1 00:00:00,390 --> 00:00:04,080 We've got another good one for you on the topic of ransomware this time, it's 2 00:00:04,080 --> 00:00:08,520 about how to prepare for a ransomware attack with an incident response plan. 3 00:00:08,760 --> 00:00:09,990 Hope you enjoy the episode. 4 00:00:14,526 --> 00:00:17,446 W. Curtis Preston: hi, and welcome to Backup Central's Restore it All podcast. 5 00:00:17,466 --> 00:00:18,166 I'm your host, W. 6 00:00:18,186 --> 00:00:19,836 Curtis Preston, aka a Mr. 7 00:00:19,836 --> 00:00:25,806 Backup, and I have with me my super expensive vacation planner coordinator. 8 00:00:26,796 --> 00:00:27,576 How's it going? 9 00:00:27,826 --> 00:00:28,416 Prasanna, 10 00:00:29,106 --> 00:00:31,716 Prasanna Malaiyandi: I'm doing well, Curtis, how are things going? 11 00:00:32,316 --> 00:00:33,216 Are you excited? 12 00:00:33,296 --> 00:00:38,246 W. Curtis Preston: I am excited, um, uh, and my wife is starting to get excited. 13 00:00:38,246 --> 00:00:41,636 I started showing her some pictures a while ago and she's 14 00:00:41,636 --> 00:00:43,226 been like downplaying it. 15 00:00:43,226 --> 00:00:45,116 Like she doesn't want to get excited. 16 00:00:45,116 --> 00:00:50,406 She wants to be sort of, Excited, but I needed her to prep for the vacation 17 00:00:50,406 --> 00:00:55,056 because this is, so this is, we're going to the Maldives, uh, which for 18 00:00:55,061 --> 00:00:59,196 those that don't know, is a series of islands off the southern coast of India. 19 00:00:59,676 --> 00:01:05,316 And, um, and, and I'm on one of those islands and, and it's a tiny island that 20 00:01:05,316 --> 00:01:08,676 literally we could walk from one end to the other in probably about 10 minutes. 21 00:01:09,216 --> 00:01:10,776 Um, and. 22 00:01:11,936 --> 00:01:15,056 We're staying in one of those, uh, for the first couple of nights we're staying 23 00:01:15,056 --> 00:01:17,516 in one of those things over the water, 24 00:01:17,666 --> 00:01:18,836 Prasanna Malaiyandi: Oh, the Villas over the. 25 00:01:19,286 --> 00:01:21,386 W. Curtis Preston: villas over the water with our, we have our own 26 00:01:21,386 --> 00:01:24,836 pool, and then right on the other side of the pool is the ocean. 27 00:01:25,196 --> 00:01:30,626 And then for the rest of the week, we're staying in a, a deluxe, um, beach. 28 00:01:31,196 --> 00:01:35,696 Uh, Villa, which basically you, you have your own private section to the beach. 29 00:01:36,146 --> 00:01:38,246 Um, I mean, it's really, really cool. 30 00:01:38,936 --> 00:01:40,066 Uh, but it's the 31 00:01:40,136 --> 00:01:40,526 Prasanna Malaiyandi: away your 32 00:01:40,591 --> 00:01:41,516 W. Curtis Preston: we've ever gone. 33 00:01:41,996 --> 00:01:42,356 What's that? 34 00:01:42,716 --> 00:01:44,156 Prasanna Malaiyandi: Can I stow away in your luggage 35 00:01:44,966 --> 00:01:47,396 W. Curtis Preston: Yeah, I mean, it looks really cool. 36 00:01:47,456 --> 00:01:50,396 Um, and, uh, we're very excited. 37 00:01:50,546 --> 00:01:54,326 I'm just trying to, you know, what happened was, I saw this movie last 38 00:01:54,326 --> 00:01:55,976 week, it's really kind of funny. 39 00:01:55,981 --> 00:01:58,976 It, it's a horror movie called Infinity Pool. 40 00:01:59,496 --> 00:02:03,696 and it was about a book author who goes with his wife to a resort island. 41 00:02:04,086 --> 00:02:06,816 And I watched it and one of, one of the things I said, I was like, wow, 42 00:02:06,816 --> 00:02:08,646 everybody's really nicely dressed there. 43 00:02:08,946 --> 00:02:13,146 Maybe I should have my wife look into the way she should prepare for the trip. 44 00:02:13,536 --> 00:02:16,971 Cuz if she shows up and you know, , whatever, and then she sees 45 00:02:16,971 --> 00:02:18,381 everybody else dresses some other way. 46 00:02:18,381 --> 00:02:19,581 She's gonna be really mad at me. 47 00:02:19,761 --> 00:02:24,141 So that's the phase that we're in right now is, is, um, looking at 48 00:02:24,141 --> 00:02:28,041 their, looking at their Instagram account, So this is what we're doing. 49 00:02:28,311 --> 00:02:31,701 We're looking at the Islands Instagram account, uh, and looking 50 00:02:31,701 --> 00:02:32,991 at the way people dress there. 51 00:02:33,171 --> 00:02:34,761 And, uh, I think we'll be okay. 52 00:02:35,241 --> 00:02:40,161 Uh, they're, um, I, I will say everyone on their Instagram account looks a 53 00:02:40,161 --> 00:02:42,021 lot younger than us, but you know, 54 00:02:42,881 --> 00:02:45,251 Prasanna Malaiyandi: Have you not heard about Instagram filters? 55 00:02:45,281 --> 00:02:48,881 Oh, speaking of, did you hear, I know you're a big movie person, Curtis, 56 00:02:49,001 --> 00:02:51,881 but they're making a movie with Tom Hanks and someone else, and they're 57 00:02:51,881 --> 00:02:53,681 gonna use AI to make them look younger. 58 00:02:55,766 --> 00:02:56,186 W. Curtis Preston: really 59 00:02:56,516 --> 00:02:58,406 Prasanna Malaiyandi: Yeah, I can't remember. 60 00:02:58,886 --> 00:03:00,506 W. Curtis Preston: to make who look younger, Tom 61 00:03:00,596 --> 00:03:00,926 Prasanna Malaiyandi: Hanks. 62 00:03:00,926 --> 00:03:02,726 Yeah, Tom Hanks and someone else. 63 00:03:03,956 --> 00:03:04,406 Yeah. 64 00:03:05,166 --> 00:03:08,786 I, I don't remember the name of the movie or who the director was, but 65 00:03:08,996 --> 00:03:10,466 I read that somewhere the other day. 66 00:03:10,471 --> 00:03:11,756 I was like, I should tell Curtis 67 00:03:11,951 --> 00:03:13,451 W. Curtis Preston: AI is gonna be the death of us. 68 00:03:13,511 --> 00:03:14,891 That's a whole other podcast. 69 00:03:16,346 --> 00:03:18,656 Prasanna Malaiyandi: which is go listen to Curtis's other podcast, 70 00:03:18,776 --> 00:03:22,316 other, other podcasts with you and Jeff talking about movie. 71 00:03:22,541 --> 00:03:25,031 W. Curtis Preston: is, yeah, we, uh, it's called the things that 72 00:03:25,031 --> 00:03:32,441 Entertain Us and, um, the, uh, yeah, so, uh, not too many episodes, but 73 00:03:32,471 --> 00:03:35,411 yeah, basically we end up mostly talking about movies that we've seen. 74 00:03:35,921 --> 00:03:41,471 Um, and, uh, I'll be talking about in our next recording about this, this 75 00:03:41,471 --> 00:03:42,761 movie be called The Infinity Pool. 76 00:03:44,326 --> 00:03:46,906 Anyway, it's, um, an interesting movie. 77 00:03:47,566 --> 00:03:52,786 So speaking of interesting, we're having our, a repeat guest and, 78 00:03:52,786 --> 00:03:57,796 um, we, we had her on, uh, a few weeks ago and we got talking about 79 00:03:57,801 --> 00:03:59,776 ransomware, one of our favorite topics. 80 00:04:00,216 --> 00:04:04,836 And we, we, we got into this phase where it was like, you know what? 81 00:04:04,836 --> 00:04:09,336 That, that is a great conversation, but there's no way we could, we could 82 00:04:09,336 --> 00:04:11,196 do it justice on that recording. 83 00:04:12,036 --> 00:04:14,196 So it was, Hey, we're gonna have her come back. 84 00:04:14,226 --> 00:04:20,106 And, uh, she is, uh, she's been in the industry for quite a while and she's been 85 00:04:20,106 --> 00:04:22,626 specializing in, uh, she's done VMware. 86 00:04:22,896 --> 00:04:23,376 Uh, she did. 87 00:04:23,376 --> 00:04:30,011 Now she's, she's working, uh, Starting to specialize in security and ransomware. 88 00:04:30,251 --> 00:04:35,231 So we're, uh, and she's the author of the vmiss.net blog, and we are 89 00:04:35,231 --> 00:04:37,271 excited to have her on the podcast. 90 00:04:37,271 --> 00:04:41,081 Again, Melissa Palmer, aka @vmiss. 91 00:04:41,561 --> 00:04:41,931 How's it going? 92 00:04:41,931 --> 00:04:42,281 Thank you for 93 00:04:42,281 --> 00:04:43,106 Melissa Palmer: having me back. 94 00:04:43,106 --> 00:04:44,006 It's going good. 95 00:04:44,246 --> 00:04:45,626 Prasanna Malaiyandi: I was surprised that you were like, Ooh, I'll 96 00:04:45,626 --> 00:04:47,276 come back on the podcast after 97 00:04:47,311 --> 00:04:49,256 Melissa Palmer: yeah, that was, of course, when I come back 98 00:04:50,486 --> 00:04:51,146 Prasanna Malaiyandi: Well, thank you for 99 00:04:51,146 --> 00:04:51,506 Melissa Palmer: scare. 100 00:04:51,506 --> 00:04:52,556 It takes a lot more. 101 00:04:52,916 --> 00:04:53,336 You said it. 102 00:04:53,336 --> 00:04:54,806 I've been in around this industry for a while. 103 00:04:54,806 --> 00:04:57,356 It takes a lot more than that to scare me away after all these years. 104 00:04:58,781 --> 00:05:01,441 Prasanna Malaiyandi: And Curtis, I think, uh, now might be a good time 105 00:05:01,446 --> 00:05:02,741 to put out our normal disclaimer. 106 00:05:03,646 --> 00:05:05,751 W. Curtis Preston: Yeah, prasanna and I work for different companies. 107 00:05:06,051 --> 00:05:07,101 Uh, he works for Zoom. 108 00:05:07,101 --> 00:05:08,151 I work for Druva. 109 00:05:08,271 --> 00:05:13,131 This is not a podcast of either company and the opinions that you hear are ours. 110 00:05:13,401 --> 00:05:18,676 Also, be sure to rate us at, uh, Uh, rate this podcast.com/restore 111 00:05:19,186 --> 00:05:22,186 and, um, if you wanna join the conversation, reach out to me. 112 00:05:22,186 --> 00:05:25,096 By the way, I, I gotta give a bunch of ways cuz I, I got some 113 00:05:25,466 --> 00:05:27,406 complaints and people say, well, I don't use Twitter anymore. 114 00:05:27,406 --> 00:05:29,056 So how you give your Twitter address. 115 00:05:29,356 --> 00:05:33,376 So my LinkedIn is, you know, linkedin.com/ally/mr. 116 00:05:33,381 --> 00:05:33,826 Backup. 117 00:05:34,186 --> 00:05:35,056 Uh, you can find me there. 118 00:05:35,486 --> 00:05:37,106 Uh, you can find me on Facebook. 119 00:05:37,106 --> 00:05:41,846 I'm on Facebook, Facebook Messenger, but my email is, uh, w Curtis Preston. 120 00:05:42,326 --> 00:05:44,156 Uh, my Facebook is w Curtis Preston. 121 00:05:44,161 --> 00:05:46,046 I'm pretty easy to find if you're looking for me. 122 00:05:46,526 --> 00:05:50,216 Um, and reach out to me and we'll get you in on the, on the conversation. 123 00:05:50,756 --> 00:05:51,356 Yeah. 124 00:05:51,446 --> 00:05:59,966 Um, the, um, this, this thing of responding to a ransomware attack, 125 00:06:00,036 --> 00:06:03,326 this, this is something I've been spending a lot of time on lately, uh, 126 00:06:03,326 --> 00:06:07,256 because I've been, I'm, I'm working on writing my next book, which will be 127 00:06:07,256 --> 00:06:09,566 about responding to ransomware attacks. 128 00:06:09,956 --> 00:06:15,356 You know, one of the things that you said in the pre-call was that if, if 129 00:06:15,356 --> 00:06:18,476 the first time you're thinking about responding to a ransomware attack is 130 00:06:18,476 --> 00:06:20,366 after you got a ransomware attack, 131 00:06:21,116 --> 00:06:21,896 Melissa Palmer: Um, 132 00:06:22,076 --> 00:06:23,186 W. Curtis Preston: it's not so good. 133 00:06:23,186 --> 00:06:23,516 Right. 134 00:06:23,891 --> 00:06:25,226 , there's a lot of, yeah. 135 00:06:25,226 --> 00:06:28,376 In fact, when I was looking at the, sort of the outline that I've been 136 00:06:28,376 --> 00:06:33,836 working on for the book, most of the outline is the first half , right? 137 00:06:34,286 --> 00:06:37,466 Everything that you need to do before, right. 138 00:06:37,496 --> 00:06:38,156 Um, 139 00:06:38,276 --> 00:06:40,586 Melissa Palmer: that's, it's like you can't just talk about 140 00:06:40,586 --> 00:06:42,146 ransomware recovery, right? 141 00:06:42,236 --> 00:06:44,906 Like, it, it, it's a hard topic to talk about because you're like, 142 00:06:45,386 --> 00:06:47,516 there's all this other stuff that if you haven't done it, guess what? 143 00:06:47,521 --> 00:06:48,836 You are not gonna be able to recover. 144 00:06:48,836 --> 00:06:50,336 So we can't just talk about recovering. 145 00:06:50,846 --> 00:06:51,656 It doesn't work that way. 146 00:06:52,241 --> 00:06:52,601 W. Curtis Preston: Right. 