:47,119 --> 00:35:48,139 Look at. 658 00:35:48,679 --> 00:35:52,519 The criticality look at the amount of damage. 659 00:35:53,119 --> 00:35:53,629 Right. 660 00:35:53,749 --> 00:35:58,339 Um, you know, like, uh, if, if I, if I, you know, looking at, 661 00:35:58,344 --> 00:36:00,679 at, you know, at a house, right? 662 00:36:00,889 --> 00:36:06,439 I don't have a password for my refrigerator, but I do for my gun locker. 663 00:36:06,949 --> 00:36:07,399 Right. 664 00:36:07,429 --> 00:36:12,259 You know, look at the things that you have in your environment where 665 00:36:12,259 --> 00:36:14,419 they could do the most damage. 666 00:36:15,229 --> 00:36:19,429 Uh, a backup system, a a file system, an email system. 667 00:36:19,429 --> 00:36:21,349 An email system, really right. 668 00:36:21,619 --> 00:36:26,419 If you know, are there, are there people that are using Exchange? 669 00:36:26,599 --> 00:36:28,009 Microsoft 365? 670 00:36:28,219 --> 00:36:32,749 I I think you're in, I think you're required to do it with, with Gmail. 671 00:36:33,169 --> 00:36:34,039 Um, 672 00:36:34,744 --> 00:36:35,104 Prasanna Malaiyandi: but maybe 673 00:36:35,224 --> 00:36:37,429 W. Curtis Preston: does Microsoft 365 require it? 674 00:36:38,719 --> 00:36:39,289 I don't know. 675 00:36:39,424 --> 00:36:40,594 Prasanna Malaiyandi: am not sure. 676 00:36:40,624 --> 00:36:40,954 Yeah. 677 00:36:41,494 --> 00:36:42,004 W. Curtis Preston: I don't know. 678 00:36:42,154 --> 00:36:43,444 Um, may maybe. 679 00:36:43,504 --> 00:36:44,074 Maybe they do, 680 00:36:44,074 --> 00:36:44,464 maybe they 681 00:36:44,464 --> 00:36:44,674 don't. 682 00:36:45,454 --> 00:36:48,484 Prasanna Malaiyandi: or if it is, maybe it's just sending a 683 00:36:48,484 --> 00:36:50,104 code to the same email account. 684 00:36:50,104 --> 00:36:51,934 So if you've compromised the email account, 685 00:36:52,684 --> 00:36:53,194 W. Curtis Preston: Yeah, I 686 00:36:53,194 --> 00:36:53,644 dunno. 687 00:36:53,649 --> 00:36:54,604 Prasanna Malaiyandi: itself, then 688 00:36:54,904 --> 00:36:55,384 W. Curtis Preston: Yeah. 689 00:36:56,014 --> 00:36:57,069 Um, so 690 00:36:57,184 --> 00:36:57,874 Prasanna Malaiyandi: The one thing, 691 00:36:58,564 --> 00:36:58,654 W. Curtis Preston: go. 692 00:37:00,124 --> 00:37:04,024 Prasanna Malaiyandi: so I totally agree MFA is important, but 693 00:37:04,084 --> 00:37:09,124 you should also think about the situations you could end up with. 694 00:37:09,724 --> 00:37:14,584 If you lose the device or the ability to generate the second factor. 695 00:37:15,664 --> 00:37:19,594 So I know Curtis, you had that issue with your phone when you upgraded. 696 00:37:20,344 --> 00:37:21,664 W. Curtis Preston: I did, I did. 697 00:37:21,934 --> 00:37:26,854 And, um, all of the cloud accounts that I had were able to help me. 698 00:37:27,274 --> 00:37:31,924 Um, it was definitely painful to, to reboot, but a little 699 00:37:31,924 --> 00:37:37,414 bit, not painful enough for, for something in terms of regenerating. 700 00:37:37,414 --> 00:37:37,744 Right. 701 00:37:38,464 --> 00:37:45,784 Um, the, I was a little worried, uh, and luckily it, it wasn't that bad, but the. 702 00:37:46,474 --> 00:37:50,764 Um, yeah, definitely make sure that when you're implementing 703 00:37:50,764 --> 00:37:55,384 this for your organization, make sure you have a failback, right? 