1 00:00:19,867 --> 00:00:23,167 I'm very rarely shocked when we record these episodes. 2 00:00:23,467 --> 00:00:25,297 But it happened in this episode. 3 00:00:25,777 --> 00:00:30,817 Uh, I ask a really important question of our guests who is a storage and 4 00:00:30,817 --> 00:00:33,247 backup and recovery security expert. 5 00:00:33,727 --> 00:00:36,457 Uh, and I was shocked by his answer. 6 00:00:36,787 --> 00:00:40,147 If you care at all about the security of your backup and recovery 7 00:00:40,147 --> 00:00:42,367 system, this is the episode for you. 8 00:00:42,397 --> 00:00:43,447 I hope you enjoy it. 9 00:00:44,194 --> 00:00:47,434 W. Curtis Preston: Hi, and welcome to Backup Central's Restore it All podcast. 10 00:00:47,439 --> 00:00:50,524 I'm your host, W Curtis Preston, aka Mr. 11 00:00:50,524 --> 00:00:55,054 Backup, and have with me a guy that I'm not sure fully filled me in. 12 00:00:55,399 --> 00:01:01,149 On everything that I was in for when I bought my Tesla Prasanna 13 00:01:01,479 --> 00:01:03,109 Malaiyandi how's it going? 14 00:01:03,109 --> 00:01:03,629 Prasanna? 15 00:01:04,254 --> 00:01:04,674 Prasanna Malaiyandi: Oh no. 16 00:01:04,674 --> 00:01:05,974 What did I do this time? 17 00:01:06,799 --> 00:01:07,609 W. Curtis Preston: I don't know. 18 00:01:07,659 --> 00:01:10,389 As you know, I've been incredibly happy with my new car. 19 00:01:10,809 --> 00:01:15,669 Um, I, I, I've, I've put a thousand miles on it already. 20 00:01:16,059 --> 00:01:20,499 Um, Which is more than you probably put in your entire first year. 21 00:01:20,499 --> 00:01:26,349 But the, um, I think the, my one disappointment, and it is, it 22 00:01:26,349 --> 00:01:31,269 truly is a disappointment, is that Tesla doesn't have tech support. 23 00:01:32,019 --> 00:01:32,379 Right. 24 00:01:32,379 --> 00:01:36,819 Given that it's essentially like, you know, that they've sold me this really 25 00:01:36,819 --> 00:01:43,419 expensive computer on wheels and it has all these interfaces and there's 26 00:01:43,424 --> 00:01:45,999 all this conflicting information about. 27 00:01:46,374 --> 00:01:51,144 Things about the car based on when you bought it, which you 28 00:01:51,144 --> 00:01:52,824 know, which model you have. 29 00:01:52,974 --> 00:01:58,974 So I have the L F P battery, which is the newer battery, which, which apparently 30 00:01:58,974 --> 00:02:02,064 according to the manual, as opposed to be charged to a hundred percent. 31 00:02:02,334 --> 00:02:07,104 Um, and you know, I just have questions that I would like to 32 00:02:07,104 --> 00:02:10,794 hear answers directly from Tesla. 33 00:02:11,424 --> 00:02:15,084 There's no phone number or email address for me to contact 34 00:02:15,109 --> 00:02:17,359 Prasanna Malaiyandi: so have you gone into the app and gone to, 35 00:02:17,419 --> 00:02:21,139 have you gone into the app, gone to support and said other issue? 36 00:02:22,494 --> 00:02:24,654 W. Curtis Preston: other that, because the only thing I've seen 37 00:02:24,654 --> 00:02:26,784 is, is schedule service call 38 00:02:27,804 --> 00:02:28,044 Prasanna Malaiyandi: Yeah. 39 00:02:28,104 --> 00:02:28,674 Uh, yeah. 40 00:02:28,674 --> 00:02:34,434 So if you do schedule service, I think you can also do other, and 41 00:02:34,434 --> 00:02:36,324 then just enter your, your questions. 42 00:02:38,184 --> 00:02:41,184 W. Curtis Preston: So you're saying my greatest disappointment doesn't exist. 43 00:02:41,184 --> 00:02:42,024 Is that what you're telling me? 44 00:02:43,044 --> 00:02:43,164 Prasanna Malaiyandi: I, 45 00:02:43,284 --> 00:02:44,724 W. Curtis Preston: You're looking at the, you're looking at the 46 00:02:44,724 --> 00:02:45,894 app right now, aren't you? 47 00:02:46,014 --> 00:02:47,334 Prasanna Malaiyandi: I am looking at the app right now. 48 00:02:47,334 --> 00:02:47,964 Yes, I am. 49 00:02:48,744 --> 00:02:50,514 Um, I think it could work. 50 00:02:50,514 --> 00:02:52,344 I, so I've never done this. 51 00:02:53,044 --> 00:02:53,334 W. Curtis Preston: Yeah. 52 00:02:54,114 --> 00:02:57,294 I mean, if I could just, if I could, yeah, if I could just have an email chat. 53 00:02:57,504 --> 00:03:02,184 Cuz a lot of 'em are just like, you know, You know, questions, right? 54 00:03:02,184 --> 00:03:05,454 Like, I'm, I'm like, I can't find this thing, right? 55 00:03:05,454 --> 00:03:08,124 I'm looking for the thing and I can't find the thing because there's 56 00:03:08,124 --> 00:03:12,084 37 menus and, um, you know, I need 57 00:03:12,114 --> 00:03:13,254 Prasanna Malaiyandi: You know there's a search now, right? 58 00:03:13,674 --> 00:03:13,894 Yes. 59 00:03:14,334 --> 00:03:16,164 W. Curtis Preston: I, I know there's a search, but it doesn't 60 00:03:16,169 --> 00:03:19,614 always find, there's a search. 61 00:03:19,719 --> 00:03:20,949 Prasanna Malaiyandi: First world problems. 62 00:03:20,949 --> 00:03:21,969 Curtis First World 63 00:03:21,999 --> 00:03:25,509 W. Curtis Preston: never ending, the, the, the never ending search for 64 00:03:25,509 --> 00:03:27,249 looking for what I'm trying to find. 65 00:03:27,609 --> 00:03:31,539 Um, yeah, I did find the most important app though. 66 00:03:32,109 --> 00:03:36,189 You know, I, we've discussed this already, the, the admission 67 00:03:36,189 --> 00:03:38,979 testing app, otherwise known 68 00:03:39,069 --> 00:03:40,509 Prasanna Malaiyandi: Otherwise known as Spart 69 00:03:40,509 --> 00:03:41,439 W. Curtis Preston: fart noise. 