147 00:06:52,601 --> 00:06:56,842 It's sort of like I, I've made the joke, uh, a few times probably on 148 00:06:56,847 --> 00:06:59,831 the pod where I've said, listen, you know, I've been in the backup 149 00:06:59,831 --> 00:07:01,451 industry, you know, a long time. 150 00:07:01,481 --> 00:07:04,901 I, I've decided to give up backups and I'm just gonna skip straight to restores. 151 00:07:05,261 --> 00:07:05,621 Right? 152 00:07:05,771 --> 00:07:08,081 You can't really , you can't really do that. 153 00:07:08,811 --> 00:07:11,721 Just like I've also said that if I'd have known how great grandkids were, 154 00:07:11,721 --> 00:07:13,101 I would've just gone straight to them. 155 00:07:13,521 --> 00:07:15,981 Um, but not, not really 156 00:07:16,256 --> 00:07:17,306 Prasanna Malaiyandi: It's not how it works. 157 00:07:17,456 --> 00:07:17,876 Yeah. 158 00:07:17,991 --> 00:07:18,501 W. Curtis Preston: Yeah. 159 00:07:18,921 --> 00:07:20,501 Melissa Palmer: It is a really good analogy though. 160 00:07:20,861 --> 00:07:21,221 It really 161 00:07:21,416 --> 00:07:22,886 W. Curtis Preston: Yeah, it is, it is. 162 00:07:23,036 --> 00:07:25,466 By the way, you want a little, little sad thing. 163 00:07:26,246 --> 00:07:30,686 So my granddaughter and her mother and, and her husband, 164 00:07:31,166 --> 00:07:34,256 uh, are, this is their last day 165 00:07:34,541 --> 00:07:36,521 Prasanna Malaiyandi: Oh, I was gonna ask you about 166 00:07:36,626 --> 00:07:39,536 W. Curtis Preston: been living here for a while, and they're moving out tomorrow. 167 00:07:40,166 --> 00:07:40,516 So, 168 00:07:40,871 --> 00:07:41,071 Prasanna Malaiyandi: Hmm. 169 00:07:41,796 --> 00:07:42,236 W. Curtis Preston: little sad moment. 170 00:07:42,386 --> 00:07:43,166 Little sad moment. 171 00:07:43,871 --> 00:07:44,221 Prasanna Malaiyandi: No. 172 00:07:44,846 --> 00:07:49,426 W. Curtis Preston: Um, but, uh, anyway, so, you know, sorry to bring that down. 173 00:07:50,351 --> 00:07:53,981 So let's talk about what, what do you think, Melissa? 174 00:07:54,191 --> 00:08:00,731 Let, let's sort of go through those things that we really needed to have done before. 175 00:08:01,031 --> 00:08:03,581 Melissa Palmer: Uh, well, lemme, lemme try to set the stage a little bit. 176 00:08:03,611 --> 00:08:07,061 Like, does everybody remember like, the disaster recovery tests, like 177 00:08:07,061 --> 00:08:11,101 back in the day, you go to the colo, you got the checkbook, the, the. 178 00:08:11,936 --> 00:08:14,786 Clipboard you make, the checkbox isn't like, I don't know, you play 179 00:08:14,786 --> 00:08:16,526 doom for a while and eat some food. 180 00:08:16,526 --> 00:08:20,576 Someone restores a server and it's like, well, it kind of worked and we're good. 181 00:08:20,576 --> 00:08:22,226 Yeah, that's how old I am. 182 00:08:22,556 --> 00:08:25,736 Um, so and then you're like, oh, it kind of worked. 183 00:08:25,741 --> 00:08:28,526 So we passed our d r test, but we can't actually recover. 184 00:08:28,676 --> 00:08:28,946 Right? 185 00:08:29,696 --> 00:08:32,516 So what you need to do is actually do a ransomware recovery test where 186 00:08:32,516 --> 00:08:33,986 you actually recover everything. 187 00:08:34,886 --> 00:08:37,706 There's a novel concept, and when you do that, you're gonna figure out all the. 188 00:08:38,626 --> 00:08:41,396 but you didn't do cuz it's not gonna work or something's not gonna whatever. 189 00:08:41,816 --> 00:08:45,446 But it, it's, you know, talking from the backup lens cuz I was 190 00:08:45,446 --> 00:08:46,886 at Veeam for quite some time. 191 00:08:47,396 --> 00:08:51,836 Um, something I talked a lot about with Veeam customers was, you know, trying to 192 00:08:51,836 --> 00:08:53,936 understand the whole recovery process. 193 00:08:53,941 --> 00:08:57,116 Cuz if I'm the backup admin and we get ransomware, I don't just 194 00:08:57,116 --> 00:08:59,096 go start restoring stuff all over. 195 00:08:59,336 --> 00:09:00,086 Like that's not what happens. 196 00:09:00,086 --> 00:09:03,116 It's not like, oh no, right somewhere tech, let me start restoring servers. 197 00:09:03,116 --> 00:09:04,526 We'll be back online in 20 minutes. 198 00:09:04,526 --> 00:09:05,576 Like it doesn't work that way. 199 00:09:07,176 --> 00:09:08,276 , you have to figure out what happened. 200 00:09:08,306 --> 00:09:10,406 Before you can start restoring, you have to figure out what happened. 201 00:09:10,406 --> 00:09:12,086 You have to figure out if the threat actors are still around. 202 00:09:12,086 --> 00:09:14,246 You have to understand what was impacted. 203 00:09:14,606 --> 00:09:19,646 I have heard a lot of people say, um, oh, well, we treat ransomware 204 00:09:19,646 --> 00:09:21,266 different and we just recover in place. 205 00:09:21,266 --> 00:09:22,706 So we're good to go. 206 00:09:22,976 --> 00:09:24,746 And I'll go back to the little VMware. 207 00:09:24,746 --> 00:09:26,516 Yeah, I'll go back to the VMware ransomware thing. 208 00:09:26,516 --> 00:09:28,676 Well, if your VMware environment is ransomware, guess what? 209 00:09:28,676 --> 00:09:31,496 You're not recovering in place cuz there's nowhere to recover to. 210 00:09:32,126 --> 00:09:34,286 Uh, so it's understanding all those different things. 211 00:09:34,286 --> 00:09:37,466 You need to have some kind of understanding of what happened 212 00:09:37,466 --> 00:09:38,396 before you can recover. 213 00:09:38,816 --> 00:09:42,476 And that is generally driven by the incident response process, which is 214 00:09:42,476 --> 00:09:43,766 gonna be driven by the security team. 215 00:09:44,606 --> 00:09:47,816 So again, if you haven't talked to the security team before, 216 00:09:47,816 --> 00:09:49,526 ransomware has attacked you. 217 00:09:50,141 --> 00:09:51,761 You're gonna have a bad time. 218 00:09:52,076 --> 00:09:56,186 Prasanna Malaiyandi: Or vice versa, if the security team hasn't talked to you about 219 00:09:56,186 --> 00:09:58,706 how backup integrates into that process. 220 00:09:58,721 --> 00:09:59,561 Melissa Palmer: that's really scary. 221 00:09:59,621 --> 00:10:01,541 That's really, that's really, that's really disturbing. 222 00:10:02,231 --> 00:10:03,881 Those are actually really even, I think that's 223 00:10:03,881 --> 00:10:04,451 scarier. 224 00:10:05,741 --> 00:10:08,591 W. Curtis Preston: I think it's, it's a, it's a combination, right? 225 00:10:08,891 --> 00:10:12,911 Well, you know, uh, yesterday, I think that was yesterday, we recorded 226 00:10:13,361 --> 00:10:18,551 a, a great podcast, uh, by the way, with Tom from Gestalt, um, that, 227 00:10:18,581 --> 00:10:21,601 that, uh, net, uh, @networkingnerd. 228 00:10:21,791 --> 00:10:22,151 Yeah. 229 00:10:22,766 --> 00:10:26,816 and he, uh, we were talking a lot about the networking side 230 00:10:26,846 --> 00:10:28,856 of the, the response, right? 231 00:10:29,036 --> 00:10:30,566 Shutting down things. 232 00:10:30,926 --> 00:10:36,236 Um, and, and using a combination of technologies, many of which are easier 233 00:10:36,236 --> 00:10:38,946 to use if you, if you set them up front. 234 00:10:39,316 --> 00:10:39,706 Right. 235 00:10:40,066 --> 00:10:44,206 And, uh, talking about things like VLANs and, uh, you know, like one of 236 00:10:44,206 --> 00:10:48,136 the things we talked about was having a VLAN for all of your desktops and 237 00:10:48,136 --> 00:10:52,756 laptops, so that if you want to stop everybody from doing anything, you 238 00:10:52,761 --> 00:10:54,976 just shut off those VLANs and boom. 239 00:10:55,486 --> 00:11:00,016 Um, there, you know, instead of having to notify 5,000 users, hey, stop doing 240 00:11:00,016 --> 00:11:02,266 anything, you just shut off their network. 241 00:11:02,266 --> 00:11:03,796 So they can't, they can't do anything. 242 00:11:04,096 --> 00:11:08,471 And then if stuff is still happening, , um, well, it's not the users, right? 243 00:11:08,471 --> 00:11:10,361 It's, it's malware, right? 244 00:11:10,531 --> 00:11:11,711 Prasanna Malaiyandi: back to segmentation. 245 00:11:11,801 --> 00:11:14,981 W. Curtis Preston: know, yeah, the, the network segmentation and the, the 246 00:11:15,421 --> 00:11:23,116 security part, I think, um, What, what, what role do you think the, I'll ask you 247 00:11:23,116 --> 00:11:24,616 what you think before I say what I think 248 00:11:25,456 --> 00:11:32,866 So what role do you think cyber insurance companies and then the, the companies 249 00:11:32,866 --> 00:11:34,726 that they can put you in touch with? 250 00:11:34,786 --> 00:11:35,506 The, the 251 00:11:35,746 --> 00:11:37,726 Melissa Palmer: Cyber insurance is becoming more and more interesting 252 00:11:37,731 --> 00:11:39,856 cuz it gets to the point where they hand you the list of things you 253 00:11:39,856 --> 00:11:42,226 need to do before they'll issue your policy and guess what you're gonna 254 00:11:42,231 --> 00:11:43,516 probably be able to cover anyway. 255 00:11:43,966 --> 00:11:47,386 Um, but a big part of, I've seen in a lot of policies lately is 256 00:11:47,391 --> 00:11:51,376 having, um, basically an instant response from on retainer ready 257 00:11:51,376 --> 00:11:53,326 to go as part of your policy. 258 00:11:53,596 --> 00:11:54,976 And I think that is invaluable. 259 00:11:55,036 --> 00:11:55,156 I. 260 00:11:55,971 --> 00:11:58,426 , everybody should have some kinda relationship with an IR firm 261 00:11:58,426 --> 00:11:59,536 if you can't do it in house. 262 00:11:59,536 --> 00:12:01,576 And uh, even if you can, right? 263 00:12:01,581 --> 00:12:03,886 Sometimes you do still need that outside perspective. 264 00:12:03,886 --> 00:12:08,806 I know a lot of larger orgs are like, no, no, we do our own ir, well, you do 265 00:12:08,806 --> 00:12:11,806 your own ir, but you're not dealing with ransomware every day and these people are 266 00:12:11,811 --> 00:12:13,456 so you might want a little bit of help. 267 00:12:14,401 --> 00:12:15,001 W. Curtis Preston: Yeah. 268 00:12:15,091 --> 00:12:15,631 Yeah. 269 00:12:15,751 --> 00:12:20,041 Um, you know, um, I hate to do it, but a another, another movie reference. 270 00:12:20,041 --> 00:12:24,751 I just saw the , the movie plane, and you know, the plane goes down in the 271 00:12:24,751 --> 00:12:28,021 middle of nowhere and they brought in the guy, they brought in the incident 272 00:12:28,021 --> 00:12:30,661 response guy basically once he showed up. 273 00:12:30,691 --> 00:12:31,251 Right. 274 00:12:31,861 --> 00:12:33,871 See, there's a movie reference for everything, 275 00:12:34,201 --> 00:12:36,541 Melissa Palmer: I haven't, I can't tell you the last movie I've watched. 276 00:12:36,541 --> 00:12:37,321 I really can't. 277 00:12:37,411 --> 00:12:37,651 I don't 278 00:12:37,811 --> 00:12:41,011 W. Curtis Preston: I can, I can, I can pull up my app, uh, 279 00:12:41,041 --> 00:12:42,961 cuz I have the Regal Unlimited. 280 00:12:42,991 --> 00:12:44,371 Melissa Palmer: tell you the last thing I watched. 281 00:12:44,371 --> 00:12:46,331 I can't tell you the last movie I watched, cuz I don't remember. 282 00:12:47,521 --> 00:12:50,221 W. Curtis Preston: I, I, yeah, I, I saw like three this week. 283 00:12:50,221 --> 00:12:52,811 So in, in the theaters 284 00:12:53,266 --> 00:12:55,846 Prasanna Malaiyandi: so back to the cyber insurance from movies. 285 00:12:56,086 --> 00:12:56,446 Uh, 286 00:12:56,686 --> 00:12:57,556 I, yes. 287 00:12:57,856 --> 00:12:58,036 Yeah. 288 00:12:58,156 --> 00:13:02,896 No, but, but, but I think, well, this is one of the points that I remember 289 00:13:02,896 --> 00:13:06,796 because remember when Tony came on from SPECT Logic, Curtis, and he was like, 290 00:13:06,826 --> 00:13:08,446 oh my God, they got hit with ransomware. 291 00:13:08,446 --> 00:13:11,866 And he's like, just the previous month they had signed up for cyber insurance. 292 00:13:11,866 --> 00:13:15,466 They had an IR firm come in, give them sort of the list of, Hey, here's 293 00:13:15,466 --> 00:13:16,726 everything you need to do to help. 294 00:13:18,136 --> 00:13:18,271 Right. 