704 00:37:55,444 --> 00:38:00,904 Uh, make sure you have a system by which if somebody does lose their, their key 705 00:38:00,904 --> 00:38:05,344 fob, if they lose their, the app, if they, if they can no longer log into their app, 706 00:38:06,184 --> 00:38:08,914 you've got a way to, to get around that. 707 00:38:08,914 --> 00:38:11,224 But that's something that needs to be done by an administrator. 708 00:38:11,809 --> 00:38:14,359 Prasanna Malaiyandi: Well, do you have a way to get around that? 709 00:38:14,629 --> 00:38:19,009 And you also have a way to verify that the person who's asking to go around 710 00:38:19,009 --> 00:38:20,869 it is a person who says they're. 711 00:38:21,199 --> 00:38:24,799 W. Curtis Preston: and, and that is getting harder and harder these days. 712 00:38:24,799 --> 00:38:29,614 A simple voice verification isn't enough anymore, unfortunately. 713 00:38:31,219 --> 00:38:36,079 Um, uh, that that's, you know, we're starting to get to the 714 00:38:36,079 --> 00:38:38,689 edge of my, of, of my knowledge. 715 00:38:38,869 --> 00:38:43,279 I mean, when I look at that, I would say that you would want to have a very 716 00:38:43,819 --> 00:38:46,489 unnatural conversation with a person. 717 00:38:46,549 --> 00:38:50,179 You would have a, you would wanna be asking questions that would not 718 00:38:50,179 --> 00:38:52,249 be possible for an AI to answer. 719 00:38:52,639 --> 00:38:53,059 Right. 720 00:38:53,449 --> 00:38:58,069 Um, and, um, I mean unfortunately we get back to sort of the, possibly 721 00:38:58,069 --> 00:39:03,919 the, uh, the shared, shared secrets, which is always a vulnerability in 722 00:39:03,919 --> 00:39:08,089 any, um, uh, sort of crypto system. 723 00:39:08,689 --> 00:39:15,229 But, you know, you, you've got to do something right, um, to ensure 724 00:39:15,229 --> 00:39:17,509 that the person that you're. 725 00:39:18,199 --> 00:39:21,739 Resetting the, the MFA four is indeed the person, right? 726 00:39:21,739 --> 00:39:23,959 Because we have had that story as well. 727 00:39:24,319 --> 00:39:27,049 I believe that was, which story was that? 728 00:39:27,049 --> 00:39:27,739 Where they. 729 00:39:29,239 --> 00:39:32,179 I think it was the Okta thing where they, where basically they were able to get 'em 730 00:39:32,179 --> 00:39:34,339 to reset the MFA, which is just wrong. 731 00:39:34,699 --> 00:39:38,119 So yeah, you need a system for resetting the MFA, but you need a system to 732 00:39:38,124 --> 00:39:41,239 make sure that you're only doing that for the, for the authorized people. 733 00:39:41,689 --> 00:39:42,559 But I, I, I. 734 00:39:43,204 --> 00:39:46,084 Uh, just number one thing again, good, better, best. 735 00:39:46,084 --> 00:39:47,314 Make sure you've got a system. 736 00:39:47,314 --> 00:39:49,924 And then as you have a system, make sure you implement or you, 737 00:39:50,224 --> 00:39:57,304 you, you, um, enhance that system to deal with the, um, an advanced 738 00:39:57,334 --> 00:40:01,384 persistent threat where they're, uh, going and, um, and attacking you. 739 00:40:02,284 --> 00:40:05,704 The, um, in terms of. 740 00:40:07,084 --> 00:40:11,764 MA system, by the way, it used to be called two FA two-factor authentication. 741 00:40:11,764 --> 00:40:13,444 We now call it MFA, multi-factor. 742 00:40:13,444 --> 00:40:14,164 Authentication. 743 00:40:14,824 --> 00:40:21,474 In terms of the, in order of good, better, best, would we say email. 744 00:40:21,474 --> 00:40:24,744 Then SMS, then OTB. 745 00:40:25,944 --> 00:40:26,394 Right. 746 00:40:27,174 --> 00:40:27,564 All right. 747 00:40:27,564 --> 00:40:31,404 So and then sort of physical token. 