70 00:03:44,409 --> 00:03:44,919 Prasanna Malaiyandi: Oh, 71 00:03:45,009 --> 00:03:46,269 W. Curtis Preston: could, you could literally, you, you, 72 00:03:46,274 --> 00:03:47,949 you can configure it so that. 73 00:03:48,399 --> 00:03:51,819 Whenever you push a button on the steering wheel, it makes a random fart noise, 74 00:03:51,909 --> 00:03:53,859 uh, to other passengers in the car. 75 00:03:54,039 --> 00:04:00,189 By the way, my wife not a big fan, not a big fan of the fart 76 00:04:00,279 --> 00:04:02,439 Prasanna Malaiyandi: Curtis, are you like a little kid in a candy store? 77 00:04:02,829 --> 00:04:07,299 W. Curtis Preston: I am inside, inside, every grown man is a five-year-old boy, 78 00:04:07,299 --> 00:04:12,999 just, just begging to get out and, uh, I'm a five year old boy with a $40,000 car. 79 00:04:13,284 --> 00:04:16,194 That wants to, that wants to try every little part, right? 80 00:04:16,554 --> 00:04:19,674 The only difference between men and boys is the price of their toys, right? 81 00:04:21,389 --> 00:04:22,374 uh, yeah. 82 00:04:22,614 --> 00:04:27,774 So tomorrow it'll be, it'll be a week, uh, that I've had my, my lovely 83 00:04:27,779 --> 00:04:30,474 new car and, uh, yes, I've put a 84 00:04:30,699 --> 00:04:31,749 Prasanna Malaiyandi: And, and oh, we should. 85 00:04:32,289 --> 00:04:33,429 We should, yeah. 86 00:04:33,429 --> 00:04:37,929 We should also tell the listeners also about your, uh, experience 87 00:04:37,929 --> 00:04:39,069 going through a car wash. 88 00:04:43,419 --> 00:04:46,179 W. Curtis Preston: I went to a car wash and you know, it's one of 89 00:04:46,179 --> 00:04:50,049 these things, things that you take for granted when you drive, uh, you 90 00:04:50,049 --> 00:04:51,879 know, what I now call an ice car? 91 00:04:51,879 --> 00:04:53,949 That's a internal combustion engine. 92 00:04:54,009 --> 00:04:58,899 A gas car is, you know, you just, it's super easy to put into neutral and, 93 00:04:58,899 --> 00:05:02,229 and, and Tesla's super easy to put into neutral if you know how to do it. 94 00:05:03,369 --> 00:05:07,389 And, uh, so I'm sitting there and I had rolled up to the, to the thing 95 00:05:07,389 --> 00:05:08,529 where the, you know, where the. 96 00:05:08,934 --> 00:05:12,324 The, the, I don't know, the conveyor belt's gonna grab my car. 97 00:05:12,384 --> 00:05:15,384 And then the guy's like, you know, he's pointing to the thing up there 98 00:05:15,384 --> 00:05:17,034 that says, you know, put it in neutral. 99 00:05:17,034 --> 00:05:20,004 And I'm like, oh yeah, I'm supposed to put it in neutral. 100 00:05:20,124 --> 00:05:21,234 I shut down the whole thing. 101 00:05:21,234 --> 00:05:25,044 I shut down the whole car wash because I had no idea how 102 00:05:25,049 --> 00:05:26,334 to put my car into neutral. 103 00:05:26,394 --> 00:05:28,134 And then I thought I had it into neutral. 104 00:05:28,284 --> 00:05:29,514 They turned it on again. 105 00:05:29,664 --> 00:05:31,494 Nope, shut it down again. 106 00:05:31,914 --> 00:05:35,214 Um, the, the only, the only nice thing I can say is thank 107 00:05:35,214 --> 00:05:36,534 God my wife was not in the car. 108 00:05:36,534 --> 00:05:37,944 She would've just been flipping out. 109 00:05:38,544 --> 00:05:43,854 Uh, but yeah, I, I did, luckily the manager was like, you know, rolled 110 00:05:43,854 --> 00:05:47,844 down the window and he's like, um, go to the menu and it's car wash mode. 111 00:05:47,874 --> 00:05:49,104 I'm like, sweet. 112 00:05:49,944 --> 00:05:50,604 Um, 113 00:05:50,604 --> 00:05:53,034 Prasanna Malaiyandi: not the first time that this has happened at that 114 00:05:53,154 --> 00:05:55,734 W. Curtis Preston: I am not the, I'm not the first idiot with a brand new 115 00:05:55,734 --> 00:05:59,454 Tesla to take it into a car wash and not know how to put it in neutral. 116 00:06:00,774 --> 00:06:06,174 Anyway, uh, so enough test Tesla talk for the day, gonna bring on our guest. 117 00:06:06,294 --> 00:06:10,614 He's been specializing in it, uh, for over 30 years and specializes 118 00:06:10,614 --> 00:06:14,394 in storage and backup and security as well as it architecture. 119 00:06:14,724 --> 00:06:17,604 He's now the CTO at Continuity Software. 120 00:06:17,844 --> 00:06:22,254 The industry's only cybersecurity solution for enterprise storage and backup systems. 121 00:06:22,614 --> 00:06:25,124 Welcome to the pod, Doran Pinhas. 122 00:06:27,114 --> 00:06:27,624 Doron Pinhas: Hi. 123 00:06:27,624 --> 00:06:28,344 Good to be here. 124 00:06:29,514 --> 00:06:31,944 W. Curtis Preston: So you're, you're currently in Israel, right? 125 00:06:31,944 --> 00:06:32,184 Doran? 126 00:06:35,409 --> 00:06:36,429 Doron Pinhas: Yep, that's true. 127 00:06:36,669 --> 00:06:38,019 W. Curtis Preston: What, what, what, what? 128 00:06:38,739 --> 00:06:39,879 It's, it's still sunny. 129 00:06:40,119 --> 00:06:42,519 What, uh, what part are you in? 130 00:06:42,609 --> 00:06:43,669 Doron Pinhas: it's 7:00 PM over here. 131 00:06:44,589 --> 00:06:47,409 Uh, just, you know, it's a very, very small country. 132 00:06:47,409 --> 00:06:49,659 It's the, the size of New Jersey maybe. 