1 00:00:19,626 --> 00:00:21,006 this episode is a good one. 2 00:00:21,186 --> 00:00:25,866 We've got a cybersecurity expert that has been in the room when people are 3 00:00:26,016 --> 00:00:28,836 responding to various cyber attacks. 4 00:00:29,136 --> 00:00:30,756 He's got some great stories. 5 00:00:30,756 --> 00:00:33,036 I love listening to them and I know you will too. 6 00:00:33,426 --> 00:00:34,086 Hope you enjoy it. 7 00:00:36,731 --> 00:00:38,051 hi, and welcome to backup. 8 00:00:38,051 --> 00:00:39,767 Central's restored all podcast. 9 00:00:39,767 --> 00:00:42,377 W. Curtis Preston: I'm your host, w Curtis Preston, a k a, Mr. 10 00:00:42,377 --> 00:00:42,917 Backup. 11 00:00:43,277 --> 00:00:47,357 And I have with me a guy who once again, has astonished me with knowledge 12 00:00:47,357 --> 00:00:50,297 that why does he know this stuff? 13 00:00:50,747 --> 00:00:53,267 He's gonna solve my office chair problem. 14 00:00:53,857 --> 00:00:56,057 Prasanna Malaiyandi how's it going? 15 00:00:56,057 --> 00:00:56,607 Prasanna, 16 00:00:57,017 --> 00:00:58,487 Prasanna Malaiyandi: I am good, Curtis. 17 00:00:58,487 --> 00:00:59,387 I'm good. 18 00:00:59,387 --> 00:01:02,627 So yeah, let's talk about you needing a new office chair. 19 00:01:03,557 --> 00:01:04,607 W. Curtis Preston: so it, it 20 00:01:04,682 --> 00:01:05,432 Prasanna Malaiyandi: show the listeners. 21 00:01:05,432 --> 00:01:06,422 Just, just squeak. 22 00:01:06,562 --> 00:01:07,397 W. Curtis Preston: Well, let's, yeah. 23 00:01:07,577 --> 00:01:13,367 So this is, so, you know, in a, in a podcast, my mic is picking 24 00:01:13,367 --> 00:01:15,197 up my squeaky office chair. 25 00:01:15,587 --> 00:01:19,097 And so either I need a new office chair or I need to lose a few pounds. 26 00:01:19,097 --> 00:01:20,567 One or the other, or maybe both. 27 00:01:21,047 --> 00:01:25,037 But uh, so you brought up what was the, it was Crandall. 28 00:01:25,832 --> 00:01:26,102 Prasanna Malaiyandi: Yep. 29 00:01:26,102 --> 00:01:26,762 Crandall Furniture. 30 00:01:27,577 --> 00:01:27,872 W. Curtis Preston: Yeah. 31 00:01:27,932 --> 00:01:31,322 Crel Furniture, which is, they're, they're apparently repurposing, 32 00:01:31,442 --> 00:01:34,772 uh, you know, all those office chairs that nobody's using anymore. 33 00:01:35,012 --> 00:01:35,312 Prasanna Malaiyandi: Yeah. 34 00:01:36,527 --> 00:01:37,937 Yeah, they buy chairs. 35 00:01:37,937 --> 00:01:40,337 They refurbish them with like new foam. 36 00:01:40,337 --> 00:01:42,737 They fix the lift mechanism. 37 00:01:42,737 --> 00:01:45,797 Sometimes they replace the arms and then they resell it at a discount. 38 00:01:46,662 --> 00:01:46,952 W. Curtis Preston: Yeah, 39 00:01:47,117 --> 00:01:49,637 Prasanna Malaiyandi: it's crazy how expensive office chairs are. 40 00:01:49,642 --> 00:01:53,747 Like some of the high-end ones are like a thousand, $1,800. 41 00:01:53,747 --> 00:01:55,067 Who wants to spend that on a chair? 42 00:01:55,067 --> 00:01:55,637 Like I get it. 43 00:01:55,637 --> 00:01:59,267 You spend a lot of time sitting in a chair just like you do, sleeping in a bed. 44 00:01:59,297 --> 00:02:03,527 But still, it's a good chunk of money to spend when you can go to like 45 00:02:03,797 --> 00:02:08,237 your local office, supply store and pick up a cheap chair for like $99. 46 00:02:08,657 --> 00:02:11,267 W. Curtis Preston: Yeah, and I don't think this was 99, but 47 00:02:11,267 --> 00:02:12,407 it wasn't much more than that. 48 00:02:13,187 --> 00:02:16,697 I don't, I don't have, if, if I had to guess, I probably got it from Costco. 49 00:02:17,207 --> 00:02:17,927 'cause I get. 50 00:02:18,497 --> 00:02:20,027 Many other things from Costco. 51 00:02:20,087 --> 00:02:20,447 Right. 52 00:02:21,047 --> 00:02:22,547 Um, but yeah, 53 00:02:22,637 --> 00:02:24,017 Prasanna Malaiyandi: I had one of those chairs. 54 00:02:24,197 --> 00:02:27,437 I had one of those chairs as well, right, where I was like, yeah, it worked well. 55 00:02:27,442 --> 00:02:31,307 And then I'll, once the pandemic hit and we were working from home, I ended up 56 00:02:31,307 --> 00:02:36,047 getting some wellness dollars from my employer and use that to get myself a 57 00:02:36,047 --> 00:02:37,847 nice standing desk and an office chair. 58 00:02:39,077 --> 00:02:39,497 W. Curtis Preston: Yeah. 59 00:02:39,597 --> 00:02:45,217 Um, so I, I think I got the same wellness money. 60 00:02:46,232 --> 00:02:48,452 And I spent it on a webcam. 61 00:02:49,262 --> 00:02:49,982 That's what I did. 62 00:02:49,982 --> 00:02:50,072 I, 63 00:02:50,147 --> 00:02:52,487 Prasanna Malaiyandi: sorry, this is for my current employer 64 00:02:52,652 --> 00:02:54,062 W. Curtis Preston: Oh, for your current employer? 65 00:02:54,152 --> 00:02:54,632 Oh, that's right. 66 00:02:54,662 --> 00:02:56,062 We, because we were at the same employer. 67 00:02:56,717 --> 00:02:59,567 But you're saying you got wellness money from your, your new employer, 68 00:02:59,987 --> 00:03:03,827 um, and, uh, which is, you know, just as good as time as any to mention 69 00:03:03,827 --> 00:03:05,597 that this is an independent podcast. 70 00:03:05,597 --> 00:03:10,937 We're not representing, uh, you know, any employers or non employers in my case. 71 00:03:11,237 --> 00:03:12,787 And, um, I. 72 00:03:12,787 --> 00:03:15,517 You know that, uh, the opinions that you hear are ours. 73 00:03:15,817 --> 00:03:19,657 And also, uh, be sure to rate us, uh, uh, uh, you know, by, uh, 74 00:03:19,717 --> 00:03:20,977 going to your favorite podcast. 75 00:03:20,977 --> 00:03:23,227 You're scrolling down and giving us all the stars and comments. 76 00:03:23,227 --> 00:03:24,907 We'd love seeing comments from listeners. 77 00:03:25,357 --> 00:03:28,777 And if you'd like to be a part of the conversation, I could be 78 00:03:28,782 --> 00:03:34,717 reached at w Curtis Preston at gmail or um, WC Preston on Twitter. 79 00:03:35,012 --> 00:03:39,422 And also linkedin.com/in/mr. 80 00:03:39,422 --> 00:03:39,992 Backup. 81 00:03:39,992 --> 00:03:40,562 That is Mr. 82 00:03:40,562 --> 00:03:43,772 Backup on LinkedIn and you can find me. 83 00:03:44,162 --> 00:03:49,052 And, uh, with that we'll turn off to our guest at this moment. 84 00:03:49,352 --> 00:03:54,422 Uh, he's, uh, specialized in cybersecurity for over 20 years and is a member of 85 00:03:54,452 --> 00:03:57,772 F B I InfraGard, which is A group that I didn't even know existed. 86 00:03:57,772 --> 00:04:01,132 But it's a partnership between the F B I and the private sector for the 87 00:04:01,137 --> 00:04:03,232 protection of US critical infrastructure. 88 00:04:03,532 --> 00:04:08,332 He's now the c e O of Black Swan, a company that strives to democratize 89 00:04:08,332 --> 00:04:10,432 enterprise level security services. 90 00:04:10,642 --> 00:04:13,642 Which one of my first questions is gonna be, what does that mean? 91 00:04:13,882 --> 00:04:16,132 Welcome to the pod, Mike Sailor. 92 00:04:17,302 --> 00:04:17,602 Mike Saylor: Thank you. 93 00:04:17,602 --> 00:04:18,322 Thanks for having me 94 00:04:19,252 --> 00:04:20,182 W. Curtis Preston: so what does that mean? 95 00:04:21,002 --> 00:04:21,222 So 96 00:04:22,552 --> 00:04:23,182 Mike Saylor: Well, uh, 97 00:04:23,242 --> 00:04:25,642 W. Curtis Preston: on your website that it says you wanted to democratize 98 00:04:25,642 --> 00:04:27,232 enterprise level security services. 99 00:04:28,012 --> 00:04:28,282 Mike Saylor: Sure. 100 00:04:28,282 --> 00:04:35,782 Well, I think in, in, you know, simple explanation is that we're trying to 101 00:04:35,782 --> 00:04:38,662 provide, uh, enterprise class services. 102 00:04:38,662 --> 00:04:42,532 The, you know what, what the big boys pay for Fortune 50, fortune 100. 103 00:04:42,937 --> 00:04:47,137 And make it affordable and scalable and flexible enough for smaller organizations, 104 00:04:47,142 --> 00:04:48,637 small, medium sized businesses. 105 00:04:49,057 --> 00:04:52,357 Uh, part of our mission is to provide that enterprise class service to 106 00:04:52,357 --> 00:04:54,337 what we consider underserved markets. 107 00:04:54,667 --> 00:05:00,487 So, uh, education, uh, family offices, uh, credit unions as an example. 108 00:05:00,877 --> 00:05:04,267 Um, but also understanding that in each one of those situations you've 109 00:05:04,267 --> 00:05:06,937 got a variety of, uh, business sizes. 110 00:05:06,937 --> 00:05:09,787 So you've got a five person credit union and you've got a 111 00:05:09,787 --> 00:05:10,927 billion dollar credit union. 112 00:05:11,317 --> 00:05:16,387 Uh, and they both need, uh, help, uh, understanding and applying, um, 113 00:05:16,807 --> 00:05:19,177 cybersecurity controls and, and services. 114 00:05:19,662 --> 00:05:23,592 Prasanna Malaiyandi: So what happens today for those small customers, right? 115 00:05:23,592 --> 00:05:27,282 Or like the five person credit union, like how do they even 116 00:05:27,282 --> 00:05:29,142 approach cybersecurity today? 117 00:05:29,142 --> 00:05:31,022 Or what is their solutions look like? 118 00:05:32,227 --> 00:05:33,697 Mike Saylor: Uh, they usually don't have one. 119 00:05:33,787 --> 00:05:34,587 Um, I. 120 00:05:34,587 --> 00:05:38,857 And they even have to, uh, in, in a lot of cases, have to outsource their just normal 121 00:05:38,857 --> 00:05:40,987 help desk, you know, hardware support. 122 00:05:41,257 --> 00:05:47,047 And they're relying on that, you know, that technology expertise to, uh, assist 123 00:05:47,047 --> 00:05:49,537 them in cyber to the extent possible. 124 00:05:50,047 --> 00:05:51,637 Um, but that's changing. 125 00:05:51,697 --> 00:05:56,677 Um, and it, and it has to, uh, a lot of, uh, services and. 126 00:05:57,367 --> 00:06:00,397 Protections and controls that any organization today rely 127 00:06:00,397 --> 00:06:01,957 on, like, like insurance. 128 00:06:02,587 --> 00:06:06,517 Uh, in order to qualify for cybersecurity insurance policies, you have to 129 00:06:06,517 --> 00:06:11,527 demonstrate these, you know, kind of, uh, good cyber hygiene practices, uh, whether 130 00:06:11,527 --> 00:06:13,297 you do it internally or you outsource it. 131 00:06:13,302 --> 00:06:18,457 Uh, and so in order just to even get insurance, uh, you have to, uh, spend 132 00:06:18,457 --> 00:06:21,157 some money to check some of these boxes. 133 00:06:21,637 --> 00:06:24,727 Um, and they're just, there's, there's not a whole lot of solutions out 134 00:06:24,727 --> 00:06:26,527 there options for them to, to go with. 135 00:06:27,967 --> 00:06:28,747 W. Curtis Preston: Interesting. 136 00:06:28,837 --> 00:06:33,607 Um, and let's talk also a little bit about, uh, F B I in regard. 137 00:06:34,147 --> 00:06:37,117 'cause like I said, I, I did, I didn't even know this in, I'm, I'm 138 00:06:37,117 --> 00:06:40,327 really glad to hear that it exists, but I didn't even know it exists. 139 00:06:40,687 --> 00:06:42,557 Uh, what, what, what does that look like? 140 00:06:43,672 --> 00:06:44,062 Mike Saylor: Sure. 141 00:06:44,122 --> 00:06:46,912 Uh, well, so it started in the late nineties. 142 00:06:46,972 --> 00:06:51,322 Uh, I think the, the first chapter was, uh, um, in the mid nineties. 