295 00:13:18,271 --> 00:13:21,931 And he was like, that was probably the most valuable thing of that sort of 296 00:13:21,931 --> 00:13:25,501 cyber insurance policy was having the experts who could walk you through. 297 00:13:26,236 --> 00:13:29,566 W. Curtis Preston: And it, and it wasn't even like he, he was just 298 00:13:29,566 --> 00:13:32,446 lucky enough to have already, you know, contracted with them. 299 00:13:32,446 --> 00:13:32,806 Right. 300 00:13:33,076 --> 00:13:37,306 But the best I think would be to , well, not that you would know 301 00:13:37,306 --> 00:13:40,006 this, but to do it not a month in advance, but obviously way in 302 00:13:40,241 --> 00:13:40,801 Melissa Palmer: right. 303 00:13:40,846 --> 00:13:43,696 W. Curtis Preston: to get, and to give you some time to work with the incident 304 00:13:43,701 --> 00:13:48,706 response team and to make sure that you are doing the things that they want 305 00:13:48,766 --> 00:13:50,686 Melissa Palmer: but that's like, that's like the problem, right? 306 00:13:50,686 --> 00:13:53,956 Like it's not, if it's when, and you don't know when. 307 00:13:53,956 --> 00:13:56,356 It could be tomorrow, it could be next week, it could be next month. 308 00:13:56,356 --> 00:13:56,956 It could be next year. 309 00:13:56,956 --> 00:13:57,496 Like you don't 310 00:13:57,571 --> 00:13:59,011 W. Curtis Preston: It could have been three weeks ago. 311 00:13:59,356 --> 00:14:01,036 Melissa Palmer: and you just haven't realized it yet, right? 312 00:14:01,141 --> 00:14:01,621 W. Curtis Preston: Yeah. 313 00:14:02,101 --> 00:14:02,881 Prasanna Malaiyandi: Do it today. 314 00:14:03,466 --> 00:14:04,216 Melissa Palmer: That's my favorite. 315 00:14:04,891 --> 00:14:05,461 W. Curtis Preston: Yeah. 316 00:14:06,301 --> 00:14:10,821 Uh, so, which is why it doesn't matter when you invent a time machine. 317 00:14:12,376 --> 00:14:13,756 Melissa Palmer: You know, I have bad news to you. 318 00:14:14,421 --> 00:14:14,911 W. Curtis Preston: What 319 00:14:14,956 --> 00:14:17,866 Melissa Palmer: I haven't invented a time machine because there are certain 320 00:14:17,871 --> 00:14:19,456 points I've always promised to myself. 321 00:14:19,456 --> 00:14:22,726 If I invented the time machine, I would go back to this point and tell 322 00:14:22,726 --> 00:14:24,376 myself I invented the time machine. 323 00:14:24,376 --> 00:14:26,776 And if that hasn't happened, I haven't invented it because 324 00:14:26,781 --> 00:14:29,026 time is not linear, right? 325 00:14:29,031 --> 00:14:31,756 So I haven't invented a time machine. 326 00:14:31,876 --> 00:14:33,166 I'm very upset about that. 327 00:14:33,526 --> 00:14:34,096 W. Curtis Preston: Me neither. 328 00:14:35,036 --> 00:14:41,536 Um, but, um, well, it's been a weird, it's been, we've been jumping in and out 329 00:14:41,536 --> 00:14:43,366 of the topic here on this podcast, but, 330 00:14:44,296 --> 00:14:45,256 Prasanna Malaiyandi: Incident response. 331 00:14:45,736 --> 00:14:46,006 W. Curtis Preston: yeah. 332 00:14:46,006 --> 00:14:48,826 So we, we, we get the cyber insurance folks because I 333 00:14:48,826 --> 00:14:50,386 think in the, in the initial. 334 00:14:51,936 --> 00:14:56,356 Ransomware phase, what people thought of cyber insurance was just a 335 00:14:56,356 --> 00:15:00,196 company to pay their ransom for you, and that they're definitely saying 336 00:15:00,266 --> 00:15:01,786 they're not interested in it anymore. 337 00:15:02,146 --> 00:15:02,566 Melissa Palmer: Yeah. 338 00:15:02,986 --> 00:15:05,446 And there's more costs beyond the ransom, right? 339 00:15:05,446 --> 00:15:07,576 So you paid the ransom, but what about everything else? 340 00:15:07,666 --> 00:15:09,196 Um, that's the thing. 341 00:15:09,196 --> 00:15:13,186 And policies have changed over time, like, back in the day a couple years ago, right? 342 00:15:13,186 --> 00:15:17,146 Like before the pandemic, uh, it was like easy to get cyber insurance. 343 00:15:17,146 --> 00:15:20,626 Like, oh yeah, I'll take a cyber insurance policy for 5 million, please, whatever. 344 00:15:20,626 --> 00:15:21,526 And now it's hard. 345 00:15:21,916 --> 00:15:25,016 And if you do actually use your, I've seen a lot of cases where if you actually 346 00:15:25,021 --> 00:15:28,066 use the insurance policy, guess what? 347 00:15:28,426 --> 00:15:31,096 They don't necessarily drop you, but guess what Your deductible co becomes. 348 00:15:31,876 --> 00:15:35,056 What they paid for your last ransomware attack, right? 349 00:15:35,086 --> 00:15:38,776 So if I had to pay 2.5 million, guess what? 350 00:15:38,776 --> 00:15:42,526 I now have a 2.5 million deductible for my next attack because let's face it. 351 00:15:43,786 --> 00:15:45,076 We get IR in, right? 352 00:15:45,076 --> 00:15:47,296 We figured out what happened, we have to recovered, and then there's a whole 353 00:15:47,296 --> 00:15:50,146 stage where we have to do a postmortem, figure out how they got in, if they're 354 00:15:50,146 --> 00:15:52,426 still in and close up the gaps. 355 00:15:52,816 --> 00:15:57,856 That doesn't always happen cuz people are so, like, ohms are back, we're good to go. 356 00:15:57,861 --> 00:15:59,056 Happy day, happy day. 357 00:15:59,176 --> 00:16:01,396 And they get hit again because they never fixed the way they 358 00:16:01,396 --> 00:16:02,326 got in in the first place. 359 00:16:03,001 --> 00:16:05,221 W. Curtis Preston: What, what do you think about the idea of. 360 00:16:05,881 --> 00:16:08,131 And again, this would be driven by management. 361 00:16:08,281 --> 00:16:11,671 And you know, a lot of times, like you said, management isn't necessarily 362 00:16:12,001 --> 00:16:16,171 at that moment thinking about the the best way to do something. 363 00:16:16,171 --> 00:16:18,121 They just wanna do the fastest way to do something. 364 00:16:18,601 --> 00:16:18,901 Right. 365 00:16:18,901 --> 00:16:24,481 So another thing I've been looking into is the idea of wouldn't the best 366 00:16:24,481 --> 00:16:29,671 practice to be to figure out how they got in before you do the recovery, 367 00:16:29,671 --> 00:16:31,471 before you turn everything back on. 368 00:16:31,786 --> 00:16:32,276 Melissa Palmer: Yeah. 369 00:16:32,276 --> 00:16:34,456 And that, that's where the IR firms come in, because. 370 00:16:36,841 --> 00:16:39,001 they'll kind of get in and they'll be able to do that. 371 00:16:39,001 --> 00:16:41,101 They'll be able to say like, you guys are so messed up. 372 00:16:41,101 --> 00:16:42,871 You didn't have any logging unabled anywhere. 373 00:16:42,871 --> 00:16:44,701 Like we, we can't tell right now. 374 00:16:44,971 --> 00:16:45,181 Right? 375 00:16:45,181 --> 00:16:47,521 It really depends on what happens in that first phase. 376 00:16:47,851 --> 00:16:48,361 Um, 377 00:16:48,811 --> 00:16:49,301 W. Curtis Preston: Yeah. 378 00:16:49,411 --> 00:16:51,841 Melissa Palmer: and it comes back to kind of getting ready for the 379 00:16:51,841 --> 00:16:54,511 attack and what kind of security practice you have in some places. 380 00:16:54,511 --> 00:16:54,691 Yeah. 381 00:16:54,696 --> 00:16:58,261 We could see, people can figure out, uh, throw in a tool and say, yeah, guess what? 382 00:16:58,291 --> 00:16:58,921 They came in here. 383 00:16:58,921 --> 00:16:59,911 We know we're good to go. 384 00:17:00,121 --> 00:17:03,151 Other times they might not find it just because there was never. 385 00:17:03,511 --> 00:17:04,021 Prasanna Malaiyandi: they came in. 386 00:17:04,021 --> 00:17:05,701 They went out before you even knew 387 00:17:06,331 --> 00:17:07,051 or nothing was 388 00:17:07,126 --> 00:17:07,456 W. Curtis Preston: under 389 00:17:07,501 --> 00:17:09,676 Melissa Palmer: or we didn't, you know, we didn't have logging on or whatever. 390 00:17:09,676 --> 00:17:11,386 Or they turned something off or, 391 00:17:11,806 --> 00:17:13,846 W. Curtis Preston: Logging is a beautiful thing and, and also 392 00:17:13,851 --> 00:17:15,946 a system to get those logs off 393 00:17:16,366 --> 00:17:17,116 Melissa Palmer: yeah, 394 00:17:17,116 --> 00:17:19,066 that's what people like, forget about, like 395 00:17:19,366 --> 00:17:21,886 who cares about the logs, like whatever their logs. 396 00:17:21,886 --> 00:17:24,526 No, you're, you're going to care about the logs someday, I promise you. 397 00:17:24,931 --> 00:17:27,691 W. Curtis Preston: Yeah, I mean, even if it's something as simple of making 398 00:17:27,691 --> 00:17:31,291 sure that the logs are represented as text somewhere, that is then 399 00:17:31,291 --> 00:17:33,991 backed up by the backup system so that you can restore all of them. 400 00:17:34,291 --> 00:17:39,841 That's basic, but there are systems that you can buy that will just automatically, 401 00:17:40,171 --> 00:17:42,091 uh, exfiltrate all of those logs for you. 402 00:17:42,091 --> 00:17:42,331 Yeah. 403 00:17:42,601 --> 00:17:42,901 Yeah. 404 00:17:43,276 --> 00:17:45,466 Prasanna Malaiyandi: I wanna go back to a point you made earlier, Melissa, about 405 00:17:45,466 --> 00:17:51,226 sort of, okay, how do you make sure that you fix the things that broke so everyone 406 00:17:51,226 --> 00:17:52,846 isn't like, Hey, my VMs are back up. 407 00:17:52,846 --> 00:17:54,406 I don't need to worry about these things anymore. 408 00:17:54,916 --> 00:17:59,896 Have you heard any cases where, I know sometimes executives have 409 00:18:00,136 --> 00:18:03,316 sort of financial liability, right? 410 00:18:03,556 --> 00:18:05,626 Melissa Palmer: I've heard of that trend, right? 411 00:18:05,626 --> 00:18:09,706 Like your guess what your bonus is tied to if you get ransomware or not, and how you. 412 00:18:10,096 --> 00:18:12,766 And stuff like that, that's starting to happen in some places. 413 00:18:13,186 --> 00:18:16,876 Um, but a lot of it comes down to maybe the processes were 414 00:18:16,876 --> 00:18:18,826 never clearly defined upfront. 415 00:18:19,186 --> 00:18:19,396 Right. 416 00:18:19,396 --> 00:18:21,766 And that's where a lot of the cyber insurance stuff can 417 00:18:21,766 --> 00:18:22,546 actually come in and help. 418 00:18:22,546 --> 00:18:26,056 Well, they'll be like, you need to show us your response process. 419 00:18:26,386 --> 00:18:27,346 And they'll be like, here you go. 420 00:18:27,346 --> 00:18:29,056 And they'll be like, okay, so where's the rest of it? 421 00:18:29,056 --> 00:18:29,776 Or something like that, right? 422 00:18:29,776 --> 00:18:30,316 Like, what, what 423 00:18:30,316 --> 00:18:30,856 happened? 424 00:18:31,111 --> 00:18:31,531 W. Curtis Preston: the. 425 00:18:32,146 --> 00:18:32,596 Melissa Palmer: this is it. 426 00:18:32,596 --> 00:18:33,376 Like here's a page. 427 00:18:33,376 --> 00:18:34,666 Like it's not gonna work. 428 00:18:35,056 --> 00:18:37,036 Um, and again, it comes back to. 429 00:18:38,966 --> 00:18:39,916 the old school DR test. 430 00:18:39,916 --> 00:18:42,886 Like there needs to be ransomware recovery tests and postmortems of 431 00:18:42,886 --> 00:18:44,416 that ransomware recovery test, right? 432 00:18:44,416 --> 00:18:47,026 Like y'all need to get in room, figure out what worked, what didn't work. 433 00:18:48,161 --> 00:18:52,901 W. Curtis Preston: Having done the old school DR test, I'm curious as to how 434 00:18:53,411 --> 00:18:55,271 they do a ransomware recovery test. 435 00:18:55,271 --> 00:18:59,231 Because one of the hardest parts of a ransomware recovery is that the 436 00:18:59,231 --> 00:19:03,101 attacker is there is still attacking, like with a dr, you just say, 437 00:19:03,131 --> 00:19:05,291 okay, those six systems are dead. 438 00:19:05,561 --> 00:19:06,281 Melissa Palmer: So, yeah. 439 00:19:06,281 --> 00:19:07,721 So here's where it gets complicated. 440 00:19:07,721 --> 00:19:10,301 You need to test multiple types of recoveries, right? 441 00:19:10,301 --> 00:19:11,861 So maybe I'm recovering, please. 