133 00:06:49,659 --> 00:06:52,569 So, uh, anywhere you put your finger, it's where I am. 134 00:06:52,569 --> 00:06:52,779 So 135 00:06:53,259 --> 00:06:53,549 W. Curtis Preston: yeah. 136 00:06:53,739 --> 00:06:55,059 Doron Pinhas: in the area of Tel Aviv. 137 00:06:55,089 --> 00:06:55,419 Yes. 138 00:06:55,419 --> 00:06:57,549 So give or take, which is in the middle of the country. 139 00:06:57,999 --> 00:06:59,859 W. Curtis Preston: I've been to, I've been to Tel Aviv, 140 00:06:59,919 --> 00:07:03,189 uh, Jerusalem, and, uh, a lot. 141 00:07:03,249 --> 00:07:08,109 I went and did scuba diving there, uh, which was very, very nice. 142 00:07:08,709 --> 00:07:10,149 Um, scuba diving in the 143 00:07:10,149 --> 00:07:11,649 Doron Pinhas: a good start for a first visit. 144 00:07:12,489 --> 00:07:14,529 W. Curtis Preston: Yeah, absolutely, absolutely. 145 00:07:14,789 --> 00:07:18,299 I wanna do our usual disclaimer, uh, Prasanna and I work for different 146 00:07:18,299 --> 00:07:23,099 companies, and this is an independent podcast and is the opinions that you 147 00:07:23,099 --> 00:07:27,049 hear are ours and don't necessarily reflect the opinions of our employers. 148 00:07:27,259 --> 00:07:31,789 Also, if you, uh, like the show, please rate us, go to your favorite pod catcher 149 00:07:32,089 --> 00:07:33,739 and give us all the stars and comments. 150 00:07:33,739 --> 00:07:36,679 We'd love to hear comments from you, and also if you'd like to 151 00:07:36,679 --> 00:07:40,984 join the conversation or just send us, you know, Kudos or whatever. 152 00:07:41,224 --> 00:07:48,544 Uh, you can reach me at w Curtis Preston gmail or uh, uh, WC Preston on Twitter 153 00:07:48,784 --> 00:07:57,664 or linkedin.com/in/mr backup Um, so, you know, when I, when I saw your, you know, 154 00:07:57,664 --> 00:08:03,289 I went to the Continuity's website and the first thing that popped up, Was this, uh, 155 00:08:03,319 --> 00:08:08,299 paper that you've done recently, which it looks like you've been doing for a couple 156 00:08:08,299 --> 00:08:14,569 of years on, uh, that that basically is a study of, uh, what, why don't, 157 00:08:14,569 --> 00:08:15,919 why don't you tell, tell us about it? 158 00:08:15,949 --> 00:08:16,789 That this paper, 159 00:08:17,674 --> 00:08:19,924 Doron Pinhas: Oh, you mean the storage and backup? 160 00:08:19,954 --> 00:08:21,754 Um, you know, state of the industry 161 00:08:22,159 --> 00:08:22,639 W. Curtis Preston: yes. 162 00:08:22,639 --> 00:08:23,239 Yes. 163 00:08:23,584 --> 00:08:24,064 Doron Pinhas: That's the one. 164 00:08:24,064 --> 00:08:24,544 Yeah. 165 00:08:24,754 --> 00:08:25,234 Okay. 166 00:08:25,894 --> 00:08:26,974 So it's the tradition. 167 00:08:26,974 --> 00:08:28,324 We started several years back. 168 00:08:28,984 --> 00:08:33,124 Uh, we were fortunate enough to meet, you know, we are in the IT business as a 169 00:08:33,124 --> 00:08:39,364 whole and, and generate, uh, management tools for, uh, large enterprises. 170 00:08:39,484 --> 00:08:41,734 We can talk about that later if there's any interest. 171 00:08:41,794 --> 00:08:45,124 Uh, and we were fortunate enough to get about with some of the 172 00:08:45,124 --> 00:08:48,634 world's largest enterprises, and we started talking years back about 173 00:08:48,634 --> 00:08:50,344 securing storage and backup systems. 174 00:08:51,244 --> 00:08:54,784 Lo and behold, and uh, it's dawned on us eventually that there is 175 00:08:54,784 --> 00:08:58,174 no standard research that tests the maturity level of the market. 176 00:08:59,179 --> 00:09:03,739 As it were, so several years back we started, uh, running surveys. 177 00:09:03,799 --> 00:09:07,249 We have a technology that then collect that can collect configuration, 178 00:09:07,249 --> 00:09:12,979 data, off storage and backup devices, appliances, media servers and stuff like 179 00:09:13,024 --> 00:09:13,244 W. Curtis Preston: Mm. 180 00:09:14,209 --> 00:09:16,399 Doron Pinhas: and then review the configuration to see 181 00:09:16,399 --> 00:09:17,749 if it's done well or not. 182 00:09:18,049 --> 00:09:19,159 That's pretty easy. 183 00:09:19,159 --> 00:09:23,089 So we collected data from, uh, everyone we talked with and many of 184 00:09:23,089 --> 00:09:25,939 those organizations were gracious enough to allow us to anonymize 185 00:09:25,939 --> 00:09:28,399 the data and generate reports. 186 00:09:28,399 --> 00:09:35,029 So to cut a long story short, um, this year we scanned the around 10,000 storage 187 00:09:35,029 --> 00:09:38,959 devices in around 250 large enterprises. 188 00:09:39,259 --> 00:09:40,849 Most of them are relatively large. 189 00:09:41,554 --> 00:09:44,674 Organizations with north of 10,000 people. 190 00:09:45,094 --> 00:09:47,554 Some of them has half a million employees. 191 00:09:47,554 --> 00:09:49,864 So it's a interesting demographics. 192 00:09:49,869 --> 00:09:55,654 60% in the United States, almost 40% in the eu, and some in Asia Pacific. 193 00:09:56,644 --> 00:10:02,074 Um, and we did find that, uh, the majority of environments. 194 00:10:02,364 --> 00:10:07,884 Did have grave misconfigurations that relate to storage and backup systems, 195 00:10:08,524 --> 00:10:09,364 W. Curtis Preston: Shocked 196 00:10:09,444 --> 00:10:12,294 Doron Pinhas: means that, you know, we're not shocked, but now we have 197 00:10:12,294 --> 00:10:14,664 the proof, the writing is on the wall. 198 00:10:14,664 --> 00:10:15,984 We can't ignore it anymore. 