1 00:00:00,000 --> 00:00:04,380 You found the backup wrap up your go-to podcast for all things 2 00:00:04,380 --> 00:00:07,140 backup recovery and cyber recovery. 3 00:00:07,620 --> 00:00:12,240 In this episode, we tackled the critical challenge of detecting ransomware 4 00:00:12,240 --> 00:00:15,179 before it wreaks havoc on your systems. 5 00:00:15,600 --> 00:00:16,559 I've got Dr. 6 00:00:16,559 --> 00:00:20,130 Mike Saylor from Black Swan Security here to break down the 7 00:00:20,130 --> 00:00:24,119 various tools and techniques that you need to know about from XDR 8 00:00:24,119 --> 00:00:25,980 to Soar and everything in between. 9 00:00:26,640 --> 00:00:31,650 We're diving into real world examples of how ransomware gets spotted, 10 00:00:32,070 --> 00:00:36,239 what signs to watch for and why you might want to think twice about 11 00:00:36,239 --> 00:00:37,679 handling this stuff on your own. 12 00:00:38,550 --> 00:00:43,140 Of course, Prasanna joins us too as we explore why that weird network traffic 13 00:00:43,410 --> 00:00:45,360 might be more sinister than you think. 14 00:00:46,244 --> 00:00:51,224 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 15 00:00:51,224 --> 00:00:56,564 Backup, and I've been passionate about backup and recovery for over 30 years. 16 00:00:56,894 --> 00:00:57,494 Ever since. 17 00:00:57,494 --> 00:01:01,094 I had to tell my boss that we had no backups of the production 18 00:01:01,094 --> 00:01:03,164 database that we had just lost. 19 00:01:03,164 --> 00:01:03,224 I. 20 00:01:03,689 --> 00:01:07,619 I don't want that to happen to you, and that's why I do this podcast. 21 00:01:08,129 --> 00:01:13,379 On this podcast, we turn unappreciated backup admins into Cyber recovery heroes. 22 00:01:13,710 --> 00:01:15,754 This is the backup wrap up. 23 00:01:29,998 --> 00:01:30,813 Welcome to the show. 24 00:01:31,663 --> 00:01:37,183 If I could ask you to take a quick second and subscribe or follow us wherever 25 00:01:37,183 --> 00:01:38,983 you watch or listen to the podcast. 26 00:01:38,983 --> 00:01:42,703 Remember, you can watch us on YouTube or you can follow us on 27 00:01:42,703 --> 00:01:46,903 any of your favorite, uh, podcast platforms, uh, with the same name. 28 00:01:47,173 --> 00:01:48,433 Uh, the backup wrap up. 29 00:01:49,123 --> 00:01:51,583 I am w Curtis Preston, AKA, Mr. 30 00:01:51,583 --> 00:01:54,763 Backup, and I have with me a guy who just for some reason wants 31 00:01:54,763 --> 00:01:59,213 to know how, how much, how much Dexter I watch Prasanna Malaiyandi. 32 00:01:59,233 --> 00:01:59,683 How's it going? 33 00:01:59,683 --> 00:02:00,333 Prasanna. 34 00:02:00,573 --> 00:02:01,863 I am good, Curtis. 35 00:02:01,863 --> 00:02:02,163 Yeah. 36 00:02:02,163 --> 00:02:04,413 Uh, Dexter is a great show. 37 00:02:04,413 --> 00:02:06,213 It's been a while since I've watched it. 38 00:02:06,213 --> 00:02:06,303 I've, I. 39 00:02:07,258 --> 00:02:07,948 Here's the thing. 40 00:02:08,008 --> 00:02:10,588 Some shows I'll go back and rewatch 41 00:02:10,978 --> 00:02:11,698 some shows. 42 00:02:11,698 --> 00:02:14,788 I'm kind of on the fence whether I wanna go back and dedicate 43 00:02:14,788 --> 00:02:16,168 that much time to watching. 44 00:02:16,378 --> 00:02:16,528 And 45 00:02:16,528 --> 00:02:17,908 there are some really, really good shows. 46 00:02:17,908 --> 00:02:20,848 Like I know you just recently Rewatched Breaking Bad. 47 00:02:21,253 --> 00:02:21,613 Yeah, 48 00:02:21,718 --> 00:02:25,228 are currently rewatching West Wing at the same time that you are 49 00:02:25,228 --> 00:02:26,128 watching Dexter. 50 00:02:26,683 --> 00:02:27,253 yeah, 51 00:02:28,033 --> 00:02:28,213 there 52 00:02:28,263 --> 00:02:29,668 And I totally get it. 53 00:02:29,668 --> 00:02:33,598 But yeah, it's just one of those things like, it's such an amazing show. 54 00:02:33,598 --> 00:02:34,378 I don't wanna be. 55 00:02:35,803 --> 00:02:37,843 I don't wanna ruin that memory that I have. 56 00:02:37,993 --> 00:02:39,198 The first time I watched the show. 57 00:02:40,663 --> 00:02:42,328 It is a really good show. 58 00:02:42,418 --> 00:02:45,508 Um, it, it's a very dark show, right? 59 00:02:45,598 --> 00:02:49,618 Um, you know, I tell people, you know, you, you have to ask yourself 60 00:02:49,618 --> 00:02:53,578 whether or not you think you could root for a serial killer, right? 61 00:02:54,463 --> 00:02:58,123 If you don't think in your wildest imagination that you could root for a 62 00:02:58,123 --> 00:03:00,463 serial killer, it's probably not for you. 63 00:03:00,973 --> 00:03:05,533 Um, even if he's a good serial killer, um, you know, with a code. 64 00:03:05,953 --> 00:03:09,883 Um, although, you know, in the episodes that I'm starting to get 65 00:03:09,883 --> 00:03:11,443 to, he's starting to break the code. 66 00:03:11,893 --> 00:03:12,708 No spoilers. 67 00:03:13,543 --> 00:03:14,383 Yeah. 68 00:03:14,413 --> 00:03:20,983 Anyway, um, spoilers, but, um, but yeah, every time I talk to you, you're like, uh, 69 00:03:21,043 --> 00:03:22,933 how many episodes of Dexter did you watch? 70 00:03:24,583 --> 00:03:29,713 It does give you some great ideas on potentially how to get away with a murder. 71 00:03:30,753 --> 00:03:31,043 Yeah, 72 00:03:31,213 --> 00:03:31,993 Just saying. 73 00:03:32,008 --> 00:03:36,298 that's why, that's why, uh, I, I had somebody heard, so, you know, like 74 00:03:36,508 --> 00:03:41,038 for some reason women really like the, like the murder podcasts, right? 75 00:03:41,338 --> 00:03:44,488 And, and guys are like, yeah, it's training. 76 00:03:47,533 --> 00:03:52,603 But anyway, uh, it's time to bring on our, uh, our guest. 77 00:03:52,603 --> 00:03:57,253 Once again, our resident cybersecurity expert, CEO of Black Swan Security. 78 00:03:57,523 --> 00:03:58,733 Mike Saylor. 79 00:03:58,753 --> 00:03:59,563 How's it going, Mike? 80 00:03:59,923 --> 00:04:00,853 It is going well guys. 81 00:04:01,183 --> 00:04:01,963 Thanks for having me. 82 00:04:03,068 --> 00:04:04,363 Do you watch Dexter? 83 00:04:05,083 --> 00:04:07,273 I've watched, I've watched some Dexter. 84 00:04:07,273 --> 00:04:11,623 I, it's, it's not, uh, it's not on my binge list, but I've, I've watched it. 85 00:04:12,973 --> 00:04:14,563 It's a good, it's a good show. 86 00:04:14,663 --> 00:04:17,423 But hey, we're not here to talk about death and dismemberment. 87 00:04:17,423 --> 00:04:21,053 We're talking, talking about something just as horrible ransomware. 88 00:04:21,623 --> 00:04:22,433 Um. 89 00:04:22,898 --> 00:04:25,118 Uh, you know, how's it, how's it been going? 90 00:04:25,118 --> 00:04:28,178 You, you've been, I don't know, the last time I talked to you, you were 91 00:04:28,598 --> 00:04:32,588 knee deep in, in an incident, but that's probably, uh, a Tuesday for you. 92 00:04:33,428 --> 00:04:34,898 Uh, it's usually Thursdays, 93 00:04:35,558 --> 00:04:36,398 Yeah. 94 00:04:36,788 --> 00:04:36,908 Oh, 95 00:04:37,058 --> 00:04:37,988 guy, bad guys. 96 00:04:37,988 --> 00:04:40,868 You know, talking about, uh, bad guys with, with ethics, they try to 97 00:04:40,868 --> 00:04:42,278 give you the benefit of the weekend, 98 00:04:43,748 --> 00:04:44,678 So nice of the. 99 00:04:45,008 --> 00:04:45,488 Yeah. 100 00:04:45,638 --> 00:04:45,998 Yeah. 101 00:04:47,298 --> 00:04:51,918 Do you, do you ever get weekends off or are you often, you know, in the, 102 00:04:52,068 --> 00:04:53,393 in the throes of one of these things? 103 00:04:55,143 --> 00:04:58,233 No, there, there's quite a few weekends off. 104 00:04:58,263 --> 00:05:04,173 Um, depending on how well prepared, uh, an organization is, you know, if 105 00:05:04,173 --> 00:05:08,013 it happens on Thursday and yeah, there, there's some things that they'll have 106 00:05:08,013 --> 00:05:10,888 to address maybe over the weekend, but for the most part you can get 'em. 107 00:05:11,648 --> 00:05:11,768 I. 108 00:05:11,913 --> 00:05:16,593 Get 'em secured and triaged, uh, you know, midnight Friday night and, you know, they 109 00:05:16,593 --> 00:05:20,613 may have to rebuild re-image and redeploy over the weekend, but that's, that's kind 110 00:05:20,613 --> 00:05:23,403 of, uh, you know, the incident response. 111 00:05:23,403 --> 00:05:27,903 Uh, specialists and leads have, have done their job and putting the fire out. 112 00:05:28,593 --> 00:05:34,233 Um, so it's, it's usually a, we get a call on Thursday and we work the weekend. 113 00:05:34,713 --> 00:05:38,253 We get a call on Thursday and we're, we, we try to get it. 114 00:05:38,793 --> 00:05:42,963 Handled by the weekend, or we get a call during the weekend. 