442 00:19:11,861 --> 00:19:12,621 I, I can't. 443 00:19:13,216 --> 00:19:15,536 , I will vomit in my mouth if I say maybe I'm recovering in place. 444 00:19:15,536 --> 00:19:16,736 I can't even like say that. 445 00:19:16,736 --> 00:19:19,286 So we're not gonna say that, but like maybe I'm going to my second site. 446 00:19:19,286 --> 00:19:20,426 Maybe I'm going to a warm site. 447 00:19:20,426 --> 00:19:21,266 Maybe I'm going to a hot site. 448 00:19:21,266 --> 00:19:22,496 Maybe I'm going to a public cloud. 449 00:19:22,496 --> 00:19:23,636 Maybe I'm going to a VMware cloud. 450 00:19:23,966 --> 00:19:25,466 You gotta test all those, right? 451 00:19:25,471 --> 00:19:29,336 Because you don't know where you're going until that incident response 452 00:19:29,366 --> 00:19:33,056 phase starts, especially when law enforcement gets involved, right? 453 00:19:33,056 --> 00:19:35,576 So let's say stuff's really bad, the FBI comes, and guess what? 454 00:19:36,176 --> 00:19:40,316 We are quarantining your whole data center while we investigate. 455 00:19:40,856 --> 00:19:41,456 Then what do you do? 456 00:19:41,616 --> 00:19:42,106 Prasanna Malaiyandi: Yeah. 457 00:19:43,466 --> 00:19:44,756 You're down for business, otherwise, 458 00:19:44,771 --> 00:19:45,101 Melissa Palmer: do? 459 00:19:45,191 --> 00:19:49,391 No, you go to public cloud, you go to um, a service provider, you go someplace else. 460 00:19:49,391 --> 00:19:51,431 So you have to have all that ironed out ahead of time. 461 00:19:51,436 --> 00:19:54,251 You have to know that there's different considerations for 462 00:19:54,251 --> 00:19:56,771 recovery from ransomware attack than a traditional disaster. 463 00:19:57,011 --> 00:19:59,081 So I guess, you know, from a traditional disaster, like what if the 464 00:19:59,086 --> 00:20:00,851 zombies eat both data centers, right? 465 00:20:00,851 --> 00:20:01,841 Then you would still need to go to the 466 00:20:01,931 --> 00:20:04,361 Prasanna Malaiyandi: but people probably aren't thinking about that though, right? 467 00:20:04,361 --> 00:20:07,421 The fact that, hey, maybe the F B I will come quarantine, right? 468 00:20:07,421 --> 00:20:08,561 Do you have your backups offsite? 469 00:20:08,566 --> 00:20:10,481 Do you have it in someplace that you can bring it up? 470 00:20:10,541 --> 00:20:13,631 And like you mentioned earlier, Melissa, it's like things you should plan for ahead 471 00:20:13,636 --> 00:20:17,641 of time before you get to the point where you are trying to recover from ransomware. 472 00:20:18,176 --> 00:20:18,776 Melissa Palmer: Exactly. 473 00:20:20,366 --> 00:20:23,096 And again, unless an organization, so I have a couple of examples 474 00:20:23,101 --> 00:20:25,256 of, I don't wanna say Dr. 475 00:20:25,256 --> 00:20:30,536 Done wrong, but uh, I worked for an uh, company when I was 476 00:20:30,536 --> 00:20:34,526 an intern on Wall Street and everything was in New York City. 477 00:20:35,251 --> 00:20:38,396 and nine 11 happened and they were a block from the World Trade Center. 478 00:20:39,356 --> 00:20:41,726 That's what they couldn't, they couldn't do anything like they were done. 479 00:20:41,906 --> 00:20:42,176 Right. 480 00:20:42,176 --> 00:20:43,016 Like they were just done. 481 00:20:43,021 --> 00:20:45,806 So they like rebuilt their systems in a hotel room someplace. 482 00:20:46,076 --> 00:20:46,286 Right. 483 00:20:46,286 --> 00:20:50,126 And that kicked off a huge project to say, we actually need a second data 484 00:20:50,126 --> 00:20:52,166 center and it needs to be not around here. 485 00:20:52,646 --> 00:20:52,946 Right. 486 00:20:53,006 --> 00:20:54,986 Um, I'm also on the east coast, right? 487 00:20:54,986 --> 00:20:58,046 So New York, hurricane Sandy, we had this hurricane roll through. 488 00:20:58,046 --> 00:21:01,316 And again, like the data centers are like 20 miles from each other. 489 00:21:01,316 --> 00:21:01,676 Guess. 490 00:21:02,526 --> 00:21:03,296 , they both tanked. 491 00:21:03,986 --> 00:21:05,516 Um, so things like that. 492 00:21:05,516 --> 00:21:10,286 So until an organization actually has something happen to them, it's really, 493 00:21:10,286 --> 00:21:13,046 and here's the issue, the, the, the difference between disaster recovery 494 00:21:13,046 --> 00:21:15,656 and ransomware recovery, when we talk about it, traditional disaster 495 00:21:15,656 --> 00:21:19,256 recovery stuff, until it happens, it's easy to accept the risk, right? 496 00:21:19,256 --> 00:21:19,886 Well, you know what? 497 00:21:19,886 --> 00:21:24,146 It's cheaper for us to just like recover from this disaster and be down for 498 00:21:24,146 --> 00:21:27,506 two weeks than it is to actually put everything into place where we build a 499 00:21:27,506 --> 00:21:28,976 second site, yada, yada, yada, yada, et. 500 00:21:30,111 --> 00:21:31,736 that's because the risk is so low, right? 501 00:21:31,736 --> 00:21:34,226 And there's all kinds of equations for this in, you know, 502 00:21:34,226 --> 00:21:35,426 cybersecurity and stuff like that. 503 00:21:35,936 --> 00:21:38,876 But when you change it to ransomware, the risk is going to, it's going to 504 00:21:38,876 --> 00:21:40,736 happen like a probability of one. 505 00:21:40,976 --> 00:21:41,816 It will happen. 506 00:21:42,236 --> 00:21:43,646 Um, and that's what people don't understand. 507 00:21:43,651 --> 00:21:44,996 Like this is going to happen. 508 00:21:44,996 --> 00:21:47,366 It's not like you can say like, well, you know, we haven't had a hundred 509 00:21:47,366 --> 00:21:49,406 years storm ever, so we'll be fine. 510 00:21:49,706 --> 00:21:51,176 Um, it's different like that. 511 00:21:51,176 --> 00:21:55,466 And a lot of people, I've actually seen a huge uptick in people getting. 512 00:21:56,966 --> 00:21:59,306 I don't think a lot of people are where they need to be. 513 00:21:59,666 --> 00:22:04,556 Um, but I think as people get ready and it gets harder and harder to attack 514 00:22:04,556 --> 00:22:07,496 people because they've put like some semblance of security in it, right? 515 00:22:07,496 --> 00:22:10,466 You're gonna go for the low-hanging fruit, you're gonna see the people 516 00:22:10,466 --> 00:22:12,926 who aren't ready get hit harder and you're just gonna see more and more 517 00:22:12,926 --> 00:22:15,686 attacks and the threat actors are gonna have to get more creative. 518 00:22:16,286 --> 00:22:18,056 Prasanna Malaiyandi: So here's a question for you. 519 00:22:19,706 --> 00:22:22,076 Normally when we think about backup and recovery, right, it's always 520 00:22:22,076 --> 00:22:24,776 about restoring your data or your application because there might be 521 00:22:24,776 --> 00:22:27,626 a hardware failure, an application fault, user error, et cetera. 522 00:22:28,226 --> 00:22:31,826 Sometimes people talk about ransomware in the same context as 523 00:22:31,831 --> 00:22:34,266 disaster recovery and sort of those 524 00:22:34,481 --> 00:22:35,771 Melissa Palmer: Ransomware is a disaster. 525 00:22:35,771 --> 00:22:35,861 I 526 00:22:36,026 --> 00:22:38,216 Prasanna Malaiyandi: but, but here's the question though, Melissa 527 00:22:38,216 --> 00:22:44,036 is, Like you had just mentioned, it's not the same as a flood or a 528 00:22:44,036 --> 00:22:45,836 hurricane or something like that. 529 00:22:45,836 --> 00:22:50,126 And so are we kind of pushing ourselves and kind of giving people the false 530 00:22:50,126 --> 00:22:55,826 impression that it is similar to those other disasters and things that they 531 00:22:55,826 --> 00:22:59,816 shouldn't worry about versus we should be treating it similar to like an application 532 00:22:59,816 --> 00:23:01,766 failure or user failure and treating it 533 00:23:02,576 --> 00:23:03,026 similar. 534 00:23:03,026 --> 00:23:05,426 It's like more towards that side of the spectrum than this side. 535 00:23:06,626 --> 00:23:09,026 Melissa Palmer: and you know, that all falls under DR anyway, like hardware 536 00:23:09,026 --> 00:23:10,136 failure and all that kind of stuff. 537 00:23:10,826 --> 00:23:14,906 Um, and again, in a lot of those cases, it's easy to say, well, you know what? 538 00:23:14,906 --> 00:23:16,076 I don't really want a second site. 539 00:23:16,076 --> 00:23:18,716 It's just cheaper to deal with the hardware. 540 00:23:18,716 --> 00:23:19,796 It'll take we'll rush order. 541 00:23:19,796 --> 00:23:23,306 I was in a situation at a company, we'll just rush order at a new array from 542 00:23:23,306 --> 00:23:25,166 E M C that will solve our problems. 543 00:23:25,171 --> 00:23:27,086 Like that was the plan and that happened. 544 00:23:27,476 --> 00:23:28,856 Um, so crazy stuff like that. 545 00:23:29,066 --> 00:23:31,916 But the problem, why I like to make the analogy so much is the problem 546 00:23:31,916 --> 00:23:34,616 is when you tell someone that you have to get ready to recover from 547 00:23:34,616 --> 00:23:36,086 ransomware, they're just like, I don't. 548 00:23:37,326 --> 00:23:37,721 what to do. 549 00:23:37,721 --> 00:23:39,641 You have to put it in some context that kind of makes sense. 550 00:23:39,641 --> 00:23:42,431 I mean, disaster recovery is definitely like not sexy, even though 551 00:23:42,431 --> 00:23:43,601 I've done it most in my career. 552 00:23:43,931 --> 00:23:47,201 Um, but it's something that everybody has an inkling about at least, right? 553 00:23:47,201 --> 00:23:49,751 Everybody kind of knows that there is usually a DR test once 554 00:23:49,751 --> 00:23:51,401 or twice or year a minimum. 555 00:23:51,701 --> 00:23:54,041 Um, so it's a way, it's a starting point, right? 556 00:23:54,041 --> 00:23:55,661 It's not your final destination, but it's a starting 557 00:23:55,661 --> 00:23:55,931 point. 558 00:23:55,931 --> 00:23:56,111 It's a. 559 00:23:56,111 --> 00:23:57,311 place to start context. 560 00:23:57,491 --> 00:24:00,701 Maybe you have some playbook, some processes that we can leverage to go build 561 00:24:00,701 --> 00:24:05,321 on top of that and say, okay, so how do we make sure that we can recover now under 562 00:24:05,321 --> 00:24:05,531 any 563 00:24:05,546 --> 00:24:08,996 W. Curtis Preston: I like to, I like to say that it's a subset, right? 564 00:24:08,996 --> 00:24:14,186 A DR is a subset of a ransomware recovery, but there's so much else, right? 565 00:24:14,186 --> 00:24:17,676 And the big thing, the but, and I think you said it already, Prasanna, but the 566 00:24:17,696 --> 00:24:22,676 big thing to me, the difference between a DR and a ransomware attack, um, is 567 00:24:22,676 --> 00:24:26,321 that the, the disaster isn't, Right. 568 00:24:26,391 --> 00:24:28,341 You're, you're still right when 569 00:24:28,436 --> 00:24:29,726 Melissa Palmer: the disaster never 570 00:24:29,781 --> 00:24:32,091 W. Curtis Preston: a flood is gone, you're like, okay, all 571 00:24:32,091 --> 00:24:33,561 these servers got wiped out. 572 00:24:33,561 --> 00:24:34,371 So those are the 573 00:24:34,421 --> 00:24:35,621 Melissa Palmer: because the threat is still there. 574 00:24:35,621 --> 00:24:38,201 Just because you recovered from the ransomware attacked doesn't mean 575 00:24:38,321 --> 00:24:40,061 they're not gonna hit you again, or someone else isn't gonna hit 576 00:24:40,071 --> 00:24:40,521 W. Curtis Preston: Right. 577 00:24:40,551 --> 00:24:43,671 Well, and, and how do you even know, um, 578 00:24:43,676 --> 00:24:43,876 Prasanna Malaiyandi: gone. 579 00:24:44,381 --> 00:24:46,601 W. Curtis Preston: You know, like when you, when when a hurricane wipes out a 580 00:24:46,601 --> 00:24:49,331 data center, you're like, okay, those are the servers we need to restore. 581 00:24:49,601 --> 00:24:51,701 But how do, when you walk into your data center and there's a 582 00:24:51,701 --> 00:24:55,451 ransomware attack going on, how do you even know which servers have 583 00:24:55,451 --> 00:24:56,831 been affected or not affected? 584 00:24:56,861 --> 00:24:57,221 Right. 