1 00:00:00,000 --> 00:00:04,050 You found the backup wrap up your go-to podcast for all things 2 00:00:04,050 --> 00:00:06,359 backup recovery and cyber recovery. 3 00:00:06,720 --> 00:00:10,950 In this episode, we tackled the critical topic of incident response plans. 4 00:00:11,250 --> 00:00:14,310 Once again, we've brought our resident cyber expert, Dr. 5 00:00:14,310 --> 00:00:19,865 Mike Saylor from Black Swan Security, who starts by defining what an IR plan is and 6 00:00:19,890 --> 00:00:22,230 how it's different from DR and BC plans. 7 00:00:22,500 --> 00:00:25,860 We then talk about how you need different kind of response plans 8 00:00:25,860 --> 00:00:27,209 for different kinds of incidents. 9 00:00:27,479 --> 00:00:30,060 Like a cyber attack versus a failed RAID array. 10 00:00:30,689 --> 00:00:34,050 We also delve into RACI diagrams and how they define who is 11 00:00:34,050 --> 00:00:39,300 responsible, accountable, consulted and informed on any incidents. 12 00:00:39,569 --> 00:00:43,050 Then we dig into where this plan should live and how you should make sure you 13 00:00:43,050 --> 00:00:45,179 have access to it and the bad guys don't. 14 00:00:45,720 --> 00:00:48,150 This is a packed episode I think you're gonna really like. 15 00:00:48,660 --> 00:00:52,260 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 16 00:00:52,260 --> 00:00:56,250 Backup, and I've been passionate about this topic for over 30 years. 17 00:00:56,595 --> 00:01:00,975 Ever since I had to tell my boss that our production database was toast 18 00:01:01,155 --> 00:01:02,504 and there were no backups of it. 19 00:01:02,864 --> 00:01:06,465 I don't want that to happen to you or anybody, and that's why I do this. 20 00:01:06,735 --> 00:01:11,925 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 21 00:01:12,165 --> 00:01:14,235 This is the backup wrap up. 22 00:01:28,723 --> 00:01:29,653 Welcome to the show. 23 00:01:30,913 --> 00:01:34,513 If I can ask you for just a quick second to go, press, subscribe or 24 00:01:34,513 --> 00:01:38,863 follow so that you'll always be able to get our content, that would be great. 25 00:01:39,478 --> 00:01:42,028 I am w Curtis Preston, AKA, Mr. 26 00:01:42,028 --> 00:01:46,078 Backup, and I have with me a guy who keeps trying to get me to watch 27 00:01:46,408 --> 00:01:51,848 this weird new version of the Lord of the Rings Prasanna Malaiyandi 28 00:01:54,838 --> 00:01:55,978 ah, yes. 29 00:01:55,978 --> 00:01:58,618 And you still have not seen it, although I did. 30 00:01:58,618 --> 00:02:03,538 So my parents, so what I'm referring to is there's this new, it's not 31 00:02:03,538 --> 00:02:06,328 even a Bollywood movie, I think it's technically a Telugu movie. 32 00:02:06,328 --> 00:02:13,438 It's so tollywood, but it is called ky, A 2398 or something like that. 33 00:02:14,488 --> 00:02:17,038 So it's supposed to be Yes, very. 34 00:02:17,533 --> 00:02:19,483 Fantasy oriented. 35 00:02:19,993 --> 00:02:25,183 Supposed to be really good shot in the modern day era or actually in the future. 36 00:02:25,183 --> 00:02:28,003 And it has some pretty famous actors. 37 00:02:28,483 --> 00:02:34,003 So from both the Telegu scene and the Thumb, and also from Hindi cinema. 38 00:02:34,003 --> 00:02:37,483 So pretty much star in all star cast. 39 00:02:37,603 --> 00:02:41,413 But I've been asking you, my parents actually went and saw it. 40 00:02:41,413 --> 00:02:44,473 They said it was like three and a half hours and it was really long, but. 41 00:02:45,808 --> 00:02:46,468 That might be like a. 42 00:02:46,468 --> 00:02:47,038 couple naps. 43 00:02:47,638 --> 00:02:49,168 Yeah, but it might be a couple naps. 44 00:02:49,168 --> 00:02:51,208 for you, But it's only one episode or one movie. 45 00:02:52,068 --> 00:02:56,388 I've been also trying to get you to watch Bahoo Bali one and two or the beginning 46 00:02:56,433 --> 00:02:56,883 yeah. 47 00:02:57,093 --> 00:02:58,383 That's the Lord of the Rings. 48 00:02:58,443 --> 00:03:00,633 When I was talking about though, isn't it? 49 00:03:00,768 --> 00:03:02,838 Oh, that's y. 50 00:03:03,438 --> 00:03:04,218 Oh, you're right. 51 00:03:04,218 --> 00:03:05,238 That is the Lord of the Rings 52 00:03:05,313 --> 00:03:06,813 and that's like seven hours. 53 00:03:06,813 --> 00:03:08,253 That's like seven hours long. 54 00:03:08,268 --> 00:03:09,288 that's six hours. 55 00:03:09,588 --> 00:03:16,158 But, uh, my wife and I, we did watch it y or over the weekend and so it's fine. 56 00:03:16,158 --> 00:03:19,128 And it's really good though, Curtis, you should watch it. 57 00:03:19,338 --> 00:03:20,778 You have until August 6th. 58 00:03:22,083 --> 00:03:23,073 Uh, okay. 59 00:03:23,073 --> 00:03:26,373 So as of this recording, I have one week to watch it. 60 00:03:26,418 --> 00:03:26,898 Yes. 61 00:03:28,083 --> 00:03:35,133 All right, well, we have with us again, our, um, can, can we call you our, 62 00:03:35,133 --> 00:03:37,113 our resident cybersecurity expert? 63 00:03:39,393 --> 00:03:39,513 Can 64 00:03:39,583 --> 00:03:42,753 I feel like I've, I, I, I feel like I do reside here now. 65 00:03:43,233 --> 00:03:46,023 I think so we've done enough episodes. 66 00:03:46,533 --> 00:03:51,993 Um, so, uh, the CEO of Black Swan Security, Mike Sailor, 67 00:03:52,203 --> 00:03:53,613 welcome to the show once again. 68 00:03:55,173 --> 00:03:55,893 Thanks guys. 69 00:03:56,043 --> 00:03:56,583 Great to be here. 70 00:03:57,348 --> 00:04:01,728 So this week we want to talk about, we talk a lot about this. 71 00:04:01,728 --> 00:04:04,488 It comes up a lot, uh, you know, in shows. 72 00:04:05,058 --> 00:04:09,498 And everybody says you need a response plan, right? 73 00:04:09,978 --> 00:04:12,768 And, uh, you know, an incident response plan. 74 00:04:12,858 --> 00:04:16,998 And we talk, some people talk about a ransomware response plan, a cybersecurity 75 00:04:16,998 --> 00:04:19,068 response plan, an incident response plan. 76 00:04:20,058 --> 00:04:21,378 Can you just help? 77 00:04:21,723 --> 00:04:25,023 Define all of those, like what, you know, do they, do they fit? 78 00:04:25,023 --> 00:04:28,653 And, and of course I talk about a disaster recovery, uh, plan. 79 00:04:29,073 --> 00:04:33,098 Where do all are, are these like Russian nesting dolls? 80 00:04:33,798 --> 00:04:35,913 Well, and what's an incident response plan to start with? 81 00:04:37,098 --> 00:04:37,388 Yeah. 82 00:04:37,503 --> 00:04:39,363 are Russian nesting dolls. 83 00:04:39,873 --> 00:04:46,773 Uh, so an incident response plan is what are you gonna do in the event that an 84 00:04:46,773 --> 00:04:49,773 event, in the event that an event occurs? 85 00:04:51,078 --> 00:04:53,238 you then classify as an incident. 86 00:04:53,238 --> 00:04:57,018 And so first part of an incident response plan is, how do I do that? 87 00:04:57,348 --> 00:05:00,378 You can't, you, you gotta define the difference then if 88 00:05:00,378 --> 00:05:01,723 you're gonna use that event 89 00:05:01,878 --> 00:05:03,108 That's where I'm, that's where I'm going. 