115 00:05:43,623 --> 00:05:48,663 Uh, so some Sunday afternoon is another good, uh, another common phone call. 116 00:05:49,383 --> 00:05:53,973 Um, so, you know, if, if the Cowboys are playing, that's a good distraction. 117 00:05:54,333 --> 00:05:57,543 Uh, I'd rather, I'd rather, I'd rather deal with ransomware than watch 118 00:05:57,543 --> 00:06:00,183 that game, uh, in a lot of cases. 119 00:06:00,963 --> 00:06:01,563 So, no. 120 00:06:01,818 --> 00:06:04,158 you, at least you have a football team. 121 00:06:04,188 --> 00:06:05,388 I live in San Diego. 122 00:06:05,388 --> 00:06:07,188 We used to have a football team. 123 00:06:07,188 --> 00:06:12,888 They moved up to Los Angeles and um, I, I call 'em the who, you know, 124 00:06:13,308 --> 00:06:15,798 if people are like, oh, do you, do you still follow the chargers? 125 00:06:15,798 --> 00:06:16,758 And I'm like, the who? 126 00:06:18,513 --> 00:06:18,863 Right. 127 00:06:21,048 --> 00:06:21,288 Yeah. 128 00:06:21,288 --> 00:06:22,548 So at least you got a team. 129 00:06:22,838 --> 00:06:25,118 So this week I wanted to talk about. 130 00:06:25,883 --> 00:06:30,983 The actual phase or you know, whatever the things that we need to 131 00:06:30,983 --> 00:06:34,103 do in order to detect ransomware. 132 00:06:34,493 --> 00:06:39,053 And I remember talking about this a little bit with you before, but can 133 00:06:39,053 --> 00:06:47,393 you, um, aside from like a, a SEIM/SOAR tool, sort of going off and noticing 134 00:06:47,393 --> 00:06:52,793 something, can you think of weird things that have happened in people's 135 00:06:52,793 --> 00:06:54,743 environments where it ended up being. 136 00:06:56,333 --> 00:06:59,393 The ultimate thing was they were actually under a ransomware attack. 137 00:06:59,393 --> 00:07:00,023 You know what I'm saying? 138 00:07:00,023 --> 00:07:05,153 Like, like for some reason the, you know, the company dishwasher stopped working 139 00:07:05,153 --> 00:07:10,073 and uh, you have weird stories like that. 140 00:07:10,958 --> 00:07:12,098 Uh, I, I do. 141 00:07:12,188 --> 00:07:15,368 And so there, there are, there are, there's malware. 142 00:07:15,368 --> 00:07:17,708 There's a category of malware called polymorphic. 143 00:07:17,738 --> 00:07:19,538 So it, it, it changes. 144 00:07:20,228 --> 00:07:24,638 Uh, some of that change depends on what the malware 145 00:07:24,638 --> 00:07:26,918 has identified as, as its host. 146 00:07:27,563 --> 00:07:29,633 And so there, there is a strain. 147 00:07:29,753 --> 00:07:33,383 There are strains of malware that are specific to certain, you know, they're, 148 00:07:33,383 --> 00:07:37,313 they're targeting specific, uh, devices. 149 00:07:37,973 --> 00:07:40,373 Um, we saw this with stuck net. 150 00:07:40,583 --> 00:07:44,543 Uh, we saw it with, uh, point of sale specific malware. 151 00:07:44,948 --> 00:07:49,673 Uh, and now there's ransomware that is looking for specific. 152 00:07:51,098 --> 00:07:52,538 Uh, specific hosts. 153 00:07:52,658 --> 00:07:56,708 It doesn't want to trigger the ransomware on, on an invaluable host. 154 00:07:56,708 --> 00:07:59,678 Like, I don't care if that's got ransomware, just throw it out the window. 155 00:08:00,338 --> 00:08:03,788 Uh, but, and then tip, its, tip its cards to what it, you know, 156 00:08:03,788 --> 00:08:04,988 the, the attackers are doing. 157 00:08:04,988 --> 00:08:08,918 They don't want to trigger the alarms before the, the, the jewels are stolen. 158 00:08:09,458 --> 00:08:12,728 So there, there are kind of your, your. 159 00:08:13,358 --> 00:08:15,698 Your analogy to the dishwasher's not working anymore. 160 00:08:15,698 --> 00:08:19,538 If it's a smart dishwasher, it could very well start to malfunction or perform 161 00:08:19,538 --> 00:08:24,818 poorly if malware is interrogating it to determine if it's its target. 162 00:08:25,703 --> 00:08:28,193 Uh, there's even malware, uh, the ransomware that, 163 00:08:28,193 --> 00:08:29,573 that cleans up after itself. 164 00:08:29,573 --> 00:08:32,603 So maybe it gets to the dishwasher and decides, well, this is a 165 00:08:32,603 --> 00:08:34,523 dishwasher and it moves on. 166 00:08:34,523 --> 00:08:36,023 Well, as it moves on, it deletes. 167 00:08:36,023 --> 00:08:37,763 Its, you know, it cleans up after itself. 168 00:08:37,763 --> 00:08:40,493 So when you go look at the, at the dishwasher, you, you're like, I 169 00:08:40,493 --> 00:08:41,843 don't, I don't know what caused that. 170 00:08:42,383 --> 00:08:42,833 But, 171 00:08:42,968 --> 00:08:44,228 Seems to be working fine now. 172 00:08:44,633 --> 00:08:48,893 more, more often than not, it's, it's user feedback about, you 173 00:08:48,893 --> 00:08:50,273 know, complaining about their. 174 00:08:51,273 --> 00:08:54,503 their computer running slowly, or, you know, I can't watch 175 00:08:54,503 --> 00:08:56,213 Netflix at lunch anymore. 176 00:08:56,663 --> 00:08:57,353 Um, 177 00:08:58,133 --> 00:08:58,763 Dexter. 178 00:08:58,793 --> 00:08:59,668 No Dexter at lunch. 179 00:09:00,143 --> 00:09:00,593 right. 180 00:09:00,593 --> 00:09:04,823 So it it's usually it's system, you know, performance degradation or, or. 181 00:09:05,438 --> 00:09:06,818 Um, just weird stuff. 182 00:09:06,818 --> 00:09:11,498 Symptoms, uh, weird symptomatic stuff that usually get, uh, you get 183 00:09:11,498 --> 00:09:15,308 notifications on to determine, well, that's weird, but then you go look 184 00:09:15,308 --> 00:09:16,268 at it and there's nothing there. 185 00:09:16,268 --> 00:09:19,628 Well, it's, well forensically you can still see some stuff, but at 186 00:09:19,628 --> 00:09:21,908 the, you know, kind of the, the surface level, you're like, I 187 00:09:21,908 --> 00:09:23,198 don't, there's no malware here. 188 00:09:23,918 --> 00:09:24,428 Um. 189 00:09:24,473 --> 00:09:28,733 but in that case though, like I'm guessing that that user would call 190 00:09:28,733 --> 00:09:32,243 their IT help desk and the IT TA person would probably take a look and 191 00:09:32,243 --> 00:09:33,683 be like, oh yeah, nothing happened. 192 00:09:34,013 --> 00:09:35,753 And then they'd probably just close it and move on. 193 00:09:35,753 --> 00:09:36,143 Right. 194 00:09:36,683 --> 00:09:40,103 Very like does, how often does it really get escalated? 195 00:09:40,103 --> 00:09:41,453 Be like, Hey, that seems weird. 196 00:09:41,453 --> 00:09:45,053 Let's figure out like, is there a security issue or something else? 197 00:09:45,558 --> 00:09:49,253 It, it, the, the frequency or the, or I guess the likelihood that that 198 00:09:49,253 --> 00:09:53,093 gets escalated is, is almost directly related to whether or not they've 199 00:09:53,093 --> 00:09:54,353 had to deal with it in the past. 200 00:09:54,953 --> 00:09:57,773 So if you've had ransomware, you're a little more diligent and 201 00:09:57,773 --> 00:09:59,753 suspicious of weird stuff happening. 202 00:09:59,753 --> 00:10:02,153 Like, all right, well we've had, we don't wanna go through that again. 203 00:10:02,663 --> 00:10:06,713 Uh, I'm gonna, I'm gonna take every call about weird stuff happening as 204 00:10:06,713 --> 00:10:11,093 if it might be ransomware or some other malware versus an environment 205 00:10:11,093 --> 00:10:14,813 where maybe they haven't had the, put a fire out or go through that. 206 00:10:14,813 --> 00:10:17,573 They're, they're, they're a little more skeptical about, you 207 00:10:17,573 --> 00:10:18,863 know, that's just user error. 208 00:10:18,863 --> 00:10:21,323 Or, you know, it's, it's Tuesday. 209 00:10:21,863 --> 00:10:22,343 Uh. 210 00:10:22,973 --> 00:10:28,103 do and do anybody, um, does anybody ever report actually seeing, like 211 00:10:28,673 --> 00:10:30,953 someone taking over their desktop? 212 00:10:30,953 --> 00:10:34,103 Like they're, they happen to see mouses moving around or 213 00:10:34,103 --> 00:10:35,423 windows opening and closing? 214 00:10:35,423 --> 00:10:36,233 Do they see that? 215 00:10:36,923 --> 00:10:43,313 We have, we have worked a few, uh, one was a, a water district, um, where they 216 00:10:43,313 --> 00:10:47,753 thought they were compromised because the mouse was moving and stuff was happening. 217 00:10:48,353 --> 00:10:48,803 Uh. 218 00:10:49,568 --> 00:10:52,538 So we, we've seen that report that that particular incident turned 219 00:10:52,538 --> 00:10:56,198 out to be, you know, Bob took the day off but forgot to do something. 220 00:10:56,198 --> 00:10:59,198 So he logged in and everybody thought Bob was not there. 221 00:10:59,198 --> 00:11:00,728 And so why is this mouse moving? 222 00:11:01,358 --> 00:11:04,088 Uh, so that turned out to be kind of funny, but, 223 00:11:04,178 --> 00:11:06,848 What we have here is a failure to communicate. 224 00:11:06,908 --> 00:11:07,298 right. 