143 00:06:51,402 --> 00:06:59,827 Um, and the, the idea is, Uh, for every F B I field office, um, there should be 144 00:06:59,827 --> 00:07:05,587 an InfraGuard chapter, and the objective of the chapter is to tie the office into 145 00:07:05,587 --> 00:07:11,558 the community, thereby, uh, expanding its eyes and ears, uh, but also, um, 146 00:07:12,007 --> 00:07:17,977 helping elevate the, uh, intelligence and awareness of the organizations in the 147 00:07:17,977 --> 00:07:21,607 community, uh, for the things that the F B I and that community is working on. 148 00:07:22,072 --> 00:07:26,542 Uh, so some, some bi-directional, uh, intelligence sharing, which 149 00:07:26,542 --> 00:07:28,162 really didn't happen for a long time. 150 00:07:28,192 --> 00:07:31,492 It's probably only been in the last five or six years that that's, that's 151 00:07:31,497 --> 00:07:33,532 really, uh, become more valuable. 152 00:07:33,952 --> 00:07:38,092 Um, prior to that, you, you might get an infra regard notice, 153 00:07:38,092 --> 00:07:41,962 uh, a few hours or a day before something comes out on the news. 154 00:07:41,992 --> 00:07:44,302 So you really weren't ahead of it too much. 155 00:07:44,872 --> 00:07:48,412 Um, but so now there's, there's 45 chapters. 156 00:07:48,802 --> 00:07:50,752 Of InfraGard throughout the country. 157 00:07:50,842 --> 00:07:53,752 Uh, there's an InfraGard National Alliance that kind of manages 158 00:07:53,757 --> 00:07:55,522 all those independent chapters. 159 00:07:55,972 --> 00:07:59,602 Um, and the chapters are made up of people from the community, 160 00:07:59,662 --> 00:08:01,372 uh, across all sectors. 161 00:08:01,432 --> 00:08:03,832 Uh, kind of initially it was all technology people. 162 00:08:04,252 --> 00:08:09,232 Uh, so 90, 90 plus percent, uh, membership and InfraGard were people and, you know, 163 00:08:09,292 --> 00:08:11,872 CIOs and engineers and help desk people. 164 00:08:12,262 --> 00:08:18,127 Uh, but today we have nurses and doctors and farmers and, um, People 165 00:08:18,127 --> 00:08:22,927 that work in infrastructure, water dams, uh, federal government, um, 166 00:08:23,257 --> 00:08:26,977 agriculture, I mentioned, um, nuclear. 167 00:08:27,487 --> 00:08:33,067 Uh, so each critical infrastructure section sector, uh, has an infra regard 168 00:08:33,067 --> 00:08:36,217 sector chief, uh, at each chapter. 169 00:08:36,277 --> 00:08:38,117 Uh, who is responsible for going out and. 170 00:08:38,767 --> 00:08:42,787 Uh, not just recruiting others from that sector, uh, to kind of 171 00:08:42,787 --> 00:08:46,867 strengthen the, the mix and dynamics of the chapters, uh, membership. 172 00:08:47,347 --> 00:08:53,407 Um, but it's also, uh, both a feeder into the F B I, uh, for intelligence 173 00:08:53,407 --> 00:08:56,527 and threats and awareness of what's going on out in the community, uh, 174 00:08:56,527 --> 00:09:00,667 but also the FBI's ability to, to, uh, To share with them so that they 175 00:09:00,667 --> 00:09:05,017 can do their job better, uh, get ahead of threats, um, be more aware. 176 00:09:05,527 --> 00:09:10,537 Uh, so it's been a pretty, pretty effective, um, partnership over the years. 177 00:09:10,597 --> 00:09:13,567 Uh, I helped stand up the North Texas chapter in the late nineties, and 178 00:09:13,567 --> 00:09:16,597 I've, I've been sector, I'm currently a sector chief over healthcare. 179 00:09:16,627 --> 00:09:18,277 I was a sector chief over technology. 180 00:09:18,277 --> 00:09:20,137 Initially I was the president of the chapter. 181 00:09:20,677 --> 00:09:23,407 Um, and we have a, a pretty strong. 182 00:09:23,947 --> 00:09:27,517 Uh, showing, uh, in our company as far as InfraGard goes, our 183 00:09:27,517 --> 00:09:29,437 c f O was a, a past president. 184 00:09:29,437 --> 00:09:34,177 She's also the past, uh, national regional representative over I think 185 00:09:34,177 --> 00:09:35,377 three or four different states. 186 00:09:35,827 --> 00:09:38,527 Our c o o was the president of the Houston chapter. 187 00:09:38,527 --> 00:09:41,107 He was also a national regional rep for a period of time. 188 00:09:41,557 --> 00:09:44,017 Uh, and then everybody in our company pretty much is a member. 189 00:09:44,557 --> 00:09:47,677 Um, and there's similar, there's a similar, uh, organization 190 00:09:47,677 --> 00:09:48,847 for the Secret Service. 191 00:09:48,847 --> 00:09:49,507 They call it. 192 00:09:49,507 --> 00:09:53,347 They used to call it the Electronic Crimes Task Force, of which I'm also a member. 193 00:09:53,857 --> 00:09:57,427 Uh, and then both of those are kind of related to the, in Texas we have the 194 00:09:57,427 --> 00:10:01,507 North Texas Crime Commission and they have subcommittees like cyber crime. 195 00:10:01,657 --> 00:10:07,117 And then, uh, the fusion centers that police departments, uh, fun, uh, operate. 196 00:10:07,267 --> 00:10:12,457 Um, in north Texas, there's the Collin County Sheriff Fusion Center, uh, from 197 00:10:12,457 --> 00:10:14,707 which I'm also a fusion liaison officer. 198 00:10:15,067 --> 00:10:18,127 So tons of intelligence sharing, information sharing. 199 00:10:19,072 --> 00:10:23,482 Uh, both to support the community, but also naturally with what we do, uh, that 200 00:10:23,482 --> 00:10:27,052 feeds really nicely into the value that we can, uh, we can give our clients. 201 00:10:27,967 --> 00:10:28,687 Prasanna Malaiyandi: That's awesome. 202 00:10:28,687 --> 00:10:32,587 I actually, like you said, Curtis, I had never heard about this and Mike, 203 00:10:32,587 --> 00:10:36,217 thank you for going into details because that's actually a really cool program. 204 00:10:36,217 --> 00:10:39,157 Like I didn't realize that the F B I connected in like this in 205 00:10:39,487 --> 00:10:42,127 sort of a systematic way, right? 206 00:10:42,127 --> 00:10:43,957 To all these other organizations. 207 00:10:44,132 --> 00:10:44,552 Mike Saylor: Mm-hmm. 208 00:10:44,782 --> 00:10:47,512 W. Curtis Preston: Yeah, we've, we've come a long way since, um, 209 00:10:47,542 --> 00:10:52,102 the days of the cuckoo's egg, which I'm, I'm assuming you've read a 210 00:10:52,102 --> 00:10:54,262 Cuckoo's Egg or the c the cuckoo egg. 211 00:10:54,262 --> 00:10:58,012 I think, you know, because in that story from Cliff Sto back in the 212 00:10:58,012 --> 00:11:02,242 day when he contacts the F B I about a cyber attack that's happening on 213 00:11:02,242 --> 00:11:05,212 his infrastructure, They're like, well, did they steal anything? 214 00:11:05,662 --> 00:11:05,902 Right. 215 00:11:06,172 --> 00:11:09,772 They didn't, they really weren't aware of the concept of a cybersecurity attack. 216 00:11:10,072 --> 00:11:11,812 So I, I'm, I'm glad to hear that. 217 00:11:11,812 --> 00:11:13,972 You know, things have come a long way since that was the 218 00:11:13,977 --> 00:11:15,802 seventies, so, you know, whatever, 219 00:11:15,877 --> 00:11:16,777 Mike Saylor: And, and on 220 00:11:16,777 --> 00:11:17,077 the, 221 00:11:17,097 --> 00:11:17,932 W. Curtis Preston: while since then. 222 00:11:18,682 --> 00:11:20,002 Mike Saylor: Kind of along those lines. 223 00:11:20,032 --> 00:11:24,622 Uh, the other benefit of that is, uh, similar to the situation where, you know, 224 00:11:24,622 --> 00:11:27,262 there was an event, uh, we always preach. 225 00:11:27,352 --> 00:11:30,592 Uh, as far as incident response goes, you've gotta get ahead of that so that 226 00:11:30,597 --> 00:11:35,632 on game day, you know what players you can call into the, to, uh, onto the field 227 00:11:35,637 --> 00:11:37,642 and uh, you know, who's gonna show up. 228 00:11:37,642 --> 00:11:40,432 And so, um, you know, we're very adamant about. 229 00:11:41,182 --> 00:11:44,872 Establishing those relationships with law enforcement and subject matter experts 230 00:11:44,872 --> 00:11:47,782 and vendors in the community so that when something bad happens, you're not 231 00:11:47,782 --> 00:11:51,562 leaving a voicemail, you're not having to figure out the right person to talk to. 232 00:11:51,982 --> 00:11:55,672 And so in regard, and the, uh, the Secret Service organizations give you 233 00:11:55,672 --> 00:11:59,032 the opportunity to actually go to, they have chapter meetings and a lot of 234 00:11:59,032 --> 00:12:02,752 times they're at the, the FBI's field office, which is also kind of cool. 235 00:12:03,262 --> 00:12:06,442 Um, and so you get to meet people and exchange business cards and go 236 00:12:06,442 --> 00:12:09,592 to coffee and have their cell phone number instead of a mailbox number and. 237 00:12:10,147 --> 00:12:13,297 Um, and find the right person to talk to so that you can put 'em in your 238 00:12:13,297 --> 00:12:17,107 plan and you know who to call and they already know you, they've met you before. 239 00:12:17,107 --> 00:12:19,657 It's not a first date type of situation. 240 00:12:19,657 --> 00:12:22,987 So when, when, when things are going bad and the the house is 241 00:12:22,987 --> 00:12:27,097 on fire, uh, you know who to call and, um, they know who you are. 242 00:12:27,652 --> 00:12:29,842 W. Curtis Preston: Yeah, I preached the, the same thing, Mike, and, 243 00:12:29,847 --> 00:12:35,362 and, and so it's, but it sounds like InfraGard is a, is a organization 244 00:12:35,362 --> 00:12:38,692 that I can contact, go to these meetings that you were talking about. 245 00:12:38,692 --> 00:12:40,852 That, that it, that it could be that liaison. 246 00:12:41,242 --> 00:12:43,312 So that I can start to form those relationships. 247 00:12:43,342 --> 00:12:46,522 'cause you're right, it's like, uh, you know, just reaching out to, to the 248 00:12:46,522 --> 00:12:51,982 F B I blindly, um, you know, Hey, I'd like to talk to you about a potential 249 00:12:51,987 --> 00:12:53,902 future event that might happen. 250 00:12:54,232 --> 00:12:54,562 Right. 251 00:12:54,562 --> 00:12:57,052 So it sounds like Ingar can be that liaison then. 252 00:12:57,052 --> 00:12:57,112 I 253 00:12:57,697 --> 00:12:58,687 Mike Saylor: And, and you're right. 254 00:12:58,687 --> 00:13:03,817 And they do have, uh, they have, uh, speaker, um, what do they call it? 255 00:13:03,907 --> 00:13:08,887 Um, you can, you can sign up to be a speaker, uh, like as a 256 00:13:08,887 --> 00:13:10,717 resource, uh, subject matter expert. 257 00:13:10,987 --> 00:13:15,007 But then the F b I also has, uh, speakers that can come to your event. 258 00:13:15,442 --> 00:13:19,642 And so very often you can pull in that, that law enforcement, uh, perspective 259 00:13:19,642 --> 00:13:21,592 to, to your message and your content. 260 00:13:21,592 --> 00:13:24,592 And they'll bring their own slides and, you know, whatever data they 261 00:13:24,592 --> 00:13:28,402 can, they can share publicly as far as current events and statistics. 262 00:13:28,407 --> 00:13:32,722 And it's, it's usually a pretty good, uh, value add, uh, as far as content. 263 00:13:32,842 --> 00:13:34,732 And, and sometimes it's a, it's a draw. 264 00:13:35,182 --> 00:13:38,602 Uh, you know, people may not want to just come see me talk, but if it's me plus 265 00:13:38,602 --> 00:13:41,812 the supervisory special agent over cyber, then all of a sudden it's interesting. 266 00:13:42,412 --> 00:13:43,132 Uh, so. 267 00:13:43,867 --> 00:13:44,407 Um, 268 00:13:44,437 --> 00:13:44,647 yeah, 269 00:13:44,827 --> 00:13:45,337 Prasanna Malaiyandi: for you, Mike. 270 00:13:45,337 --> 00:13:45,787 Come on. 271 00:13:46,387 --> 00:13:47,407 Mike Saylor: there's a lot of value. 272 00:13:47,407 --> 00:13:48,877 There's a lot of value in membership. 273 00:13:48,937 --> 00:13:51,997 Um, each chapter has their own dues. 274 00:13:52,027 --> 00:13:56,047 Like our, I think our chapter, it's 25 or $50 a year. 275 00:13:56,497 --> 00:14:01,477 Uh, but that also pays for, um, you know, food at an event or you get 276 00:14:01,482 --> 00:14:03,427 discounts to go into some conference. 