748 00:40:32,014 --> 00:40:36,124 Why are email and SMS on the lowest of the good, better, best list? 749 00:40:37,009 --> 00:40:40,219 Prasanna Malaiyandi: Well, if you think about SMS right now, there's a lot 750 00:40:40,224 --> 00:40:42,679 of sim hijacking that goes on, right? 751 00:40:42,679 --> 00:40:46,429 You've, I've heard countless cases about people going to a cell phone 752 00:40:46,429 --> 00:40:51,619 provider sim hijacking and stealing someone's phone number and then 753 00:40:51,619 --> 00:40:53,029 draining their crypto wallet. 754 00:40:55,534 --> 00:40:59,524 That's the way that they had used for the multifactor authentication. 755 00:40:59,899 --> 00:41:02,179 W. Curtis Preston: So we would, would we actually put SMS under 756 00:41:02,179 --> 00:41:05,629 email then, or is email less or 757 00:41:05,854 --> 00:41:07,294 Prasanna Malaiyandi: I think they're about the, I 758 00:41:07,354 --> 00:41:07,654 W. Curtis Preston: about 759 00:41:07,654 --> 00:41:08,104 the same. 760 00:41:08,104 --> 00:41:09,484 Yeah, yeah, you're probably right. 761 00:41:09,544 --> 00:41:09,874 Yeah. 762 00:41:10,324 --> 00:41:14,104 So email, SMS and, and the problem is this is what's used by probably the 763 00:41:14,104 --> 00:41:17,704 majority of people that are doing, uh, in the consumer world, because 764 00:41:17,709 --> 00:41:22,504 the next requires a significant change for the typical consumer. 765 00:41:22,774 --> 00:41:28,504 But when we're talking about corporate world, we've got sort of, um, free OTP. 766 00:41:29,389 --> 00:41:31,639 And that OTP just stands for one-Time password. 767 00:41:31,669 --> 00:41:35,419 We got free OTP implementations like Google Authenticator, 768 00:41:35,809 --> 00:41:38,479 um, and uh, I use Authe. 769 00:41:38,839 --> 00:41:39,769 There are others. 770 00:41:39,979 --> 00:41:47,419 Um, and then you have software based OTP, such as Symantec, the VIP program. 771 00:41:47,809 --> 00:41:49,459 The big difference between these two. 772 00:41:50,899 --> 00:41:51,649 An RSA. 773 00:41:51,649 --> 00:41:52,309 Right, thank you. 774 00:41:52,729 --> 00:41:57,289 The, the big difference between those two categories generally in, in my experience, 775 00:41:57,679 --> 00:42:03,914 the, um, the free OTPs, they're doing it based on an atomic clock, and so it, 776 00:42:03,919 --> 00:42:06,349 it just resets at the top of the minute. 777 00:42:07,384 --> 00:42:11,584 So you just, if, if you get to the end of the 60 seconds, you just 778 00:42:11,584 --> 00:42:13,534 have to like try the next password. 779 00:42:13,714 --> 00:42:19,564 Whereas with the, the commercial ones, the, the 60 seconds or 30 seconds starts 780 00:42:19,864 --> 00:42:22,204 with the moment that you open the app. 781 00:42:22,354 --> 00:42:22,804 Right. 782 00:42:23,074 --> 00:42:26,764 Um, and I'm sure there's probably additional security 783 00:42:26,764 --> 00:42:27,819 provided by them as well. 784 00:42:28,159 --> 00:42:31,234 But that's the big, uh, from a usability perspective, that's a 785 00:42:31,234 --> 00:42:32,554 big difference between those two. 786 00:42:33,004 --> 00:42:33,424 And then we've 787 00:42:33,429 --> 00:42:34,804 got the, the key fob. 788 00:42:34,894 --> 00:42:35,284 Go ahead. 789 00:42:35,989 --> 00:42:38,479 Prasanna Malaiyandi: Oh, and also between the free and the commercial. 790 00:42:38,479 --> 00:42:43,189 The other thing is probably from an admin management perspective, the commercial 791 00:42:43,189 --> 00:42:49,459 ones are probably easier to manage a large number of users than free Solutions 792 00:42:49,579 --> 00:42:50,209 W. Curtis Preston: exactly. 