225 00:11:07,598 --> 00:11:11,073 Um, but then there's other cases, and this is actually a a what. 226 00:11:11,903 --> 00:11:14,843 In, in the, in a corporate environment, we don't see it as often. 227 00:11:14,993 --> 00:11:19,553 Uh, but small businesses and individuals often get scammed into the hole. 228 00:11:19,553 --> 00:11:23,093 You've got a virus call this phone number, we then remote access into your 229 00:11:23,093 --> 00:11:27,773 machine and then, you know, their access persists or, or something else happened 230 00:11:27,773 --> 00:11:29,753 to, to drive that, that weird behavior. 231 00:11:30,413 --> 00:11:33,833 Uh, but in a corporate environment, well, you know what, I, I take that back. 232 00:11:34,553 --> 00:11:36,683 So the other problem that we've run into. 233 00:11:37,493 --> 00:11:40,133 Uh, is managed service providers. 234 00:11:40,133 --> 00:11:43,133 So you've got this one company that, that supports the, you 235 00:11:43,133 --> 00:11:44,603 know, technology to some degree. 236 00:11:44,603 --> 00:11:47,603 Whether it's everything, uh, servers and workstations and 237 00:11:47,603 --> 00:11:49,193 help desk is all outsourced. 238 00:11:49,523 --> 00:11:53,723 Or it's some something specific like a, like a core processing server 239 00:11:53,723 --> 00:11:57,923 that does your financials if you're a credit union at, so you have 240 00:11:57,923 --> 00:11:59,813 this one, one to many relationship. 241 00:11:59,813 --> 00:12:03,168 You've got this one company that supports many clients and. 242 00:12:03,953 --> 00:12:05,903 Uh, just human nature. 243 00:12:05,903 --> 00:12:08,063 We wanna make sure that that's as easy as possible. 244 00:12:08,063 --> 00:12:12,143 So what we found were what we call cons, uh, coincidental passwords. 245 00:12:12,143 --> 00:12:15,023 So this one vendor uses the same credentials to log 246 00:12:15,023 --> 00:12:16,703 into all of their clients. 247 00:12:17,633 --> 00:12:21,623 And so what we've seen recently is, yeah, there's this remote control 248 00:12:21,623 --> 00:12:25,523 stuff going on because that vendor was compromised and they didn't know it. 249 00:12:25,553 --> 00:12:28,193 But now bad guys have access to the environments of all 250 00:12:28,193 --> 00:12:30,113 the clients they support. 251 00:12:30,728 --> 00:12:35,783 There wa there was a big, uh, there was a big one a few years ago where it was. 252 00:12:36,773 --> 00:12:41,303 It was a dentist, it was a dental service provider. 253 00:12:41,393 --> 00:12:45,773 I remember where they, they, they were like the software that 254 00:12:45,773 --> 00:12:50,663 every dentist uses in the US and, um, it was that kind of thing. 255 00:12:50,663 --> 00:12:55,763 And so basically they had, um, they were able to take control or of, of 256 00:12:55,913 --> 00:12:58,193 hundreds of, uh, dentists around the us. 257 00:12:58,193 --> 00:12:58,823 I remember that. 258 00:12:59,633 --> 00:13:00,293 Um. 259 00:13:00,353 --> 00:13:00,863 Oh darn. 260 00:13:00,863 --> 00:13:02,183 My dental appointment got canceled. 261 00:13:05,513 --> 00:13:08,663 you know, it's probably, it was probably a kid that didn't want to go to the dentist 262 00:13:08,663 --> 00:13:10,073 and he is the one that pulled that off. 263 00:13:11,303 --> 00:13:11,813 Yeah. 264 00:13:11,843 --> 00:13:13,763 You know, whenever I think about the dentist, I think about 265 00:13:13,763 --> 00:13:22,403 Steve Martin and, um, um, what's the, um, oh darn it, um, the. 266 00:13:24,173 --> 00:13:25,013 It will come to me later. 267 00:13:25,013 --> 00:13:27,803 There's a, there's a musical, it's a, it was a Broadway musical, and then they made 268 00:13:27,803 --> 00:13:33,473 a movie of it starring Rick Moranis and Steve Martin plays the Sadistic Dentist. 269 00:13:33,983 --> 00:13:39,563 Um, it's a, if you just, if you want a good laugh, go type in YouTube 270 00:13:39,563 --> 00:13:41,423 and type in Steve Martin dentist. 271 00:13:41,963 --> 00:13:43,433 Um, uh, yeah, 272 00:13:43,493 --> 00:13:44,183 it's a good laugh. 273 00:13:44,183 --> 00:13:44,753 Anyway, go 274 00:13:44,768 --> 00:13:47,963 so, so what we've been talking about so far is sort of. 275 00:13:48,623 --> 00:13:53,033 Users noticing something odd happening, calling in, right, 276 00:13:53,483 --> 00:13:54,233 getting in, troubleshooting. 277 00:13:54,233 --> 00:13:59,213 But I'm guessing though that users aren't always the best people to recognize 278 00:13:59,213 --> 00:14:02,723 when things go wrong, and they're probably not always at their desk 279 00:14:03,113 --> 00:14:05,633 when the bad actor is doing something. 280 00:14:06,203 --> 00:14:09,023 So what happens for all those other scenarios? 281 00:14:10,478 --> 00:14:14,498 So there's, there's other things that we do in a corporate environment that 282 00:14:14,498 --> 00:14:19,868 we hopefully would notice weird things, our backups, our network bandwidth. 283 00:14:19,988 --> 00:14:20,048 Um. 284 00:14:22,133 --> 00:14:26,213 And there, there's tons of places that you can set up alerts and triggers, 285 00:14:26,243 --> 00:14:32,603 uh, firewall, uh, weird IP addresses, different protocols, uh, unexpected 286 00:14:32,603 --> 00:14:34,643 data going out, different ports. 287 00:14:35,363 --> 00:14:35,573 Um. 288 00:14:38,603 --> 00:14:41,453 There's a lot of things we could look at and, and, and it's, it's a pretty 289 00:14:41,453 --> 00:14:44,813 lengthy list, but humanly possible. 290 00:14:44,873 --> 00:14:47,813 Like, is there one person that's gonna go down this whole checklist every 291 00:14:47,813 --> 00:14:49,853 day, you know, several times a day? 292 00:14:50,273 --> 00:14:53,063 Uh, that's just not, that's not feasible. 293 00:14:53,603 --> 00:14:58,313 Uh, and so you've really gotta roll that up into a tool that can automate it and 294 00:14:58,313 --> 00:15:00,653 just give you a dashboard view of things. 295 00:15:01,253 --> 00:15:01,793 Um. 296 00:15:02,513 --> 00:15:06,293 The, the, the secret, the, the key is how many things, how 297 00:15:06,293 --> 00:15:07,973 much visibility do we have? 298 00:15:08,633 --> 00:15:13,493 Finding tools and the data sources and the use cases that all line up. 299 00:15:13,853 --> 00:15:15,923 Like there's a, there's a ransomware use case. 300 00:15:15,923 --> 00:15:16,163 All right? 301 00:15:16,163 --> 00:15:19,853 So from ran, if, if we're, if, if our focus or objective 302 00:15:19,853 --> 00:15:21,293 is to identify ransomware. 303 00:15:22,043 --> 00:15:25,073 Then working backwards from that objective, we've gotta find the data 304 00:15:25,073 --> 00:15:27,503 sources that would give us the indicators. 305 00:15:27,983 --> 00:15:31,283 Uh, then we've gotta have the technology that can consume or 306 00:15:31,283 --> 00:15:33,263 connect and consume that data source. 307 00:15:33,773 --> 00:15:38,003 Uh, then we've gotta have some policy procedure around the source of that data. 308 00:15:38,003 --> 00:15:38,753 Like, what is it? 309 00:15:38,753 --> 00:15:39,473 Is it a server? 310 00:15:39,833 --> 00:15:42,593 You know, uh, firewall, how's it configured? 311 00:15:42,593 --> 00:15:43,343 How do we patch it? 312 00:15:43,343 --> 00:15:44,123 How do we update it? 313 00:15:44,183 --> 00:15:45,143 How do we back it up? 314 00:15:45,623 --> 00:15:49,613 Uh, so that playbook is, is fairly extensive, but the, the detection 315 00:15:49,793 --> 00:15:52,133 part of that is all about visibility. 316 00:15:52,703 --> 00:15:57,443 Um, and, well, I guess fundamentally too, understanding how ransomware works. 317 00:15:57,923 --> 00:16:02,963 Um, 'cause I mean, your, your smart dishwasher probably isn't gonna 318 00:16:02,963 --> 00:16:04,913 get infected with, with ransomware. 319 00:16:05,303 --> 00:16:05,753 Uh. 320 00:16:05,823 --> 00:16:05,943 Hmm. 321 00:16:06,818 --> 00:16:07,478 Not yet. 322 00:16:07,748 --> 00:16:08,318 Not yet. 323 00:16:08,588 --> 00:16:13,718 Uh, now your, your, your internet connected Instapot, uh, that we, 324 00:16:13,718 --> 00:16:18,278 there, there's actually been at least, uh, laboratory ex uh, examples of 325 00:16:18,398 --> 00:16:20,138 getting malware on your Instapot. 326 00:16:21,098 --> 00:16:23,828 Uh, 'cause you can make the display say different things, or your 327 00:16:23,833 --> 00:16:28,508 voting machine, I guess is a good relevant, uh, near term scenario. 328 00:16:29,078 --> 00:16:29,588 Um, 329 00:16:30,893 --> 00:16:34,493 Well, those should not be network connected, so hope not. 330 00:16:34,853 --> 00:16:36,083 Well, we say should a lot, 331 00:16:38,213 --> 00:16:43,313 people get involved and people do incon inconsistent things. 