90 00:05:03,173 --> 00:05:03,393 Oh. 91 00:05:03,648 --> 00:05:08,628 part is, the first part of, of your incident response plan is how do 92 00:05:08,628 --> 00:05:12,828 I, how do I intake an event report? 93 00:05:12,978 --> 00:05:17,628 Uh, could be smoke, it could be, uh, my computer's acting weird. 94 00:05:17,628 --> 00:05:18,078 It could be. 95 00:05:18,933 --> 00:05:25,863 Um, the website's down, uh, and then how do I classify that event as a type of 96 00:05:25,863 --> 00:05:30,003 incident and then as a type of incident, what, what level of incident is it? 97 00:05:30,003 --> 00:05:33,633 1, 2, 3, or, or however your organization classifies things. 98 00:05:34,323 --> 00:05:38,463 And so the first part is that that analysis and categorization of an 99 00:05:38,463 --> 00:05:43,863 event into, uh, an incident and, uh, incident type and criticality. 100 00:05:44,808 --> 00:05:46,368 Right, and, and then 101 00:05:49,008 --> 00:05:49,308 go ahead. 102 00:05:50,478 --> 00:05:55,428 So then you have an incident, and based on what that incident type is, you 103 00:05:55,428 --> 00:05:56,808 would have what's called a playbook. 104 00:05:57,723 --> 00:06:01,773 So that playbook could be ransomware, that playbook could be denial of service, 105 00:06:01,773 --> 00:06:07,743 the website's down, uh, operational, you know, uh, outage type of playbook. 106 00:06:08,253 --> 00:06:13,113 Uh, or it could be, uh, misconduct, uh, you know, employee, employee misconduct 107 00:06:13,113 --> 00:06:16,593 or trying to access stuff that shouldn't, unauthorized access type playbook. 108 00:06:17,133 --> 00:06:18,573 Um, and you would. 109 00:06:20,313 --> 00:06:25,383 You, you would do an analysis of your organization's most likely threats 110 00:06:25,383 --> 00:06:27,303 and build playbooks based on those. 111 00:06:29,118 --> 00:06:32,088 And then playbooks are like we've talked about in the past, just 112 00:06:32,388 --> 00:06:33,798 sort of everything documented. 113 00:06:33,798 --> 00:06:36,348 Hey, if this happens, here's all the people involved. 114 00:06:36,348 --> 00:06:37,968 Here's all the steps that everyone takes. 115 00:06:37,968 --> 00:06:41,868 Here's who's responsible for what actions, here's who I have to 116 00:06:41,868 --> 00:06:43,998 talk to, and all the rest of that. 117 00:06:43,998 --> 00:06:44,298 Right. 118 00:06:44,298 --> 00:06:45,858 And here's who needs to be informed. 119 00:06:46,933 --> 00:06:47,293 Right. 120 00:06:47,293 --> 00:06:48,343 At least an outline. 121 00:06:48,433 --> 00:06:48,613 Uh, 122 00:06:48,643 --> 00:06:50,023 something's better than nothing. 123 00:06:50,473 --> 00:06:53,683 And then, and then back to Curtis's question about disaster recovery. 124 00:06:53,683 --> 00:06:55,453 And how does incident response plan it? 125 00:06:55,453 --> 00:06:59,473 It is nested because an event becomes an incident and an incident 126 00:06:59,473 --> 00:07:01,123 can then become a disaster. 127 00:07:02,073 --> 00:07:02,883 'cause essentially a. 128 00:07:03,363 --> 00:07:04,593 The, you know, you have a Dr. 129 00:07:04,593 --> 00:07:05,943 Runbook, right? 130 00:07:05,973 --> 00:07:08,343 Or a play, you know, you're saying playbook, playbook, 131 00:07:08,343 --> 00:07:09,423 runbook, same thing to you. 132 00:07:10,113 --> 00:07:10,383 Yeah. 133 00:07:10,453 --> 00:07:10,873 It is. 134 00:07:11,403 --> 00:07:18,693 So, um, it, it's a, I I think of it a, a bit like programming where Dr. 135 00:07:18,693 --> 00:07:22,398 Runbook is, you know, is a function, is a library that can 136 00:07:22,398 --> 00:07:23,943 be called by the bigger program. 137 00:07:23,943 --> 00:07:24,213 Right. 138 00:07:24,213 --> 00:07:27,603 So that, that to me is like the. 139 00:07:28,218 --> 00:07:34,008 The, the deepest, nested part, right, because only after we've had an 140 00:07:34,008 --> 00:07:36,408 incident, we've classified an incident. 141 00:07:36,528 --> 00:07:38,988 We've classified it as a cybersecurity incident. 142 00:07:39,198 --> 00:07:42,918 We've classified it as a, it's a ransomware event, and it's a 143 00:07:42,918 --> 00:07:45,558 ransomware event that needs restore. 144 00:07:46,203 --> 00:07:54,843 Right now we, you know, and then we have done our preparatory steps that 145 00:07:54,903 --> 00:07:59,133 we need to do because, you know, I talk about a lot about this a lot, 146 00:07:59,133 --> 00:08:04,893 and that is one of the big differences between a disaster recovery response 147 00:08:05,343 --> 00:08:12,513 and a, a ransomware response is that almost always the disaster is over. 148 00:08:12,903 --> 00:08:13,413 Right. 149 00:08:13,653 --> 00:08:15,543 The flood has receded. 150 00:08:15,933 --> 00:08:19,653 Um, because you, you can't start, you can't start your recovery 151 00:08:19,653 --> 00:08:20,883 until the flood has receded. 152 00:08:21,093 --> 00:08:25,023 The winds have stopped, the earthquake is over, the fire has 153 00:08:25,023 --> 00:08:31,083 been put out, whatever the disaster was, it's over call the DR person. 154 00:08:31,288 --> 00:08:37,353 The, the big difference with a cyber event is that the attack is ongoing 155 00:08:37,413 --> 00:08:39,993 and you've got to put that fire out. 156 00:08:40,368 --> 00:08:45,408 Uh, to, to use that analogy before you can ever call the DR person, and that's why 157 00:08:45,408 --> 00:08:49,668 I'm saying it's sort of the most nested within, within the, the nesting dolls. 158 00:08:49,848 --> 00:08:50,838 What do you think of that comment? 159 00:08:52,093 --> 00:08:53,053 Completely agree. 160 00:08:53,143 --> 00:08:56,833 And, and just to add a level of complexity with regard to backups, 161 00:08:56,923 --> 00:08:59,113 uh, during your incident response. 162 00:08:59,473 --> 00:09:02,293 If it's a ransomware where there's some compromise that happened 163 00:09:02,293 --> 00:09:05,323 that led to the ransomware, then you've gotta make sure then also 164 00:09:05,803 --> 00:09:09,583 that the backups you're restoring don't also include the compromise. 165 00:09:10,128 --> 00:09:11,208 That you're trying to, 166 00:09:11,213 --> 00:09:12,078 to tie off? 167 00:09:13,978 --> 00:09:14,468 Correct. 168 00:09:14,508 --> 00:09:19,158 lot more, a lot more attention to detail and, and analysis, uh, during 169 00:09:19,158 --> 00:09:23,838 an incident than for sure, than, than, uh, cleaning up after a disaster. 170 00:09:26,253 --> 00:09:31,803 So you have these, so you said you take the event, you identify it, 171 00:09:32,253 --> 00:09:37,923 you put it into the right bucket of incidences, and then you. 172 00:09:38,688 --> 00:09:42,108 Put a severity alongside it, and then you just sort of execute 173 00:09:42,108 --> 00:09:44,388 your incident response plan. 174 00:09:44,928 --> 00:09:51,918 Now, are these like, I am sure it's hard to cover every single incident 175 00:09:51,918 --> 00:09:55,188 and severity or priority, right? 