793 00:42:50,449 --> 00:42:55,729 Um, the, um, and then we have the, the, the key fob, right? 794 00:42:55,734 --> 00:42:58,789 The, the, the physical ones, which are also offered by 795 00:42:59,089 --> 00:43:00,919 UB Key and also also by RSA. 796 00:43:00,919 --> 00:43:01,249 Right? 797 00:43:01,309 --> 00:43:02,569 They also offer the physical 798 00:43:02,899 --> 00:43:03,199 key fob. 799 00:43:03,330 --> 00:43:05,190 Prasanna Malaiyandi: The one that we didn't talk about that we 800 00:43:05,190 --> 00:43:07,175 probably should include, and it's kind of lumped under the hardware. 801 00:43:07,175 --> 00:43:10,231 One, is also like key cards. 802 00:43:10,785 --> 00:43:14,865 So if you work in the government, your ID has a certain key on it. 803 00:43:14,865 --> 00:43:18,585 And for instance, even if you enter your password, it won't unlock without 804 00:43:18,585 --> 00:43:19,815 actually having the card as well. 805 00:43:20,640 --> 00:43:23,790 W. Curtis Preston: So you'll need somewhere to basically tap that card. 806 00:43:24,375 --> 00:43:25,725 Prasanna Malaiyandi: Well, it did laptops. 807 00:43:25,725 --> 00:43:28,845 As an example, you insert, there's a slot in laptops 808 00:43:29,505 --> 00:43:29,805 that are 809 00:43:30,075 --> 00:43:33,525 W. Curtis Preston: So yeah, so that's another, that's a physical, uh, thing. 810 00:43:33,765 --> 00:43:37,875 And by the way, the most of the stuff is available as an app on the 811 00:43:37,880 --> 00:43:39,795 computer or an app on your smartphone. 812 00:43:39,800 --> 00:43:42,135 The, the, the software solutions that we were talking about. 813 00:43:42,825 --> 00:43:47,085 Um, I do prefer authe over Google Authenticator mainly because of the 814 00:43:47,085 --> 00:43:52,395 problem that I, the fact that I could back up my, my, uh, password system. 815 00:43:52,935 --> 00:43:56,325 Um, and then there, you know, do you want to talk a little bit about 816 00:43:56,355 --> 00:43:59,775 the, sort of the, the ultimate, which is biometric detection? 817 00:44:00,930 --> 00:44:03,450 Prasanna Malaiyandi: So the last one is really biometrics. 818 00:44:03,450 --> 00:44:08,820 So I'm sure everyone on your phone these days, you use a face ID or your 819 00:44:08,820 --> 00:44:11,370 thumbprint to unlock your phone, right? 820 00:44:11,400 --> 00:44:15,330 Um, and so a lot of apps that are installed on your phone can also 821 00:44:15,330 --> 00:44:19,140 say, Hey, enter your password and now give me a biometric as well 822 00:44:19,140 --> 00:44:20,370 to make sure it's really you. 823 00:44:20,970 --> 00:44:21,840 W. Curtis Preston: Right, right. 824 00:44:22,350 --> 00:44:25,200 Um, and there's also like built into laptops. 825 00:44:25,200 --> 00:44:28,020 You have, uh, fingerprint detection on your laptops. 826 00:44:28,500 --> 00:44:32,550 Um, and there's face detection built into, you know, a lot of apps. 827 00:44:32,820 --> 00:44:38,370 I guess what I'm just saying is username and password is not enough anymore, 828 00:44:38,460 --> 00:44:42,360 and it just continues to amaze me that. 829 00:44:43,200 --> 00:44:47,400 Uh, when I read a story like the one that I read this morning that it's like, 830 00:44:47,400 --> 00:44:52,110 here it is a major corporation that was attacked simply because they didn't have 831 00:44:52,110 --> 00:44:55,200 MFA enabled on an app that allows MFA. 832 00:44:56,365 --> 00:44:56,655 Prasanna Malaiyandi: Yeah. 833 00:44:56,925 --> 00:44:59,040 W. Curtis Preston: I, I, I just don't understand that. 834 00:44:59,040 --> 00:45:03,540 So if that's you, please Now, like immediately, especially again, 835 00:45:03,690 --> 00:45:05,100 you're, you're a backup person. 