199 00:10:15,989 --> 00:10:19,734 We knew in this secret of our heart that things might go wrong, but 200 00:10:19,739 --> 00:10:21,354 now we know they are not great. 201 00:10:22,339 --> 00:10:26,329 And, you know, stored and backup means are awesome at so many things. 202 00:10:26,329 --> 00:10:30,499 They know how to increase capacity and deal with ever shrinking backup 203 00:10:30,499 --> 00:10:35,359 windows and you know, ingest new technologies and move from on-prem to 204 00:10:35,359 --> 00:10:37,669 cloud storage and all that fun stuff. 205 00:10:37,909 --> 00:10:40,279 But there are not necessarily security experts. 206 00:10:40,969 --> 00:10:45,079 And it is important to become more knowledgeable about security 207 00:10:45,079 --> 00:10:49,669 because the outcomes of two lacks security in restorative 208 00:10:49,669 --> 00:10:51,949 backup system can be devastating. 209 00:10:52,249 --> 00:10:54,979 You know, that's something I'd love to be able to talk about and then 210 00:10:54,979 --> 00:11:00,619 maybe, uh, we can have some practical advice around how can you do better? 211 00:11:00,949 --> 00:11:03,169 You know, once people get convinced, it is important. 212 00:11:03,544 --> 00:11:06,094 Prasanna Malaiyandi: Yeah, so just a quick question. 213 00:11:06,124 --> 00:11:10,894 Um, When you were, uh, looking at these backup and storage systems, 214 00:11:11,134 --> 00:11:14,914 what sort of things were you looking for when you're evaluating 215 00:11:14,919 --> 00:11:17,284 figure out were they secure or not? 216 00:11:18,724 --> 00:11:22,384 Doron Pinhas: So there, there are several dimensions to establishing 217 00:11:22,594 --> 00:11:25,804 where whether, uh, uh, storage and backup infrastructure are secure. 218 00:11:25,804 --> 00:11:29,884 So all the way from the very mundane, for example, are those, 219 00:11:30,154 --> 00:11:33,394 uh, pieces of equipment and software laying around patched. 220 00:11:34,354 --> 00:11:39,364 So surprisingly enough, uh, you know when people look at backup software 221 00:11:39,364 --> 00:11:42,514 like Veeam and Veritas and you know, forgive me for all the rest and 222 00:11:42,544 --> 00:11:46,654 Rubrik and others, these are piece of commercial software vendors will discover 223 00:11:46,654 --> 00:11:50,704 security vulnerabilities, whether the code they have created or third party 224 00:11:50,704 --> 00:11:52,384 libraries they use, everyone does that. 225 00:11:53,014 --> 00:11:55,654 And they will write security bullet, public security 226 00:11:55,654 --> 00:11:57,214 bulletins and issue patches. 227 00:11:57,274 --> 00:11:59,374 So the question is, do you update your software? 228 00:11:59,644 --> 00:12:03,559 Now when it comes to the software bit, That's a little easier because 229 00:12:03,739 --> 00:12:06,619 the traditional vulnerability management engine you might 230 00:12:06,619 --> 00:12:08,659 already have on on, on the floor. 231 00:12:09,019 --> 00:12:10,309 We'll probably catch that. 232 00:12:11,359 --> 00:12:14,269 Uh, but when you look at the stored and backup ecosystems, there are 233 00:12:14,269 --> 00:12:17,779 all sorts of bizarre components there that are never scanned, right? 234 00:12:17,779 --> 00:12:21,509 So we have, if you have a large shop, you have a sun fabric, and you have N 235 00:12:21,514 --> 00:12:26,629 dmp and you have NetApp, and you have, uh, whatever storage, OSS and various 236 00:12:26,629 --> 00:12:29,299 mix, no, HP and LMC and ibm, and. 237 00:12:29,864 --> 00:12:30,434 Pure. 238 00:12:31,034 --> 00:12:35,084 Um, these devices are never scanned by vulnerability managed engines. 239 00:12:35,084 --> 00:12:39,044 And so, but it's pretty easy to determine if they are exposed or not. 240 00:12:39,074 --> 00:12:44,354 So one of the trivial bits we've done is just retrieve the configuration baseline 241 00:12:44,984 --> 00:12:46,424 of all the devices we have scanned. 242 00:12:46,424 --> 00:12:49,754 Where there is are backup appliances and archiving appliances. 243 00:12:50,564 --> 00:12:54,944 And shockingly you'll find that, uh, patches have been out there 244 00:12:54,944 --> 00:12:56,324 for things like log four j. 245 00:12:56,929 --> 00:12:58,729 That can impact the storage arrays. 246 00:12:58,939 --> 00:12:59,629 Definitely can. 247 00:12:59,959 --> 00:13:02,509 So, uh, but they haven't been patched. 248 00:13:02,659 --> 00:13:04,789 And when you talk to professionals, say, oh, I didn't 249 00:13:04,789 --> 00:13:06,199 know that I have that exposure. 250 00:13:06,204 --> 00:13:11,029 I've run my scan with one of the big names, whatever, tenable Ines and Rapid 251 00:13:11,034 --> 00:13:14,359 Seven and others, and they're all great companies, but they just don't scan. 252 00:13:14,899 --> 00:13:18,859 The storage ecosystem to that level of detail, and people have 253 00:13:18,859 --> 00:13:20,449 a blind spot and it's, it's bad. 254 00:13:20,449 --> 00:13:22,429 So one thing is, that's mundane, right? 255 00:13:22,429 --> 00:13:26,839 So, and, and around that category, I can count several other aspects. 256 00:13:26,839 --> 00:13:30,289 Like, you know, you want to have your software patch, you want to have some 257 00:13:30,289 --> 00:13:32,239 of the ridiculous stuff cleaned up. 258 00:13:32,244 --> 00:13:35,299 Like, you know, you, you buy a backup appliance, it has a default 259 00:13:35,304 --> 00:13:37,129 factory account like Root, root. 260 00:13:37,699 --> 00:13:38,929 Did you close that account? 