176 00:09:55,188 --> 00:09:56,508 That goes alongside it. 177 00:09:56,748 --> 00:09:59,838 So how do you sort of decide like, which ones am I actually going to 178 00:09:59,838 --> 00:10:01,758 create an incident response plan for? 179 00:10:01,758 --> 00:10:03,678 Which ones do I not need to? 180 00:10:05,088 --> 00:10:06,828 Because it all comes down to. 181 00:10:07,278 --> 00:10:09,048 Like resources in the company, right? 182 00:10:10,018 --> 00:10:10,738 It does. 183 00:10:10,738 --> 00:10:12,328 And, and that's where you're gonna start. 184 00:10:12,718 --> 00:10:15,868 So in, in your incident response plan, and this, this goes. 185 00:10:16,653 --> 00:10:20,073 Kind of back to the left a little bit in understanding the business 186 00:10:20,073 --> 00:10:24,423 and the, the way it operates and how technology supports the business and, 187 00:10:24,483 --> 00:10:29,523 and all the critical components of, uh, where, where the, the business 188 00:10:30,033 --> 00:10:33,663 revenue and, and, um, focus is. 189 00:10:34,323 --> 00:10:34,683 Uh. 190 00:10:35,868 --> 00:10:41,118 Create an inventory of, of your, of your resources, both on the IT side. 191 00:10:41,118 --> 00:10:44,238 We should already have that, especially from a disaster recovery perspective. 192 00:10:44,238 --> 00:10:45,498 And I'll add this comment too. 193 00:10:46,068 --> 00:10:49,938 If you have a mature disaster recovery plan, then a lot of 194 00:10:49,938 --> 00:10:51,019 the work that you're gonna. 195 00:10:51,903 --> 00:10:55,713 Put into creating your incident response plan should have already been done. 196 00:10:56,163 --> 00:11:01,203 I've got an inventory of all our, our IT assets and where our data is 197 00:11:01,203 --> 00:11:05,553 and the SLAs for, you know, if this machine's offline for an hour, we, we 198 00:11:05,553 --> 00:11:07,113 lost a million dollars type of thing. 199 00:11:08,253 --> 00:11:12,363 Well then, and the, and the, the resources we need to address those 200 00:11:12,363 --> 00:11:14,523 disaster recovery activities. 201 00:11:14,838 --> 00:11:15,498 Who's the sy? 202 00:11:15,528 --> 00:11:16,728 Who owns that system? 203 00:11:16,908 --> 00:11:18,198 Who's our network administrator? 204 00:11:18,198 --> 00:11:19,278 Who's our active directory? 205 00:11:19,278 --> 00:11:20,058 Who's who? 206 00:11:20,448 --> 00:11:21,408 Who's our website? 207 00:11:21,828 --> 00:11:23,238 You should, you should know who. 208 00:11:23,238 --> 00:11:27,468 All those subject matter experts and stakeholders and owners are both on 209 00:11:27,468 --> 00:11:29,118 the IT side and the business side. 210 00:11:29,718 --> 00:11:30,108 Right? 211 00:11:30,288 --> 00:11:33,468 So understanding that, um. 212 00:11:34,518 --> 00:11:39,168 That environment of resources is critical to being successful in incident response. 213 00:11:39,528 --> 00:11:43,878 All right, well then to your question about do we, you know, we can't possibly 214 00:11:43,878 --> 00:11:47,598 have a playbook for everything, but what, what you'll learn, especially 215 00:11:47,598 --> 00:11:51,228 after you, you do your first playbook and your first tabletop exercise, 216 00:11:51,228 --> 00:11:52,968 is that there are very common 217 00:11:53,058 --> 00:11:55,338 elements of every incident response. 218 00:11:55,698 --> 00:11:56,658 You've got a leader. 219 00:11:56,913 --> 00:12:00,363 That knows how to, that understands the environment and knows how to 220 00:12:00,363 --> 00:12:02,523 categorize an event appropriately. 221 00:12:02,973 --> 00:12:07,173 And then from that categorization of incident and priority can assemble 222 00:12:07,173 --> 00:12:11,883 the right people from this inventory of resources to be effective 223 00:12:11,883 --> 00:12:13,563 at responding to that incident. 224 00:12:14,133 --> 00:12:17,103 You know, if it's ransomware, it's kind of an all hands on deck thing, 225 00:12:17,433 --> 00:12:21,603 but if the website's down, I, I already know, I, I can look up who to call. 226 00:12:22,218 --> 00:12:22,818 I need our 227 00:12:22,818 --> 00:12:26,958 ISP, our host, our hosting site, the the person that wrote the website, 228 00:12:27,318 --> 00:12:30,888 the person that knows all the backend systems that support the website. 229 00:12:31,368 --> 00:12:35,418 I've got all that hammered out, and we'll get on a call and I've got their phone 230 00:12:35,418 --> 00:12:39,438 number and their email and where they live and account numbers and all that stuff. 231 00:12:40,068 --> 00:12:43,158 So you don't have to basically cry wolf every single time. 232 00:12:43,893 --> 00:12:45,753 You don't, and you, and you should not. 233 00:12:46,353 --> 00:12:51,933 Uh, so you know when, when an incident happens and, and or an event happens and 234 00:12:51,933 --> 00:12:53,463 you're like, this is a true incident. 235 00:12:53,883 --> 00:12:55,053 You don't go push the button. 236 00:12:55,143 --> 00:12:59,193 You, you, you call the next person and get some, some, some feedback and 237 00:12:59,193 --> 00:13:03,303 some collaboration, uh, and then you start to expand the team as necessary. 238 00:13:03,303 --> 00:13:05,763 You don't, you don't call everybody to the table for every answer. 239 00:13:06,583 --> 00:13:08,388 and, and I think you, I think you. 240 00:13:09,408 --> 00:13:14,778 You mentioned this a little bit earlier, but I just want to, um, you know, 241 00:13:14,778 --> 00:13:18,018 when you, when you said that a lot of the work would've already been done, 242 00:13:18,018 --> 00:13:19,818 if you have a DR plan, that's great. 243 00:13:21,123 --> 00:13:23,913 If you don't have one, uh, that's not good. 244 00:13:24,033 --> 00:13:27,813 But, but I want to say that if this is the first time you're 245 00:13:27,813 --> 00:13:34,293 doing any of this kind of work, the really key first thing is the BIA. 246 00:13:34,443 --> 00:13:35,013 Right? 247 00:13:35,403 --> 00:13:36,093 It's like. 248 00:13:36,588 --> 00:13:42,288 Because, you know, as nerds as it people, we, we, we very often, we, we 249 00:13:42,468 --> 00:13:46,998 focus immediately on the, you know, the cyber aspect or the recovery aspect 250 00:13:46,998 --> 00:13:49,878 or the backup aspect and you know, how are we gonna get our network up? 251 00:13:49,883 --> 00:13:50,538 Okay, okay. 252 00:13:50,598 --> 00:13:54,138 We need to figure out what actually matters, right? 253 00:13:54,378 --> 00:13:55,998 What makes the company money? 254 00:13:56,238 --> 00:13:59,778 What's going to cost the company money when it's down? 255 00:14:00,228 --> 00:14:00,678 Right. 256 00:14:00,858 --> 00:14:04,818 What are things that we can do without and, and how long and 257 00:14:04,818 --> 00:14:06,678 how long can we do without them? 258 00:14:07,128 --> 00:14:11,958 Uh, how much money are we losing when this part of the company is down? 259 00:14:12,378 --> 00:14:12,828 Right? 