585 00:24:57,221 --> 00:24:59,381 That's, that is a big part of it. 586 00:24:59,516 --> 00:25:02,126 Prasanna Malaiyandi: Yeah, and I guess the other thing is even like you 587 00:25:02,126 --> 00:25:05,306 might see the active infection, like things are being encrypted, et cetera, 588 00:25:05,306 --> 00:25:07,106 but it might just be lying silently. 589 00:25:07,106 --> 00:25:07,316 Right. 590 00:25:07,316 --> 00:25:09,806 We've talked about dwell time in the past, right. 591 00:25:09,806 --> 00:25:10,076 Where it's 592 00:25:10,226 --> 00:25:10,766 Melissa Palmer: chill. 593 00:25:10,766 --> 00:25:12,296 They just chill in there for a while. 594 00:25:12,301 --> 00:25:13,196 Like, who knows? 595 00:25:13,586 --> 00:25:16,886 Um, I, I can't remember off the top of my head, but I remember reading like a big 596 00:25:16,891 --> 00:25:19,376 name breach or something like that, or a big name attack, and they said they were 597 00:25:19,376 --> 00:25:20,726 in the network for like six months or 598 00:25:21,006 --> 00:25:22,586 Prasanna Malaiyandi: I think Solar Winds was like 599 00:25:22,676 --> 00:25:22,931 Melissa Palmer: was it? 600 00:25:22,991 --> 00:25:23,651 I don't remember. 601 00:25:23,651 --> 00:25:25,391 But I remember reading a couple of them where they've been in there a 602 00:25:25,391 --> 00:25:28,721 significant period of time and who knows what they're doing there, right? 603 00:25:28,721 --> 00:25:30,161 Like who knows unless you catch them. 604 00:25:30,251 --> 00:25:30,671 So it's about 605 00:25:30,671 --> 00:25:31,301 catching 'em past. 606 00:25:31,676 --> 00:25:34,256 W. Curtis Preston: The meantime is something like 60 days 607 00:25:34,256 --> 00:25:36,176 actually is what I, what I read. 608 00:25:36,656 --> 00:25:37,316 Um, I 609 00:25:37,331 --> 00:25:38,651 Melissa Palmer: be the worst ransomware person. 610 00:25:38,651 --> 00:25:40,541 I'd be like, let's go, let's go. 611 00:25:40,541 --> 00:25:42,341 It's like, no, you're not supposed to do that. 612 00:25:42,341 --> 00:25:45,761 You gotta take your time and traverse through the network and get ad. 613 00:25:45,941 --> 00:25:47,771 I'd be like, let's go encrypt VMware. 614 00:25:47,771 --> 00:25:48,701 Let's go. 615 00:25:49,001 --> 00:25:50,321 I'd be caught so fast. 616 00:25:50,531 --> 00:25:51,671 Or maybe I wouldn't, maybe I. 617 00:25:53,336 --> 00:25:53,576 W. Curtis Preston: That's 618 00:25:53,576 --> 00:25:56,156 Prasanna Malaiyandi: You're only caught if someone's monitoring and watching. 619 00:25:56,266 --> 00:25:56,786 Right Melissa? 620 00:25:57,461 --> 00:25:57,911 Melissa Palmer: Right. 621 00:25:57,911 --> 00:25:58,511 And you need to be 622 00:25:58,511 --> 00:25:59,771 looking for the right things. 623 00:26:00,851 --> 00:26:01,061 W. Curtis Preston: Yeah. 624 00:26:01,061 --> 00:26:05,771 As soon as you encrypt a, a vm, uh, you're gonna set off alarm or two. 625 00:26:06,371 --> 00:26:10,442 Um, but I, I think you encrypt, I think you encrypt a lot of 626 00:26:10,447 --> 00:26:12,671 files that no one's looking at. 627 00:26:12,791 --> 00:26:13,181 Right. 628 00:26:13,541 --> 00:26:15,071 But the moment you start 629 00:26:15,236 --> 00:26:18,266 Melissa Palmer: Once you hit the the thing, the only thing is you'll hit. 630 00:26:18,596 --> 00:26:22,016 You'll hopefully you'll be caught as soon as you start encrypting the VMs. 631 00:26:22,316 --> 00:26:23,996 You do them all at once, so it doesn't matter. 632 00:26:25,181 --> 00:26:25,331 W. Curtis Preston: Yeah. 633 00:26:25,331 --> 00:26:25,571 Right. 634 00:26:25,571 --> 00:26:26,051 Cuz it's, 635 00:26:26,081 --> 00:26:26,701 Melissa Palmer: I got all 636 00:26:26,701 --> 00:26:26,941 of 'em. 637 00:26:26,941 --> 00:26:29,351 It doesn't matter that you caught me doing the first one, I did them all. 638 00:26:29,741 --> 00:26:33,011 Um, but yeah, so generally they're in their wreaking havoc, steal maybe 639 00:26:33,281 --> 00:26:36,071 exfiltrating data, doing some stuff before they go encryption habit. 640 00:26:36,101 --> 00:26:38,291 Or maybe like, I've heard cases recently where they don't even 641 00:26:38,291 --> 00:26:39,581 bother, like encrypting stuff. 642 00:26:39,581 --> 00:26:41,261 They're just stealing data at this point and be like, by the 643 00:26:41,261 --> 00:26:42,501 way, look what we have. 644 00:26:43,001 --> 00:26:45,911 Prasanna Malaiyandi: Is that easier by the way, to steal data? 645 00:26:45,911 --> 00:26:49,571 Because it seems that you can sort of fly under the radar if you just steal 646 00:26:49,571 --> 00:26:52,391 data because people will probably, maybe they notice, maybe they don't, 647 00:26:52,396 --> 00:26:54,401 but it's not as obvious as, say, 648 00:26:54,461 --> 00:26:57,231 Melissa Palmer: It is definitely not as obvious as encrypting stuff, I'm 649 00:26:57,231 --> 00:26:58,911 like this weird monitoring nerd too. 650 00:26:58,911 --> 00:27:00,811 I had like this monitoring fetish at Veeam. 651 00:27:00,831 --> 00:27:02,001 It was very strange. 652 00:27:02,511 --> 00:27:05,871 Um, so like, I would like really hone in on like what to look 653 00:27:05,871 --> 00:27:07,701 for to catch that too, right? 654 00:27:08,091 --> 00:27:09,651 But not everybody is crazy like me. 655 00:27:10,071 --> 00:27:10,581 Um, 656 00:27:11,901 --> 00:27:12,351 network 657 00:27:12,351 --> 00:27:14,361 W. Curtis Preston: I think, yeah, I do. 658 00:27:15,021 --> 00:27:19,731 To answer your question, Prasanna, I do think that exfiltration as an overall 659 00:27:19,731 --> 00:27:28,011 process is easier in that if you can get any data out that there's a, there's a 660 00:27:28,011 --> 00:27:30,651 much higher chance that they will respond. 661 00:27:30,801 --> 00:27:32,121 That they will pay the ransom. 662 00:27:32,391 --> 00:27:32,751 Right? 663 00:27:32,751 --> 00:27:34,281 Because backups aren't gonna help. 664 00:27:34,731 --> 00:27:36,141 Melissa Palmer: I'm looking at my black hat over there. 665 00:27:36,141 --> 00:27:38,391 I'm wondering if I should like, put it on for this discussion or something. 666 00:27:38,961 --> 00:27:44,001 Um, like you would probably like see like, all right, like if I'm a bad person, 667 00:27:44,211 --> 00:27:45,741 I'm not a bad person, I'm a good person. 668 00:27:46,341 --> 00:27:48,291 Um, like they start small, right? 669 00:27:48,291 --> 00:27:50,001 They grab a file here and there and they see if they 670 00:27:50,421 --> 00:27:51,441 Prasanna Malaiyandi: if anyone notices. 671 00:27:51,506 --> 00:27:52,551 Melissa Palmer: this, grab that, right? 672 00:27:52,551 --> 00:27:54,831 Like, you don't go and just be like, oh look, here's the final. 673 00:27:55,686 --> 00:27:58,286 25 million gigabytes of MP3s. 674 00:27:58,286 --> 00:27:59,226 I'm gonna take it all at once. 675 00:27:59,226 --> 00:28:00,786 No, they're like picky and choosy. 676 00:28:00,786 --> 00:28:02,256 They try to find the sensitive data. 677 00:28:02,256 --> 00:28:03,336 They take a little bit here and there. 678 00:28:03,576 --> 00:28:05,286 Maybe they only need to grab a couple spreadsheets. 679 00:28:05,286 --> 00:28:05,526 Right? 680 00:28:05,526 --> 00:28:08,316 It's not like, I think there's this misnomer that like they get 681 00:28:08,316 --> 00:28:10,836 in there and I'm just gonna start downloading massive chunks of 682 00:28:10,841 --> 00:28:11,376 data. 683 00:28:11,691 --> 00:28:13,551 W. Curtis Preston: well, that's the whole point of 684 00:28:13,746 --> 00:28:15,246 Melissa Palmer: so you could exfiltrate a vm, just like 685 00:28:15,246 --> 00:28:16,776 download the vmd K and be like, 686 00:28:16,791 --> 00:28:18,261 W. Curtis Preston: yeah, exactly. 687 00:28:18,456 --> 00:28:18,516 Melissa Palmer: ad. 688 00:28:18,696 --> 00:28:19,356 Have a nice life 689 00:28:20,261 --> 00:28:25,266 W. Curtis Preston: that's that whole phase of the, um, the initial phase of an attack 690 00:28:25,566 --> 00:28:31,236 is trying to expand out, seeing what you can find out, seeing if you can find 691 00:28:31,236 --> 00:28:33,966 a spreadsheet called customer database 692 00:28:34,236 --> 00:28:34,416 Melissa Palmer: You know? 693 00:28:34,416 --> 00:28:34,746 Right. 694 00:28:34,996 --> 00:28:36,246 W. Curtis Preston: xls , right. 695 00:28:37,866 --> 00:28:39,336 Um, or like. 696 00:28:39,456 --> 00:28:42,186 Melissa Palmer: you might not bother encrypting everything, but if you 697 00:28:42,186 --> 00:28:45,756 can't find much, you say, all right, I'll steal some stuff and tell 'em I 698 00:28:45,756 --> 00:28:48,516 have some files, but I won't tell them what I'll hope that'll make them pay. 699 00:28:48,516 --> 00:28:50,436 And I'll just go, you know, encrypt some stuff while. 700 00:28:51,906 --> 00:28:52,896 Which is more illegal? 701 00:28:52,896 --> 00:28:54,246 Is one more legal than the other? 702 00:28:55,266 --> 00:28:57,216 Prasanna Malaiyandi: I think they both are pretty bad, 703 00:28:57,336 --> 00:28:58,986 Melissa Palmer: is one more illegal than the other? 704 00:29:00,231 --> 00:29:01,731 W. Curtis Preston: Well, they're both extortion. 705 00:29:02,511 --> 00:29:05,691 Um, the act, The act 706 00:29:05,706 --> 00:29:08,196 Melissa Palmer: but if you're actually exfiltrating, you're stealing it. 707 00:29:08,271 --> 00:29:08,661 W. Curtis Preston: yeah. 708 00:29:09,141 --> 00:29:11,361 That's gonna depend on where this happens. 709 00:29:11,961 --> 00:29:15,201 Uh, whether or not exfiltrating the data is a different crime. 710 00:29:16,051 --> 00:29:17,391 And damaging the data. 711 00:29:18,261 --> 00:29:23,331 Um, but, uh, but in the, the extortion happens on both sides, right? 712 00:29:23,331 --> 00:29:24,651 And that's definitely illegal in 713 00:29:24,891 --> 00:29:25,101 Melissa Palmer: that 714 00:29:25,191 --> 00:29:26,451 W. Curtis Preston: pretty much every jurisdiction 715 00:29:26,511 --> 00:29:27,171 Melissa Palmer: legal kids. 716 00:29:27,306 --> 00:29:31,086 Prasanna Malaiyandi: Yeah, so we talked about, so we talked 717 00:29:31,086 --> 00:29:32,316 about incident response. 718 00:29:33,156 --> 00:29:35,686 You've now been hit by a ransomware attack. 719 00:29:36,881 --> 00:29:39,186 in, then let's just take VMware environments, right? 720 00:29:39,216 --> 00:29:43,296 So what do you see people doing like, or what are things that they 721 00:29:43,296 --> 00:29:45,096 should be doing that they're not? 722 00:29:45,486 --> 00:29:46,926 Like, how do they even approach 723 00:29:46,941 --> 00:29:48,291 Melissa Palmer: Yeah, so he, 724 00:29:48,306 --> 00:29:50,166 Prasanna Malaiyandi: VMware environment gets encrypted Now, what 725 00:29:51,411 --> 00:29:52,821 Melissa Palmer: Um, to me it's trash. 726 00:29:54,051 --> 00:29:56,751 I would throw it away and start over, like, I'm not even joking. 727 00:29:56,751 --> 00:29:57,271 Throw it 728 00:29:57,411 --> 00:29:57,861 W. Curtis Preston: No, not 729 00:29:58,036 --> 00:29:59,976 Prasanna Malaiyandi: and, and, and, and how much? 730 00:30:00,921 --> 00:30:03,411 And and how much would you, when you say throw it away, are you talking about 731 00:30:03,411 --> 00:30:07,671 throwing away the virtual machines, throwing away the ESXi servers, the. 732 00:30:07,686 --> 00:30:11,526 Melissa Palmer: the host, wipe the storage array, wipe it all and start over. 733 00:30:12,156 --> 00:30:14,106 Um, and, and here's the thing, right? 734 00:30:14,106 --> 00:30:16,106 So like, you know, I, I like it. 735 00:30:16,111 --> 00:30:21,126 I have this weird side of me that also does like weird blogging stuff, right? 736 00:30:21,126 --> 00:30:23,106 And like, I like SEO and stuff like that. 737 00:30:23,616 --> 00:30:26,766 And even my career at Veeam people are like, how do I back up my VMware host? 738 00:30:27,881 --> 00:30:29,436 you don't, they're like, what do you mean? 739 00:30:29,436 --> 00:30:33,096 I'm like, you don't, um, you automate the build process 740 00:30:33,096 --> 00:30:34,026 and the configuration, right? 