836 00:45:05,100 --> 00:45:06,540 If you're listening to me, you're a backup person. 837 00:45:07,110 --> 00:45:08,430 Go to your backup system. 838 00:45:08,490 --> 00:45:10,530 Have I enabled MFA on net backup? 839 00:45:10,920 --> 00:45:16,920 Have I enabled MFA on, you know, uh, Veeam Druva, uh, Rubrik, Cohesity? 840 00:45:16,920 --> 00:45:17,850 Have I enabled that? 841 00:45:18,120 --> 00:45:21,500 Did they force me to enable, I, I, I wish they would, if they 842 00:45:21,500 --> 00:45:23,030 haven't forced you to enable it. 843 00:45:23,585 --> 00:45:24,245 Do it now. 844 00:45:24,395 --> 00:45:27,635 Do it now before you finish this podcast. 845 00:45:28,365 --> 00:45:29,630 Prasanna Malaiyandi: Now I would say. 846 00:45:30,335 --> 00:45:34,475 That for many of these systems, because they do support single sign-on, 847 00:45:34,745 --> 00:45:38,315 it's usually up to those single sign-on providers to do the MFA. 848 00:45:38,345 --> 00:45:44,225 For instance, if you are able to log into, say, Rubrik using Okta as your 849 00:45:44,225 --> 00:45:49,715 single sign-on provider, as long as Okta has MFA enabled, Rubrik necessarily 850 00:45:49,715 --> 00:45:53,375 doesn't need explicitly to support it because it's already supported 851 00:45:53,375 --> 00:45:54,815 by the single sign-on provider. 852 00:45:55,250 --> 00:45:57,740 W. Curtis Preston: So I'm gonna agree and disagree with you, right? 853 00:45:58,100 --> 00:46:04,040 Is there a way to log into Rubrik without that, that system needs 854 00:46:04,040 --> 00:46:05,930 MFA, that's all I'm saying. 855 00:46:06,770 --> 00:46:09,650 Um, if there's like a back door, a back way, I. 856 00:46:10,610 --> 00:46:13,520 If Okta is down, there's another way for you to log into 857 00:46:13,520 --> 00:46:14,870 your favorite backup system. 858 00:46:15,170 --> 00:46:20,180 That system needs to mf have MFA, and it's the back doors that often 859 00:46:20,180 --> 00:46:22,700 get compromised because they're ignored and not maintained. 860 00:46:23,240 --> 00:46:23,600 So, 861 00:46:24,125 --> 00:46:25,505 Prasanna Malaiyandi: And change your default password. 862 00:46:26,090 --> 00:46:27,740 W. Curtis Preston: and change your default password. 863 00:46:29,120 --> 00:46:31,125 Again, we keep reading these things right. 864 00:46:32,195 --> 00:46:32,285 Prasanna Malaiyandi: Yeah. 865 00:46:33,095 --> 00:46:37,115 W. Curtis Preston: Uh, anyway, this will stop 90 plus percent of 866 00:46:37,115 --> 00:46:40,835 ransomware attacks out there, and all of this stuff is relatively easy 867 00:46:41,255 --> 00:46:44,735 and there's no point in doing the fancier stuff until you've done this. 868 00:46:45,515 --> 00:46:50,945 So anyway, thanks for, you know, helping me work through that persona. 869 00:46:52,190 --> 00:46:54,380 Prasanna Malaiyandi: Uh, no worries, Curtis, and I'm glad your 870 00:46:54,380 --> 00:46:56,540 wifi is up and running and, uh. 871 00:46:56,705 --> 00:46:57,575 W. Curtis Preston: that's what I was about to say. 872 00:46:57,575 --> 00:47:01,115 Even though you were completely worthless yesterday, right around this time. 873 00:47:02,255 --> 00:47:04,625 Um, and thanks again to our listeners. 874 00:47:04,655 --> 00:47:05,945 We'd be nothing without you. 875 00:47:06,155 --> 00:47:07,181 That is a wrap.