277 00:14:03,457 --> 00:14:08,347 Uh, so there's a lot of, a lot of kind of cool ecosystem, um, you belong to 278 00:14:08,347 --> 00:14:09,907 once, once you, uh, become a member. 279 00:14:10,597 --> 00:14:13,267 Prasanna Malaiyandi: I am surprised this isn't publicized more 280 00:14:14,977 --> 00:14:20,557 Mike Saylor: It's infraguard.org I N F R A G A R d.org. 281 00:14:20,797 --> 00:14:21,817 W. Curtis Preston: Yeah, I'm all over 282 00:14:21,912 --> 00:14:23,197 Mike Saylor: you can sign up online. 283 00:14:23,557 --> 00:14:28,147 The, uh, the application process is, is can be kind of long, anywhere 284 00:14:28,147 --> 00:14:30,967 from, you know, 45 to 120 days. 285 00:14:31,477 --> 00:14:34,927 Uh, they do a cursory background and then each office has to do kind 286 00:14:34,927 --> 00:14:39,997 of a vetting, uh, to determine if, uh, You know, membership is for you. 287 00:14:40,597 --> 00:14:44,497 Uh, but then, uh, you're invited to kind of a new member session 288 00:14:44,497 --> 00:14:48,937 and you get to meet people, the board, uh, other members, uh, F B I. 289 00:14:48,937 --> 00:14:52,087 And, and one of the things that I'll mention is, so for every InfraGard 290 00:14:52,092 --> 00:14:55,537 chapter there is a full-time F B I agent that is your liaison. 291 00:14:55,627 --> 00:14:58,057 And they, so they kind of manage from the F B I side. 292 00:14:58,462 --> 00:15:00,832 Everything your chapter's doing, even though your chapter has its 293 00:15:00,832 --> 00:15:03,982 own board of directors and event planning and all that stuff, there's 294 00:15:03,982 --> 00:15:06,052 always a full-time F b I person. 295 00:15:06,082 --> 00:15:10,102 Um, at your event, at your board meeting, um, kind of the liaison 296 00:15:10,102 --> 00:15:13,042 for anything you need that the, that the bureau can, can help you with. 297 00:15:13,687 --> 00:15:14,407 Prasanna Malaiyandi: That's awesome. 298 00:15:14,587 --> 00:15:14,797 Now, 299 00:15:15,607 --> 00:15:15,937 W. Curtis Preston: Go ahead. 300 00:15:17,257 --> 00:15:19,717 Prasanna Malaiyandi: just a follow up, I know you talked about sort of 301 00:15:19,717 --> 00:15:21,927 establishing those relationships, right? 302 00:15:21,927 --> 00:15:29,047 With other people who are in the chapter, do they do things like tabletop exercises 303 00:15:29,047 --> 00:15:30,577 or other things or is that kind of, I. 304 00:15:31,462 --> 00:15:33,192 Outside the scope of this group. 305 00:15:34,567 --> 00:15:37,687 Mike Saylor: So the, the InfraGard membership, well, and, and different 306 00:15:37,687 --> 00:15:40,867 chapters do different things like the Louisiana chapter is there. 307 00:15:41,662 --> 00:15:47,362 They're kind of known for, um, uh, anti, you know, maritime 308 00:15:47,422 --> 00:15:50,152 anti drone capabilities. 309 00:15:50,422 --> 00:15:53,662 So there are people at, in that chapter that are involved in how to 310 00:15:53,662 --> 00:15:58,372 protect businesses along the river, uh, from drones and drone strikes and 311 00:15:58,372 --> 00:15:59,902 surveillance and all that good stuff. 312 00:16:00,292 --> 00:16:03,142 And so they, they do exercises pretty often and they have 313 00:16:03,142 --> 00:16:04,282 some really good events. 314 00:16:04,582 --> 00:16:06,982 And they're, the Houston chapter's, good New York chapter. 315 00:16:06,982 --> 00:16:11,602 Not only do they do, um, Exercises, but they have a podcast, so 316 00:16:11,602 --> 00:16:13,192 they, they broadcast things. 317 00:16:13,192 --> 00:16:15,952 I, I wanna say it was at least weekly, maybe monthly, but I 318 00:16:15,952 --> 00:16:19,372 think it's weekly and they're very well known for their multimedia. 319 00:16:19,912 --> 00:16:22,552 Um, and so there, there are different chapters kind of 320 00:16:22,552 --> 00:16:24,112 specialize and do their own thing. 321 00:16:24,262 --> 00:16:29,527 Um, But then you're also invited to bigger events. 322 00:16:29,617 --> 00:16:34,477 Uh, so, um, I know that there's kind of a, uh, a large scale FEMA 323 00:16:34,477 --> 00:16:36,547 event, uh, every now and then. 324 00:16:36,577 --> 00:16:39,217 And so we're, you know, we're invited to participate in that. 325 00:16:39,637 --> 00:16:42,097 But as a chapter, as a community, we don't. 326 00:16:43,162 --> 00:16:46,522 The North Texas chapter has not gotten together and said, you know, we could 327 00:16:46,522 --> 00:16:50,542 probably add a lot of value if we start to collaborate and, and participate together. 328 00:16:50,632 --> 00:16:53,602 Uh, maybe this time we help, you know, this, this company or this 329 00:16:53,602 --> 00:16:57,412 set of companies, maybe this, this sector like technology or healthcare. 330 00:16:57,682 --> 00:17:00,652 And, you know, next time we focus on something else, I think it's a great idea. 331 00:17:00,652 --> 00:17:03,412 But, uh, I, I haven't seen it done, but it's definitely something 332 00:17:03,412 --> 00:17:04,142 that they're open to doing. 333 00:17:05,182 --> 00:17:06,352 W. Curtis Preston: Yeah, this is great. 334 00:17:06,352 --> 00:17:11,212 Yeah, I'm, I, I was just looking at the site and I, I wanna say, so, so, so 335 00:17:11,212 --> 00:17:17,572 Prasanna, two areas of California where there's like a really big city and then 336 00:17:17,572 --> 00:17:20,542 a smaller city next to the big city. 337 00:17:21,682 --> 00:17:22,882 One of these. 338 00:17:24,172 --> 00:17:28,582 Places has its own San Diego chapter, I'm sorry, San Diego Field 339 00:17:28,582 --> 00:17:32,212 office of the F B I and therefore a chapter of this organization. 340 00:17:32,452 --> 00:17:33,442 The other one does not. 341 00:17:33,442 --> 00:17:34,762 Do you understand what I'm trying to say to you? 342 00:17:36,232 --> 00:17:36,502 Prasanna Malaiyandi: No. 343 00:17:38,152 --> 00:17:39,112 W. Curtis Preston: There is a San Diego. 344 00:17:39,352 --> 00:17:41,072 There is a San Diego field office. 345 00:17:41,917 --> 00:17:43,057 Prasanna Malaiyandi: There's not a Santa Clara 346 00:17:43,162 --> 00:17:45,982 W. Curtis Preston: There is not a, there is not a E, there's 347 00:17:45,982 --> 00:17:48,232 not even a Southern Bay Area. 348 00:17:48,292 --> 00:17:51,862 There is just San Francisco Bay Area field office. 349 00:17:52,357 --> 00:17:53,557 They, they didn't, they didn't 350 00:17:53,602 --> 00:17:54,382 Mike Saylor: they also have. 351 00:17:54,427 --> 00:17:55,417 W. Curtis Preston: Bay, go ahead. 352 00:17:55,987 --> 00:17:58,777 Mike Saylor: They also have satellite offices and the F B I does. 353 00:17:58,777 --> 00:18:04,537 So for example, um, Frisco, Texas is kind of northwest of downtown Dallas, 354 00:18:04,537 --> 00:18:06,847 but you know, within 30 minute driving. 355 00:18:07,267 --> 00:18:10,927 Uh, so the Dallas F B I headquarters is in downtown Dallas, but they have 356 00:18:10,927 --> 00:18:14,137 a satellite office in Frisco and they have a satellite office in Fort Worth. 357 00:18:14,677 --> 00:18:18,127 Uh, all of that is considered, uh, under the purview of the Dallas 358 00:18:18,127 --> 00:18:23,377 Field Office, and our North Texas chapter goes from Waco to Lubbock and. 359 00:18:23,722 --> 00:18:25,312 Abilene, uh, I'm sorry. 360 00:18:25,312 --> 00:18:29,242 Um, just east of El Paso all the way out to Shreveport. 361 00:18:29,242 --> 00:18:34,012 So technically, like quite literally all of North Texas is part of one chapter. 362 00:18:34,012 --> 00:18:39,892 However, we have some of the, uh, members that are out in like the Abilene area 363 00:18:39,897 --> 00:18:42,652 as an example, that feel disconnected. 364 00:18:42,652 --> 00:18:44,392 Like we can't keep driving to Dallas. 365 00:18:44,392 --> 00:18:48,472 Every time you guys have an event, we wanna start our own chapter, uh, and. 366 00:18:49,102 --> 00:18:52,882 They got enough support for that, where they did a feasibility study and, uh, 367 00:18:52,882 --> 00:18:55,822 and interest and they were going to help them build their own chapter. 368 00:18:55,822 --> 00:18:58,702 I'm not sure the status of that, but, uh, that is an option. 369 00:18:58,792 --> 00:19:03,832 If, if you find enough interest in membership and you know it's feasible, 370 00:19:03,922 --> 00:19:06,892 um, you know, they'll, they're, they're open to starting other chapters. 371 00:19:07,672 --> 00:19:11,152 W. Curtis Preston: well, sadly, there's no one in the South Bay area that 372 00:19:11,152 --> 00:19:13,642 knows anything about technology or. 373 00:19:14,137 --> 00:19:14,917 Prasanna Malaiyandi: Not at all. 374 00:19:15,367 --> 00:19:15,607 Yeah. 375 00:19:17,647 --> 00:19:18,007 Yeah. 376 00:19:18,037 --> 00:19:18,607 W. Curtis Preston: anyway. 377 00:19:18,787 --> 00:19:21,547 So, well let me just ask you one, one final question about this 378 00:19:21,547 --> 00:19:23,227 topic and then I wanna move on. 379 00:19:23,677 --> 00:19:30,007 Um, and that is, there is a debate when, you know, as I've been continuing to 380 00:19:30,007 --> 00:19:36,187 research incident response, having to do with ransomware, there is a debate as to. 381 00:19:36,532 --> 00:19:40,042 When or if to contact the F B I, right? 382 00:19:40,042 --> 00:19:44,302 Or just law enforcement in general, but in the us The F B I W. 383 00:19:44,302 --> 00:19:45,792 What's your opinion on that? 384 00:19:47,082 --> 00:19:52,252 Mike Saylor: Uh, my opinion is as soon as possible, however, um, You know, 385 00:19:52,252 --> 00:19:55,762 it's not always up to, to us and us by us, I mean, you know, technology, 386 00:19:55,762 --> 00:19:58,912 leadership, you know, whether you're the CISO or the c I o, unless, unless 387 00:19:58,912 --> 00:20:04,822 you're chartered to do so by executive management, uh, I always suggest that 388 00:20:04,827 --> 00:20:08,962 whoever the IT leadership is, you know, we're just, we're just putting out a fire. 389 00:20:09,532 --> 00:20:10,312 Uh, you know what? 390 00:20:10,312 --> 00:20:12,262 Whatever the incident is, we're putting out the fire. 391 00:20:12,262 --> 00:20:14,992 So from a technology perspective, our job is to recover. 392 00:20:15,007 --> 00:20:18,487 Or from a business perspective, you really need to defer that to your 393 00:20:18,487 --> 00:20:23,527 legal counsel or, or your, whoever your executive is or your insurance company. 394 00:20:24,037 --> 00:20:26,017 Uh, but your insurance company is gonna say, involve law 395 00:20:26,017 --> 00:20:27,307 enforcement as soon as possible. 396 00:20:27,607 --> 00:20:30,637 Your legal counsel, whether it's internal or, or, or outside 397 00:20:30,637 --> 00:20:32,827 counsel is gonna want to know more. 398 00:20:33,157 --> 00:20:38,362 Um, But at, at the end of the day, uh, and I, and I've, I've seen this from, 399 00:20:38,512 --> 00:20:39,982 from a lot of different perspectives. 400 00:20:39,987 --> 00:20:42,472 'cause I'm also, I also do expert testimony in court. 401 00:20:42,472 --> 00:20:45,262 So if this ended up in court, you know, one of the things 402 00:20:45,262 --> 00:20:47,302 that that benefits you from. 403 00:20:47,662 --> 00:20:50,722 Contacting law enforcement as soon as possible is, is a 404 00:20:50,722 --> 00:20:52,102 phrase called due diligence. 