741 00:30:34,026 --> 00:30:35,916 You don't actually back up your host and restore it. 742 00:30:35,916 --> 00:30:36,396 It's, you 743 00:30:36,891 --> 00:30:37,521 Prasanna Malaiyandi: You just rebuild 744 00:30:37,626 --> 00:30:37,836 Melissa Palmer: thing. 745 00:30:37,836 --> 00:30:39,996 It's a clean install and you configure it. 746 00:30:40,596 --> 00:30:43,686 Um, so that's what people need to be testing to is how I would 747 00:30:43,686 --> 00:30:46,146 actually recover is almost misnomer. 748 00:30:46,151 --> 00:30:47,196 Cuz Prasannally I would trash it. 749 00:30:47,586 --> 00:30:50,556 Um, how do I re rapidly rebuild a VMware environment? 750 00:30:50,706 --> 00:30:51,396 And that's something. 751 00:30:52,146 --> 00:30:53,856 People don't do every day, right? 752 00:30:53,861 --> 00:30:56,706 Like that stuff runs like you might have not even reinstalled. 753 00:30:56,706 --> 00:30:59,526 You could have just been upgrading for the last like 10 years and like, 754 00:30:59,556 --> 00:31:02,826 whatever, probably not 10, probably four or five years, you'll get a new host. 755 00:31:02,826 --> 00:31:03,126 I don't know. 756 00:31:03,126 --> 00:31:03,576 It depends. 757 00:31:03,936 --> 00:31:09,246 Um, so that's something that people don't practice and don't do. 758 00:31:09,846 --> 00:31:11,956 Um, and you can actually do that all. 759 00:31:12,931 --> 00:31:15,981 for the most part, um, in a nested virtualization environment. 760 00:31:15,981 --> 00:31:17,211 Get all your processes down stuff. 761 00:31:17,211 --> 00:31:19,881 So it's a pretty low co I mean, you should test on your physical hardware 762 00:31:19,881 --> 00:31:23,991 at some point for any drivers and stuff, but it's actually a relatively low 763 00:31:24,681 --> 00:31:26,361 cost and effort thing to figure out. 764 00:31:26,361 --> 00:31:27,651 It's not rocket science. 765 00:31:27,891 --> 00:31:31,161 Prasanna Malaiyandi: But when you do this testing, wouldn't you also want to 766 00:31:31,166 --> 00:31:33,021 involve, say like your networking team, 767 00:31:33,131 --> 00:31:35,391 Melissa Palmer: Yes, you would wanna, any of this testing, 768 00:31:35,391 --> 00:31:36,531 you wanna involve anybody? 769 00:31:36,561 --> 00:31:37,911 Everybody, right? 770 00:31:37,911 --> 00:31:39,351 Everybody should be involved in this. 771 00:31:40,411 --> 00:31:40,956 everybody. 772 00:31:40,956 --> 00:31:43,506 And that's I think, one of the biggest problems we see that they're not, 773 00:31:44,241 --> 00:31:45,381 W. Curtis Preston: So when you say, 774 00:31:45,426 --> 00:31:48,226 Melissa Palmer: They're like, I don't have time to do this. 775 00:31:48,891 --> 00:31:51,381 W. Curtis Preston: when you say rebuild the VMware environment, 776 00:31:52,191 --> 00:31:55,131 um, obviously you're talking about vm, you know, wiping the hosts and, 777 00:31:55,136 --> 00:31:56,271 and the storage and all of that. 778 00:31:56,841 --> 00:32:01,611 When we get to the phase of actually bringing back VMs, 779 00:32:01,996 --> 00:32:02,606 Melissa Palmer: Mm-hmm. 780 00:32:03,231 --> 00:32:04,791 W. Curtis Preston: what way would you do that? 781 00:32:06,561 --> 00:32:09,621 Melissa Palmer: Um, so most backup software these days have something 782 00:32:09,621 --> 00:32:14,871 built in where it'll actually scan for ransomware as you are restoring, right? 783 00:32:14,931 --> 00:32:16,551 And find the ransomware if it's there. 784 00:32:16,551 --> 00:32:17,991 Cause at that point, you know what you're infected with, 785 00:32:17,996 --> 00:32:19,221 so you know what to look for. 786 00:32:19,701 --> 00:32:23,661 Um, so I would be either scanning it or, you know, if you have really good. 787 00:32:24,406 --> 00:32:26,841 and then you can decide how you're gonna fix it, or you're just gonna go 788 00:32:26,841 --> 00:32:28,641 back to an earlier point or whatever. 789 00:32:28,911 --> 00:32:31,791 Um, you know, some people are really good with the IR stuff and say, we know the 790 00:32:31,791 --> 00:32:35,091 ransomware came in this date, this time we are absolutely a million percent certain 791 00:32:35,096 --> 00:32:38,721 because we have all these logs go back to the last known good restore point, right? 792 00:32:39,171 --> 00:32:40,311 Um, so it really depends. 793 00:32:40,311 --> 00:32:44,691 But the backup people gonna be a big part of that, right? 794 00:32:44,691 --> 00:32:45,201 Because it's gonna be 795 00:32:45,441 --> 00:32:46,731 W. Curtis Preston: Y Yeah, I, 796 00:32:47,211 --> 00:32:48,021 Melissa Palmer: do they have built in? 797 00:32:48,501 --> 00:32:51,381 W. Curtis Preston: this is something I put a lot of thought into lately 798 00:32:51,531 --> 00:32:55,221 of if the meantime of a, of a. 799 00:32:56,061 --> 00:33:01,461 Infection is 60 days, and some of them are twice that, um, the, the 800 00:33:01,466 --> 00:33:06,531 idea of of saying, oh, well we got, we got infected December 1st, so 801 00:33:06,531 --> 00:33:08,091 we're gonna restore to December 1st. 802 00:33:08,121 --> 00:33:08,541 That's a 803 00:33:08,586 --> 00:33:10,626 Melissa Palmer: That doesn't, it doesn't always work. 804 00:33:10,626 --> 00:33:12,666 In some cases it might, in some cases it won't. 805 00:33:12,666 --> 00:33:14,706 And then you're going back to scanning, 806 00:33:15,141 --> 00:33:17,331 W. Curtis Preston: So you've got, you've got to, I think in most 807 00:33:17,331 --> 00:33:20,901 cases, if many, if not most cases, you're gonna do a restoring. 808 00:33:22,091 --> 00:33:22,266 Melissa Palmer: Yeah. 809 00:33:22,296 --> 00:33:24,396 I've seen kind of almost like two stage recoveries too. 810 00:33:24,401 --> 00:33:27,966 Like get the bare minimum of stuff something up and run something 811 00:33:27,966 --> 00:33:29,406 online up and running, right. 812 00:33:29,586 --> 00:33:32,076 To restore services and then do the full recovery later. 813 00:33:32,346 --> 00:33:34,626 So you're not, you might be like, all right, so you know what? 814 00:33:34,806 --> 00:33:37,506 We can roll these servers back to December 29th. 815 00:33:37,866 --> 00:33:39,636 We can use the newest copy of the database. 816 00:33:39,636 --> 00:33:43,446 We can mash it together and make it work and serve our customers 817 00:33:43,506 --> 00:33:45,396 while we're actually restoring everything the right way. 818 00:33:45,641 --> 00:33:46,441 Prasanna Malaiyandi: Rackspace, 819 00:33:46,566 --> 00:33:47,926 Melissa Palmer: So it did that. 820 00:33:48,126 --> 00:33:52,746 W. Curtis Preston: Prasanna. 821 00:33:52,761 --> 00:33:53,061 Yeah. 822 00:33:53,766 --> 00:33:54,126 Melissa Palmer: you okay? 823 00:33:54,126 --> 00:33:55,416 You were eating another sip of tea there. 824 00:33:55,791 --> 00:33:58,701 W. Curtis Preston: It's what I thought of when you, when you, as soon as 825 00:33:58,701 --> 00:34:00,801 she said that, I, yeah, I know. 826 00:34:00,951 --> 00:34:01,311 Yeah. 827 00:34:01,371 --> 00:34:02,601 Just make sure. 828 00:34:03,021 --> 00:34:07,431 Unlike Rackspace, just make sure that you thought of this beforehand. 829 00:34:07,881 --> 00:34:08,241 Right. 830 00:34:08,246 --> 00:34:12,591 The only way that this is gonna work is if you identify what are the three 831 00:34:12,596 --> 00:34:17,601 services that need to be up right away so that we can function as a company and 832 00:34:17,601 --> 00:34:20,721 what are the other 20, 5,000 services 833 00:34:20,781 --> 00:34:23,001 Melissa Palmer: That kind of, um, that ties almost more into like 834 00:34:23,061 --> 00:34:24,981 the business con, you know, B C D R 835 00:34:25,116 --> 00:34:25,716 W. Curtis Preston: Yeah. 836 00:34:26,076 --> 00:34:26,616 Yeah, 837 00:34:26,781 --> 00:34:27,471 Melissa Palmer: continuity sort. 838 00:34:27,471 --> 00:34:30,531 Like what are our key applications and what level of, what do we have 839 00:34:30,531 --> 00:34:33,891 to do to get those online First comes back to our RPOs and RTOs, right? 840 00:34:34,476 --> 00:34:34,896 W. Curtis Preston: yeah. 841 00:34:36,291 --> 00:34:39,651 Melissa Palmer: it's, it's, the thing is, it's such a big discussion that unless 842 00:34:39,651 --> 00:34:42,621 you've had it cross-functionally with the business owners and the app owners, 843 00:34:42,621 --> 00:34:45,411 and the infrastructure owners and the security team, you're not in a good. 844 00:34:46,671 --> 00:34:47,001 W. Curtis Preston: Yeah. 845 00:34:47,061 --> 00:34:50,361 I, I think, I think it's, it's just, it's one thing to have a discussion, 846 00:34:50,361 --> 00:34:58,911 again, going to Dr versus rr, um, is that it's one thing to go, well, what 847 00:34:58,911 --> 00:35:00,321 are the servers we're gonna do first? 848 00:35:00,326 --> 00:35:03,621 And what are, what are the servers that we're gonna do three hours later? 849 00:35:04,491 --> 00:35:06,711 It's a whole other thing to say, what are the servers we're gonna do the 850 00:35:06,711 --> 00:35:10,581 first couple of days, and what are the servers we're gonna do next week? 851 00:35:10,851 --> 00:35:11,331 Right. 852 00:35:11,571 --> 00:35:11,751 I, 853 00:35:11,811 --> 00:35:12,921 Melissa Palmer: And that, that's the problem, right? 854 00:35:12,921 --> 00:35:15,681 You don't know until it happens. 855 00:35:15,681 --> 00:35:19,911 Like if, if you, if it's your whole environment is done right. 856 00:35:20,181 --> 00:35:23,181 That is very different than, oh, we know, just, they just did this 857 00:35:23,181 --> 00:35:24,961 subset of servers or whatever. 858 00:35:24,961 --> 00:35:30,066 It's, and like we were, um, The company I worked for a company 859 00:35:30,066 --> 00:35:31,206 that I no longer worked there. 860 00:35:31,206 --> 00:35:34,956 It was a pr uh, I was a customer and they had a, a very, they were one of the first 861 00:35:34,956 --> 00:35:39,426 really, really big ransomware attacks in the news, and it was like a disaster. 862 00:35:39,426 --> 00:35:41,706 I was like, wow, I'm glad I'm not on the VMware team anymore 863 00:35:41,706 --> 00:35:42,996 there when this is going down. 864 00:35:42,996 --> 00:35:43,266 Right. 865 00:35:43,656 --> 00:35:47,466 Um, , but it really depends and you don't know what's gonna happen. 866 00:35:47,466 --> 00:35:49,656 The only thing you can do is be as prepared as possible, right? 867 00:35:49,656 --> 00:35:51,036 Test different recovery methods. 868 00:35:51,456 --> 00:35:55,536 Um, and I love RPOs and RTOs in saying that we can meet them under a testing 869 00:35:55,536 --> 00:35:58,986 scenario, but in the real world, we don't know that that's gonna happen. 870 00:36:00,296 --> 00:36:00,786 W. Curtis Preston: Yeah. 871 00:36:01,371 --> 00:36:03,801 Prasanna Malaiyandi: One of the things on the podcast we talked about a couple 872 00:36:03,801 --> 00:36:08,436 days ago was, Like Tom was mentioning, oh yeah, you just shut down your 873 00:36:08,436 --> 00:36:12,726 network and you start figuring out, okay, what was affected but in what? 874 00:36:12,786 --> 00:36:14,616 And you prevent everything go from going in and out. 875 00:36:14,621 --> 00:36:16,566 And I was like, but how do you communicate? 876 00:36:16,566 --> 00:36:16,836 Right? 877 00:36:16,836 --> 00:36:20,916 And he's like, yeah, make sure you have ahead of time, sort of use cell phones. 878 00:36:20,946 --> 00:36:21,996 iMessage can work. 879 00:36:21,996 --> 00:36:25,626 You can set up a separate Slack instance completely outside of 880 00:36:25,626 --> 00:36:27,546 the corporate environment, right? 881 00:36:27,956 --> 00:36:30,916 Whatever it is to keep that ongoing communications. 882 00:36:31,296 --> 00:36:34,086 Melissa Palmer: like, uh, how am I supposed to use Microsoft Teams to 883 00:36:34,086 --> 00:36:35,526 communicate with a security team? 884 00:36:35,706 --> 00:36:37,026 Well, that might be Office 365. 885 00:36:37,026 --> 00:36:38,706 That might be, okay, that's a bad example. 886 00:36:38,841 --> 00:36:40,941 W. Curtis Preston: Yeah, as long as you have a, as long as you have a, 887 00:36:40,946 --> 00:36:43,161 um, an internet connection, right? 