260 00:14:13,068 --> 00:14:17,778 Um, and when this part of the company is down, is there something else that 261 00:14:17,868 --> 00:14:22,548 the people that work on that part of the company can do to continue 262 00:14:22,548 --> 00:14:24,018 to make money for the company? 263 00:14:24,378 --> 00:14:26,658 Uh, or do we just send them home? 264 00:14:27,018 --> 00:14:29,928 Um, you know, so they're not twiddling their thumbs. 265 00:14:30,258 --> 00:14:34,278 and Curtis, when you said BIA, you meant business impact assessment, correct. 266 00:14:34,608 --> 00:14:34,908 you. 267 00:14:34,908 --> 00:14:35,478 Thank you. 268 00:14:37,908 --> 00:14:38,898 What do you, what do you think, Mike? 269 00:14:39,258 --> 00:14:40,308 Any, any additional. 270 00:14:41,778 --> 00:14:42,618 Absolutely. 271 00:14:42,618 --> 00:14:45,438 And so the BIA is valuable in so many ways. 272 00:14:45,438 --> 00:14:47,148 BIA will help you on your insurance. 273 00:14:47,148 --> 00:14:50,028 It helps you on your business continuity, your disaster recovery, your incident 274 00:14:50,028 --> 00:14:52,878 response, all your risk assessments. 275 00:14:52,938 --> 00:14:54,258 It's, it's very critical. 276 00:14:54,258 --> 00:14:57,798 And any, any due diligence for like acquisitions and mergers and all 277 00:14:57,798 --> 00:15:00,168 that stuff, it's, it's very critical. 278 00:15:00,198 --> 00:15:04,278 It's also a good, uh, it's also a good tool for process. 279 00:15:04,893 --> 00:15:07,923 Uh, improvement and overhead analysis. 280 00:15:08,433 --> 00:15:10,443 Uh, it, it's, it's, it's really good. 281 00:15:10,953 --> 00:15:14,403 Well then, uh, to touch on something you mentioned, uh, you know, if, 282 00:15:14,433 --> 00:15:17,523 if this incident, or if this event happens and people can't do their 283 00:15:17,523 --> 00:15:20,073 work and you send them home, or what else could they be doing? 284 00:15:20,553 --> 00:15:22,713 Uh, that also touches on business continuity. 285 00:15:22,713 --> 00:15:27,003 So how do we keep running the business without technology, which is really 286 00:15:27,003 --> 00:15:28,743 what disaster recovery focuses on. 287 00:15:28,743 --> 00:15:30,093 Business continuity is that. 288 00:15:30,738 --> 00:15:31,098 that. 289 00:15:31,128 --> 00:15:35,328 that contingency plan for, you know, I can't use the phone anymore or, or 290 00:15:35,328 --> 00:15:38,718 that system's down and, and now we've gotta revert to pen and paper and, 291 00:15:39,288 --> 00:15:42,198 uh, how do I, how do I keep taking orders or scheduling 292 00:15:42,198 --> 00:15:43,848 repairs or whatever the case might 293 00:15:44,043 --> 00:15:46,983 Somebody go find a big box of carbon paper. 294 00:15:47,373 --> 00:15:51,033 Yeah, like Curtis's, uh, doctor's office or 295 00:15:51,303 --> 00:15:53,673 that direct show that happened in the Midwest summer. 296 00:15:53,673 --> 00:15:54,898 Remember that episode Curtis? 297 00:15:55,168 --> 00:15:55,458 Yeah. 298 00:15:55,518 --> 00:15:56,218 The derecho. 299 00:15:56,218 --> 00:15:57,693 Yeah, that's a great episode. 300 00:15:57,693 --> 00:16:01,473 We, we, we did have somebody on here who, who lived in a place, 301 00:16:01,503 --> 00:16:03,753 um, and they experienced a derecho. 302 00:16:03,753 --> 00:16:05,223 Have you ever even heard of a derecho? 303 00:16:07,488 --> 00:16:09,618 I've heard the term, but I don't, I'm, I'm assuming It, 304 00:16:09,813 --> 00:16:10,143 it's a, 305 00:16:10,383 --> 00:16:14,283 it just means a, a hurricane that forms over land. 306 00:16:16,008 --> 00:16:19,278 Um, don't have any idea why it's called what it's called, 307 00:16:19,278 --> 00:16:20,358 but that's what it's called. 308 00:16:20,988 --> 00:16:25,968 Um, so yeah, so we've done our, our business impact analysis. 309 00:16:25,968 --> 00:16:27,918 We, you know, we, we, we know all the parts. 310 00:16:28,248 --> 00:16:28,758 We know the. 311 00:16:29,673 --> 00:16:31,773 We know where to focus our efforts. 312 00:16:32,043 --> 00:16:38,193 And then we need to focus on the things that are likely to happen, the things that 313 00:16:38,193 --> 00:16:40,413 are likely to give us the biggest impact. 314 00:16:40,923 --> 00:16:43,953 And, you know, persona you talked about, you know, we can't do everything. 315 00:16:44,313 --> 00:16:47,643 We talk a lot on here about good, better, best, right? 316 00:16:47,793 --> 00:16:48,183 Good. 317 00:16:48,183 --> 00:16:52,143 Is to have something, to have some kind of outline for anything. 318 00:16:52,383 --> 00:16:56,373 If you have nothing, anything is better, is better than nothing. 319 00:16:56,583 --> 00:16:58,533 On a back of an napkin is fine too. 320 00:16:58,923 --> 00:16:59,403 Yeah. 321 00:16:59,463 --> 00:16:59,943 Yeah. 322 00:17:00,273 --> 00:17:11,223 Um, and the what if you've got nothing, once you've done the impact analysis and, 323 00:17:11,313 --> 00:17:17,913 um, you've decided on, you know, we're gonna focus on, I, I think it wouldn't be, 324 00:17:17,973 --> 00:17:22,743 it wouldn't be crazy to say we're gonna focus on a ransomware event that takes 325 00:17:22,743 --> 00:17:26,343 out our, you know, priority one servers. 326 00:17:27,513 --> 00:17:29,583 What would be your next step? 327 00:17:31,533 --> 00:17:35,103 Well, I'll add some, I'll add some color to that scenario because part of 328 00:17:35,103 --> 00:17:39,933 your analysis may, may indicate that in the event of an, of an incident like 329 00:17:39,933 --> 00:17:42,843 that, you cannot reallocate people. 330 00:17:43,023 --> 00:17:45,303 Those people have to keep doing whatever it is they're doing. 331 00:17:45,303 --> 00:17:49,743 So your incident response plan should identify resources that you 332 00:17:49,743 --> 00:17:52,023 can bring in to augment your staff. 333 00:17:52,383 --> 00:17:54,723 And address the incident or vice versa. 334 00:17:54,723 --> 00:17:57,423 Maybe it's your, your full-time, people addressing the incident, but 335 00:17:57,423 --> 00:18:00,963 then you need to bring in staff, you know, some contractors to continue 336 00:18:01,353 --> 00:18:03,423 daily operations or whatever that is. 337 00:18:03,723 --> 00:18:07,803 Or that you've got zero capability of responding to that incident and 338 00:18:07,803 --> 00:18:12,063 you've gotta bring in a third party, 100% to, to support and you're just 339 00:18:12,063 --> 00:18:13,863 providing them guidance or oversight. 340 00:18:14,613 --> 00:18:16,713 And I mean, it's, it's kind of like, uh. 341 00:18:17,208 --> 00:18:22,548 The, the flood, the flood response, the blackman mooring or whoever it is 342 00:18:23,023 --> 00:18:23,413 Yep. 343 00:18:23,538 --> 00:18:24,648 where you've got a flood. 344 00:18:24,708 --> 00:18:28,248 Nobody, I don't know how to clean up a flood or respond to a flood. 