261 00:13:39,264 --> 00:13:39,924 Oops. 262 00:13:40,014 --> 00:13:42,414 So many organizations fail to do those. 263 00:13:42,414 --> 00:13:45,114 Very simple, you know, it's not just the root root account. 264 00:13:45,114 --> 00:13:46,794 There are service accounts. 265 00:13:47,124 --> 00:13:52,549 There are default called home configurations that by and large, Are 266 00:13:52,549 --> 00:13:54,889 not restricted to specific IP addresses. 267 00:13:54,949 --> 00:13:56,779 And if I'm a hacker, I can spoof those. 268 00:13:57,109 --> 00:13:59,959 So there are basic things you can do when you get a device, whether 269 00:13:59,964 --> 00:14:04,279 that's a medial library or whatever, an archiving appliances or set up 270 00:14:04,279 --> 00:14:09,859 a softer element that you can do to do the basics of hardening them. 271 00:14:10,159 --> 00:14:11,749 So, so this is one area. 272 00:14:12,589 --> 00:14:16,039 Another relates to a little bit more convoluted best practices. 273 00:14:16,099 --> 00:14:19,549 You know, vendors will publish best practices for security, but by and 274 00:14:19,549 --> 00:14:22,549 large it gurus tends to ignore them. 275 00:14:22,549 --> 00:14:26,059 We want to go to the meet, how can we set up our first job? 276 00:14:26,929 --> 00:14:29,929 But there are things, uh, that should be done. 277 00:14:30,259 --> 00:14:32,509 Again, some of them are pretty mundane, right? 278 00:14:32,509 --> 00:14:35,629 I'll give you just one example and you tell me if I'm going to, uh, 279 00:14:35,854 --> 00:14:36,184 Prasanna Malaiyandi: No, 280 00:14:36,229 --> 00:14:37,759 Doron Pinhas: uh, technical too quickly. 281 00:14:37,759 --> 00:14:40,789 But, um, you know, time. 282 00:14:41,974 --> 00:14:44,554 We all know about time it passes, right? 283 00:14:45,034 --> 00:14:49,084 So, but when you set up a storage or a backup appliance, you 284 00:14:49,084 --> 00:14:52,504 need to set up so it up with an authoritative time server, right? 285 00:14:53,374 --> 00:14:58,624 Um, if I'm a hacker and I, uh, realize that it didn't harden the time 286 00:14:58,624 --> 00:15:03,454 settings, I can spoof the time server and then I can issue all sorts of 287 00:15:03,459 --> 00:15:06,994 attacks, like time's up attacks where, you know, I persuade your archiving 288 00:15:06,994 --> 00:15:08,594 appliance that 12 years have passed. 289 00:15:09,874 --> 00:15:11,074 Just in the span of a minute. 290 00:15:11,824 --> 00:15:17,584 Of course, you can defeat that by setting up an authorized time server and using 291 00:15:17,584 --> 00:15:21,664 authentication and stuff like that, but it's not set up out of the box. 292 00:15:21,754 --> 00:15:23,584 Now if I'm not setting up my time correctly. 293 00:15:23,584 --> 00:15:26,884 Of course, encryption keys can go stale and elapse, you know, 294 00:15:26,889 --> 00:15:28,144 really bad stuff can happen. 295 00:15:28,804 --> 00:15:30,094 So this is a trivial thing. 296 00:15:30,094 --> 00:15:34,744 If you look at, uh, at reality from the security wearing the security hat or 297 00:15:34,744 --> 00:15:39,454 security glasses, you'll realize that you have to harden some basic, uh, components 298 00:15:39,454 --> 00:15:43,924 like time services and dns, and you have to close default accounts and set 299 00:15:43,924 --> 00:15:45,784 up centrally managed authentication. 300 00:15:46,354 --> 00:15:47,734 All of these are best practices. 301 00:15:47,734 --> 00:15:48,694 Vendors will publish. 302 00:15:49,054 --> 00:15:51,784 They will also tell you that, Hey, we are shipping this box 303 00:15:52,684 --> 00:15:56,734 out of the gate with some initial security configurations like we. 304 00:15:57,094 --> 00:16:02,164 Do allow you to decide if you want to configure SIFs one, two, whatever. 305 00:16:02,914 --> 00:16:05,284 Uh, which Cipher Suites do you want to support? 306 00:16:05,914 --> 00:16:09,214 Do you support in Fs version three and four and above? 307 00:16:09,274 --> 00:16:10,744 Do you want to limit some of those? 308 00:16:10,744 --> 00:16:13,684 So it's your job to decide, you know, we are selling you a Tesla. 309 00:16:14,074 --> 00:16:16,684 You need to drive it out of the factory and you need to 310 00:16:16,684 --> 00:16:18,244 do it as safely as you can. 311 00:16:18,244 --> 00:16:21,994 You can of course drive it's hard, but you can try, you can 312 00:16:21,994 --> 00:16:23,074 still force it into a tree. 313 00:16:23,079 --> 00:16:26,764 So, The vendors will tell you, you may want to consider to 314 00:16:26,914 --> 00:16:28,294 close some of the protocols. 315 00:16:28,294 --> 00:16:30,454 If you're not using nfs, close it please. 316 00:16:30,664 --> 00:16:33,334 If you're using nfs, maybe you want to disable NFS version three. 317 00:16:33,574 --> 00:16:36,724 So we want to review some of those settings and follow 318 00:16:36,724 --> 00:16:37,864 the vendor best practices. 319 00:16:38,554 --> 00:16:41,374 So we start to see a picture emerging. 320 00:16:41,374 --> 00:16:46,294 So we check for the basic vulnerabilities and the locking down of default 321 00:16:46,294 --> 00:16:50,644 accounts, and then we go ahead and read the various vendor recommendations and 322 00:16:50,644 --> 00:16:52,804 make them into a structured library of. 323 00:16:53,209 --> 00:16:56,119 Things you should be looking into, and we just have a platform 324 00:16:56,119 --> 00:16:57,229 that can automate those checks. 