888 00:36:43,881 --> 00:36:46,071 Um, which is pretty easy to get 889 00:36:46,161 --> 00:36:48,711 Melissa Palmer: but like who has people's phone numbers these days? 890 00:36:48,852 --> 00:36:51,197 W. Curtis Preston: people with incident response plans, that's who 891 00:36:51,247 --> 00:36:51,697 Melissa Palmer: yeah, that's 892 00:36:51,742 --> 00:36:54,622 Prasanna Malaiyandi: But But aren't there issues though, where ransomware 893 00:36:54,622 --> 00:36:58,822 actors might still have access to your Slack instance and be monitoring 894 00:36:58,822 --> 00:37:00,292 what's going on from an incident 895 00:37:00,292 --> 00:37:00,952 Melissa Palmer: I've seen that. 896 00:37:00,952 --> 00:37:01,762 I've seen that. 897 00:37:01,762 --> 00:37:04,792 I've seen, I have seen that happen where like, they still had access. 898 00:37:04,792 --> 00:37:05,392 It was teams. 899 00:37:05,397 --> 00:37:06,592 I think they still had access. 900 00:37:06,592 --> 00:37:10,102 They were watching the IR stuff happen as they were still in there hanging out. 901 00:37:10,107 --> 00:37:13,942 It's like, oh yeah, Y again, 902 00:37:14,032 --> 00:37:15,442 W. Curtis Preston: ransomware stuff is bad. 903 00:37:15,472 --> 00:37:18,412 Melissa, I'm just gonna take that stance. 904 00:37:18,727 --> 00:37:19,387 Melissa Palmer: bad. 905 00:37:19,387 --> 00:37:22,297 It's bad, and you don't know what's gonna happen until it happens. 906 00:37:22,297 --> 00:37:24,787 Which is why, and it ties back to incident response, right? 907 00:37:24,787 --> 00:37:28,177 And having an incident response firm on retainer that does this every day. 908 00:37:28,507 --> 00:37:28,747 Right? 909 00:37:28,747 --> 00:37:32,707 Because I, I don't care how good, even if, like, okay, let's say 910 00:37:32,707 --> 00:37:37,627 you drop Melissa into X, Y, Z company and you put her in charge. 911 00:37:38,092 --> 00:37:40,432 W. Curtis Preston: Do are you gonna repel down a rope from a helicopter? 912 00:37:40,432 --> 00:37:40,792 Because that 913 00:37:40,867 --> 00:37:43,117 Melissa Palmer: Yes, I'm gonna repel down a rope from a helicopter, 914 00:37:43,117 --> 00:37:46,927 drop me in, right, and say, Melissa, get ready for ransomware, 915 00:37:47,017 --> 00:37:48,727 and six months later you hit me. 916 00:37:49,717 --> 00:37:52,567 I would like to say that I'll be able to recover, but I don't know that. 917 00:37:53,902 --> 00:37:54,022 I don't know. 918 00:37:54,022 --> 00:37:58,402 That doesn't matter how good you are, you're not doing this every day, right? 919 00:37:58,462 --> 00:38:02,332 Like, so unless you're doing this every day, cuz every attack is different. 920 00:38:02,337 --> 00:38:04,372 It's gonna be like, what have these people seen in the other events? 921 00:38:04,377 --> 00:38:06,592 What, what ransomware gang have you been hit by? 922 00:38:06,592 --> 00:38:07,012 Right? 923 00:38:07,432 --> 00:38:10,402 So I can put everything into place that I think I will need 924 00:38:10,402 --> 00:38:11,362 to make sure that we recover. 925 00:38:11,362 --> 00:38:13,252 And yeah, honestly, we'd probably recover all our data. 926 00:38:13,252 --> 00:38:15,532 I don't know if we meet our RPOs and our tails. 927 00:38:15,702 --> 00:38:18,172 I, I, I'm pretty sure I could get all the data to the recoverable point, 928 00:38:18,172 --> 00:38:21,022 but what was Exfiltrated, how did they get in all that kind of stuff. 929 00:38:22,817 --> 00:38:24,127 you don't know, which is why you have to call the pros. 930 00:38:24,127 --> 00:38:25,537 You have to call the people that do this every day. 931 00:38:25,627 --> 00:38:31,717 Prasanna Malaiyandi: Is there sort of a standard ransomware recovery test, but. 932 00:38:32,752 --> 00:38:34,942 That kind of outlines like, Hey, here are the thing. 933 00:38:34,942 --> 00:38:38,182 Because I can imagine, say you can't afford, the pros 934 00:38:38,242 --> 00:38:39,382 say you can't afford the pros. 935 00:38:39,382 --> 00:38:39,742 Right? 936 00:38:40,402 --> 00:38:44,572 Is there sort of a, here are the testing scenarios you should be thinking 937 00:38:44,572 --> 00:38:48,022 about, or here are the things that sort of get shot in the head when a 938 00:38:48,022 --> 00:38:50,722 ransomware recovery or ransomware hits. 939 00:38:51,337 --> 00:38:54,817 Melissa Palmer: Um, Google tabletop exercises like ransomware recovery, 940 00:38:54,817 --> 00:38:56,587 disaster recovery, tabletop exercises. 941 00:38:56,592 --> 00:38:56,677 Right? 942 00:38:56,677 --> 00:38:57,517 That's a good place to start. 943 00:38:57,517 --> 00:39:00,157 I've thought about doing like a dungeon and dragon style type, 944 00:39:00,157 --> 00:39:01,387 like ransomware recovery thing. 945 00:39:01,387 --> 00:39:01,477 I 946 00:39:01,477 --> 00:39:02,587 Prasanna Malaiyandi: With the actual people. 947 00:39:02,587 --> 00:39:04,657 Yeah, with like you get the networking security 948 00:39:04,747 --> 00:39:06,787 Melissa Palmer: think that would be fun and useful. 949 00:39:06,787 --> 00:39:07,237 And you know what? 950 00:39:07,237 --> 00:39:09,547 When you make things fun, people actually pay a. 951 00:39:10,007 --> 00:39:10,427 Prasanna Malaiyandi: Yep. 952 00:39:10,697 --> 00:39:10,792 Melissa Palmer: right? 953 00:39:10,792 --> 00:39:14,872 So like, if I get you all in terms and be like, today we are going to talk 954 00:39:14,872 --> 00:39:19,192 about ransomware recovery and have a mock simulation of what would happen. 955 00:39:19,342 --> 00:39:23,932 Be like, okay, you're a Paladin, you're a warrior, uh, you're a ma. 956 00:39:24,982 --> 00:39:28,102 Uh, an adult black dragon just showed up and encrypted your VMs. 957 00:39:28,107 --> 00:39:28,792 What are you doing? 958 00:39:28,797 --> 00:39:29,212 Right? 959 00:39:29,362 --> 00:39:29,692 Like, 960 00:39:30,052 --> 00:39:32,662 you're gonna have so much fun, you're gonna remember it, and 961 00:39:32,662 --> 00:39:33,712 it's gonna work out a lot better. 962 00:39:33,787 --> 00:39:33,997 Prasanna Malaiyandi: Yeah. 963 00:39:35,617 --> 00:39:36,307 W. Curtis Preston: I like that. 964 00:39:36,337 --> 00:39:36,877 Yeah. 965 00:39:36,997 --> 00:39:40,537 Um, by the way, one of the things, you know, we talked a lot about prepping. 966 00:39:41,167 --> 00:39:44,527 One of the things that I think also in terms of, we talked 967 00:39:44,527 --> 00:39:45,937 about exfiltration monitoring. 968 00:39:46,537 --> 00:39:50,437 I also, uh, like the idea, and we talked about it on a couple of 969 00:39:50,437 --> 00:39:56,767 different episodes, this idea of, um, Something on your d n s side 970 00:39:56,917 --> 00:40:00,547 that would notice when you start talking to really weird domain names. 971 00:40:00,982 --> 00:40:01,942 Melissa Palmer: Yeah, that's a big one. 972 00:40:01,942 --> 00:40:03,082 And there's all these lists. 973 00:40:03,142 --> 00:40:08,302 Um, a lot of these researchers will just like tweet like, by the way, domains 974 00:40:08,302 --> 00:40:09,562 looking a little hot, a little suss. 975 00:40:09,567 --> 00:40:10,702 You might wanna block that stuff. 976 00:40:11,182 --> 00:40:13,792 Um, so yeah, there's these lists of these like known bad domains 977 00:40:13,792 --> 00:40:14,872 and ips and stuff like that too. 978 00:40:15,007 --> 00:40:15,457 W. Curtis Preston: Right. 979 00:40:15,907 --> 00:40:16,267 Yeah. 980 00:40:16,267 --> 00:40:21,097 And, and the other, uh, but I, I do think that if. 981 00:40:22,852 --> 00:40:28,492 If you implement exfiltration monitoring, if you have a specific exfiltration 982 00:40:28,492 --> 00:40:32,752 monitoring, I think you could stop mo or, or notice it quickly and stop it. 983 00:40:33,202 --> 00:40:37,552 Um, but what I'm hearing from others is that not everybody 984 00:40:37,552 --> 00:40:38,662 can afford such a thing. 985 00:40:39,112 --> 00:40:39,532 Right. 986 00:40:39,712 --> 00:40:41,492 Um, that, that, 987 00:40:41,572 --> 00:40:43,432 Melissa Palmer: lot of people can't afford it or they don't have the 988 00:40:43,492 --> 00:40:46,582 skill set to build it themselves, and you really wanna be building and 989 00:40:46,582 --> 00:40:47,932 maintaining your own security systems. 990 00:40:48,342 --> 00:40:48,622 Probably not. 991 00:40:49,117 --> 00:40:50,857 W. Curtis Preston: No, but a lot of people do, 992 00:40:51,382 --> 00:40:52,702 Melissa Palmer: Yeah, because they have no choice. 993 00:40:52,702 --> 00:40:53,482 It's better than nothing. 994 00:40:53,992 --> 00:40:56,242 Like I've done some weird stuff with some weird software because 995 00:40:56,242 --> 00:40:57,022 it was better than nothing. 996 00:40:57,532 --> 00:41:01,012 Um, it, it, it's really a difficult point to be in. 997 00:41:01,012 --> 00:41:05,902 And it's kind of like, you know, you all these people put out these, um, all 998 00:41:05,902 --> 00:41:08,572 these, uh, security companies will do all this research of like, here's the 999 00:41:08,577 --> 00:41:11,782 top ways they're getting in and blah, blah, blah, and all this kind of stuff. 1000 00:41:12,142 --> 00:41:13,852 Um, there's a lot of marketing that goes into it, but 1001 00:41:13,852 --> 00:41:14,962 there's a lot of truth, right? 1002 00:41:14,992 --> 00:41:15,862 So like, I. 1003 00:41:16,797 --> 00:41:18,997 . The big thing was the people for a long time, the people 1004 00:41:18,997 --> 00:41:20,467 let it in, you know, multi. 1005 00:41:20,947 --> 00:41:23,017 Where was it when, when this whole Cisco thing happened? 1006 00:41:23,017 --> 00:41:25,807 That was like, um, mfa, right? 1007 00:41:25,807 --> 00:41:27,847 They got in through their mfa cuz they kept spamming of them. 1008 00:41:27,847 --> 00:41:31,117 Eventually they said yes because like, stop calling me at 11 o'clock at night. 1009 00:41:31,837 --> 00:41:35,632 Um, . Now they're saying, oh, it's more vulnerabilities than people, right? 1010 00:41:35,632 --> 00:41:38,602 So honestly, I feel like the people might be easier to deal 1011 00:41:38,602 --> 00:41:39,772 with in the vulnerabilities. 1012 00:41:39,892 --> 00:41:40,312 I don't know. 1013 00:41:40,822 --> 00:41:43,492 Um, because then it's gonna be like testing the patches. 1014 00:41:43,497 --> 00:41:44,422 Can we patch everything? 1015 00:41:44,422 --> 00:41:45,442 Can we remediate everything? 1016 00:41:45,447 --> 00:41:48,892 It's, it's just like, what are the areas that you can find within your 1017 00:41:48,892 --> 00:41:53,962 own organization to be quick wins because you wanna prove that you can 1018 00:41:53,962 --> 00:41:57,232 win to your management so you get more money and can do more projects. 1019 00:41:57,232 --> 00:42:00,892 So you need like a balance of quick wins to prove progress and high. 1020 00:42:02,047 --> 00:42:02,062 right? 1021 00:42:02,067 --> 00:42:04,492 What are the things that I can implement that will have the 1022 00:42:04,492 --> 00:42:06,112 most impact to reduce the risk? 1023 00:42:06,112 --> 00:42:07,912 And you're never gonna get the risk to zero. 1024 00:42:07,912 --> 00:42:11,812 I, there's um, a lot of people say that, like assume breach, right? 1025 00:42:11,812 --> 00:42:14,422 Like assume they're gonna get in so we can do all this security stuff. 1026 00:42:14,427 --> 00:42:15,592 We can do all this backup. 1027 00:42:15,802 --> 00:42:18,292 And backup is basically assuming they're gonna get in, right? 1028 00:42:18,297 --> 00:42:21,052 Like, we're not backing this stuff up cuz we think our security is so great. 1029 00:42:21,052 --> 00:42:23,872 Like we're assuming that it's the last line of defense, we're gonna need it. 1030 00:42:24,652 --> 00:42:27,772 Um, so a lot of it is just trying to mitigate what you. 1031 00:42:29,047 --> 00:42:31,687 in a way that makes sense for your organization, because we can't have 1032 00:42:31,687 --> 00:42:35,467 everybody working 20 hour days doing this either, or they're gonna be too fried to 1033 00:42:35,467 --> 00:42:37,657 make mistakes and people are a problem. 1034 00:42:38,377 --> 00:42:39,547 Um, it, it's difficult. 