345 00:18:28,248 --> 00:18:33,498 I know how to, I may know where the water shutoff valve is, but 100% of that 346 00:18:33,498 --> 00:18:35,328 response is gonna be some third party. 347 00:18:35,718 --> 00:18:38,958 And so that business impact analysis is gonna help you determine. 348 00:18:39,258 --> 00:18:43,458 What proportion of inside, outside, you know, extra help you're gonna 349 00:18:43,458 --> 00:18:44,808 need and who's gonna do what? 350 00:18:45,438 --> 00:18:49,668 All right, so then, then the event happens, uh, and you're gonna, you're 351 00:18:49,668 --> 00:18:55,278 gonna use that resource playbook depending on what that that event is, 352 00:18:55,728 --> 00:18:59,598 um, to bring in the right, the right resources, the right people, and, 353 00:18:59,598 --> 00:19:01,278 and start managing that response. 354 00:19:03,273 --> 00:19:03,753 So. 355 00:19:03,948 --> 00:19:07,128 If you'll have your playbook or your incident response 356 00:19:07,128 --> 00:19:09,618 plan, you've executed on it. 357 00:19:09,618 --> 00:19:11,238 You knew who the resources to pull in. 358 00:19:11,238 --> 00:19:15,798 I'm sure along the way, as you're going through this actual event, 359 00:19:15,798 --> 00:19:17,868 you probably see some gaps. 360 00:19:17,868 --> 00:19:21,828 Maybe you're probably fine tuning, tweaking, adjusting, adding to 361 00:19:21,828 --> 00:19:25,128 your incident response plan to update it so the next time it 362 00:19:25,128 --> 00:19:26,958 happens, you're better prepared. 363 00:19:27,648 --> 00:19:30,018 I guess the one question I have is. 364 00:19:30,843 --> 00:19:31,773 Environments change. 365 00:19:31,773 --> 00:19:32,913 We've always talked about it, right? 366 00:19:32,913 --> 00:19:37,863 New systems come on board, new sites come up, new applications get deployed. 367 00:19:37,863 --> 00:19:39,303 There are new threats out there. 368 00:19:40,233 --> 00:19:44,553 What sort of frequency should people be thinking about going and revisiting 369 00:19:44,553 --> 00:19:46,263 their incident response plans? 370 00:19:46,263 --> 00:19:49,683 Because it's not helpful if, say, today, right? 371 00:19:49,683 --> 00:19:55,203 You have an incident response plan for how to deal with telephone communications 372 00:19:55,203 --> 00:19:56,853 from like 30 years ago, right? 373 00:19:56,853 --> 00:20:00,363 So how do you make sure that your plans are also up to date as the 374 00:20:00,363 --> 00:20:04,473 world changes, as your environment changes and as the people change too? 375 00:20:05,443 --> 00:20:09,373 as a, as a good, as a good practice, good governance would be reviewing 376 00:20:09,373 --> 00:20:12,523 all your policies, procedures, and plans at least once a year. 377 00:20:13,153 --> 00:20:17,893 But I'll, I'll caveat that with any significant change to your personnel, 378 00:20:18,043 --> 00:20:21,733 your environment, or the way your business operates should then dictate a 379 00:20:21,733 --> 00:20:23,168 review of all the things that support. 380 00:20:23,868 --> 00:20:27,978 And, uh, not only support all of those things, but also support the response 381 00:20:27,978 --> 00:20:30,648 activity to any, any related incidents. 382 00:20:31,098 --> 00:20:34,728 Uh, so as often as it makes sense, but at least once a year. 383 00:20:35,133 --> 00:20:35,493 Okay. 384 00:20:36,708 --> 00:20:39,168 And I'll, I'll add to that too, that there's often two types 385 00:20:39,168 --> 00:20:40,548 of incident response plans. 386 00:20:40,908 --> 00:20:43,638 There's the very technical one with the playbooks and the contact 387 00:20:43,638 --> 00:20:45,138 information, the technical details. 388 00:20:45,138 --> 00:20:45,768 That's for the. 389 00:20:46,233 --> 00:20:48,393 The internal response team consumption. 390 00:20:48,753 --> 00:20:52,023 And then there's kind of a general population incident response plan, 391 00:20:52,023 --> 00:20:55,323 which is more like a guide to, well, how do I report stuff and what do 392 00:20:55,323 --> 00:20:56,103 I expect? 393 00:20:56,103 --> 00:20:56,313 And, 394 00:20:56,883 --> 00:21:01,923 um, you know, some that, that same plan may also include a provision that says you 395 00:21:01,923 --> 00:21:07,083 as an employee or contractor may be called upon as a subject matter expert to help. 396 00:21:07,383 --> 00:21:08,583 Respond to an incident. 397 00:21:08,913 --> 00:21:09,063 And 398 00:21:09,063 --> 00:21:12,393 so putting all that, all that stuff out there as far as expectations 399 00:21:12,393 --> 00:21:15,003 and guidance in a, in a, a shorter, 400 00:21:15,333 --> 00:21:16,953 you know, kind of condensed manual, 401 00:21:17,613 --> 00:21:21,513 similar disaster recovery, you know, there, there's like your evacuation plan 402 00:21:22,083 --> 00:21:25,083 and then there's the tech, the, the, the true disaster recovery plan 403 00:21:25,083 --> 00:21:26,643 that has a lot more detail on it. 404 00:21:27,708 --> 00:21:32,418 I like the idea of, I, I think one of the most crucial elements, if not the very 405 00:21:32,418 --> 00:21:38,358 first element that goes into an IR or DR plan, is the, the contact list, right? 406 00:21:38,538 --> 00:21:39,648 Who do you call for? 407 00:21:39,648 --> 00:21:41,658 What, who's responsible for what? 408 00:21:42,048 --> 00:21:45,258 Um, what is Mike Sailor's cell phone number? 409 00:21:45,738 --> 00:21:47,718 Um, you know, to, to call. 410 00:21:48,338 --> 00:21:53,408 Because he's our guy to bring in, in the case of scenario, and again, you, 411 00:21:53,408 --> 00:21:56,798 you, you have to update that information 'cause that stuff changes all the time. 412 00:21:56,888 --> 00:21:57,308 Right. 413 00:21:57,908 --> 00:21:59,828 Um, and 414 00:22:00,063 --> 00:22:00,333 And, and don't. 415 00:22:00,678 --> 00:22:04,488 Don't just Google Mike and his cell phone number and put it in your contact list. 416 00:22:04,488 --> 00:22:07,308 Actually, you, you've gotta call these people and say 417 00:22:07,308 --> 00:22:08,088 hello and 418 00:22:08,418 --> 00:22:13,458 and you know, I'm, I'm, we need to, we need to establish a, a, a relationship or 419 00:22:13,458 --> 00:22:17,868 a rapport so that you, you are, uh, you will answer the phone when I call you, 420 00:22:18,468 --> 00:22:19,518 uh, and, and 421 00:22:19,518 --> 00:22:20,418 know that it's important. 422 00:22:21,048 --> 00:22:21,318 Yeah. 423 00:22:21,348 --> 00:22:24,498 'cause I don't answer, I don't answer unknown, uh, phone numbers. 424 00:22:24,588 --> 00:22:26,208 So, um, yeah. 425 00:22:26,448 --> 00:22:26,688 Same. 426 00:22:27,078 --> 00:22:29,718 Um, yeah, so we've got our contact list. 427 00:22:29,778 --> 00:22:32,538 Uh, we've got our vendor list, right? 428 00:22:32,538 --> 00:22:38,028 We've got our, um, all of tech, the technologies that are involved. 429 00:22:38,538 --> 00:22:42,918 Um, and we've got an escalation list, right? 