332 00:16:45,488 --> 00:16:45,938 Yeah. 333 00:16:45,998 --> 00:16:49,508 Um, so it's interesting, you know, our last episode was actually about 334 00:16:49,508 --> 00:16:53,408 election integrity, so it's just interesting that you mention that. 335 00:16:53,828 --> 00:16:56,648 Um, yeah, uh, I, I'll just say that. 336 00:16:57,038 --> 00:16:57,368 Well, I. 337 00:16:58,043 --> 00:17:02,213 Any voting machine that I'm aware of, the design does not have a 338 00:17:02,213 --> 00:17:05,573 network connection, but we can have a whole other discussion about that. 339 00:17:05,573 --> 00:17:13,163 But, um, so the, the we, we did have a discussion though sometimes, uh, 340 00:17:13,163 --> 00:17:15,713 with, uh, with our red team member. 341 00:17:16,073 --> 00:17:19,283 He talked about using, um, he was. 342 00:17:19,683 --> 00:17:26,103 He used the television, the smart tv, in the lobby of the, um, of 343 00:17:26,103 --> 00:17:29,913 the company to, you know, to, to hack the rest of the environment. 344 00:17:29,973 --> 00:17:32,313 And basically he figured out what the TV was. 345 00:17:32,913 --> 00:17:37,893 They bought the tv, they, you know, uh, reverse engineered it, figured out 346 00:17:37,953 --> 00:17:42,693 how to, you know, how to hack it, uh, and then use that as a, you know, as 347 00:17:42,693 --> 00:17:44,433 a way to bridge into the environment. 348 00:17:45,063 --> 00:17:46,893 Um, but, um. 349 00:17:48,563 --> 00:17:53,933 uh, so when we start talking about this, we've got to start talking about some 350 00:17:53,933 --> 00:17:59,633 sort of tools that are, and there's three tools that I'm aware of and, um, you 351 00:17:59,633 --> 00:18:02,603 know, which would be XDR, sim and soar. 352 00:18:03,083 --> 00:18:04,853 SOAR is more about the response, right? 353 00:18:04,853 --> 00:18:08,273 But XDR and SIM tools are about the actual detection. 354 00:18:08,303 --> 00:18:09,533 Did I, did I get that right? 355 00:18:10,718 --> 00:18:16,808 So the, the XDR is, is the platform that you would, um, consolidate 356 00:18:16,808 --> 00:18:21,338 all of your alerts and data sources from different other tools. 357 00:18:21,338 --> 00:18:24,758 So it's kind of like the top, the top of your security stack. 358 00:18:25,538 --> 00:18:25,828 Okay. 359 00:18:26,438 --> 00:18:32,408 And then the, the sim is, is kind of below that. 360 00:18:32,498 --> 00:18:33,608 So SIM is one of the. 361 00:18:35,243 --> 00:18:40,283 One of the feeds into your XDR platform, EDR, you know, your anti malware endpoint 362 00:18:40,283 --> 00:18:42,263 stuff, that's another data source. 363 00:18:42,893 --> 00:18:44,513 Um, and, and so. 364 00:18:44,528 --> 00:18:49,028 I just thought all the, all the EDR tools were calling themselves XDR tools. 365 00:18:49,028 --> 00:18:49,118 That 366 00:18:49,628 --> 00:18:49,838 that's 367 00:18:49,988 --> 00:18:51,398 And, and they're really not. 368 00:18:51,608 --> 00:18:52,268 Um, 369 00:18:52,808 --> 00:18:56,978 the evolution of EDR into more of a managed service is still 370 00:18:56,978 --> 00:18:59,048 missing the network layer. 371 00:18:59,138 --> 00:19:05,138 So the, the eds like CrowdStrike that say that they, they do XDR, they're, 372 00:19:05,138 --> 00:19:08,468 I think they're their definition. 373 00:19:08,468 --> 00:19:10,058 I think it's a terminology problem. 374 00:19:10,088 --> 00:19:13,298 XDR, the extended detect respond. 375 00:19:14,558 --> 00:19:20,168 Maybe they're, they're, they're expanding their visibility, uh, uh, you know, 376 00:19:20,168 --> 00:19:24,038 out from just workstations and servers and they're doing some other stuff. 377 00:19:24,038 --> 00:19:28,178 But really it's just the managed service and response capabilities that they're 378 00:19:28,178 --> 00:19:30,368 putting on top of their EDR solution. 379 00:19:30,788 --> 00:19:35,408 But they're still missing the, the east, west, you know, network traffic, net flow, 380 00:19:35,633 --> 00:19:36,143 Okay. 381 00:19:36,353 --> 00:19:38,543 Okay, so EEDR. 382 00:19:39,023 --> 00:19:39,533 Sorry to interrupt. 383 00:19:39,563 --> 00:19:43,433 EDR would be endpoint detection response, which typically what we're 384 00:19:43,433 --> 00:19:48,623 talking about there is, is like desktops and laptops and things like that. 385 00:19:48,683 --> 00:19:49,913 Not so much servers. 386 00:19:50,243 --> 00:19:50,903 Would that be right? 387 00:19:50,918 --> 00:19:51,818 Well servers too. 388 00:19:51,818 --> 00:19:55,388 I mean, you can, you can put EDR on, on servers for sure. 389 00:19:56,303 --> 00:19:58,523 But not necessarily networks, like network 390 00:19:58,703 --> 00:20:01,883 it, it, uh, CrowdStrike doesn't do network analysis. 391 00:20:02,063 --> 00:20:06,293 And so, you know, even before, you know, the, the first, the first kind 392 00:20:06,293 --> 00:20:10,043 of acronym was NDR Network Layer stuff. 393 00:20:10,043 --> 00:20:15,773 So that's like extra hop, uh, you know, net flow, uh, your, your router. 394 00:20:16,073 --> 00:20:17,603 Trip wire type stuff. 395 00:20:17,993 --> 00:20:22,433 And then, and then we have the, the anti-malware antivirus 396 00:20:22,433 --> 00:20:24,173 group grew into anti-malware. 397 00:20:24,173 --> 00:20:27,833 Now that's an EDR, so it's managed with, and it's really, that's, 398 00:20:27,833 --> 00:20:30,263 that's a, that's not a new concept. 399 00:20:30,653 --> 00:20:35,693 It's really just console view of your anti-malware deployment. 400 00:20:35,753 --> 00:20:37,163 And that's been around for a long time. 401 00:20:38,288 --> 00:20:41,108 Uh, but then as a managed service, we want to call it something. 402 00:20:41,108 --> 00:20:42,248 So there's your EDR. 403 00:20:42,308 --> 00:20:44,888 So it's more than just monitoring and managing. 404 00:20:44,888 --> 00:20:46,838 It's also the ability to respond. 405 00:20:47,528 --> 00:20:49,988 So now we have NDR and EDR. 406 00:20:49,988 --> 00:20:54,788 Well, then MDR came into the, into play and, and the idea with MDR was now we 407 00:20:54,788 --> 00:20:59,378 can look at network, primarily network, uh, and then the evolution of that. 408 00:21:00,968 --> 00:21:03,788 Uh, monitor, detect, monitor, detect 409 00:21:04,193 --> 00:21:04,943 Oh, okay. 410 00:21:05,228 --> 00:21:10,658 like MSPs, the managed security service providers, they, they're also slash mdr. 411 00:21:11,108 --> 00:21:15,068 That's, that's our, that's our, our, uh, our del our delivery service. 412 00:21:15,788 --> 00:21:20,378 Uh, well then that's expanded now to say, well, I can, depending on my sim and 413 00:21:20,378 --> 00:21:23,558 MDR was primarily just a sim solution. 414 00:21:23,558 --> 00:21:25,238 That's, that's the top of their stack. 415 00:21:25,958 --> 00:21:31,928 Well, is your sim technology capable of ingesting the EDR data from your 416 00:21:31,928 --> 00:21:34,418 EDR console or, or your endpoints? 417 00:21:34,988 --> 00:21:40,658 Uh, it was really good at NDR if, if you had the technology in your environment 418 00:21:40,658 --> 00:21:43,238 to collect and provide the, the network 419 00:21:43,298 --> 00:21:43,418 The 420 00:21:43,478 --> 00:21:44,408 west traffic. 421 00:21:44,918 --> 00:21:49,208 So even, even MDR at, at, at the beginning was just like, sis log 422 00:21:49,328 --> 00:21:51,368 server events and your firewall. 423 00:21:51,368 --> 00:21:52,298 And that was pretty much it. 424 00:21:53,048 --> 00:21:53,858 Uh, well then. 425 00:21:54,398 --> 00:21:57,758 XDR in, in every case network. 426 00:21:59,228 --> 00:22:01,058 The MDR uh, component, the. 427 00:22:01,853 --> 00:22:03,353 Does a little bit more than network. 428 00:22:03,353 --> 00:22:08,933 And then the E-D-R-X-D-R, the idea with XDR, the extended detect is that 429 00:22:08,933 --> 00:22:12,383 we can plug anything into our console. 430 00:22:12,383 --> 00:22:18,383 So that's our sim, that's an anti malware, uh, NetFlow, uh, and even 431 00:22:18,443 --> 00:22:22,943 like some XDR platforms can do like physical security devices, like 432 00:22:22,943 --> 00:22:26,723 badges and motion cameras, and, um. 433 00:22:27,278 --> 00:22:31,748 I, OT things, uh, like, hey, my dishwasher's throwing errors a bunch. 434 00:22:31,808 --> 00:22:34,868 Uh, you know, you can, I guess if there's a use case for that. 435 00:22:35,468 --> 00:22:41,198 Um, so XD the idea with XDR, uh, and even, even broader than that, is an 436 00:22:41,198 --> 00:22:47,858 open XDR uh, platform that just about anything you can imagine can be fed into 437 00:22:47,858 --> 00:22:53,678 this thing, uh, to correlate events and, and if it's capable, develop behavioral 438 00:22:53,678 --> 00:22:55,718 baselines and some other cool stuff. 