1035 00:42:39,577 --> 00:42:41,197 It really is hard for any organization. 1036 00:42:41,197 --> 00:42:46,057 It's what can I do with what resources I have and cya, right? 1037 00:42:46,057 --> 00:42:50,047 If I'm, I'd probably be doing a lot of cya when, you know, they tell you 1038 00:42:50,047 --> 00:42:51,517 it's too expensive, you can't do that. 1039 00:42:51,517 --> 00:42:52,687 Well, you better have that documented. 1040 00:42:52,687 --> 00:42:54,907 So when you get ransomware, not like, Melissa, why didn't you 1041 00:42:54,907 --> 00:42:56,107 put in that security system? 1042 00:42:56,112 --> 00:42:57,127 You told me we didn't have the. 1043 00:42:57,472 --> 00:43:00,562 W. Curtis Preston: You don't know what's the current hot way that they're gonna, 1044 00:43:00,952 --> 00:43:02,122 they're, they're gonna attack you. 1045 00:43:02,362 --> 00:43:05,242 You can't stop all, uh, vulnerabilities. 1046 00:43:05,272 --> 00:43:10,942 You can't stop all stupid user things that stupid users are gonna do. 1047 00:43:11,512 --> 00:43:19,147 Um, and, um, And, and so you, I do think you, you have to assume breach, right? 1048 00:43:19,297 --> 00:43:23,467 And so you do have to do some things in your network that are going to 1049 00:43:23,467 --> 00:43:26,257 tell you when the bad guys are here. 1050 00:43:26,827 --> 00:43:29,587 Um, and that we stop it 1051 00:43:29,587 --> 00:43:31,117 as quickly as we can. 1052 00:43:31,797 --> 00:43:33,057 Melissa Palmer: Can we make a movie about this? 1053 00:43:33,057 --> 00:43:33,567 Please? 1054 00:43:34,227 --> 00:43:35,237 Like that would be really cool. 1055 00:43:35,307 --> 00:43:35,667 W. Curtis Preston: Nobody. 1056 00:43:35,967 --> 00:43:36,627 It'll only be 1057 00:43:36,782 --> 00:43:37,482 Melissa Palmer: I'm gonna watch it 1058 00:43:37,902 --> 00:43:40,572 I'm gonna have chat, G b T, write me a movie. 1059 00:43:40,692 --> 00:43:42,672 I've had to write me ransomware, hallmark movies. 1060 00:43:42,672 --> 00:43:46,542 I kid you not, I'm just saying 1061 00:43:47,412 --> 00:43:48,402 have to entertain myself. 1062 00:43:48,402 --> 00:43:48,792 How now? 1063 00:43:49,257 --> 00:43:49,647 Prasanna Malaiyandi: Wait, 1064 00:43:49,812 --> 00:43:51,612 W. Curtis Preston: my wife would watch it if we make it a 1065 00:43:52,042 --> 00:43:54,672 krama, make it a Korean drama. 1066 00:43:54,912 --> 00:43:55,602 Um, 1067 00:43:55,782 --> 00:43:56,022 Melissa Palmer: be good. 1068 00:43:56,022 --> 00:43:57,732 Or like a Bollywood ransomware story. 1069 00:43:57,792 --> 00:44:00,942 W. Curtis Preston: yeah, I, there was a ransomware attack and a 1070 00:44:00,972 --> 00:44:03,762 krama that, uh, I dunno if you saw, there's one called Startup. 1071 00:44:04,422 --> 00:44:08,952 Um, and, uh, there, there's a, there's a, a really big 1072 00:44:08,952 --> 00:44:11,202 incubator in Korea in this movie. 1073 00:44:11,532 --> 00:44:15,912 Um, and this group of people, they, they do a startup there and. 1074 00:44:16,437 --> 00:44:19,197 Right at the crucial moment they get, they get a ransomware attack. 1075 00:44:19,617 --> 00:44:23,607 Um, and, and it was because some people did some dumb stuff. 1076 00:44:23,607 --> 00:44:25,497 They cut some corners, you know, and so they got 1077 00:44:26,262 --> 00:44:26,532 Prasanna Malaiyandi: They got. 1078 00:44:26,757 --> 00:44:28,197 W. Curtis Preston: and the tech wasn't bad. 1079 00:44:28,677 --> 00:44:29,127 Right. 1080 00:44:29,217 --> 00:44:33,537 Um, there, I, I've actually seen a lot of, there was, uh, the good 1081 00:44:33,537 --> 00:44:38,937 doctor, that's the one with the guy that has, he's on the spectrum anyway. 1082 00:44:38,937 --> 00:44:39,657 They got, they got, 1083 00:44:39,832 --> 00:44:40,192 Melissa Palmer: episode 1084 00:44:40,227 --> 00:44:41,457 W. Curtis Preston: they got, they got a ransomware 1085 00:44:41,457 --> 00:44:42,027 attack. 1086 00:44:42,492 --> 00:44:42,972 Melissa Palmer: Grey's Anatomy 1087 00:44:43,017 --> 00:44:44,757 W. Curtis Preston: Uh, Grey's Anatomy did one. 1088 00:44:44,847 --> 00:44:47,907 Uh, the good doctor did one and the tech wasn't bad. 1089 00:44:48,357 --> 00:44:48,777 Right. 1090 00:44:48,837 --> 00:44:52,527 Uh, I just, I just hate it when it's like, like when you watch, I dunno if you 1091 00:44:52,527 --> 00:44:54,237 ever watch, did you ever watch the Net? 1092 00:44:54,912 --> 00:44:55,482 Melissa Palmer: Yeah. 1093 00:44:55,572 --> 00:44:56,022 Yeah. 1094 00:44:56,127 --> 00:44:56,547 Prasanna Malaiyandi: Yep. 1095 00:44:56,547 --> 00:44:57,027 W. Curtis Preston: That tech 1096 00:44:57,132 --> 00:45:00,402 Melissa Palmer: Look, all I know is I was, I don't know, maybe there's some 1097 00:45:00,402 --> 00:45:03,942 Hallmark movies going on in my house and it was on in the other room when I was 1098 00:45:03,942 --> 00:45:05,382 cooking dinner and my ears perked up. 1099 00:45:05,387 --> 00:45:08,772 Cause I heard something about an engineer and it was the dude who was the engineer. 1100 00:45:08,832 --> 00:45:10,872 I was like, oh, I had hopes for this one. 1101 00:45:10,872 --> 00:45:15,252 So Hallmark, if you are listening to this, I would love to be your female 1102 00:45:15,257 --> 00:45:18,012 lead in a I think that would be so much. 1103 00:45:19,842 --> 00:45:20,922 Come on, come on. 1104 00:45:21,282 --> 00:45:22,002 Happy ending. 1105 00:45:22,002 --> 00:45:23,292 They, we, we recover from 1106 00:45:23,437 --> 00:45:25,557 W. Curtis Preston: question is, how can you incorporate a small 1107 00:45:25,557 --> 00:45:29,637 town with a business that's, you know, on its last legs? 1108 00:45:29,667 --> 00:45:29,787 And 1109 00:45:29,832 --> 00:45:30,462 Melissa Palmer: Totally. 1110 00:45:30,582 --> 00:45:30,912 Prasanna Malaiyandi: That would 1111 00:45:30,912 --> 00:45:31,482 work. 1112 00:45:31,512 --> 00:45:32,002 Yeah. 1113 00:45:32,127 --> 00:45:34,797 W. Curtis Preston: instead of a ran, instead of a, uh, you know, a big 1114 00:45:34,797 --> 00:45:37,977 bookstore coming into town to shut down your little bookstore, it's 1115 00:45:38,337 --> 00:45:41,547 the ransomware attack shuts down the little, the little bookstore in 1116 00:45:41,682 --> 00:45:43,152 Prasanna Malaiyandi: Or it could be at a doctor's 1117 00:45:43,197 --> 00:45:43,767 W. Curtis Preston: And, 1118 00:45:44,232 --> 00:45:44,622 Melissa Palmer: Yeah. 1119 00:45:45,492 --> 00:45:46,422 Or local hospital. 1120 00:45:46,422 --> 00:45:47,352 We could do local hospital. 1121 00:45:47,352 --> 00:45:47,872 That would be fine. 1122 00:45:48,642 --> 00:45:50,682 Small town hospital only thing for miles. 1123 00:45:51,432 --> 00:45:56,082 W. Curtis Preston: It's, it's the big city girl that knows, um, that knows 1124 00:45:56,082 --> 00:45:58,032 about ransomware to rescue the little 1125 00:45:58,092 --> 00:46:01,302 Melissa Palmer: big city girl, leaves her job at a software company, goes back 1126 00:46:01,302 --> 00:46:04,542 to her hometown to go out on her own. 1127 00:46:05,652 --> 00:46:05,982 just 1128 00:46:06,102 --> 00:46:09,762 W. Curtis Preston: Um, can you tell I've seen a Hallmark movie or show a show 1129 00:46:09,777 --> 00:46:11,352 Melissa Palmer: I, it's my guilty pleasure. 1130 00:46:11,422 --> 00:46:15,772 I'm just gonna say that, uh, around Christmas there was a thing going around. 1131 00:46:15,772 --> 00:46:18,622 It was like Hallmark movie generator, and I looked at it 1132 00:46:18,622 --> 00:46:20,062 and I went, this is my life. 1133 00:46:20,122 --> 00:46:20,932 Oh my goodness. 1134 00:46:20,932 --> 00:46:22,342 I'm a Hallmark movie. 1135 00:46:22,372 --> 00:46:23,842 This is so cool. 1136 00:46:24,442 --> 00:46:28,072 W. Curtis Preston: They are kind of predictable as storylines, but, but yet 1137 00:46:28,072 --> 00:46:30,442 they've yet to have a ransomware attack. 1138 00:46:30,817 --> 00:46:31,357 Melissa Palmer: Come on. 1139 00:46:31,852 --> 00:46:32,602 W. Curtis Preston: I'm behind that. 1140 00:46:33,727 --> 00:46:34,087 Yeah. 1141 00:46:35,377 --> 00:46:39,097 Well on that note, um, speaking of disappointing, um, you 1142 00:46:39,097 --> 00:46:41,977 know, if you folks like this 1143 00:46:41,977 --> 00:46:42,997 episode, I think there's 1144 00:46:42,997 --> 00:46:47,407 some, I, uh, uh, I think, no, I think this was a good episode. 1145 00:46:47,437 --> 00:46:49,987 Um, and I like, I think, you know, we covered a lot. 1146 00:46:50,197 --> 00:46:51,307 We also had a little bit of fun. 1147 00:46:51,367 --> 00:46:51,967 I love that. 1148 00:46:51,967 --> 00:46:55,587 That's actually my favorite kind of episode where we, if it's just straight 1149 00:46:55,592 --> 00:46:57,217 talk the whole time, it's boring. 1150 00:46:57,457 --> 00:46:58,987 Um, and. 1151 00:46:59,992 --> 00:47:00,982 This was good. 1152 00:47:01,012 --> 00:47:02,062 Uh, good, good. 1153 00:47:02,062 --> 00:47:03,022 Smattering of both. 1154 00:47:03,652 --> 00:47:07,672 So, um, I think the one thing we're getting away from this is the best way 1155 00:47:07,672 --> 00:47:11,452 to respond to a ransomware attack is to respond to it before it happens. 1156 00:47:11,767 --> 00:47:12,277 Melissa Palmer: Yes. 1157 00:47:12,682 --> 00:47:13,132 W. Curtis Preston: Right. 1158 00:47:13,372 --> 00:47:17,722 Talk to people, talk to, you know, talk to a incident response team. 1159 00:47:17,722 --> 00:47:20,002 A cyber insurance company's a good way to get one of those. 1160 00:47:20,302 --> 00:47:26,992 Um, you know, uh, do all the, the, those, the ransomware recovery scenarios, right? 1161 00:47:26,992 --> 00:47:31,132 All the different scenarios from a, the, the backup and recovery standpoint, right? 1162 00:47:31,192 --> 00:47:36,862 Um, and, um, and do some kind of monitoring, logging, logging. 1163 00:47:38,107 --> 00:47:40,447 Saving your logs, getting the logs, logging log. 1164 00:47:40,957 --> 00:47:42,707 I can't, I can't say that. 1165 00:47:43,817 --> 00:47:44,647 I can't say it that 1166 00:47:44,662 --> 00:47:45,112 Prasanna Malaiyandi: lugging. 1167 00:47:45,967 --> 00:47:47,047 W. Curtis Preston: Yeah, log, logging. 1168 00:47:47,047 --> 00:47:48,307 Logging, I can't, I don't know. 1169 00:47:48,547 --> 00:47:50,197 My tongue doesn't do that anyway. 1170 00:47:50,257 --> 00:47:55,807 Um, and then also some kind of monitoring for what's going on in your environment. 1171 00:47:55,897 --> 00:47:59,427 That would set off alarms when a ransomware. 1172 00:48:00,082 --> 00:48:02,032 You know, initial phase is happening. 1173 00:48:02,272 --> 00:48:05,662 Uh, cuz that's the key to start to stopping it, is to stop it 1174 00:48:05,752 --> 00:48:05,962 Melissa Palmer: Yep. 1175 00:48:05,967 --> 00:48:06,172 Get it. 1176 00:48:06,657 --> 00:48:07,147 Prasanna Malaiyandi: Yeah, 1177 00:48:07,552 --> 00:48:08,212 W. Curtis Preston: absolutely. 1178 00:48:08,992 --> 00:48:10,012 Well, thanks Melissa 1179 00:48:10,477 --> 00:48:11,047 Melissa Palmer: Thank you. 1180 00:48:12,202 --> 00:48:15,172 W. Curtis Preston: and uh, thanks Prasanna despite the fact that you were the 1181 00:48:15,172 --> 00:48:16,612 cause of all of our technical problems. 1182 00:48:17,407 --> 00:48:18,337 Prasanna Malaiyandi: I'm sorry. 1183 00:48:18,367 --> 00:48:19,387 Hopefully not. 1184 00:48:19,447 --> 00:48:20,287 Melissa Palmer: Sounds like a Hallmark 1185 00:48:20,572 --> 00:48:20,722 Prasanna Malaiyandi: I 1186 00:48:20,737 --> 00:48:22,117 Melissa Palmer: Sounds like a Hallmark movie, just saying 1187 00:48:22,302 --> 00:48:23,142 W. Curtis Preston: We'll see this. 1188 00:48:23,722 --> 00:48:26,602 Prasanna Malaiyandi: Thanks Curtis, and enjoy your vacation, Curtis, and 1189 00:48:26,602 --> 00:48:28,222 thanks Melissa for joining us again. 1190 00:48:28,797 --> 00:48:29,427 Melissa Palmer: my pleasure. 1191 00:48:29,902 --> 00:48:32,632 W. Curtis Preston: All right, and thanks to our listeners, uh, you know, you're 1192 00:48:32,632 --> 00:48:36,982 the reason we do this, and be sure to subscribe so that you can restore it all.