430 00:22:42,948 --> 00:22:48,498 A list of what's go, who's going to be called when, and then also. 431 00:22:48,978 --> 00:22:51,708 Who's going to be called when those people don't answer the phone? 432 00:22:52,248 --> 00:22:56,478 Um, right, because I, I know that comes up in a, in a, um, like in a 433 00:22:56,478 --> 00:22:58,908 tabletop, well, it comes up all the time. 434 00:22:58,938 --> 00:22:59,328 Right. 435 00:22:59,988 --> 00:23:07,398 Uh, Fred, who's the one that's responsible for A, B, C, uh, he's on vacation, right? 436 00:23:07,398 --> 00:23:08,718 He, he's in Aruba. 437 00:23:09,168 --> 00:23:10,698 Uh, good for Fred. 438 00:23:11,118 --> 00:23:15,528 And he's taken an actual vacation and he is unplugged the cell phone. 439 00:23:16,068 --> 00:23:20,538 And, uh, you know, and he's not taking our calls, so who's gonna take 440 00:23:20,538 --> 00:23:22,458 Fred's call when Fred's not there? 441 00:23:22,728 --> 00:23:25,518 That should be the case for every responsibility in the, 442 00:23:25,998 --> 00:23:27,108 you know, in the company, right? 443 00:23:28,843 --> 00:23:30,948 Uh, correct, and, and you should have a chart. 444 00:23:31,158 --> 00:23:35,838 And, and if you remember from a previous episode, we call that a racy diagram. 445 00:23:36,233 --> 00:23:36,773 That's right. 446 00:23:37,203 --> 00:23:37,493 Yeah. 447 00:23:38,148 --> 00:23:41,388 Uh, and spell that out again. 448 00:23:42,108 --> 00:23:43,248 RACI, 449 00:23:43,968 --> 00:23:47,958 responsible, accountable, consulted, and informed. 450 00:23:48,678 --> 00:23:52,938 And so for everybody on your response team, you would, you would 451 00:23:52,938 --> 00:23:56,928 indicate, and sometimes that changes based on what the playbook is. 452 00:23:57,558 --> 00:24:02,418 Uh, but who's, who's, who are your primary responsible, uh, accountable 453 00:24:02,418 --> 00:24:06,588 people for all the different types of incidents that you include, uh, in, in 454 00:24:06,588 --> 00:24:08,538 your, in your, in your response plan. 455 00:24:09,243 --> 00:24:13,308 Persona is the first person I call, uh, when I need to do something. 456 00:24:14,073 --> 00:24:16,623 I don't know how to do, because I have this feeling that he 457 00:24:16,623 --> 00:24:21,093 knows, he, he's watched a YouTube video about how to do it. 458 00:24:21,753 --> 00:24:24,483 What does that seem, does that seem reasonable persona? 459 00:24:26,448 --> 00:24:28,998 97% accurate, I would say. 460 00:24:29,043 --> 00:24:31,893 he, he watches a lot of YouTube videos. 461 00:24:32,973 --> 00:24:34,623 Um, all right. 462 00:24:34,673 --> 00:24:37,763 So we have our, we have our, our list, our contact list, we have 463 00:24:37,763 --> 00:24:41,303 the actual procedures, the actual runbooks that are, you know, the 464 00:24:41,303 --> 00:24:42,683 different things that we're gonna do. 465 00:24:43,103 --> 00:24:45,953 Uh, is there anything else that needs to go into response plan? 466 00:24:45,953 --> 00:24:46,043 Yep. 467 00:24:46,043 --> 00:24:46,103 So. 468 00:24:46,908 --> 00:24:49,908 So at the, at the end of your response plan, you, you should 469 00:24:49,908 --> 00:24:54,858 have as much reference material as you think is, uh, necessary. 470 00:24:54,858 --> 00:25:00,198 So, you know, there's your, your instant response team contact list, but down at 471 00:25:00,198 --> 00:25:04,218 the bottom, kind of to your point of, of third parties, but more than just 472 00:25:04,308 --> 00:25:08,118 name and phone number, you may need an account number or a policy number 473 00:25:08,118 --> 00:25:11,718 or, um, something specific, a pin. 474 00:25:11,808 --> 00:25:15,438 Uh, you know, if there's, you know, multifactor, um, and then. 475 00:25:17,088 --> 00:25:18,288 Something at the end. 476 00:25:18,438 --> 00:25:22,518 Uh, towards the end, we have, I, I typically suggest appendices. 477 00:25:22,998 --> 00:25:27,858 And so one of the escalation points of an incident is 478 00:25:27,858 --> 00:25:29,538 whether or not it was a breach. 479 00:25:30,738 --> 00:25:32,178 And the difference between incident and 480 00:25:32,178 --> 00:25:33,948 breach can be significant 481 00:25:34,038 --> 00:25:35,298 for a lot of different reasons. 482 00:25:35,298 --> 00:25:38,118 What, you can get sued over a breach, right? 483 00:25:38,748 --> 00:25:41,058 A breach might require that you, you 484 00:25:41,058 --> 00:25:45,228 have, uh, reporting, reporting obligations to the state or. 485 00:25:45,783 --> 00:25:46,263 What have you. 486 00:25:46,263 --> 00:25:49,803 So then, so there's a, there's usually an appendix that helps you walk through 487 00:25:49,803 --> 00:25:53,673 kind of a decision tree to determine if a, if an incident was a breach, 488 00:25:54,093 --> 00:25:57,333 well then we've got all of this, you know, maybe, especially if you're a 489 00:25:57,333 --> 00:26:03,333 publicly traded company, what are your reporting requirements, uh, by state, 490 00:26:03,573 --> 00:26:09,753 by statute, and then some things that you want to pre, uh, pre-negotiate. 491 00:26:10,398 --> 00:26:14,298 Is with, and this is with like management and legal or hr, how do 492 00:26:14,298 --> 00:26:17,688 we communicate different types of incidents internally and externally? 493 00:26:17,688 --> 00:26:22,068 And so having those predefined templates for emails or phone calls 494 00:26:22,698 --> 00:26:24,708 already in your plan, so you're not on 495 00:26:24,708 --> 00:26:28,428 the phone for an hour negotiating with internal audit or legal about, 496 00:26:28,428 --> 00:26:29,808 all right, how are we gonna say this? 497 00:26:30,228 --> 00:26:31,758 You've, you've got all that stuff outta the way. 498 00:26:33,138 --> 00:26:34,128 So Mike. 499 00:26:34,458 --> 00:26:36,018 So we have everything documented. 500 00:26:36,408 --> 00:26:40,638 I think one thing we didn't cover is where does this document live? 501 00:26:41,748 --> 00:26:46,518 Because right if, because if it's like on your normal internal systems 502 00:26:46,518 --> 00:26:49,788 and you get hit with a ransomware attack, now your incident response 503 00:26:49,788 --> 00:26:51,918 plans are also potentially gone. 504 00:26:52,398 --> 00:26:55,008 If you get hit by a hurricane or a flood and you have it in 505 00:26:55,008 --> 00:26:59,178 physical paper form in the site location, those are probably gone. 506 00:26:59,568 --> 00:27:00,168 So. 507 00:27:00,663 --> 00:27:03,008 How do people store these and make Sure. 508 00:27:03,008 --> 00:27:03,968 it's still accessible? 509 00:27:04,563 --> 00:27:06,843 I've seen a lot of variations of this. 510 00:27:06,843 --> 00:27:09,663 I've seen the All right, who's, whose turn is it to take the metal 511 00:27:09,663 --> 00:27:11,433 box home in the trunk of their car? 512 00:27:12,003 --> 00:27:15,453 Uh, I've seen people store it with their tapes at Iron Mountain. 