439 00:22:57,218 --> 00:23:02,738 So then, um, does Soar fit into that, all of that? 440 00:23:03,683 --> 00:23:05,933 So SOAR is also not a new term. 441 00:23:06,173 --> 00:23:10,253 Uh, so SOAR is security orchestration and automated response. 442 00:23:10,913 --> 00:23:15,713 Uh, so the idea with SOAR is that we have this playbook, and historically 443 00:23:15,713 --> 00:23:17,693 it's been a manual playbook, right? 444 00:23:17,693 --> 00:23:20,153 We get out the book and we look through it and say, this is what we're gonna 445 00:23:20,153 --> 00:23:21,563 do in response to whatever this. 446 00:23:22,373 --> 00:23:26,753 Thing is, so it could be an incident, it could be a, a malware, it could 447 00:23:26,753 --> 00:23:30,533 be a stolen laptop, whatever. 448 00:23:30,953 --> 00:23:35,453 You've got this playbook and, and the idea with playbooks is you assess 449 00:23:35,453 --> 00:23:39,833 yourself, like our company does these things and we have these assets, and 450 00:23:40,283 --> 00:23:42,743 what is the most likely impact to us? 451 00:23:43,628 --> 00:23:46,658 Ransomware's at the top should be at the top of everybody's list these 452 00:23:46,658 --> 00:23:51,278 days, if you're connected to the internet and have users, uh, ransomware 453 00:23:51,278 --> 00:23:55,508 is just statistically more likely than a lot of other things these 454 00:23:55,508 --> 00:23:57,458 days, but it could be other stuff. 455 00:23:57,458 --> 00:24:03,008 You should have a playbook on, uh, denial of service if your company 456 00:24:03,008 --> 00:24:07,418 relies on internet connectivity, um, for revenue and communications. 457 00:24:07,418 --> 00:24:12,248 You, if you have a, a large remote workforce and they have laptops that have. 458 00:24:12,713 --> 00:24:17,903 Company data on it that you should have a playbook on stolen laptops. 459 00:24:18,398 --> 00:24:21,608 Is this similar to the incident response plan stuff we talked about 460 00:24:21,608 --> 00:24:23,678 a couple or many episodes ago? 461 00:24:23,843 --> 00:24:29,183 it is, and, uh, however, uh, soar, uh, traditionally and, and I was kind of, 462 00:24:29,243 --> 00:24:33,713 I was getting to that the, the Soar traditionally was more broadly defined. 463 00:24:33,713 --> 00:24:36,983 So you could have something that might not be considered an incident yet. 464 00:24:37,628 --> 00:24:41,168 Um, so, so, so back in the day also incorporated, well, 465 00:24:41,168 --> 00:24:43,148 how do we analyze this event? 466 00:24:43,748 --> 00:24:44,078 Hmm. 467 00:24:44,168 --> 00:24:48,578 Uh, and then we, and then we started to developing more technical incident 468 00:24:48,578 --> 00:24:53,648 response plans and programs that said, all right, that playbook is now part 469 00:24:53,648 --> 00:24:59,198 of our plan, and here are the more technical, tactical things we need to do. 470 00:24:59,618 --> 00:25:03,278 Well then the evolution of Soar, uh, from a platform or technology 471 00:25:03,278 --> 00:25:05,828 perspective is, all right, how do we automate some of this stuff? 472 00:25:06,608 --> 00:25:06,898 Yeah. 473 00:25:07,118 --> 00:25:11,978 And so there are, there are third party tools that are, so our sim, our 474 00:25:11,978 --> 00:25:14,948 XDR platform, identified this stuff. 475 00:25:15,368 --> 00:25:20,738 Uh, let's integrate this automation tool or, or we have this tool now that's, 476 00:25:20,768 --> 00:25:26,438 that we can then go and, and use to say, we need to handle this, this incident. 477 00:25:27,443 --> 00:25:32,933 So as an example, could it be something like, I've detected some random 478 00:25:32,933 --> 00:25:37,373 network traffic on this particular client that doesn't look right. 479 00:25:37,373 --> 00:25:40,463 The SOAR detects it and maybe it shuts off the network port. 480 00:25:41,303 --> 00:25:41,873 Yes. 481 00:25:42,233 --> 00:25:46,043 And so in the Soar you would, you would again, define these playbooks 482 00:25:46,073 --> 00:25:48,023 when this happens, do these things. 483 00:25:48,413 --> 00:25:57,743 And so with ransomware as an example, if, uh, user account experiences, several 484 00:25:57,743 --> 00:26:00,593 failed logins and then a successful login. 485 00:26:01,103 --> 00:26:06,833 And then service, you know, anti malware is shut off on the endpoint and 486 00:26:06,923 --> 00:26:14,543 there is internet traffic to geo, you know, whatever IP address, uh, around 487 00:26:14,543 --> 00:26:16,793 the world do these things, right? 488 00:26:16,793 --> 00:26:24,263 Disabled user revoke, MFA tokens, uh, uh, shun or, or quarantine 489 00:26:24,263 --> 00:26:28,853 that, that endpoint, you know, take it off the, you know, um, uh. 490 00:26:30,653 --> 00:26:35,273 Block its IP address, uh, notify whoever and do these things, 491 00:26:35,273 --> 00:26:36,263 and you can automate that. 492 00:26:37,043 --> 00:26:41,093 Um, and it can be as, as detailed as that. 493 00:26:41,128 --> 00:26:44,723 It, it could be, uh, and any variation of that. 494 00:26:44,723 --> 00:26:48,413 So yeah, those, those, that's a great example of how that, that 495 00:26:48,418 --> 00:26:53,303 tool and it, and it would do it so quick, like milliseconds versus the, 496 00:26:53,303 --> 00:26:56,843 the human version of that is, um. 497 00:26:57,248 --> 00:26:59,948 You know, your sim tool pops up and says, you know, you've 498 00:26:59,948 --> 00:27:01,208 got something to look into. 499 00:27:01,208 --> 00:27:04,238 An analyst takes 15 to 20 minutes to verify it. 500 00:27:04,568 --> 00:27:05,828 Uh, we have a valid thing. 501 00:27:05,828 --> 00:27:07,388 Let me escalate it to level two. 502 00:27:07,388 --> 00:27:10,658 Level two looks at it, you know, another 15, 20 minutes. 503 00:27:10,658 --> 00:27:14,558 Now we're looking at other, other data sources like the firewall and some stuff. 504 00:27:14,858 --> 00:27:18,728 We've now validated that then we, we escalate that to the client if it's 505 00:27:18,728 --> 00:27:23,258 an MSP version, uh, or, or the, the business owner or the stakeholder 506 00:27:23,258 --> 00:27:24,638 in a, in a corporate environment. 507 00:27:25,088 --> 00:27:25,448 Uh. 508 00:27:25,778 --> 00:27:29,798 And we're waiting for a response from them to determine what to do next. 509 00:27:29,798 --> 00:27:34,808 And so now that that millisecond soar automated response has turned into at a 510 00:27:34,808 --> 00:27:41,558 minimum hour and a half, two hours, and who knows what, you know, that malware 511 00:27:41,558 --> 00:27:45,638 is, especially the ones that, that, uh, can run autonomously, is our, they've 512 00:27:45,638 --> 00:27:49,448 already done reconnaissance to look at what else this thing has access to. 513 00:27:49,448 --> 00:27:51,248 And I've already spread and done other stuff. 514 00:27:52,958 --> 00:27:53,923 Time is of the essence. 515 00:27:54,608 --> 00:27:55,028 yeah. 516 00:27:55,088 --> 00:27:55,568 Yeah. 517 00:27:55,988 --> 00:27:57,308 So all, all right. 518 00:27:57,308 --> 00:28:03,098 So let, let's say, let's say I'm a company, I'm an organization that 519 00:28:03,758 --> 00:28:06,338 has none of these tools, right? 520 00:28:06,788 --> 00:28:10,148 Just, and I'm, I'm listening to this episode, I'm like, holy crap. 521 00:28:10,748 --> 00:28:13,658 Like, how many things do I need to buy and where should I start? 522 00:28:13,838 --> 00:28:15,818 Um, I, I think that's. 523 00:28:16,373 --> 00:28:19,523 I think that's where the average person might be right now. 524 00:28:19,913 --> 00:28:21,143 Um, and that's where I am. 525 00:28:21,263 --> 00:28:26,573 Um, I'm like, wow, that's a, that's an awful lot of tools where, you know, and, 526 00:28:26,573 --> 00:28:29,873 and, and each of them thinks they're, they're, you know, well, you gotta have 527 00:28:29,873 --> 00:28:32,843 this, you gotta have MDR, you gotta have XDR, you gotta have sim, you gotta have, 528 00:28:32,843 --> 00:28:34,283 so you gotta have all these things. 529 00:28:35,303 --> 00:28:39,678 And I'm sure there's an acronyms that we haven't got to, um, where, 530 00:28:39,743 --> 00:28:43,403 where does, you know, I'm worried that I'm gonna get ransomware where. 531 00:28:44,648 --> 00:28:46,893 Do I start with all these tools? 532 00:28:48,473 --> 00:28:52,313 There's a lot of different, uh, approaches to the problem and understanding. 533 00:28:52,318 --> 00:28:55,218 The problem is, is fundamentally economics, right? 534 00:28:55,458 --> 00:28:56,058 I can't afford. 535 00:28:57,203 --> 00:29:00,923 The people or the, the software or the whatever it is to, to 536 00:29:00,923 --> 00:29:04,313 truly, um, improve my, my odds. 537 00:29:04,643 --> 00:29:05,633 And that's really what it is. 538 00:29:05,633 --> 00:29:09,713 I mean, you can invest everything you have in protecting yourself and 539 00:29:09,713 --> 00:29:11,453 you're still a statistic at some point. 