405 00:20:52,402 --> 00:20:56,932 So when, when we talk about, all right, so you guys screwed up, but how diligent 406 00:20:56,932 --> 00:20:58,582 were you in trying to prevent this? 407 00:20:58,582 --> 00:21:00,682 How diligent were you in responding to this? 408 00:21:00,682 --> 00:21:03,982 And how diligent were you in, in asking for help from everybody that you 409 00:21:03,982 --> 00:21:05,872 could possibly ask from for help from? 410 00:21:05,992 --> 00:21:08,052 And how open were you in? 411 00:21:08,312 --> 00:21:12,187 Um, And understanding and communicating what the problem was. 412 00:21:12,517 --> 00:21:17,227 And so if, if in any of those phases, uh, you're perceived as less than 413 00:21:17,227 --> 00:21:20,247 diligent, uh, and possibly, um, I. 414 00:21:20,617 --> 00:21:23,857 You know, hiding something or, or, or trying to cover something 415 00:21:23,857 --> 00:21:25,777 up when it gets to damages. 416 00:21:25,777 --> 00:21:29,197 If, if this lawsuit goes to damages, that's where it's gonna come back on you. 417 00:21:29,647 --> 00:21:32,767 Uh, 'cause everybody that, that goes through an incident, obviously you're 418 00:21:32,767 --> 00:21:34,507 guilty of having gone through an incident. 419 00:21:34,567 --> 00:21:38,107 You didn't do enough of something, which is almost impossible. 420 00:21:38,107 --> 00:21:41,437 But, you know, when you're in court, it's kind of black and white and you, 421 00:21:41,887 --> 00:21:44,677 at the end of the day, the fact is you had a breach, you had an incident, 422 00:21:44,677 --> 00:21:46,417 and it, it resulted in these things. 423 00:21:46,987 --> 00:21:48,997 Um, all right, so there's. 424 00:21:49,532 --> 00:21:51,292 You, you, you get a judgment for that. 425 00:21:51,682 --> 00:21:53,092 Alright, well then we go to damages. 426 00:21:53,092 --> 00:21:55,942 And some of that's black and white too, California especially, you 427 00:21:55,942 --> 00:21:59,392 know, for every record of California citizen, there's, it's defined. 428 00:21:59,932 --> 00:22:02,902 But, uh, on top of that, uh, so that's statutory. 429 00:22:02,902 --> 00:22:06,742 But then the, the judge can say, you guys were not diligent in 430 00:22:06,742 --> 00:22:08,932 protecting, responding, communicating. 431 00:22:09,292 --> 00:22:12,442 And, and because of that, I'm going to assess these additional fines. 432 00:22:13,222 --> 00:22:15,472 And so, uh, there's a lot to consider. 433 00:22:15,712 --> 00:22:19,132 And back to the tabletop exercise, that's when you need to start talking 434 00:22:19,132 --> 00:22:22,432 through, this is how this should actually go, and someone's gonna 435 00:22:22,432 --> 00:22:23,932 go, when do we call law enforcement? 436 00:22:23,932 --> 00:22:27,922 And we should look at the people in the room that would typically have 437 00:22:27,922 --> 00:22:31,882 that answer, and let's get that in writing ahead of time, uh, and put 438 00:22:31,882 --> 00:22:35,692 that in our plan as, uh, as part of, uh, how we respond to stuff. 439 00:22:36,337 --> 00:22:40,327 W. Curtis Preston: You don't want to be the, the, the, the rogue, uh, incident 440 00:22:40,332 --> 00:22:45,607 response cyber security person just randomly deciding to call the F B I. 441 00:22:46,147 --> 00:22:48,207 Uh, this needs to be decided up upfront. 442 00:22:48,952 --> 00:22:51,532 Mike Saylor: now I've been through some incidents, uh, just real quick 443 00:22:51,537 --> 00:22:58,582 where, uh, the incident was something illegal and management said, you're 444 00:22:58,582 --> 00:22:59,612 not reporting that to anybody. 445 00:22:59,782 --> 00:23:03,592 We'll handle it internally, but there are certain cases where 446 00:23:03,592 --> 00:23:05,452 you are a mandatory reporter. 447 00:23:05,842 --> 00:23:10,612 Having identified certain types of things, um, and it's kind of up to 448 00:23:10,612 --> 00:23:15,052 you on how to handle that, but I would suggest, uh, even if management 449 00:23:15,052 --> 00:23:18,472 said, don't report it, that's your, your life you're dealing with. 450 00:23:18,472 --> 00:23:21,202 If they find out you didn't report it and you knew about it, now you're going to 451 00:23:21,202 --> 00:23:22,792 jail regardless of what your boss said. 452 00:23:23,362 --> 00:23:28,012 Um, so I would suggest there's ways doing anonymous, uh, reporting and 453 00:23:28,012 --> 00:23:32,602 then just capture that activity as evidence that you did report it. 454 00:23:33,022 --> 00:23:36,862 Um, So there's, there's a, there's a lot of things to consider when you're, you're 455 00:23:36,862 --> 00:23:38,962 responsible for responding to stuff. 456 00:23:39,382 --> 00:23:43,552 Uh, and in addition to that, you may have access to things that, that require you as 457 00:23:43,552 --> 00:23:45,412 a mandatory reporter for doing something. 458 00:23:45,967 --> 00:23:48,007 Prasanna Malaiyandi: I was interesting you brought that up, Mike. 459 00:23:48,007 --> 00:23:51,577 I was just reading a, I think on Twitter or read or something like that where 460 00:23:51,847 --> 00:23:56,557 people were saying like as a programmer, right, if you're asked to do something, 461 00:23:56,557 --> 00:24:00,367 which doesn't seem right, right, and the company gets caught in the end, 462 00:24:00,372 --> 00:24:02,947 you're sort of the one responsible because you wrote the code, right? 463 00:24:02,947 --> 00:24:06,337 You did something when someone told you to do something illegal, potentially. 464 00:24:06,757 --> 00:24:07,027 Right? 465 00:24:07,027 --> 00:24:08,827 And it's still your neck on the line. 466 00:24:08,837 --> 00:24:14,357 Versus like, no one ever really gets like penalized like that for 467 00:24:14,362 --> 00:24:16,187 saying no to doing something illegal. 468 00:24:16,877 --> 00:24:17,207 Right. 469 00:24:17,207 --> 00:24:21,347 And so it applies in various cases, including responding to being 470 00:24:21,352 --> 00:24:22,697 told to do something illegal. 471 00:24:23,087 --> 00:24:25,547 Uh, the one thing I did want to ask you, Mike, just going back to the 472 00:24:25,547 --> 00:24:30,497 question Curtis asked about sort of reporting, how do you feel that 473 00:24:30,497 --> 00:24:36,647 companies have done in being transparent about cybersecurity incidences? 474 00:24:36,647 --> 00:24:36,677 I. 475 00:24:37,702 --> 00:24:40,372 Mike Saylor: Well, I think that's a double-edged sword because it could 476 00:24:40,372 --> 00:24:43,102 seem like they're not being very transparent when really they just 477 00:24:43,102 --> 00:24:44,302 don't have a clue of what's going on. 478 00:24:45,067 --> 00:24:46,717 Uh, and, and I think that's the case. 479 00:24:46,717 --> 00:24:48,817 The majority of the time we got ransomware. 480 00:24:48,847 --> 00:24:49,807 How did it happen? 481 00:24:49,927 --> 00:24:53,407 Someone clicked something, I guess, but they really don't know, or that's 482 00:24:53,407 --> 00:24:56,677 what they were told, even though that's not maybe really how it happened. 483 00:24:57,097 --> 00:25:01,537 So I think understanding and understanding comes from, you know, information. 484 00:25:01,537 --> 00:25:02,737 Well, how do we get information? 485 00:25:02,742 --> 00:25:04,447 Well, you've gotta have the right technology stack. 486 00:25:04,447 --> 00:25:08,107 You've gotta have the right visibility and people and all reporting. 487 00:25:09,007 --> 00:25:14,332 And if, if any one of those areas is lacking, Then your ability to 488 00:25:14,452 --> 00:25:17,362 really know what happened, uh, is diminished to some degree. 489 00:25:17,362 --> 00:25:21,232 So I, I think there's two, there's, there's, there's a couple of perspectives. 490 00:25:21,232 --> 00:25:22,402 I'm not just gonna say there's two. 491 00:25:22,402 --> 00:25:25,802 There's, there's the one where they just really didn't know what happened in their. 492 00:25:26,662 --> 00:25:29,602 They're sharing what they, they know in whatever way they know how. 493 00:25:30,052 --> 00:25:33,532 Uh, and a lot of those cases, it's because they tried to address it on their own. 494 00:25:33,622 --> 00:25:37,282 They didn't bring in the law enforcement or outside help or 495 00:25:37,282 --> 00:25:39,142 professional firm or, or what have you. 496 00:25:39,472 --> 00:25:40,792 They just said, we had a problem. 497 00:25:40,852 --> 00:25:44,992 We're gonna accept the, you know, the, the fact that it happened and pay 498 00:25:44,997 --> 00:25:48,682 our dues or, you know, whatever the consequences are and we'll move on. 499 00:25:49,252 --> 00:25:51,082 And, uh, so there's that perspective. 500 00:25:51,082 --> 00:25:53,512 The other one is companies that truly. 501 00:25:54,187 --> 00:25:57,337 Can't or have decided they can't take the reputational 502 00:25:57,337 --> 00:25:59,557 risk of divulging what happened. 503 00:25:59,977 --> 00:26:02,257 Uh, some of that might be privacy or contractual. 504 00:26:02,257 --> 00:26:06,397 Like you will never tell people that our network was, uh, compromised 505 00:26:06,397 --> 00:26:09,307 because that, because we rely on you for these other things. 506 00:26:09,312 --> 00:26:13,057 And so clients could be impacted by, by your incident, you know, their, 507 00:26:13,087 --> 00:26:14,557 their business or service too. 508 00:26:14,557 --> 00:26:18,967 So, uh, depending on how your business functions and how you, how complex it is 509 00:26:18,972 --> 00:26:21,487 with, with providing services or data to. 510 00:26:21,997 --> 00:26:23,887 To clients or third parties. 511 00:26:23,917 --> 00:26:27,517 Uh, you may be limited in what you can say, um, but I think what you're 512 00:26:27,517 --> 00:26:31,567 getting at is, yeah, there are definitely companies out there that will deny 513 00:26:31,567 --> 00:26:33,007 altogether that there was a comp. 514 00:26:33,007 --> 00:26:36,907 I don't, so, you know, some, some bad guys put all of our customer data on 515 00:26:36,907 --> 00:26:38,797 the, on the internet and you can see it. 516 00:26:39,157 --> 00:26:44,257 They'll, they will still deny to the nth degree that they were not compromised, 517 00:26:44,257 --> 00:26:45,667 that they did not get that data from us. 518 00:26:45,667 --> 00:26:48,487 And I was actually in a case like that with a telecom company. 519 00:26:48,997 --> 00:26:52,897 Uh, the Secret Service called us and said, Actually the F b I called 520 00:26:52,897 --> 00:26:55,837 us first and said, we're seeing your client data on the internet. 521 00:26:56,407 --> 00:26:59,227 And um, this was in the, the late nineties. 522 00:26:59,377 --> 00:27:01,987 Um, we're seeing your customer's data on the internet. 523 00:27:02,527 --> 00:27:06,517 And when we started looking into it, they were all of our internet customers. 524 00:27:06,907 --> 00:27:09,757 And so we went back to our internet provider and said, it looks like all 525 00:27:09,757 --> 00:27:14,962 this data's coming from you, and they denied it Well, Secret Service got 526 00:27:14,962 --> 00:27:17,212 involved, uh, due to jurisdiction. 527 00:27:17,212 --> 00:27:18,772 It was different states and different things. 528 00:27:18,772 --> 00:27:23,152 And so we went, we actually went to that company, uh, onsite with the 529 00:27:23,152 --> 00:27:25,882 Secret Service and said, we're here to talk about this, that, and the other. 530 00:27:25,882 --> 00:27:27,142 And well, it wasn't us. 531 00:27:27,562 --> 00:27:29,122 Uh, it, it didn't come from us. 532 00:27:29,542 --> 00:27:33,532 Well, all the data that we were seeing, and it's not just related 533 00:27:33,532 --> 00:27:35,692 to you, it's got metadata in it. 534 00:27:35,692 --> 00:27:36,652 That said it did come from you. 535 00:27:36,682 --> 00:27:37,162 No, it didn't. 536 00:27:37,552 --> 00:27:39,382 Well, we're not leaving until we talk to somebody, so they 537 00:27:39,382 --> 00:27:40,672 put us in this conference room. 538 00:27:41,167 --> 00:27:42,067 And locked us in there. 