513 00:27:15,933 --> 00:27:20,703 I've seen people, uh, uh, pay for a service where it's like a cloud-based 514 00:27:20,703 --> 00:27:24,363 disaster recovery thing, where different stakeholders have the ability 515 00:27:24,363 --> 00:27:27,873 to log in and update their stuff, and that's where the plan lives. 516 00:27:28,383 --> 00:27:32,973 Uh, and then, uh, I've also seen some pretty creative, uh, approaches to this 517 00:27:32,973 --> 00:27:35,763 with like $0 retainers with a, a law firm. 518 00:27:36,483 --> 00:27:38,883 And so pre-negotiate, get all the paperwork outta the way. 519 00:27:38,883 --> 00:27:41,433 And I would, I would suggest this with an instant response firm. 520 00:27:41,433 --> 00:27:46,803 And, and even, uh, uh, you know, if, if, if your staff isn't capable of, of 521 00:27:46,803 --> 00:27:52,233 quickly fixing or building or re-imaging stuff, then go find a, a firm that, that 522 00:27:52,233 --> 00:27:56,133 can provide you those resources and, and get all the paperwork done today. 523 00:27:56,613 --> 00:27:59,883 And, but to my point, uh, uh, or back to my point about the law firm. 524 00:27:59,883 --> 00:28:04,593 So $0 retainer establishes and it gets all the deconfliction out of the way. 525 00:28:04,953 --> 00:28:09,783 Uh, but send, give them your, your Dr and incident response plan. 526 00:28:10,263 --> 00:28:12,273 And because you're gonna call them anyway, 527 00:28:12,903 --> 00:28:16,203 uh, make sure that you've got their phone numbers, but you're, it's great. 528 00:28:16,203 --> 00:28:16,713 Great point. 529 00:28:16,713 --> 00:28:20,073 I've seen in a lot of cases where, you know, we're trying to, there's an 530 00:28:20,073 --> 00:28:23,223 incident, we're trying to coordinate response and their networks, their 531 00:28:23,223 --> 00:28:27,543 internet's down, their email's down and, and, you know, how do, how do we even 532 00:28:27,543 --> 00:28:30,033 coordinate among their response team? 533 00:28:30,213 --> 00:28:33,273 And so having a, having a relationship with someone that can. 534 00:28:33,993 --> 00:28:38,433 That can provide you that, that communications medium, but also, uh, be 535 00:28:38,433 --> 00:28:40,653 a, a good place to keep your, your plan. 536 00:28:41,313 --> 00:28:45,963 Yeah, I, I, my personal preference is I like having an electronic version 537 00:28:45,963 --> 00:28:50,853 because it's easier to maintain, but I also like having that paper version and 538 00:28:50,853 --> 00:28:52,623 the way I like having the way I like. 539 00:28:53,238 --> 00:28:59,268 Creating a paper version is in a loose leaf type of a notebook, so that allows 540 00:28:59,268 --> 00:29:03,978 me, when I update a couple of pages, I can just rip out at those pages and 541 00:29:03,978 --> 00:29:08,508 replace those pages so that I'm not printing an entire tree of documentation 542 00:29:08,508 --> 00:29:10,278 every time I go to update the runbook. 543 00:29:10,728 --> 00:29:15,948 Um, and I do like that idea of having it, having it stored somewhere else 544 00:29:15,948 --> 00:29:18,378 other than the company, but close by. 545 00:29:18,708 --> 00:29:18,978 Right. 546 00:29:18,978 --> 00:29:20,568 If we're talking about actual paper. 547 00:29:21,353 --> 00:29:23,933 It needs, you know, you talked about a law firm, you talked about an instant 548 00:29:23,933 --> 00:29:31,043 response team somewhere that stuff is stored, that's accessible to us as a 549 00:29:31,043 --> 00:29:38,243 company, but, uh, but not too accessible because it's in the data center that, 550 00:29:38,303 --> 00:29:40,073 uh, that we're trying to recover. 551 00:29:40,458 --> 00:29:41,448 Or at least a copy. 552 00:29:41,538 --> 00:29:41,778 Right. 553 00:29:41,898 --> 00:29:42,558 Store it somewhere 554 00:29:42,783 --> 00:29:43,383 A copy. 555 00:29:43,383 --> 00:29:43,713 Yeah. 556 00:29:44,043 --> 00:29:46,893 Um, of course the more copies you have, the more trouble you 557 00:29:46,893 --> 00:29:48,123 have maintaining those copies. 558 00:29:48,123 --> 00:29:48,363 Right. 559 00:29:48,363 --> 00:29:55,023 But the, the, um, the, uh, and I think the, the, the physical paper 560 00:29:55,293 --> 00:29:59,673 issue is less of an issue during a cybersecurity event as it, than it is 561 00:30:00,063 --> 00:30:03,483 in a, in a disaster where the, you know, the building blew up or was on fire. 562 00:30:03,933 --> 00:30:13,543 But, I cannot overstate the value of, um, of a paper document, right? 563 00:30:13,783 --> 00:30:19,333 In a, in an event that potentially takes out your, you know, 564 00:30:19,543 --> 00:30:20,923 everything that you have, right? 565 00:30:21,013 --> 00:30:23,083 I mean, I mean, I'm, you know, I'm a, I'm a huge fan of the 566 00:30:23,083 --> 00:30:24,883 cloud putting stuff in the cloud. 567 00:30:25,363 --> 00:30:28,123 Uh, what if you got no internet, right? 568 00:30:29,383 --> 00:30:32,383 Cloud's, cloud's great, but you can't see the clouds anymore. 569 00:30:33,028 --> 00:30:33,478 Yep. 570 00:30:34,348 --> 00:30:34,708 Yep. 571 00:30:35,858 --> 00:30:40,868 So off switching topics, so we have the cybersecurity incident 572 00:30:40,868 --> 00:30:44,588 response plan, which for company documents, who all the people are, 573 00:30:44,588 --> 00:30:46,058 how they respond, and all the rest. 574 00:30:46,058 --> 00:30:46,118 I. 575 00:30:47,288 --> 00:30:51,638 This is a goldmine for malicious actors, right? 576 00:30:51,698 --> 00:30:57,038 So if they got their hands on this right, they know your entire playbook. 577 00:30:57,038 --> 00:31:01,598 It's like if you got the military plans for like the nuclear weapons and 578 00:31:01,598 --> 00:31:03,638 like how things will respond, right? 579 00:31:03,638 --> 00:31:10,058 So how, like how should people go about protecting these from these bad actors? 580 00:31:11,063 --> 00:31:15,443 So it should be considered or classified as a, a confidential or sensitive 581 00:31:15,443 --> 00:31:19,043 document, so password protected, you know, make sure it's stored 582 00:31:19,103 --> 00:31:21,143 appropriately with restricted access. 583 00:31:21,653 --> 00:31:22,493 Uh, but you're right. 584 00:31:22,523 --> 00:31:23,273 In fact, uh. 585 00:31:23,868 --> 00:31:28,578 We did a tabletop exercise on ransomware for a, an engineering company. 586 00:31:29,178 --> 00:31:33,408 Uh, and then shortly after the tabletop, they actually had a ransomware attack. 587 00:31:33,648 --> 00:31:39,228 Uh, come to find out the threat actors had been in that environment for six months 588 00:31:39,618 --> 00:31:44,088 or actually privy to the tabletop exercise and had access to their instant 589 00:31:44,088 --> 00:31:45,618 response plan and their insurance 590 00:31:45,618 --> 00:31:49,038 policies and all these other things, which then help them better 591 00:31:49,038 --> 00:31:51,198 strategize and facilitate the attack. 