325 00:16:58,144 --> 00:17:00,244 Now there, there are some other components to that. 326 00:17:00,244 --> 00:17:05,734 For example, there are several standards that are today not legally binding, 327 00:17:05,854 --> 00:17:10,534 but there are standards out there to regulate how stuff can be secured, right? 328 00:17:10,539 --> 00:17:12,394 So we have the NIST framework. 329 00:17:12,924 --> 00:17:14,424 We have the ISO framework. 330 00:17:14,544 --> 00:17:15,714 Within NIST and iso. 331 00:17:15,714 --> 00:17:20,544 There are families of, uh, uh, documents that regulate various aspects of security, 332 00:17:20,544 --> 00:17:23,784 but specifically in recent years, there is more guidance for storage. 333 00:17:23,784 --> 00:17:24,054 Right? 334 00:17:24,059 --> 00:17:29,244 NIST has published, uh, the special publication 802 0 9, which 335 00:17:29,244 --> 00:17:32,184 talks about storage and backup systems, security guidelines. 336 00:17:32,844 --> 00:17:33,084 Right. 337 00:17:33,174 --> 00:17:33,414 Just. 338 00:17:34,474 --> 00:17:38,134 Spell it out differently, but you know, uh, and we were fortunate enough 339 00:17:38,134 --> 00:17:42,484 to take part in shaping, uh, this particular piece ISO are publishing. 340 00:17:43,144 --> 00:17:49,894 Um, there is a, a document called, uh, ISO 27 0 40, which, uh, outlines, 341 00:17:50,434 --> 00:17:52,474 uh, guidelines for storage security. 342 00:17:52,474 --> 00:17:55,564 So the current version is dated 2015. 343 00:17:56,614 --> 00:17:58,144 Uh, it was great at the time. 344 00:17:58,144 --> 00:18:00,634 It's not great anymore, but they are working on a new release. 345 00:18:00,634 --> 00:18:04,379 Which is going to come out any week now, and we are fortunate enough 346 00:18:04,379 --> 00:18:07,889 to see some of the drafts and even comment and it's awesome, right? 347 00:18:07,889 --> 00:18:13,379 So we have guidance around what could serve as a framework for having better 348 00:18:13,379 --> 00:18:14,819 security for storage and backup. 349 00:18:15,719 --> 00:18:18,839 Um, so the last, maybe that's the last source. 350 00:18:18,839 --> 00:18:22,409 We also, uh, review all of those guidelines and then we pick the 351 00:18:22,409 --> 00:18:25,559 ones that are relevant to the average user and turn them into a 352 00:18:26,069 --> 00:18:28,109 comprehensive automated checklist. 353 00:18:28,639 --> 00:18:33,799 If you're curious, we have about whatever, three to 4,000 automated checks. 354 00:18:34,189 --> 00:18:34,579 So when 355 00:18:34,594 --> 00:18:35,404 Prasanna Malaiyandi: gonna say, yeah. 356 00:18:35,409 --> 00:18:38,509 Doron Pinhas: go, go ahead and collect the configuration, you 357 00:18:38,509 --> 00:18:40,489 know, we just need read only access. 358 00:18:40,494 --> 00:18:42,469 That's how we work with, uh, the organizations. 359 00:18:42,469 --> 00:18:43,339 We advise. 360 00:18:44,029 --> 00:18:47,449 We ask them to let us, uh, have a readonly role. 361 00:18:47,594 --> 00:18:50,804 We collect the data, we keep it in, it doesn't have to leave. 362 00:18:50,834 --> 00:18:55,034 We run our tool and it's just create a dashboard and score cards saying This is 363 00:18:55,034 --> 00:18:59,834 what you're doing well and here is where you, uh, can improve or might have failed. 364 00:19:00,524 --> 00:19:03,974 And now, uh, uh, uh, many of those organizations are really gracious 365 00:19:03,979 --> 00:19:05,564 allowing us to take the stats out. 366 00:19:06,139 --> 00:19:12,919 So that's how we came across with a sample of around 10,000 components and component 367 00:19:12,919 --> 00:19:17,839 could be a media server, archiving device, master server storage appliance. 368 00:19:18,379 --> 00:19:21,649 And when, when you talk about backup, of course everyone realizes today 369 00:19:21,649 --> 00:19:24,829 that the, when you want to recover something, you have multiple. 370 00:19:25,369 --> 00:19:26,899 Layers of defense. 371 00:19:26,989 --> 00:19:32,719 So the, the quickest recovery can be done from live on disk storage, 372 00:19:32,719 --> 00:19:35,089 whether that's snapshots or replicas. 373 00:19:35,839 --> 00:19:41,239 Uh uh, and then you have a progressing line now where you know the list quick 374 00:19:41,389 --> 00:19:45,199 recoveries from offsite and you know, offline, maybe even offline tapes. 375 00:19:45,619 --> 00:19:49,579 So we have a progression of, uh, mediums and when we want to protect backup, we 376 00:19:49,579 --> 00:19:51,079 have to look at all those two components. 377 00:19:51,079 --> 00:19:52,159 So we want to protect our. 378 00:19:53,384 --> 00:19:57,044 A master server or media servers or archiving appliances, our online 379 00:19:57,044 --> 00:20:00,254 storage, the snapshots, the replica engines, all of these have to be hardened 380 00:20:01,064 --> 00:20:02,264 and there is a bit more than that. 381 00:20:02,714 --> 00:20:04,814 Uh, so, uh, 382 00:20:05,194 --> 00:20:06,814 Prasanna Malaiyandi: that's very comprehensive. 