539 00:27:42,072 --> 00:27:43,957 Didn't let us out to go talk to anybody. 540 00:27:43,957 --> 00:27:45,817 And we had to, like, someone would come in and say, what do 541 00:27:45,817 --> 00:27:46,717 you want to, what do you need? 542 00:27:46,717 --> 00:27:47,317 And we would say it. 543 00:27:47,317 --> 00:27:50,737 And they would go out and, and look, uh, or, or collect that for us. 544 00:27:50,742 --> 00:27:55,087 And, uh, sometime during the day, I asked if I could plug into their, their 545 00:27:55,087 --> 00:27:59,077 wall jack and, uh, so I could have internet access to, to check email. 546 00:27:59,077 --> 00:27:59,737 And they said, sure. 547 00:28:00,127 --> 00:28:03,877 Well, I started running, running a, a network sniffer, uh, capturing network 548 00:28:04,027 --> 00:28:04,357 W. Curtis Preston: you did. 549 00:28:05,092 --> 00:28:07,492 Mike Saylor: And, and back in the day they were using, uh, I C 550 00:28:07,492 --> 00:28:09,742 Q, the, the chat, the chat app. 551 00:28:09,742 --> 00:28:12,382 And I was capturing in plain text everything they were saying. 552 00:28:12,652 --> 00:28:15,832 And it was all about, ha ha, we've got 'em locked in the conference room. 553 00:28:15,832 --> 00:28:18,352 They'll give up talking to us at some point and just go home. 554 00:28:18,352 --> 00:28:19,702 We're not gonna give 'em anything. 555 00:28:20,152 --> 00:28:24,367 Um, Tell Bob that he's safe, you know that his screw up is we're 556 00:28:24,367 --> 00:28:25,927 gonna brush it under the rug and all. 557 00:28:26,107 --> 00:28:29,347 So I remember this, this little secret service lady, uh, and 558 00:28:29,347 --> 00:28:30,457 I say she really was little. 559 00:28:30,457 --> 00:28:31,837 She was like five feet tall. 560 00:28:32,317 --> 00:28:34,027 Um, her name was Kim. 561 00:28:34,027 --> 00:28:37,837 She kicked the conference room door open and it was, it was the door that 562 00:28:37,837 --> 00:28:39,787 opened in, but she kicked it out. 563 00:28:39,787 --> 00:28:40,477 I mean, she. 564 00:28:41,032 --> 00:28:44,512 She knew how to kick a door and she kicked that door and said, I need 565 00:28:44,572 --> 00:28:47,992 the executive team in this office right in front of me in the next five 566 00:28:47,992 --> 00:28:49,252 minutes where people are going to jail. 567 00:28:49,582 --> 00:28:50,842 And she took control. 568 00:28:50,842 --> 00:28:56,812 And, and it was probably, uh, maybe later that year, we actually 569 00:28:56,812 --> 00:28:58,162 caught the hacker that did that. 570 00:28:58,162 --> 00:28:59,422 His name was Matthew Freeze. 571 00:28:59,422 --> 00:29:02,452 He, uh, we caught him in Corpus Christi with the Sheriff's Department. 572 00:29:02,992 --> 00:29:04,942 Uh, he's in, I think he's still in jail. 573 00:29:05,392 --> 00:29:11,662 Um, But I went down to interview Matt Freeze, uh, and uh, thinking 574 00:29:11,662 --> 00:29:14,542 I was gonna have a chance to talk to him about how he did it and get 575 00:29:14,542 --> 00:29:18,832 the, the, the verbal confirmation that it did come from this company. 576 00:29:18,832 --> 00:29:19,912 'cause they're still denying it. 577 00:29:20,482 --> 00:29:27,952 And, uh, I was there for nine hours waiting in line of, uh, more important 578 00:29:27,952 --> 00:29:29,542 people than me to talk to this guy. 579 00:29:29,542 --> 00:29:32,152 He had hacked NASA and Department of Defense and. 580 00:29:32,932 --> 00:29:36,682 Library of Congress, all these other people were there to ask him how he 581 00:29:36,682 --> 00:29:38,212 did what he did and get his confession. 582 00:29:38,212 --> 00:29:41,482 And so I ended up giving my list of questions to a Homeland Security guy. 583 00:29:41,487 --> 00:29:45,352 Back then, it wasn't called Homeland Security, it was, uh, uh, ice. 584 00:29:45,832 --> 00:29:49,102 Um, and so I got, I got his confession that way. 585 00:29:49,102 --> 00:29:54,682 But, uh, I, I'm, I'm not even sure why, how we got, oh, uh, people 586 00:29:54,682 --> 00:29:56,032 saying that they weren't hacked. 587 00:29:56,032 --> 00:29:57,832 Even though you've got all the evidence points, 588 00:29:57,847 --> 00:29:58,687 W. Curtis Preston: Right, right. 589 00:29:59,197 --> 00:30:02,887 Well, that's, that's a great story with the, with, with a, with a great climax. 590 00:30:02,887 --> 00:30:06,007 I love the, the agent kicking down the door. 591 00:30:06,037 --> 00:30:08,857 Uh, yeah, that must have been something to be there. 592 00:30:09,337 --> 00:30:13,537 Um, so, so let me, let, let me do a change of tack here. 593 00:30:14,227 --> 00:30:18,067 So, you know, let's say we're a company, we have done. 594 00:30:19,012 --> 00:30:23,152 From a, so we, you know, we have, we have an incident response plan, right? 595 00:30:23,152 --> 00:30:27,052 We, we've, we've decided whether or not we're gonna contact law enforcement. 596 00:30:27,472 --> 00:30:32,302 We, um, we did all of the things that a cybersecurity company asked 597 00:30:32,302 --> 00:30:36,083 us to do in terms of prevention and, and, and all of those things. 598 00:30:37,072 --> 00:30:41,062 Um, what one, one thing I am. 599 00:30:42,472 --> 00:30:48,442 Interested in is obviously we, we spend a lot of our time with 600 00:30:48,502 --> 00:30:50,302 talking about ransomware, right? 601 00:30:50,962 --> 00:30:55,132 And the, and I understand that ransomware really in the end is 602 00:30:55,132 --> 00:31:00,352 just a payload of a, a much bigger cybersecurity problem, right? 603 00:31:00,967 --> 00:31:08,077 Um, what I'm seeing a lot is that I, I, I'm reading that now. 604 00:31:08,437 --> 00:31:13,987 I think it was like more than 90% of what we used to just call ransomware 605 00:31:13,987 --> 00:31:19,147 attacks are really exfiltration attacks accompanied with ransomware. 606 00:31:19,207 --> 00:31:19,657 Right. 607 00:31:20,137 --> 00:31:25,777 Um, and so I, I have a couple of, you know, sort of questions about. 608 00:31:26,802 --> 00:31:30,652 Uh, starting with, you know, given the way, the way a typical 609 00:31:30,652 --> 00:31:32,812 ransomware attack happens, right? 610 00:31:32,812 --> 00:31:37,402 You've got your, the, the initial, um, uh, I forgot what 611 00:31:37,407 --> 00:31:38,812 actually what the world calls it. 612 00:31:38,817 --> 00:31:41,242 The, the initial access broker, right? 613 00:31:41,242 --> 00:31:44,452 You get the initial access broker, then you get somebody that's in there 614 00:31:44,572 --> 00:31:46,942 and they start probing around, right? 615 00:31:46,942 --> 00:31:50,242 They start seeing how they can, you know, how they can get around. 616 00:31:50,482 --> 00:31:54,052 And then my understanding is as soon as they can, they start exfiltrating data. 617 00:31:54,652 --> 00:31:57,862 So my question is, it is sort of two questions. 618 00:31:59,302 --> 00:32:04,042 you know, beyond the usual, you know, there are some things, you 619 00:32:04,042 --> 00:32:06,322 know, there are some things that we know we should all be doing, right? 620 00:32:06,322 --> 00:32:09,712 You know, in terms of password management and M f A and, um, you 621 00:32:09,712 --> 00:32:13,762 know, all, all of those you, you know, and, and, and, uh, patch management. 622 00:32:14,872 --> 00:32:17,722 Um, can you think of some things. 623 00:32:18,142 --> 00:32:23,332 That a company that wants to take that next step, things that, 624 00:32:23,337 --> 00:32:29,572 that, that could either stop, um, lateral movement number one. 625 00:32:30,262 --> 00:32:33,892 And then, and then just as importantly, if not, if not more 626 00:32:33,897 --> 00:32:36,022 importantly, exfiltration of data. 627 00:32:37,612 --> 00:32:38,842 That was a really long question. 628 00:32:38,842 --> 00:32:39,622 Sorry about that. 629 00:32:40,207 --> 00:32:43,147 Mike Saylor: And, and I had so many things I wanted to chime in with that. 630 00:32:43,147 --> 00:32:48,037 I've, I've lost some of them, but, uh, I'm, I'm glad you, I'm glad When you 631 00:32:48,037 --> 00:32:51,847 said typical ransomware, you didn't go down, they, they clicked on an email. 632 00:32:51,877 --> 00:32:53,557 'cause that's not typical anymore. 633 00:32:53,557 --> 00:32:55,147 That's, that's statistically the. 634 00:32:55,867 --> 00:32:59,377 Probably the higher probability of success, but in a lot of cases 635 00:32:59,377 --> 00:33:02,587 it's just that user that gets compromised, not not the whole company. 636 00:33:03,187 --> 00:33:08,527 So you're right, typically the, the enterprise, uh, scale attack 637 00:33:08,557 --> 00:33:13,327 is, uh, via some either access broker or the ransomware campaign. 638 00:33:13,387 --> 00:33:15,247 Uh, has, you know, their own. 639 00:33:15,967 --> 00:33:20,497 Uh, squad of pen testers that are finding ways into environments, but you're right. 640 00:33:20,497 --> 00:33:23,917 So typically it is access to the environment that then, you know, as 641 00:33:23,922 --> 00:33:27,067 far as the phases of attack goes, then they start, uh, the reconnaissance. 642 00:33:28,087 --> 00:33:31,327 Uh, to answer your question about, um, how do we, how do we 643 00:33:31,332 --> 00:33:33,487 address the exfiltration piece? 644 00:33:33,577 --> 00:33:38,197 Um, my favorite response is it depends, and I say that a lot in a lot of 645 00:33:38,197 --> 00:33:42,652 different scenarios and, and, Uh, and it's for good reason because it 646 00:33:42,652 --> 00:33:45,382 really depends on the organization. 647 00:33:45,982 --> 00:33:50,182 And so each company needs to go through an exercise of figuring out what's important 648 00:33:50,182 --> 00:33:56,572 to them and where is it because maybe your data's already exfiltrated, it's 649 00:33:56,572 --> 00:33:58,312 out in, you know, a cloud somewhere. 650 00:33:58,312 --> 00:34:01,432 So I'm not even have to attack your company anymore. 651 00:34:01,437 --> 00:34:04,402 I just have to go figure out where your data is and attack that company. 652 00:34:04,912 --> 00:34:08,272 Um, and, or maybe it's a partner or whoever, and there's 653 00:34:08,277 --> 00:34:09,562 tons of examples of, of. 654 00:34:10,447 --> 00:34:11,587 F bad guys. 655 00:34:11,587 --> 00:34:15,187 Figuring out where the, where the important stuff is and making best 656 00:34:15,187 --> 00:34:16,717 use of their time and resources. 657 00:34:16,767 --> 00:34:20,847 So, so it really does depend on the organization, uh, understanding 658 00:34:20,847 --> 00:34:24,237 your technology stack, your architecture, your culture. 659 00:34:24,997 --> 00:34:25,117 I. 660 00:34:25,137 --> 00:34:27,837 Uh, and then obviously where is your stuff? 661 00:34:27,897 --> 00:34:28,557 Is it data? 662 00:34:28,557 --> 00:34:30,687 Is it a system, is it a service? 663 00:34:30,807 --> 00:34:32,967 Uh, because that's what bad guys are gonna figure out when 664 00:34:32,967 --> 00:34:34,317 they're doing the reconnaissance. 665 00:34:34,317 --> 00:34:36,687 They're looking for, you know, who is this company? 666 00:34:36,687 --> 00:34:40,377 'cause in a lot of cases, they don't, they didn't specifically attack you. 667 00:34:40,827 --> 00:34:43,827 Uh, they just, they were running some tools and found a vulnerability and 668 00:34:43,827 --> 00:34:46,647 they picked at it, and now they've got access to some company's network. 669 00:34:47,007 --> 00:34:48,417 So they've gotta figure that out first. 670 00:34:48,807 --> 00:34:51,447 Once they figure out who you are, they wanna figure out what you do. 671 00:34:51,567 --> 00:34:53,847 Uh, where, where is your important stuff? 