540 00:29:11,903 --> 00:29:13,943 'cause bad guys are gonna figure out how to get to you. 541 00:29:14,573 --> 00:29:18,743 Um, but remember that ransomware is malware. 542 00:29:19,373 --> 00:29:26,753 And all malware requires user, user interaction in order to infect your thing. 543 00:29:27,413 --> 00:29:31,913 So your computer, um, if it's not connected to the internet and you're not 544 00:29:31,973 --> 00:29:35,603 looking at email and going to websites, you're, you're, you're good, right? 545 00:29:35,663 --> 00:29:37,733 Or you're, you know, 99% there. 546 00:29:37,823 --> 00:29:41,003 Uh, you also have to disable all your USB ports and Bluetooth 547 00:29:41,003 --> 00:29:42,023 and all that other stuff too. 548 00:29:42,773 --> 00:29:46,373 Um, which means you really can't use your, your computer for anything. 549 00:29:47,153 --> 00:29:47,633 Um. 550 00:29:49,088 --> 00:29:51,548 So then, but, but if you start there, all right. 551 00:29:51,548 --> 00:29:54,848 If my computer's not connected to anything, what can I do? 552 00:29:55,208 --> 00:29:56,168 Well, I can't do much. 553 00:29:56,168 --> 00:29:57,188 Well, I need to do this thing. 554 00:29:57,188 --> 00:29:58,598 Well, what do I need to do that thing? 555 00:29:58,598 --> 00:30:03,488 Well, I need internet to get to this website so I can log in to do my work. 556 00:30:03,518 --> 00:30:06,863 Okay, well then can we exclude the majority of other things 557 00:30:06,863 --> 00:30:08,018 that you don't need to do? 558 00:30:08,138 --> 00:30:08,468 Yeah. 559 00:30:08,498 --> 00:30:08,828 All right. 560 00:30:08,828 --> 00:30:10,658 So let's, we can write policy about that. 561 00:30:10,658 --> 00:30:11,228 That's okay. 562 00:30:12,083 --> 00:30:12,893 Well, what else do you need? 563 00:30:12,893 --> 00:30:13,763 Oh, I need email. 564 00:30:14,483 --> 00:30:17,723 I need email to be able to send and receive files and talk to people. 565 00:30:17,753 --> 00:30:18,173 Okay. 566 00:30:19,433 --> 00:30:25,343 Well, are there ways of restricting email's ability to, to present me with 567 00:30:25,343 --> 00:30:27,143 things that, that could be a risk? 568 00:30:27,173 --> 00:30:29,393 Well, yeah, that's, you know, email filtering and spam 569 00:30:29,393 --> 00:30:30,833 filtering and stuff of that stuff. 570 00:30:31,823 --> 00:30:35,153 Some of those tools, some of the, some of that stuff that I've 571 00:30:35,153 --> 00:30:39,383 mentioned is, are probably already a capability of what you've purchased. 572 00:30:40,148 --> 00:30:43,268 Like Office 365 comes with some good stuff. 573 00:30:43,328 --> 00:30:45,848 They just don't do a real good job at teaching you how to, 574 00:30:46,088 --> 00:30:47,558 how to use it and configure it. 575 00:30:47,888 --> 00:30:51,428 And us as consumers are really poor at, at reading the manual. 576 00:30:52,358 --> 00:30:52,658 Um. 577 00:30:52,688 --> 00:30:56,738 comes with some other stuff that, but they do charge quite a, quite a bit for it, 578 00:30:57,263 --> 00:30:57,743 They do. 579 00:30:57,743 --> 00:30:58,403 And so, 580 00:30:58,973 --> 00:31:01,973 um, but you know, going back to how many tools do I need to 581 00:31:01,973 --> 00:31:03,413 buy, that's another decision. 582 00:31:03,413 --> 00:31:08,663 Do I, do I buy more licensing and, and capabilities from this one tool? 583 00:31:08,663 --> 00:31:10,973 Or do I look at, you know, what other things can I bolt 584 00:31:10,973 --> 00:31:13,103 on and, and add to, to this? 585 00:31:13,103 --> 00:31:16,253 Maybe it's more cost effective, but now you've got a, now you've 586 00:31:16,253 --> 00:31:19,703 got overhead and having to spend more time doing these other tools, 587 00:31:20,603 --> 00:31:20,903 well then all. 588 00:31:22,523 --> 00:31:24,473 So you've, you've been somewhat diligent. 589 00:31:24,473 --> 00:31:29,723 You've, you're, you're using your computer responsibly and you, you've 590 00:31:29,723 --> 00:31:35,633 figured out how to use what you paid for, uh, to do, you know, what, 591 00:31:35,693 --> 00:31:37,223 what you can with what you have. 592 00:31:37,678 --> 00:31:38,098 Mm-Hmm. 593 00:31:38,663 --> 00:31:44,003 Then it all comes down to just be being aware and, and you know that that 594 00:31:44,003 --> 00:31:46,463 email from so and so, you know, the. 595 00:31:46,973 --> 00:31:48,893 Uh, it's an email about A PDF. 596 00:31:48,893 --> 00:31:49,703 You need to sign. 597 00:31:50,063 --> 00:31:52,283 Well, were you expecting a PDF to sign? 598 00:31:52,373 --> 00:31:55,313 Did you just, you just sign random PDFs? 599 00:31:56,363 --> 00:31:59,243 Uh, you just can't wait to wake up in the morning and, and look 600 00:31:59,243 --> 00:32:01,283 for a PDF to sign in your inbox. 601 00:32:01,853 --> 00:32:02,453 Um, 602 00:32:02,693 --> 00:32:05,303 transfer the, the money, you know what I mean? 603 00:32:05,393 --> 00:32:05,543 The. 604 00:32:06,078 --> 00:32:06,298 So, 605 00:32:06,473 --> 00:32:09,593 another big one is like, you know, you get the, the thing from the boss 606 00:32:09,593 --> 00:32:11,543 saying, I need you to do this EFT 607 00:32:12,203 --> 00:32:13,493 to this new customer. 608 00:32:13,793 --> 00:32:14,183 Right? 609 00:32:14,948 --> 00:32:16,838 And you need to call your boss. 610 00:32:17,198 --> 00:32:20,438 You know, people that are sending you stuff to sign, uh, people 611 00:32:20,438 --> 00:32:21,608 that are asking you for money. 612 00:32:21,608 --> 00:32:23,468 Those are, those are important things. 613 00:32:23,963 --> 00:32:24,353 yeah. 614 00:32:24,728 --> 00:32:25,328 Call them. 615 00:32:26,273 --> 00:32:26,663 Yeah. 616 00:32:26,888 --> 00:32:31,898 Call your boss, call, you know that vendor that sent you something to sign and 617 00:32:32,033 --> 00:32:34,103 And don't use the number that's on the invoice. 618 00:32:34,393 --> 00:32:35,558 You don't call the. 619 00:32:36,938 --> 00:32:39,878 number, you know, not the, not the number that they, they sent you. 620 00:32:40,238 --> 00:32:42,638 It's kinda like back in the day with credit card fraud. 621 00:32:42,638 --> 00:32:45,248 Hey, your, your account is, there's a problem with your account. 622 00:32:45,248 --> 00:32:46,058 Call this number. 623 00:32:46,118 --> 00:32:46,448 Well 624 00:32:47,288 --> 00:32:50,708 that number's on the back of your debit card too, so you should call that number. 625 00:32:50,708 --> 00:32:52,118 Not the number They, they texted 626 00:32:52,178 --> 00:32:52,598 Yeah. 627 00:32:52,658 --> 00:32:56,108 And and I would say you should call the boss's cell phone, not 628 00:32:56,408 --> 00:32:59,078 something on the company phone system if you still have one. 629 00:32:59,348 --> 00:33:00,668 that's a great point too. 630 00:33:01,118 --> 00:33:01,718 Um. 631 00:33:02,573 --> 00:33:05,273 But, you know, kind of at the end of the day, and, and maybe getting 632 00:33:05,423 --> 00:33:09,053 back to your, your original question with, well, how do, how does the 633 00:33:09,053 --> 00:33:10,763 average person protect themself? 634 00:33:10,763 --> 00:33:12,233 It starts with just being diligent. 635 00:33:12,233 --> 00:33:17,633 Just take a minute and, and think through the, you know, rationale of whatever 636 00:33:17,633 --> 00:33:20,273 it is that you're, you were gonna do. 637 00:33:20,273 --> 00:33:23,693 Click on something, open something, download something, go to a website, 638 00:33:24,203 --> 00:33:26,213 scan a QR code with your phone. 639 00:33:26,903 --> 00:33:27,203 Um. 640 00:33:27,818 --> 00:33:30,068 These are all things that you maybe just, just take a minute 641 00:33:30,158 --> 00:33:31,088 and, and really think through. 642 00:33:31,088 --> 00:33:32,198 Do I need to do that? 643 00:33:32,258 --> 00:33:33,548 Was I expecting that? 644 00:33:33,878 --> 00:33:38,348 Could there be something, you know, malicious or, or, uh, 645 00:33:38,378 --> 00:33:39,938 wrong with whatever this is? 646 00:33:39,938 --> 00:33:42,368 And it never hurts to phone a friend. 647 00:33:42,878 --> 00:33:43,328 Um. 648 00:33:44,018 --> 00:33:47,708 And, and, you know, making friends is important in this, in, in cyber. 649 00:33:47,708 --> 00:33:51,878 'cause you know, as, as a individ, as an individual, you, you're 650 00:33:51,878 --> 00:33:54,878 probably not gonna be exposed to or experience a lot of things. 651 00:33:55,298 --> 00:33:59,498 Um, and then the more people you talk to about what you see and and your questions, 652 00:33:59,498 --> 00:34:03,428 the more likely you're gonna get somebody that's probably already made that mistake 653 00:34:03,428 --> 00:34:05,108 and can help you not make it yourself. 