592 00:31:51,198 --> 00:31:51,438 And. 593 00:31:51,833 --> 00:31:56,243 Uh, which, and they got paid, you know, they, they made several million 594 00:31:56,243 --> 00:32:01,703 dollars off of that deal because they were, they were informed, uh, and 595 00:32:01,703 --> 00:32:03,203 they knew what the capabilities were. 596 00:32:03,203 --> 00:32:07,253 They knew that they were gonna be, um, ineffective at responding 597 00:32:07,253 --> 00:32:09,443 to a ransomware attack, um, 598 00:32:10,268 --> 00:32:10,808 Yeah. 599 00:32:11,393 --> 00:32:15,533 sure that you, you fix all the problems identified in a tabletop exercise, 600 00:32:15,563 --> 00:32:16,793 and this organization did not. 601 00:32:17,423 --> 00:32:19,253 Well, I, I think that's a great question. 602 00:32:19,253 --> 00:32:24,023 P and I think it goes back to the same thing that we advise for 603 00:32:24,023 --> 00:32:26,873 backup systems segregation, right? 604 00:32:27,113 --> 00:32:31,073 Making sure that it's just not on the same systems with the same usernames 605 00:32:31,073 --> 00:32:35,363 and passwords protected by active directory and an admin and an active 606 00:32:35,363 --> 00:32:36,803 directory admin password, right? 607 00:32:37,558 --> 00:32:38,668 It's gotta be more than that. 608 00:32:38,668 --> 00:32:42,928 And, and that's, and I think that's where SaaS providers can be very helpful. 609 00:32:43,018 --> 00:32:43,408 Right. 610 00:32:43,768 --> 00:32:47,488 Uh, I like this idea, you know, um, that you talked about Mike, of having 611 00:32:47,488 --> 00:32:53,128 a, you know, basically services that will, that they probably have, I. 612 00:32:54,143 --> 00:32:56,693 Templates and things that you can use for an incident response 613 00:32:56,693 --> 00:32:58,343 plan and help build it out. 614 00:32:58,343 --> 00:33:00,323 It makes making that easier. 615 00:33:00,563 --> 00:33:05,513 And then also it's, it's stored in a different environment than yours. 616 00:33:05,903 --> 00:33:10,403 Uh, of course you gotta vet all their security because persona, you are 100% 617 00:33:10,403 --> 00:33:11,843 right, that that would be a gold mine. 618 00:33:12,143 --> 00:33:13,943 Just like backup systems are a gold mine. 619 00:33:13,943 --> 00:33:17,273 You get, you get in charge of the backup system and you have, you know, 620 00:33:17,513 --> 00:33:20,873 why, why hack all the servers when I can just restore the data that I want? 621 00:33:20,993 --> 00:33:21,353 Right? 622 00:33:22,808 --> 00:33:25,088 Um, any final thoughts, Mike? 623 00:33:25,088 --> 00:33:29,408 Any final things we need to say about creating an an incident response plan? 624 00:33:30,953 --> 00:33:36,113 Yes, the design of that plan will drive its effectiveness. 625 00:33:36,923 --> 00:33:42,143 And so, uh, from an audit perspective, um, well, even more fundamentally 626 00:33:42,143 --> 00:33:46,283 controls perspective, an incident response plan or program would be considered 627 00:33:46,283 --> 00:33:51,293 a control, uh, that helps drive the effectiveness of your organization. 628 00:33:51,293 --> 00:33:51,353 I. 629 00:33:51,998 --> 00:33:54,068 There's two parts of a control. 630 00:33:54,068 --> 00:33:56,858 There's the design of the control, and then there's the operational 631 00:33:56,858 --> 00:33:58,298 effectiveness of a control. 632 00:33:58,748 --> 00:34:00,398 And so we can put this plan together. 633 00:34:00,398 --> 00:34:02,558 We can have all these whiteboarding sessions and phone 634 00:34:02,558 --> 00:34:03,818 calls about who's doing what. 635 00:34:03,818 --> 00:34:05,108 And we put it all in this document. 636 00:34:05,108 --> 00:34:10,928 We feel great about it, but it doesn't mean a thing if you don't walk through 637 00:34:10,928 --> 00:34:13,898 it to see how effective that design is. 638 00:34:13,898 --> 00:34:17,318 And that's, you have to do table, you have to do an exercise to test 639 00:34:17,318 --> 00:34:18,818 the effectiveness of your plan. 640 00:34:19,268 --> 00:34:21,068 'cause like Mike Tyson said. 641 00:34:22,328 --> 00:34:24,008 Yeah, everybody has a plan until I hit 'em. 642 00:34:25,988 --> 00:34:31,178 And so your response plan is, that's all it is, is a plan until, until you get hit. 643 00:34:31,688 --> 00:34:33,788 And if you don't, if you haven't, if you haven't walked through 644 00:34:33,788 --> 00:34:36,668 it, you're not gonna know how well you, uh, respond to that. 645 00:34:36,728 --> 00:34:37,178 That hit. 646 00:34:38,168 --> 00:34:40,988 Yeah, I really thought you were gonna rhyme earlier. 647 00:34:41,078 --> 00:34:43,748 You know, you something. 648 00:34:44,018 --> 00:34:45,098 I forgot what you said. 649 00:34:45,428 --> 00:34:47,828 It's, uh, you don't got that thing or something. 650 00:34:47,828 --> 00:34:51,728 I thought you were gonna rhyme there, but, you know, uh, but I, yeah, I, 651 00:34:51,728 --> 00:34:53,438 I, I thought exactly about that. 652 00:34:54,398 --> 00:34:56,498 That Mike, that Mike Tyson comment. 653 00:34:56,528 --> 00:34:59,648 You know, everybody, everybody got play until they get hit in the face. 654 00:35:00,458 --> 00:35:01,328 Absolutely. 655 00:35:01,838 --> 00:35:05,348 All right, well thanks again, Mike for uh, walking us through 656 00:35:08,408 --> 00:35:10,688 and thanks again for some great questions this time. 657 00:35:10,688 --> 00:35:11,108 Persona, 658 00:35:11,858 --> 00:35:15,098 I, I think I'm starting to think more like a bad actor, which is kind of. 659 00:35:15,713 --> 00:35:16,193 Fun. 660 00:35:17,048 --> 00:35:18,093 that's what you gotta do, right? 661 00:35:18,343 --> 00:35:19,853 Gotta think like a bad actor. 662 00:35:20,453 --> 00:35:20,653 Absolutely. 663 00:35:21,638 --> 00:35:25,058 All right, and thanks to our listeners, we do this for you. 664 00:35:25,388 --> 00:35:27,098 Uh, reach out to us, say hi. 665 00:35:27,188 --> 00:35:29,498 Go to backup wrap up.com and put in a comment. 666 00:35:29,498 --> 00:35:30,908 I love getting comments from people. 667 00:35:31,268 --> 00:35:34,358 Um, and, uh, you know, rate us go. 668 00:35:34,448 --> 00:35:35,948 You know, if you love us, rate us. 669 00:35:35,948 --> 00:35:37,058 If you hate us, don't. 670 00:35:38,408 --> 00:35:38,888 Anyway. 671 00:35:39,158 --> 00:35:40,538 Uh, that is a wrap. 672 00:35:43,448 --> 00:35:48,158 The backup wrap up is written, recorded and produced by me w Curtis Preston. 673 00:35:48,698 --> 00:35:50,168 If you need backup or Dr. 674 00:35:50,168 --> 00:35:53,798 Consulting content generation or expert witness work, 675 00:35:54,098 --> 00:35:56,078 check out backup central.com. 676 00:35:56,798 --> 00:35:59,918 You can also find links from my O'Reilly Books on the same website. 677 00:36:00,578 --> 00:36:04,688 Remember, this is an independent podcast and any opinions that you 678 00:36:04,688 --> 00:36:06,578 hear are those of the speaker. 679 00:36:06,643 --> 00:36:08,503 And not necessarily an employer. 680 00:36:09,403 --> 00:36:10,123 Thanks for listening.