672 00:34:54,372 --> 00:34:55,692 Including your backups. 673 00:34:56,022 --> 00:34:59,742 Uh, and then to some degree, they're also looking for your financials and if they 674 00:34:59,742 --> 00:35:05,112 can find a copy of your insurance, uh, policy, all these things, well, all right. 675 00:35:05,112 --> 00:35:10,632 So depending on the company, uh, and, and your organization's particular situation, 676 00:35:11,052 --> 00:35:14,832 um, there are ways of addressing. 677 00:35:15,762 --> 00:35:19,962 Uh, the data exfiltration problem, one of those is, well, let's put our ti 678 00:35:19,992 --> 00:35:21,672 put tighter controls around our data. 679 00:35:21,677 --> 00:35:26,622 And that includes like data integrity, monitor file integrity monitoring, um, 680 00:35:27,102 --> 00:35:32,112 restricted access, network segmentation, firewall rules that throttle, you know, 681 00:35:32,112 --> 00:35:35,712 data uploads or alerts of, of doing so. 682 00:35:36,132 --> 00:35:40,452 Um, but I did wanna address one, um, one comment you made. 683 00:35:40,452 --> 00:35:42,072 How do we prevent this from happening? 684 00:35:42,072 --> 00:35:42,732 And I really think. 685 00:35:43,377 --> 00:35:47,697 People need to stop thinking about preventing it and start looking at 686 00:35:47,697 --> 00:35:51,627 ways of identifying it as soon as possible with either automated or 687 00:35:51,627 --> 00:35:53,817 human response as soon as possible. 688 00:35:54,147 --> 00:35:57,507 Uh, and then how do we collect all the information we need to make sure 689 00:35:57,512 --> 00:36:00,567 that we understand how it happened, what they did, and, and capture 690 00:36:00,567 --> 00:36:01,857 what we did to respond to that. 691 00:36:02,277 --> 00:36:06,537 And so that's very important, uh, for a lot of different reasons. 692 00:36:06,537 --> 00:36:12,687 One, if you put too much, uh, emphasis on prevention, then. 693 00:36:13,152 --> 00:36:14,382 A couple of things are gonna happen. 694 00:36:14,382 --> 00:36:19,332 One, you've, you've invested a lot of money that could be more appropriately 695 00:36:19,332 --> 00:36:21,882 used in identification and response. 696 00:36:22,362 --> 00:36:26,532 Uh, two, you're very likely going to become complacent thinking that you've 697 00:36:26,532 --> 00:36:29,622 got everything in place you need, and that's not gonna happen to us. 698 00:36:30,432 --> 00:36:33,732 And then lastly, a lot of those preventative controls don't do 699 00:36:33,732 --> 00:36:36,672 the data collection necessary to figure out how things happened. 700 00:36:37,212 --> 00:36:39,642 Um, and, and we get asked a lot. 701 00:36:39,732 --> 00:36:43,392 We had this incident and all we need to know is, is there 702 00:36:43,392 --> 00:36:44,862 evidence of data exfiltration? 703 00:36:46,452 --> 00:36:47,922 Because that's all we have to report. 704 00:36:47,927 --> 00:36:50,022 So what we had ransomware, so what we had a breach. 705 00:36:50,022 --> 00:36:52,482 If there was no data taken, then we don't have to report it. 706 00:36:52,902 --> 00:36:53,412 Okay, great. 707 00:36:53,412 --> 00:36:56,712 Well, let's look at your technology stack and, and the things that you have 708 00:36:56,717 --> 00:37:00,222 that would've collected that information and they didn't have anything or what 709 00:37:00,222 --> 00:37:01,722 they have wasn't configured well. 710 00:37:02,007 --> 00:37:05,877 And so we didn't have the information to, to determine whether or not 711 00:37:05,877 --> 00:37:07,947 data was exfiltrated to any degree. 712 00:37:08,487 --> 00:37:12,117 Uh, so we could see the, the network connections and the sessions, uh, 713 00:37:12,117 --> 00:37:16,137 but we couldn't see, uh, the data throughput or, or even what the data was. 714 00:37:16,497 --> 00:37:16,947 Prasanna Malaiyandi: so. 715 00:37:17,292 --> 00:37:21,132 In that case though, Mike, is it you have to assume worst case, that there 716 00:37:21,132 --> 00:37:26,022 was personal data or other things that was exfiltrated or is it, I don't 717 00:37:26,022 --> 00:37:30,252 know what was happened, so I'll just say I don't know or nothing happened. 718 00:37:30,627 --> 00:37:32,127 Mike Saylor: There's a couple of things there too. 719 00:37:32,517 --> 00:37:37,467 Uh, so I mean, fundamentally, all of your data should be encrypted as often as it 720 00:37:37,467 --> 00:37:39,807 as it can be, uh, at rest in transit. 721 00:37:39,897 --> 00:37:45,987 Um, so that if it is exfiltrated, you, you, you were diligent protecting your 722 00:37:45,992 --> 00:37:50,787 data so that if it was stolen, there's a small likelihood that it's even usable. 723 00:37:51,657 --> 00:37:54,117 Well, not usable within, you know, relatively, you 724 00:37:54,117 --> 00:37:54,957 know, 10 years or whatever. 725 00:37:55,122 --> 00:37:55,212 Right. 726 00:37:55,722 --> 00:37:59,292 Um, so encryption is very important from a diligence perspective. 727 00:37:59,742 --> 00:38:04,992 Well then in the absence of evidence that data was exfiltrated, um, 728 00:38:05,022 --> 00:38:07,872 and this is something you have to work with your legal counsel on. 729 00:38:08,202 --> 00:38:14,232 How do we then word our communication, uh, to employees or clients or even the state 730 00:38:14,292 --> 00:38:16,422 or regulatory agency about what happened? 731 00:38:16,812 --> 00:38:24,732 And very often it is, uh, stated similar to, uh, no evidence was found to support. 732 00:38:25,572 --> 00:38:25,962 Right. 733 00:38:26,082 --> 00:38:30,492 So it's not yes or no, it's, we didn't find anything that said it did happen. 734 00:38:30,972 --> 00:38:31,242 W. Curtis Preston: Yeah. 735 00:38:31,242 --> 00:38:33,222 We've talked about a number of those incidents. 736 00:38:33,327 --> 00:38:33,597 Prasanna Malaiyandi: Yeah. 737 00:38:34,407 --> 00:38:37,107 W. Curtis Preston: We, we have no evidence that that data was stolen. 738 00:38:37,107 --> 00:38:40,887 That because we had really bad tracking mechanisms that would 739 00:38:40,887 --> 00:38:42,417 give, that would tell us that data. 740 00:38:42,642 --> 00:38:45,042 Mike Saylor: and it, and it also depends on the threat actors. 741 00:38:45,042 --> 00:38:49,377 There are some threat actors that have a, uh, You know, a good 742 00:38:49,377 --> 00:38:50,937 reputation if you can have one. 743 00:38:50,997 --> 00:38:55,287 Uh, as a, as a threat actor that says, you know, they, they live by their code, 744 00:38:55,767 --> 00:39:00,687 and their code is, you know, if we steal your data, uh, you have, let's just say 745 00:39:00,692 --> 00:39:04,857 three days to acknowledge that you were breached and then you have, uh, and then 746 00:39:04,862 --> 00:39:06,627 we'll, we'll submit to you an offer. 747 00:39:07,167 --> 00:39:11,817 Uh, so you ransom note, and if so, first, if you, if you acknowledge that you are, 748 00:39:11,817 --> 00:39:15,507 were attacked and you contact us within three days, then we won't put your company 749 00:39:15,507 --> 00:39:19,077 on the wall of shame, which is a public indication that you were compromised. 750 00:39:19,077 --> 00:39:22,257 And, and people that know us know that we have some or all of your data. 751 00:39:23,097 --> 00:39:26,487 So we won't do that, and then we'll give you the ransom note. 752 00:39:26,547 --> 00:39:30,237 And if you pay that ransom note, or if we start these negotiations and we get, 753 00:39:30,237 --> 00:39:34,767 we go through this process and you pay us, then we promise to, to destroy all 754 00:39:34,767 --> 00:39:38,517 your data and, and keep it confidential and we'll even give you good tech 755 00:39:38,517 --> 00:39:40,347 support while you're trying to recover. 756 00:39:40,737 --> 00:39:45,387 Um, and so I've been through a variety of, of, of those types of incidents, seeing 757 00:39:45,387 --> 00:39:48,147 the, the gamut of, uh, bad actors that. 758 00:39:48,492 --> 00:39:52,122 Aren't very well organized and don't care, uh, all the way up through 759 00:39:52,122 --> 00:39:56,412 the very organized ones that, that operate like a, like a business and 760 00:39:56,412 --> 00:39:59,352 they've got good customer support or, you know, as good as it can be. 761 00:39:59,832 --> 00:40:06,372 Um, but, um, I will say that, you know, there is a trend towards 762 00:40:06,432 --> 00:40:07,752 data exfiltration with ransomware. 763 00:40:08,562 --> 00:40:14,307 Uh, there's, there's a still a large um, A large occurrence of ransomware where 764 00:40:14,307 --> 00:40:17,517 they don't care about your data, they just wanna make sure you're all locked up. 765 00:40:17,547 --> 00:40:20,097 And that's what they're gonna use for leverage to get you to pay. 766 00:40:20,547 --> 00:40:23,847 Because there's also the, the on the backside of that, even though threat 767 00:40:23,847 --> 00:40:28,917 actors are very risk averse, there's less risk from a, a consequence 768 00:40:28,917 --> 00:40:32,637 perspective, a prosecution perspective of just compromising your network 769 00:40:32,637 --> 00:40:33,957 and, and encrypting your stuff. 770 00:40:34,107 --> 00:40:34,977 Sure, I'll get in trouble. 771 00:40:34,977 --> 00:40:35,157 Sure. 772 00:40:35,157 --> 00:40:38,697 I'll get jail time and all this stuff, but if I also steal your data, 773 00:40:39,012 --> 00:40:43,002 Especially if it's regulatory data, healthcare, p i i, whatever, that's 774 00:40:43,002 --> 00:40:45,312 additional charges if I get caught. 775 00:40:45,552 --> 00:40:48,912 And so in a lot of cases, similar to the data access brokers, you 776 00:40:48,912 --> 00:40:53,982 also have, um, uh, network access brokers in addition to them. 777 00:40:53,982 --> 00:40:55,182 You also have the data brokers. 778 00:40:55,187 --> 00:40:57,942 So you've got the, and so it's this whole ecosystem. 779 00:40:57,942 --> 00:40:59,322 All right, so who do I know? 780 00:40:59,412 --> 00:41:01,992 Who, who can I pay to compromise your network? 781 00:41:01,992 --> 00:41:02,832 Alright, got that. 782 00:41:02,832 --> 00:41:03,732 I have the access. 783 00:41:04,032 --> 00:41:05,922 Who can I pay to develop the payload? 784 00:41:06,267 --> 00:41:06,957 Alright, got that. 785 00:41:06,957 --> 00:41:09,957 So payload's in there, ransomware's running, and now we've got 786 00:41:09,957 --> 00:41:12,837 their environment locked up and we've got this data set. 787 00:41:12,957 --> 00:41:15,147 I don't want the data set 'cause I don't want to get caught with it. 788 00:41:15,147 --> 00:41:18,057 So now I gotta find a data broker that will buy it from me, who knows how 789 00:41:18,057 --> 00:41:19,797 then to kinda like diamonds, right? 790 00:41:19,917 --> 00:41:22,317 I bought the rod diamonds, I gotta find a diamond cutter and then I 791 00:41:22,317 --> 00:41:23,667 gotta find a diamond distributor. 792 00:41:23,672 --> 00:41:25,797 And, you know, everybody makes their own cut. 793 00:41:26,187 --> 00:41:30,447 Um, so there isn't, there are uh, uh, there's still a large volume of, of 794 00:41:30,447 --> 00:41:34,077 attacks where this eco, this whole ecosystem comes into play and, and you're 795 00:41:34,077 --> 00:41:37,887 just, Depending on where you, where you catch the attack, you're dealing 796 00:41:37,887 --> 00:41:39,867 with different, um, threat actors. 797 00:41:40,602 --> 00:41:41,562 W. Curtis Preston: Yeah, that, that's interesting. 798 00:41:41,562 --> 00:41:42,762 I wasn't aware. 799 00:41:42,852 --> 00:41:46,332 Um, you know, it sounds like it's kind of like felony murder, right? 800 00:41:46,332 --> 00:41:49,962 Where, you know, like, um, it, it makes it worse, right? 