654 00:34:05,633 --> 00:34:05,843 Yeah. 655 00:34:05,843 --> 00:34:08,633 And Mike, just on that last point, I think it's a great thing, and I 656 00:34:08,633 --> 00:34:11,753 know we did an entire discussion about like cyber insurance, 657 00:34:12,113 --> 00:34:12,413 right? 658 00:34:12,413 --> 00:34:14,363 And how they're like a trusted advisor. 659 00:34:14,363 --> 00:34:18,383 You should talk to them because I'm sure they could give you good advice on sort 660 00:34:18,383 --> 00:34:22,163 of how to shore up your defenses and be able to detect and protect yourself 661 00:34:22,163 --> 00:34:24,473 against ransomware and other malware. 662 00:34:25,808 --> 00:34:30,008 And there's a couple of, a couple of real quick, uh, like things to consider 663 00:34:30,008 --> 00:34:34,418 if, if you think you've got ransomware or malware, just turn your computer off. 664 00:34:34,913 --> 00:34:37,133 Power it off, take the battery out, unplug it. 665 00:34:37,133 --> 00:34:39,683 'cause that, that stuff needs power to do its job. 666 00:34:40,643 --> 00:34:43,553 And if, if you really think, you know, I've got my critical, my 667 00:34:43,553 --> 00:34:46,733 whole life is on this computer and I think I have malware, shut it off. 668 00:34:46,763 --> 00:34:47,363 Unplug it. 669 00:34:47,363 --> 00:34:50,933 Take the battery out and find somebody that can help you get your data 670 00:34:50,933 --> 00:34:52,913 off of it and make sure it's clean. 671 00:34:53,393 --> 00:34:57,083 Um, and that way at least you've got a backup. 672 00:34:57,833 --> 00:35:00,233 Backups are, are critical with ransomware. 673 00:35:00,743 --> 00:35:02,753 Um, but yeah, don't. 674 00:35:03,578 --> 00:35:04,358 Don't just sit there. 675 00:35:04,358 --> 00:35:07,988 It's kind of like, you know, especially guys, and I'm, I'm definitely guilty. 676 00:35:07,988 --> 00:35:11,348 I'm a little hardheaded when it comes to illness and health. 677 00:35:11,888 --> 00:35:14,228 If you've got symptoms, call the doctor. 678 00:35:15,398 --> 00:35:15,848 Right. 679 00:35:16,058 --> 00:35:17,948 Don't, don't sit there and go, oh, I'll give it. 680 00:35:17,948 --> 00:35:19,148 I'll give it another day. 681 00:35:19,148 --> 00:35:21,458 Or maybe I just need a nap. 682 00:35:22,328 --> 00:35:22,388 Yeah. 683 00:35:23,993 --> 00:35:25,193 Yeah, I, um. 684 00:35:25,943 --> 00:35:31,013 Which brings up, and, and this is a giant tee up, and, uh, but you know, it would 685 00:35:31,013 --> 00:35:37,103 seem to me that this is too important for you to try to figure it out yourself. 686 00:35:37,103 --> 00:35:40,343 Like if you, if you're not a cybersecurity specialist, if you, if you, if 687 00:35:40,343 --> 00:35:43,373 you're not living your life, this thing, it's kinda like backup, right? 688 00:35:43,373 --> 00:35:46,163 Where it's like, it's way more difficult than you think it is. 689 00:35:46,253 --> 00:35:46,673 Right. 690 00:35:47,183 --> 00:35:51,383 Um, and that, and that's why MSPs exist, right? 691 00:35:51,443 --> 00:35:54,323 And so it would seem to me that I. 692 00:35:55,208 --> 00:35:59,438 Rather than try to figure out which of 10 different, you know, I mean, somebody 693 00:35:59,438 --> 00:36:04,508 showed me a, um, it was like the, it was like the, one of those things where they 694 00:36:04,508 --> 00:36:08,828 have just company logos and it was like the cybersecurity landscape and there were 695 00:36:08,828 --> 00:36:15,458 like just hundreds of these logos up there of products and services that I could buy. 696 00:36:15,458 --> 00:36:20,318 And, and it would seem to me that what I need, I need two things. 697 00:36:20,318 --> 00:36:21,008 I need. 698 00:36:21,518 --> 00:36:25,418 Tools that work, right, that, that, that do the things that I need. 699 00:36:25,928 --> 00:36:28,988 And more importantly, I need somebody that knows how to use those tools. 700 00:36:29,408 --> 00:36:31,658 'cause it doesn't do any good if I buy this great. 701 00:36:32,273 --> 00:36:38,633 You know, uh, detection tool to find, you know, what's going on and, but I 702 00:36:38,693 --> 00:36:42,983 don't know how to configure it so that it works and I don't know what to do. 703 00:36:43,163 --> 00:36:45,893 And of course, one of the most common things is that I configured it such 704 00:36:45,893 --> 00:36:49,163 a way that I get a whole bunch of false positives and then very quickly 705 00:36:49,163 --> 00:36:51,173 it, it just ends up becoming ignored. 706 00:36:51,503 --> 00:36:51,923 Right. 707 00:36:52,553 --> 00:36:55,883 So I, I think that's where the, where the MSSP and obviously I'm, I'm, 708 00:36:55,883 --> 00:36:57,743 I'm teeing it up for you, but I, I. 709 00:36:59,393 --> 00:37:03,653 I don't know what else, what else would be right for, for a small organization 710 00:37:03,653 --> 00:37:06,548 or even a medium sized organization that has never done this before. 711 00:37:07,673 --> 00:37:08,843 No, I appreciate that. 712 00:37:08,873 --> 00:37:10,048 Uh, and, and you're right. 713 00:37:11,363 --> 00:37:14,933 Um, going back to kind of the initial comments of, uh, you know, just good 714 00:37:14,933 --> 00:37:18,413 visibility if you wanna do it yourself, make sure you have the fundamentals. 715 00:37:18,413 --> 00:37:19,973 Good anti vi, anti malware. 716 00:37:20,618 --> 00:37:25,148 Um, that gives you consolidated, a consolidated view of all your assets. 717 00:37:25,178 --> 00:37:28,208 You know, you don't have to go to every computer and see if there's an infection. 718 00:37:28,208 --> 00:37:32,888 It needs to report up to a, a console that you can log into and, and get real 719 00:37:32,888 --> 00:37:34,718 updates and know where the problems are. 720 00:37:35,348 --> 00:37:41,498 Um, the, the other, the other gap, I mean, you, you managed, I mean, you 721 00:37:41,498 --> 00:37:46,118 mentioned needing someone that knows the technology and you know, an expert. 722 00:37:47,633 --> 00:37:51,563 To expand on that, it needs to be someone that's available 24 hours a day. 723 00:37:52,043 --> 00:37:55,103 'cause bad guys aren't gonna go, oh, you know, they're probably still 724 00:37:55,103 --> 00:37:57,923 at work working on the computer now is a good time to attack them. 725 00:37:58,523 --> 00:38:01,373 No, it's, it's when you're asleep and you're in middle of the 726 00:38:01,373 --> 00:38:05,603 night, uh, you know, Thur Thursday morning or Thursday after midnight 727 00:38:05,633 --> 00:38:06,653 is when they're gonna hit you. 728 00:38:06,653 --> 00:38:08,933 And, and because they also know that you're not gonna wanna, 729 00:38:10,373 --> 00:38:12,773 uh, be at work over the weekend. 730 00:38:12,773 --> 00:38:16,223 So they, for whatever reason, all right, they're, they're not gonna make it. 731 00:38:17,123 --> 00:38:18,353 Uh, uh, easy for you. 732 00:38:18,563 --> 00:38:21,503 Uh, and, and in a lot of cases, that's also because they're, they're 733 00:38:21,503 --> 00:38:26,333 overseas in a different time zone anyway, so the fundamentals are good. 734 00:38:26,393 --> 00:38:30,743 Endpoint protection, the, uh, good visibility across your environment. 735 00:38:30,833 --> 00:38:37,223 Um, good firewall, uh, cloud, uh, office 365, Google AWS, whatever 736 00:38:37,223 --> 00:38:38,843 you got, whatever's being used. 737 00:38:39,323 --> 00:38:39,803 Um. 738 00:38:41,783 --> 00:38:45,203 And then someone that, that you can call or someone that is looking 739 00:38:45,203 --> 00:38:46,793 at your stuff 24 hours a day. 740 00:38:47,213 --> 00:38:50,153 And there are some service providers where, you know, maybe you do have a 741 00:38:50,153 --> 00:38:55,493 staff during the day, uh, and so you just need nights and weekends and holidays. 742 00:38:55,943 --> 00:38:59,213 And so there are some providers like us that, that are flexible 743 00:38:59,213 --> 00:39:00,263 in that, in that regard. 744 00:39:00,263 --> 00:39:02,903 So that does help with, uh, cost and the economics. 745 00:39:03,503 --> 00:39:04,043 Um. 746 00:39:04,673 --> 00:39:08,753 But at the end of the day, absolutely, um, make friends with some experts, 747 00:39:08,783 --> 00:39:11,003 uh, that you can call for nothing else. 748 00:39:11,033 --> 00:39:13,073 Uh, if nothing else, just to ask questions. 749 00:39:13,403 --> 00:39:17,243 But ideally, uh, someone that can help you identify the right 750 00:39:17,243 --> 00:39:21,173 solutions, uh, to give you the right visibility and the right coverage. 751 00:39:21,203 --> 00:39:23,963 Uh, and again, I it's gotta be 24 hours a day. 752 00:39:24,398 --> 00:39:28,733 Yeah, so Mike, most of these organizations, right, they 753 00:39:28,733 --> 00:39:29,858 don't have unlimited budget. 