383 00:20:07,304 --> 00:20:07,664 Doron Pinhas: Yeah. 384 00:20:07,669 --> 00:20:07,844 Yeah. 385 00:20:07,844 --> 00:20:11,234 So to, this was a very long-winded way of saying, yeah. 386 00:20:11,234 --> 00:20:14,234 So these, these are some of the areas we gather together 387 00:20:14,264 --> 00:20:15,794 to compile that list of checks. 388 00:20:15,794 --> 00:20:17,624 And that's how we can come about with a. 389 00:20:18,094 --> 00:20:24,454 Pretty comprehensive set of, uh, scores and in the report we, we try to make 390 00:20:24,454 --> 00:20:26,404 it easy and friendly to the user. 391 00:20:26,404 --> 00:20:28,174 We divided the findings into the top. 392 00:20:28,939 --> 00:20:32,509 Five categories that were common in almost all environments. 393 00:20:33,319 --> 00:20:38,689 We also, uh, dedicated the section to some of the less frequent issues 394 00:20:38,749 --> 00:20:41,359 that are extremely lethal, as it were. 395 00:20:41,359 --> 00:20:45,379 So, you know, not many people do that, but if you do, that can be devastating. 396 00:20:45,769 --> 00:20:47,299 So you might want to watch out. 397 00:20:47,839 --> 00:20:52,189 And I think what can be really actionable if, if I'm interested to see 398 00:20:52,189 --> 00:20:56,269 that, just take that list of the top five or top six and ask yourself, I. 399 00:20:56,689 --> 00:20:58,099 Am I free from those? 400 00:20:58,699 --> 00:21:02,329 You probably will find that for some of those, even in your own organizations. 401 00:21:02,329 --> 00:21:05,869 There is something here to take a closer look at, uh, 402 00:21:05,874 --> 00:21:07,219 which I think can be valuable. 403 00:21:07,609 --> 00:21:13,639 This is why our way of sharing, um, the generosity of the organization 404 00:21:13,644 --> 00:21:18,349 work with, in, in, in freely sharing what they do well and what they don't. 405 00:21:18,354 --> 00:21:22,459 So, you know, everyone can actually, uh, use that as a benchmark. 406 00:21:23,009 --> 00:21:24,859 W. Curtis Preston: I, I, I really like that Doran. 407 00:21:24,919 --> 00:21:28,759 Um, in fact, the, the, the, you know, we're recording this 408 00:21:28,759 --> 00:21:30,079 in the middle of June, the. 409 00:21:30,769 --> 00:21:36,889 The episode that went live this morning was, uh, an se that was sort 410 00:21:36,889 --> 00:21:44,989 of bemoaning the fact that companies don't share, um, security, especially 411 00:21:44,989 --> 00:21:46,879 when a security incident happens. 412 00:21:47,209 --> 00:21:51,769 They don't share with the rest of the world what happened, why it happened. 413 00:21:51,769 --> 00:21:55,069 Basically, you know, information that can help people. 414 00:21:55,189 --> 00:21:59,659 And I think in this case, this is really helpful, uh, in that. 415 00:22:00,274 --> 00:22:01,984 Uh, there's two things in here. 416 00:22:01,984 --> 00:22:06,184 One, one, you know, I, I, you know, early in the said, I sh I said, shocked. 417 00:22:06,184 --> 00:22:06,604 Shocked. 418 00:22:06,604 --> 00:22:09,904 I am, uh, I, I, you know, I'm not shocked, right? 419 00:22:10,054 --> 00:22:14,674 Because of the, the, um, you know, because, you know, I've been in the 420 00:22:14,674 --> 00:22:19,654 back space for a while and storage and backup due kind of get the back of the 421 00:22:19,654 --> 00:22:22,024 bus status for, for a lot of reasons. 422 00:22:22,029 --> 00:22:25,714 They just don't get the, many of the tools aren't looking at that. 423 00:22:25,714 --> 00:22:27,964 Many of the people aren't thinking about that. 424 00:22:28,504 --> 00:22:32,254 And the, but the reality is storage and backup. 425 00:22:32,284 --> 00:22:33,934 That's where it's at. 426 00:22:33,964 --> 00:22:36,994 That's where the data is, right? 427 00:22:36,994 --> 00:22:39,814 It, it's the, it is the thing that you're protecting. 428 00:22:39,814 --> 00:22:44,404 In fact, um, you know, in this episode that went live, um, uh, 429 00:22:44,404 --> 00:22:47,044 today we, you know, we were talking about, well, we're not really. 430 00:22:47,689 --> 00:22:50,059 I, I don't think of myself as a cybersecurity person. 431 00:22:50,059 --> 00:22:52,579 I think of myself as a backup and, and data person. 432 00:22:52,579 --> 00:22:55,279 And, and he made the point of saying, well, without data, there's 433 00:22:55,279 --> 00:22:56,809 no point in having cybersecurity. 434 00:22:57,019 --> 00:22:57,409 Right. 435 00:22:57,679 --> 00:23:00,199 Uh, which is, which is, which is really good. 436 00:23:00,199 --> 00:23:00,559 Right. 437 00:23:00,859 --> 00:23:07,609 Um, I, I am curious, w with this survey that you did, um, or study whatever, 438 00:23:07,609 --> 00:23:10,319 whatever you'd like to call it, what. 439 00:23:10,864 --> 00:23:16,324 When you went out there, can you speak at all to like the percentage 440 00:23:16,384 --> 00:23:20,224 that you would find, like if you, if you were at a hundred companies, 441 00:23:20,554 --> 00:23:25,594 how many of them had something that you would consider truly scary? 442 00:23:25,714 --> 00:23:27,994 Uh, a misconfiguration that was 443 00:23:28,279 --> 00:23:30,379 Doron Pinhas: Are you sitting tightly? 444 00:23:31,054 --> 00:23:32,614 W. Curtis Preston: Uh, I'm sitting tightly. 