801 00:41:49,962 --> 00:41:52,092 You killed somebody, but you killed somebody in the 802 00:41:52,092 --> 00:41:53,532 commission of another felony. 803 00:41:53,537 --> 00:41:54,882 It makes it, it makes it worse. 804 00:41:55,782 --> 00:42:02,637 Um, the, um, Um, and so like, even if you didn't mean to kill them, right. 805 00:42:02,667 --> 00:42:03,537 That's my understanding. 806 00:42:03,537 --> 00:42:07,827 Like even if it, if it would otherwise be considered like accidental homicide 807 00:42:07,827 --> 00:42:10,797 or whatever, that because you, it happened in the commission of a 808 00:42:10,797 --> 00:42:12,837 felony, it makes it felony murder. 809 00:42:13,257 --> 00:42:16,197 Um, that, that is an interesting concept. 810 00:42:16,257 --> 00:42:22,017 Um, I, I, I, by the way, Mike, even though it sounds like maybe I was saying 811 00:42:22,017 --> 00:42:25,707 differently, I completely agree with you with sort of the, the assumed breach. 812 00:42:26,307 --> 00:42:27,357 Concept, right? 813 00:42:27,357 --> 00:42:31,977 That you need to spend, you need to be just as good if not better, with 814 00:42:31,977 --> 00:42:37,227 detection and response, uh, and recovery than the prevention aspect, right? 815 00:42:37,527 --> 00:42:40,257 Um, you know, having said that, there's nothing wrong with, with 816 00:42:40,257 --> 00:42:41,517 an ounce of prevention, right? 817 00:42:41,907 --> 00:42:46,737 Um, and that's why, um, I, I just, it, it bothers me. 818 00:42:47,397 --> 00:42:51,177 Like, on, on one hand we talk about some of the advanced things that you 819 00:42:51,177 --> 00:42:54,447 could do to, to help, but most people I. 820 00:42:55,032 --> 00:42:58,782 Um, you know, such as preventing, preventing lateral movement 821 00:42:58,782 --> 00:43:01,482 between systems that don't need to have lateral movement, right. 822 00:43:02,232 --> 00:43:07,272 Um, the, there's nothing wrong with that, but you're right, there's a cost and of 823 00:43:07,272 --> 00:43:10,512 doing it initially, there's a cost of maintaining that and there's a cost of. 824 00:43:11,022 --> 00:43:14,922 Of, you know, well, cybersecurity is always a pain, right? 825 00:43:14,922 --> 00:43:17,802 The be the more security you have, the harder it's to do your job. 826 00:43:18,072 --> 00:43:18,342 Right? 827 00:43:18,342 --> 00:43:20,742 Unless you're the si the sc the cybersecurity guy. 828 00:43:21,282 --> 00:43:27,102 Um, the, um, uh, I had a point, I was on my, I was on my way to 829 00:43:27,107 --> 00:43:29,142 a point and it seems to have, 830 00:43:29,247 --> 00:43:31,647 Mike Saylor: that's why secure, that's why convenience stores are 831 00:43:31,647 --> 00:43:33,387 robbed more than security stores. 832 00:43:34,932 --> 00:43:36,162 W. Curtis Preston: I see, I see what you did there. 833 00:43:36,672 --> 00:43:44,682 Um, the, um, The, uh, let's talk about response and recovery. 834 00:43:45,282 --> 00:43:50,652 Um, the, which is generally what we end up talking most of our time about here. 835 00:43:51,012 --> 00:43:55,692 What do you think is, you know, we talked about the things that you 836 00:43:55,692 --> 00:43:59,742 need to do in advance, establishing a communication with the F B I or other law 837 00:43:59,742 --> 00:44:04,992 enforcement, um, you know, establishing a relationship with somebody like yourself. 838 00:44:05,742 --> 00:44:09,912 Um, you know, so, so that you're not, you're not making that conversation the 839 00:44:09,912 --> 00:44:12,252 first time in the middle of an incident. 840 00:44:12,852 --> 00:44:17,502 What else do you think people need to do to be ready to respond, 841 00:44:18,042 --> 00:44:19,902 uh, in, in a cyber attack? 842 00:44:21,292 --> 00:44:24,922 Mike Saylor: Well, I think, uh, ex tabletop exercises are a great way to kind 843 00:44:24,922 --> 00:44:27,502 of ferret that out for your organization. 844 00:44:27,832 --> 00:44:30,832 Sit down with as many people in your company as you can. 845 00:44:30,892 --> 00:44:34,222 I mean, a lot of it departments are like, let's just do it with us first so we don't 846 00:44:34,222 --> 00:44:35,452 look stupid in front of everybody else. 847 00:44:35,452 --> 00:44:36,142 And that's fine. 848 00:44:36,622 --> 00:44:39,172 You know, you know, have a, have your, have your, you 849 00:44:39,172 --> 00:44:40,312 know, red, blue or red white. 850 00:44:40,707 --> 00:44:45,327 You know, scrimmage game, um, but then involve as many people as possible. 851 00:44:45,327 --> 00:44:47,307 And I've seen this be so successful. 852 00:44:47,727 --> 00:44:52,377 Um, and, and even involve your insurance broker and your outside counsel and invite 853 00:44:52,377 --> 00:44:57,627 the F b I invite the Secret Service, um, have this exercise and, and pick a topic. 854 00:44:58,227 --> 00:45:02,067 Um, and whether you do it yourself or, or, you know, look for a moderator. 855 00:45:02,127 --> 00:45:04,257 Uh, and there's a lot of good moderators out there. 856 00:45:04,257 --> 00:45:05,997 I'm, I, I do these all the time. 857 00:45:06,027 --> 00:45:07,587 I'm considered a breach coach. 858 00:45:08,037 --> 00:45:11,787 But then there's, there's even cybersecurity law firms that will, uh, 859 00:45:11,787 --> 00:45:13,737 will facilitate, uh, a good tabletop. 860 00:45:13,737 --> 00:45:15,327 And the idea is, let's pick a topic. 861 00:45:15,387 --> 00:45:19,167 Ransomware or intellectual property theft or. 862 00:45:19,767 --> 00:45:23,337 Um, our data center gets hit by a plane 'cause we're close to an airport. 863 00:45:23,577 --> 00:45:26,787 Whatever it is, pick a topic, invite as many people as you can 864 00:45:26,907 --> 00:45:28,227 and walk through the scenario. 865 00:45:28,632 --> 00:45:32,922 Um, you know, somebody clicked the link and, and you know, they came to 866 00:45:32,922 --> 00:45:37,122 work and their desktop icons are all changed and they can't use anything. 867 00:45:37,122 --> 00:45:39,432 Well, and then we got another call and then, alright, well 868 00:45:39,432 --> 00:45:41,112 let's start with who do they call? 869 00:45:41,142 --> 00:45:42,192 Who does an employee talk? 870 00:45:42,192 --> 00:45:43,182 Who is their phone number? 871 00:45:43,182 --> 00:45:44,862 Is there an what if email doesn't work? 872 00:45:45,522 --> 00:45:46,692 Uh, so who do they call? 873 00:45:46,692 --> 00:45:48,192 And then what does that person do? 874 00:45:48,222 --> 00:45:50,502 How do we, how do we assess the situation? 875 00:45:50,802 --> 00:45:53,652 And which is, you know, kind of phase one of incident response is how do we 876 00:45:53,652 --> 00:45:56,022 categorize this event into an incident? 877 00:45:56,172 --> 00:45:57,162 Is it a non-event? 878 00:45:57,402 --> 00:45:58,242 Is it critical? 879 00:45:58,572 --> 00:46:01,602 Uh, and then that then based on your plan, would indicate 880 00:46:01,602 --> 00:46:02,952 who else needs to be involved. 881 00:46:02,952 --> 00:46:07,962 Once we categorize, once we categorize the, uh, the incident, well then I. 882 00:46:08,727 --> 00:46:12,267 Having as many people there as possible is, is valuable two ways. 883 00:46:12,267 --> 00:46:14,667 One, maybe you don't know who needs to be in involved. 884 00:46:14,667 --> 00:46:17,907 And you can start asking all the attendees, uh, who are the right 885 00:46:17,907 --> 00:46:21,897 people, uh, because you know, I sent this email out five months ago and 886 00:46:21,897 --> 00:46:24,267 nobody's responded who the right person is, but we're all in the same room. 887 00:46:24,267 --> 00:46:24,897 Let's working out. 888 00:46:25,467 --> 00:46:28,797 But at the same time, uh, you're gonna get some people going. 889 00:46:28,947 --> 00:46:29,367 I. 890 00:46:30,207 --> 00:46:33,387 Would've had no idea that's what's involved with doing X, Y, 891 00:46:33,387 --> 00:46:34,887 or Z unless I was in this room. 892 00:46:35,397 --> 00:46:36,927 And I'll tell you a funny story. 893 00:46:36,927 --> 00:46:40,737 We were doing a, a tabletop for a, a company, uh, I think they're in 894 00:46:40,737 --> 00:46:48,267 healthcare and part of the scenario was, uh, threat actor used the contact us. 895 00:46:49,197 --> 00:46:52,467 Button on their website to say, that's how they said, you 896 00:46:52,467 --> 00:46:53,727 know, we have all your data. 897 00:46:54,117 --> 00:46:55,227 Call us in three days. 898 00:46:55,737 --> 00:46:57,807 Um, and here's the information to do so. 899 00:46:58,107 --> 00:46:59,307 And so that was part of the scenario. 900 00:46:59,307 --> 00:47:02,307 So I, uh, I asked, well, who's in charge of the website? 901 00:47:02,312 --> 00:47:04,377 And there were two people in the audience and they said, we are. 902 00:47:04,377 --> 00:47:06,687 And I said, well, what would you do if you got that email? 903 00:47:06,687 --> 00:47:08,097 And they said, we'd probably delete it. 904 00:47:08,097 --> 00:47:09,657 'cause we wouldn't believe it was true. 905 00:47:10,257 --> 00:47:12,537 Well, okay, well maybe you shouldn't delete it anymore. 906 00:47:12,537 --> 00:47:15,027 You should, you know, forward that to the security team 907 00:47:15,027 --> 00:47:16,197 and let them figure that out. 908 00:47:16,527 --> 00:47:17,247 And they said, good. 909 00:47:17,517 --> 00:47:19,317 Good call, uh, good policy. 910 00:47:19,317 --> 00:47:23,157 So, but there were, there were a lot of people in the audience that said, I'm 911 00:47:23,157 --> 00:47:27,507 glad I was here because I would've had no idea that all these moving parts, 912 00:47:27,507 --> 00:47:31,227 and this is this level of effort and this stuff would, is necessary for 913 00:47:31,227 --> 00:47:32,877 responding to whatever the incident was. 914 00:47:32,877 --> 00:47:37,137 Well then, well now it's a good time to ask the insurance broker who's on the call 915 00:47:37,137 --> 00:47:38,877 or in the meeting, when do we contact you? 916 00:47:38,877 --> 00:47:40,197 And they're gonna say, well, as soon as possible. 917 00:47:40,962 --> 00:47:44,772 And, and from, from an employee, uh, company perspective, I think there 918 00:47:44,772 --> 00:47:48,222 was a misconception that calling the insurance like as soon as possible 919 00:47:48,432 --> 00:47:50,082 is somehow gonna affect your premium. 920 00:47:50,082 --> 00:47:51,852 Like, we're gonna pay more because we called you. 921 00:47:52,362 --> 00:47:53,802 Um, and that's not the case. 922 00:47:53,802 --> 00:47:56,292 They want to be involved as soon as possible to help you make the right 923 00:47:56,297 --> 00:48:00,522 decisions because you may be using third parties and buying, you know, 924 00:48:00,522 --> 00:48:05,202 going through this, this expense that, uh, may not be reimbursable. 925 00:48:05,262 --> 00:48:07,242 You know, you might not be able to get paid back for that 926 00:48:07,242 --> 00:48:08,292 if, even if your claim is. 927 00:48:09,012 --> 00:48:12,312 Is accepted, but at the same time, the insurance company wants to know 928 00:48:12,312 --> 00:48:16,032 about how diligent you're being and they wanna be involved in the process. 929 00:48:16,032 --> 00:48:19,962 And that's gonna help you determine or, or hopefully help you, uh, 930 00:48:19,992 --> 00:48:22,692 towards getting your claim approved. 931 00:48:23,232 --> 00:48:26,862 Um, and then they're gonna be the ones, uh, along with your legal counsel, helping 932 00:48:26,867 --> 00:48:31,572 you make the right decisions about how to communicate, uh, situations to third 933 00:48:31,577 --> 00:48:34,392 parties and outside, you know, clients and what have you, but also internally. 