754 00:39:30,548 --> 00:39:30,788 Right. 755 00:39:30,788 --> 00:39:34,778 Cost is always a concern in terms of priority. 756 00:39:34,778 --> 00:39:35,048 Right. 757 00:39:35,048 --> 00:39:38,198 I know you talked about endpoint, you talked about XDR, 758 00:39:38,198 --> 00:39:39,938 you talked about sim, right? 759 00:39:39,938 --> 00:39:41,048 You talked about all these things. 760 00:39:41,828 --> 00:39:44,948 If they're looking for sort of what is the first thing that they should 761 00:39:44,948 --> 00:39:51,668 go after and try to protect or detect ransomware on or malware on, what 762 00:39:51,668 --> 00:39:54,488 is, what is sort of like the most important thing in their environment 763 00:39:54,488 --> 00:39:55,688 that they should be concerned with? 764 00:39:57,323 --> 00:39:58,103 It depends. 765 00:40:00,308 --> 00:40:01,988 It really, it really does depend. 766 00:40:01,988 --> 00:40:04,868 I mean, some businesses, uh, so you've really got back to 767 00:40:04,868 --> 00:40:08,143 understanding yourself before you can understand your, your enemy. 768 00:40:08,933 --> 00:40:11,333 'cause your enemy's gonna probably know you better than you. 769 00:40:11,453 --> 00:40:11,903 You do. 770 00:40:11,903 --> 00:40:16,253 In order to be successful, uh, you've really gotta understand your business. 771 00:40:16,313 --> 00:40:21,353 And so again, if your business is, uh, highly driven by your workforce and your 772 00:40:21,353 --> 00:40:24,833 workforce is out, you know, on the, on the, you know, they're road warriors or 773 00:40:24,833 --> 00:40:26,843 they're working from home, absolutely. 774 00:40:26,843 --> 00:40:29,873 Endpoint protection is a priority because they're prob, they 775 00:40:29,873 --> 00:40:31,793 probably have company data on that. 776 00:40:32,033 --> 00:40:37,613 Device or they're using that device to log into, you know, VPN or, or your cloud. 777 00:40:37,973 --> 00:40:41,063 And so if that device is compromised, then your, your 778 00:40:41,063 --> 00:40:44,213 production network, your production environment may be compromised also. 779 00:40:44,843 --> 00:40:48,653 But what if, what if you're, you're a data center and you don't have, all 780 00:40:48,653 --> 00:40:51,353 your endpoints are servers, right? 781 00:40:51,803 --> 00:40:54,953 Uh, and then so, but then there also. 782 00:40:55,268 --> 00:40:57,938 Co, uh, co-managed, they're, they're not yours. 783 00:40:58,298 --> 00:41:03,398 You, you own the hardware, but you don't own the, the, the, the virtual 784 00:41:03,398 --> 00:41:05,168 machines or, or, or what have you. 785 00:41:05,168 --> 00:41:07,328 So now your, your focus is your perimeter 786 00:41:07,838 --> 00:41:09,008 and your connectivity. 787 00:41:09,548 --> 00:41:13,058 Uh, so I think those are two extreme, you know, one, one end of the other. 788 00:41:13,358 --> 00:41:17,498 Uh, but truly understand your environment first, uh, and where you're. 789 00:41:17,828 --> 00:41:22,028 Your critical assets are, and your data and your use cases, uh, and what's 790 00:41:22,028 --> 00:41:24,428 most likely impacting your business. 791 00:41:24,848 --> 00:41:28,058 Uh, and then from that, uh, derive your priorities. 792 00:41:28,063 --> 00:41:28,283 And, 793 00:41:28,583 --> 00:41:28,803 Hmm 794 00:41:29,978 --> 00:41:32,528 and there are some, there are some organizations that fit smack dab 795 00:41:32,528 --> 00:41:35,978 in the middle, and you just have to have good hygiene across all of it. 796 00:41:36,608 --> 00:41:37,088 Uh, 797 00:41:39,878 --> 00:41:42,728 I could, I could probably go on for hours on, on a good 798 00:41:42,728 --> 00:41:44,798 approach to this, but the, the. 799 00:41:45,278 --> 00:41:46,118 It all depends. 800 00:41:46,303 --> 00:41:47,048 Next episode. 801 00:41:48,488 --> 00:41:54,758 The, the other real quick thing, uh, in order to know how, and, and this kind 802 00:41:54,758 --> 00:41:58,958 of tags on to know yourself, but there's a lot of organizations that aren't real 803 00:41:58,958 --> 00:42:03,968 familiar, uh, or real accurate with all the things they need to protect anyway. 804 00:42:04,268 --> 00:42:05,588 Similar to backups. 805 00:42:06,068 --> 00:42:07,718 You know, I can, yeah, I can run back up. 806 00:42:08,783 --> 00:42:13,883 But I can only back up what I know about, uh, and ideally even, even more 807 00:42:13,883 --> 00:42:17,843 so to the next level, how important, how do I prioritize those backups? 808 00:42:18,533 --> 00:42:19,703 Security is the same. 809 00:42:19,763 --> 00:42:21,473 Uh, I can only secure what I know. 810 00:42:22,163 --> 00:42:25,373 And if, if there's stuff on the network and there's stuff in the cloud and 811 00:42:25,373 --> 00:42:28,523 there's people working from home that I don't know, then I can't protect that. 812 00:42:29,153 --> 00:42:32,003 And if I am gonna protect it, how do I protect it? 813 00:42:32,063 --> 00:42:33,743 You know that, that visibility part. 814 00:42:33,743 --> 00:42:36,743 How do I get the data from those things, those tools? 815 00:42:37,433 --> 00:42:41,063 To know if there's a problem and how to respond to it. 816 00:42:41,063 --> 00:42:42,053 Is it automated? 817 00:42:42,053 --> 00:42:42,983 Is it a person? 818 00:42:43,583 --> 00:42:49,013 Um, and then all of that is going to kind of bubble up to what are my options and 819 00:42:49,013 --> 00:42:50,753 what does it cost and what do I need? 820 00:42:50,753 --> 00:42:52,733 Is that, is that something I can do on my own? 821 00:42:52,733 --> 00:42:57,293 Is that, uh, opportunity to bring in a managed service provider? 822 00:42:57,863 --> 00:43:02,753 Um, and I think real quick on, on, on the, the cost, I think 823 00:43:02,753 --> 00:43:04,763 there's a big misconception that. 824 00:43:05,153 --> 00:43:06,143 Yeah, I'm a small company. 825 00:43:06,143 --> 00:43:08,693 I can't afford cybersecurity. 826 00:43:08,783 --> 00:43:10,583 Uh, that is a huge misconception. 827 00:43:10,583 --> 00:43:14,663 There are, there are a number of providers out there like us that, that 828 00:43:14,663 --> 00:43:19,073 are flexible and scalable and I mean, our, our smallest we have, we have 829 00:43:19,073 --> 00:43:22,373 clients that just have two employees and they work out of their garage. 830 00:43:22,883 --> 00:43:27,953 But they are, they've determined, uh, from an analysis of themselves that 831 00:43:27,953 --> 00:43:31,313 they, they are, they have a huge cyber risk and they need that protection. 832 00:43:32,198 --> 00:43:38,108 And so, uh, it, it can be affordable, um, if we know what we're protecting and, 833 00:43:38,168 --> 00:43:40,403 and what the, what the playbooks are. 834 00:43:42,218 --> 00:43:44,798 I know a couple of guys that do a podcast from their dining room. 835 00:43:48,833 --> 00:43:51,773 Well, hey Mike, it's been great talking to you again. 836 00:43:52,053 --> 00:43:52,578 It's the whole thing of like. 837 00:43:53,433 --> 00:43:56,673 There, there's a lot of people, by the way, who do literally say, I don't 838 00:43:56,673 --> 00:43:58,173 have enough money for backup too. 839 00:43:58,203 --> 00:43:58,623 Right. 840 00:43:58,698 --> 00:44:01,413 And, and just like, you know, makes my head explode. 841 00:44:01,743 --> 00:44:04,833 So, um, uh, yeah. 842 00:44:04,953 --> 00:44:05,913 Thanks for bringing that up. 843 00:44:06,483 --> 00:44:07,383 All right, folks. 844 00:44:07,443 --> 00:44:12,243 Um, and Prasanna, thanks for, thanks for, uh, being here as, as always. 845 00:44:13,188 --> 00:44:14,148 Yeah, no, this was fun. 846 00:44:14,148 --> 00:44:15,588 And Mike, it's been great chatting. 847 00:44:15,588 --> 00:44:16,338 It's been a while. 848 00:44:16,338 --> 00:44:18,078 So glad to have you back on. 849 00:44:18,918 --> 00:44:20,118 For sure I missed you. 850 00:44:21,393 --> 00:44:21,843 Yeah. 851 00:44:22,293 --> 00:44:27,183 And, uh, thanks to the, uh, our listeners, uh, we'd be nothing without you. 852 00:44:27,483 --> 00:44:28,548 That is a wrap. 853 00:44:31,458 --> 00:44:36,168 The backup wrap up is written, recorded and produced by me w Curtis Preston. 854 00:44:36,708 --> 00:44:38,178 If you need backup or Dr. 855 00:44:38,178 --> 00:44:41,808 Consulting content generation or expert witness work, 856 00:44:42,108 --> 00:44:44,088 check out backup central.com. 857 00:44:44,808 --> 00:44:47,928 You can also find links from my O'Reilly Books on the same website. 858 00:44:48,588 --> 00:44:52,698 Remember, this is an independent podcast and any opinions that you 859 00:44:52,698 --> 00:44:54,588 hear are those of the speaker. 860 00:44:54,653 --> 00:44:56,513 And not necessarily an employer. 861 00:44:57,413 --> 00:44:58,133 Thanks for listening.