934 00:48:34,397 --> 00:48:36,852 And we walked through this, just adding this real quick. 935 00:48:37,092 --> 00:48:38,382 Alright, so you've got this incident. 936 00:48:39,357 --> 00:48:43,437 And, and we did this, uh, we did a tabletop with an engineering company and 937 00:48:43,437 --> 00:48:44,877 they didn't do anything we suggested. 938 00:48:44,877 --> 00:48:47,247 And then like six weeks later, they got hit with ransomware and they 939 00:48:47,247 --> 00:48:48,387 were down for two and a half months. 940 00:48:48,777 --> 00:48:53,547 But, uh, that's the other important thing about tabletops or, or any type of 941 00:48:53,547 --> 00:48:57,867 assessment, you really need to take the remediation seriously, uh, and take action 942 00:48:58,077 --> 00:48:59,607 on those things as soon as possible. 943 00:48:59,817 --> 00:49:03,807 'cause if, if we found them, bad guys have probably found them too. 944 00:49:04,137 --> 00:49:06,537 But one of the things that we found out in a tabletop, or that 945 00:49:06,537 --> 00:49:08,277 came to mind was communication. 946 00:49:08,622 --> 00:49:10,002 Specifically internally. 947 00:49:10,302 --> 00:49:13,092 So this engineering company got hit with ransomware. 948 00:49:13,092 --> 00:49:16,392 They were down, nobody could do any work and they couldn't even email people. 949 00:49:16,452 --> 00:49:19,887 Alright, so, Do you have a system, uh, that collects 950 00:49:19,887 --> 00:49:21,687 personal emails and phone numbers? 951 00:49:21,927 --> 00:49:25,287 Do you have a system where people can call in to get status? 952 00:49:25,287 --> 00:49:26,607 Like, is it a snow day? 953 00:49:26,727 --> 00:49:28,077 Uh, are we off for the day? 954 00:49:28,317 --> 00:49:29,277 Uh, is there an incident? 955 00:49:29,577 --> 00:49:30,537 When are we gonna hear an update? 956 00:49:30,542 --> 00:49:31,257 That kind of stuff. 957 00:49:31,467 --> 00:49:34,917 But then do you also have a policy that says, in the event of an 958 00:49:34,917 --> 00:49:38,967 incident, you are prohibited from discussing this stuff on social media? 959 00:49:39,327 --> 00:49:40,797 Don't put on LinkedIn. 960 00:49:40,827 --> 00:49:41,967 Oh, we had an incident today. 961 00:49:41,967 --> 00:49:43,707 I got, I guess I got the next two months off. 962 00:49:44,322 --> 00:49:49,392 Um, that you're, you've gotta contain that and or at least, uh, uh, 963 00:49:49,422 --> 00:49:51,282 define the messaging for that stuff. 964 00:49:51,612 --> 00:49:52,302 Get ahead of it. 965 00:49:52,752 --> 00:49:56,922 Uh, go ahead and make your templates for internal and external communications. 966 00:49:56,922 --> 00:49:57,762 Like, what are we gonna say? 967 00:49:57,762 --> 00:50:02,982 Well, you should, uh, plan for that now, uh, instead of wasting time during an 968 00:50:03,012 --> 00:50:05,442 incident, you know, trying to figure it out while the house is on fire. 969 00:50:05,952 --> 00:50:10,722 Um, so having said all of that, um, you know, incident response 970 00:50:10,872 --> 00:50:12,822 exercises are very valuable. 971 00:50:13,182 --> 00:50:16,947 Um, And even though you may want to have your own little huddle to figure 972 00:50:16,947 --> 00:50:21,327 out, you know, how well are we before we invite the rest of the, the crew, 973 00:50:21,657 --> 00:50:25,947 um, you should invite as many people, internal, external, subject matter 974 00:50:25,947 --> 00:50:32,397 experts, partners, um, um, as you can, uh, to get everybody, um, playing on 975 00:50:32,427 --> 00:50:35,787 the same team, on the same field they show up for at the, at the right time. 976 00:50:36,237 --> 00:50:39,117 Um, and they have an idea of what the playbook is. 977 00:50:41,157 --> 00:50:41,487 W. Curtis Preston: Wow. 978 00:50:42,402 --> 00:50:45,132 Prasanna Malaiyandi: Wow, that's, yeah, very detailed. 979 00:50:45,132 --> 00:50:48,942 And like you mentioned, it's sort of plan ahead of time, right? 980 00:50:49,602 --> 00:50:53,412 I'm sure there are so many companies where it's like, Hey, ransomware 981 00:50:53,412 --> 00:50:54,462 hits, or We have an incident. 982 00:50:54,462 --> 00:50:57,942 It's just IT and the security org that's dealing with this, right? 983 00:50:57,947 --> 00:51:00,912 But like you mentioned, there's so many other folks involved. 984 00:51:00,917 --> 00:51:04,662 And just knowing who those people are, especially if you're a large company, you 985 00:51:04,667 --> 00:51:07,572 don't know, like one department doesn't know who the other department is even. 986 00:51:08,082 --> 00:51:08,322 Right. 987 00:51:08,322 --> 00:51:08,862 And having that. 988 00:51:09,762 --> 00:51:13,332 Mike Saylor: We had a situation where for, for four days, we were operating under 989 00:51:13,332 --> 00:51:18,372 the un, uh, assumption that they only had a, uh, $3 million cyber insurance policy. 990 00:51:18,732 --> 00:51:22,542 So we were restricting, uh, who was involved to restrict 991 00:51:22,542 --> 00:51:23,982 the expense and the overhead. 992 00:51:24,372 --> 00:51:28,122 Uh, and it wasn't until we were on a, uh, I think it was like 11 993 00:51:28,122 --> 00:51:31,752 o'clock at night on a Sunday, we were on a, an update call and we were 994 00:51:31,757 --> 00:51:33,642 talking about this $3 million policy. 995 00:51:33,642 --> 00:51:37,062 When someone walks, I could see them walk behind the person talking on the 996 00:51:37,067 --> 00:51:38,652 camera, and they go, we have 6 million. 997 00:51:40,062 --> 00:51:40,482 Like, what? 998 00:51:40,722 --> 00:51:41,262 What do you mean? 999 00:51:41,262 --> 00:51:43,242 We have two, $3 million policies? 1000 00:51:43,242 --> 00:51:44,202 And nobody knew that. 1001 00:51:44,382 --> 00:51:45,912 Nobody else, but this person knew that. 1002 00:51:46,272 --> 00:51:47,412 And that completely changed. 1003 00:51:47,412 --> 00:51:50,142 We're like, well, look, we need to start getting more resources in here. 1004 00:51:50,382 --> 00:51:54,072 You know, call, call the big brand response teams and all. 1005 00:51:54,192 --> 00:51:58,932 So that really changed the game because that just happened to come out in a 1006 00:51:58,932 --> 00:52:02,892 meeting without, you know, everybody else being really aware of, uh, Yeah. 1007 00:52:03,372 --> 00:52:06,702 And the other bad part of that situation, uh, unfortunately, was that, 1008 00:52:06,702 --> 00:52:08,622 uh, they had $6 million in coverage. 1009 00:52:08,622 --> 00:52:12,612 But what they didn't also know is that it was a self-funded insurance policy. 1010 00:52:13,632 --> 00:52:13,852 Prasanna Malaiyandi: Uh, 1011 00:52:14,232 --> 00:52:16,602 Mike Saylor: So they were paying into that over, over time and the 1012 00:52:16,602 --> 00:52:19,932 insurance company said, we'll cover you, uh, if the day comes, but then 1013 00:52:19,932 --> 00:52:21,522 you've gotta pay it back pretty much. 1014 00:52:21,642 --> 00:52:24,642 And so, um, they didn't know that either. 1015 00:52:25,572 --> 00:52:26,292 So a lot of things 1016 00:52:26,292 --> 00:52:26,652 Prasanna Malaiyandi: Raid your 1017 00:52:26,652 --> 00:52:27,282 policy. 1018 00:52:27,492 --> 00:52:27,762 Yeah. 1019 00:52:27,912 --> 00:52:28,812 W. Curtis Preston: they found that out. 1020 00:52:29,472 --> 00:52:33,492 Um, well, listen, um, wait, I'm, did I mute myself? 1021 00:52:33,552 --> 00:52:33,702 No. 1022 00:52:34,482 --> 00:52:34,752 There. 1023 00:52:34,752 --> 00:52:35,202 I muted. 1024 00:52:35,262 --> 00:52:35,532 Okay. 1025 00:52:35,532 --> 00:52:35,832 Sorry. 1026 00:52:36,522 --> 00:52:39,072 Um, listen, Mike, we could talk all day. 1027 00:52:39,112 --> 00:52:40,992 I, I, I love the stories by the way. 1028 00:52:40,992 --> 00:52:41,262 I, 1029 00:52:41,502 --> 00:52:41,622 Prasanna Malaiyandi: eh. 1030 00:52:42,822 --> 00:52:44,982 W. Curtis Preston: you know, you, you know me, Prasanna, I'm, I'm a 1031 00:52:44,982 --> 00:52:49,452 storyteller myself, and I, I think nothing, nothing tells the story 1032 00:52:49,452 --> 00:52:53,552 like a good story, you know, nothing, nothing drills that point home, uh, 1033 00:52:53,632 --> 00:52:55,482 better than a good story, for sure. 1034 00:52:55,872 --> 00:52:58,722 Um, and I, I love hearing. 1035 00:52:59,307 --> 00:53:03,147 From these real incidents, uh, what, you know, what, what I'm hearing? 1036 00:53:03,567 --> 00:53:06,267 So I, I like, you know, the things that I picked up here. 1037 00:53:06,267 --> 00:53:08,667 First off, I like the amount of time we spent on the F B 1038 00:53:08,667 --> 00:53:10,827 I, uh, and for guard program. 1039 00:53:10,917 --> 00:53:14,157 Uh, I definitely wanna look more into that and I think the listeners 1040 00:53:14,162 --> 00:53:15,297 should look more into that. 1041 00:53:15,657 --> 00:53:21,177 And I like this idea, uh, and of, of using them as a way to establish those 1042 00:53:21,177 --> 00:53:24,507 communication channels before an event. 1043 00:53:24,927 --> 00:53:29,457 Um, and I like the idea of, well, you know, we, we, we always promote 1044 00:53:29,457 --> 00:53:35,397 the idea of, of tabletop exercises and, um, you know, in, in my 1045 00:53:35,397 --> 00:53:37,077 world, you know, we call them Dr. 1046 00:53:37,437 --> 00:53:41,817 Dr exercises right back before the, the cyber world was also 1047 00:53:41,817 --> 00:53:43,287 attacking backup systems. 1048 00:53:43,587 --> 00:53:47,967 Um, so I, you know, I think this has been a great conversation, Mike. 1049 00:53:47,967 --> 00:53:49,557 So I want to thank you for coming on. 1050 00:53:50,157 --> 00:53:50,637 Mike Saylor: Certainly. 1051 00:53:51,642 --> 00:53:54,462 W. Curtis Preston: And, uh, Prasanna once again, as always, 1052 00:53:54,462 --> 00:53:56,142 you with your, with your wisdom. 1053 00:53:57,337 --> 00:54:00,817 Prasanna Malaiyandi: Yeah, anytime Curtis, and I hope you'll be ordering a chair 1054 00:54:00,817 --> 00:54:03,577 or at least, or uh, browsing chair soon. 1055 00:54:03,967 --> 00:54:05,977 And Mike, thank you for the info. 1056 00:54:06,007 --> 00:54:06,127 I. 1057 00:54:06,777 --> 00:54:07,017 Yeah. 1058 00:54:07,017 --> 00:54:11,397 It's always fascinating hearing these real life stories because that's something 1059 00:54:11,397 --> 00:54:12,897 that you don't hear about, right? 1060 00:54:12,897 --> 00:54:16,407 What did people experience and what was it like going through? 1061 00:54:16,407 --> 00:54:20,547 It's just like what you read, like reading the Cuckoo's Nest or Cuckoo's Egg, right? 1062 00:54:20,547 --> 00:54:23,277 It's like those are the types of stories that are interesting that 1063 00:54:23,277 --> 00:54:27,237 you learn from, especially new people in this space, like myself, right? 1064 00:54:27,237 --> 00:54:29,847 Where it's like, hey, what really goes on behind the scenes and 1065 00:54:29,847 --> 00:54:30,957 what does it take to recover? 1066 00:54:32,037 --> 00:54:33,027 So thank you for sharing. 1067 00:54:33,392 --> 00:54:34,002 Mike Saylor: Certainly. 1068 00:54:34,542 --> 00:54:34,692 Yeah. 1069 00:54:34,692 --> 00:54:35,402 I've got stories all day. 1070 00:54:37,662 --> 00:54:38,052 W. Curtis Preston: Sounds like 1071 00:54:38,052 --> 00:54:39,102 Prasanna Malaiyandi: we'll have you back on. 1072 00:54:39,102 --> 00:54:41,412 W. Curtis Preston: Yeah, you and me over beers, Mike, nobody would 1073 00:54:41,412 --> 00:54:43,032 ever get the word in edgewise. 1074 00:54:43,362 --> 00:54:47,022 And once again, I want to thank our listeners, uh, and remember to subscribe 1075 00:54:47,027 --> 00:54:48,942 so that you can restore it all.