445 00:23:33,109 --> 00:23:33,529 Doron Pinhas: Yeah. 446 00:23:33,529 --> 00:23:36,619 Well, you know, pretty much all of them. 447 00:23:36,994 --> 00:23:37,714 W. Curtis Preston: I knew you were 448 00:23:37,759 --> 00:23:45,034 Doron Pinhas: the average, right, so, so the average device on average, A 449 00:23:45,034 --> 00:23:49,204 device, and again, we define a device as either truly physical device, like a 450 00:23:49,204 --> 00:23:54,784 sand fabric switch, or a storage array or back backup appliance or archiving 451 00:23:54,784 --> 00:23:58,534 appliance or stuff like that through a media server, which is a, you know, hosted 452 00:23:58,534 --> 00:24:01,324 a piece of software and a master server. 453 00:24:01,414 --> 00:24:05,644 Each one is a device, so the average device will have 14. 454 00:24:06,154 --> 00:24:10,624 Risks out of which three are critical or major, meaning that if I'm a hacker, 455 00:24:10,624 --> 00:24:12,454 I, I can get in and take your data out. 456 00:24:12,964 --> 00:24:18,364 So it's, that's not to say that 100% of the organizations were, uh, in a poor 457 00:24:18,364 --> 00:24:21,544 situation, you know, maybe two or 3%. 458 00:24:21,964 --> 00:24:29,614 Did actually better than others, but by and large, I think the state of the 459 00:24:29,614 --> 00:24:32,134 industry is not great yet to be mild. 460 00:24:32,134 --> 00:24:35,314 And if you want to be more brutal, it's dismal. 461 00:24:35,539 --> 00:24:39,799 Prasanna Malaiyandi: Do you feel though that some of this is because storage and 462 00:24:39,799 --> 00:24:41,509 backup, it's kind of like a web, right? 463 00:24:41,509 --> 00:24:45,799 A very complex tangled web that no one really knows how everything 464 00:24:45,799 --> 00:24:49,219 is all connected together, which leads to some of these issues? 465 00:24:49,224 --> 00:24:55,969 Or do you think it's some other situation why companies are doing poorly? 466 00:24:56,164 --> 00:24:59,704 Doron Pinhas: Yeah, I'd love to debug that notion by the way that it's a 467 00:24:59,704 --> 00:25:02,944 web, which is too complex for the human intellect to grasp, right? 468 00:25:02,944 --> 00:25:04,084 You didn't say that exactly. 469 00:25:04,084 --> 00:25:06,904 Like I'm, uh, but, but, uh, no. 470 00:25:06,904 --> 00:25:10,774 So there, there is a way to put structure on top, you know, roll up 471 00:25:10,774 --> 00:25:15,874 your sleeves and you can apply a clear methodology to, to be much better. 472 00:25:15,874 --> 00:25:16,864 It's actually. 473 00:25:17,254 --> 00:25:18,364 Not very difficult. 474 00:25:18,364 --> 00:25:20,824 We, you know, if time allows, we can talk a little bit about what 475 00:25:20,824 --> 00:25:22,594 you can do to be much more secure. 476 00:25:23,254 --> 00:25:27,754 So, uh, I and I object to making it something really intangible 477 00:25:27,754 --> 00:25:29,164 that's, you know, incomprehensible. 478 00:25:29,164 --> 00:25:31,444 It's just a little bit of work. 479 00:25:31,654 --> 00:25:32,614 We have all the foundation. 480 00:25:32,614 --> 00:25:33,604 So what, but what are your, to 481 00:25:33,754 --> 00:25:34,834 Prasanna Malaiyandi: oh, sorry, sorry, sorry. 482 00:25:34,954 --> 00:25:39,394 Uh, my question though wasn't necessarily about security guidelines being complex, 483 00:25:39,604 --> 00:25:43,324 it was more the infrastructure that are deployed in customers environments 484 00:25:43,324 --> 00:25:46,984 such that maybe when you're backing up, you don't know necessarily how all 485 00:25:46,984 --> 00:25:48,964 the devices are connected together. 486 00:25:49,174 --> 00:25:49,414 Right. 487 00:25:49,414 --> 00:25:51,694 Or the different IT groups or things like that. 488 00:25:52,684 --> 00:25:52,924 Doron Pinhas: Yeah. 489 00:25:52,954 --> 00:25:55,174 So you, you do have a point. 490 00:25:55,894 --> 00:26:02,314 And I'll give an example, but it's still no reason not to, uh, you know, 491 00:26:02,314 --> 00:26:04,384 uh, get a good handle of things, right? 492 00:26:04,384 --> 00:26:05,734 So it can be complex, right? 493 00:26:05,734 --> 00:26:07,564 So let's first prove your point, right? 494 00:26:08,134 --> 00:26:11,404 Um, and I, again, I'm thinking like a hacker, right? 495 00:26:11,404 --> 00:26:14,794 I want to attack your, uh, favorite backup software. 496 00:26:14,839 --> 00:26:14,899 Mm. 497 00:26:15,859 --> 00:26:19,189 And there are many ways I can go about it if it's not patched. 498 00:26:19,189 --> 00:26:23,479 We mentioned some I can use, uh, default accounts maybe didn't really separate. 499 00:26:23,484 --> 00:26:26,659 There was a principle of separation of, uh, authorities. 500 00:26:26,659 --> 00:26:29,329 You don't want to have an admin account that can actually 501 00:26:29,329 --> 00:26:31,999 manage, uh, the backup server. 502 00:26:31,999 --> 00:26:35,629 You have to separate those entities into separate planes. 503 00:26:35,629 --> 00:26:39,499 Some will argue that the, uh, backup admin should be part of active directory. 504 00:26:40,039 --> 00:26:42,079 There are merits to that line of thought. 505 00:26:42,799 --> 00:26:46,069 Um, you know, but it has to be strictly separated because the 506 00:26:46,069 --> 00:26:49,369 first thing a hacker will do once they, they, they first get in. 507 00:26:49,459 --> 00:26:53,869 Now they do a little bit of a, uh, uh, reconnaissance eventually, you 508 00:26:53,874 --> 00:26:57,859 should assume they'll get admin level, uh, credentials, domain 509 00:26:57,979 --> 00:26:59,599 admin level cred that will happen. 510 00:27:00,424 --> 00:27:03,394 So when they do that, they should not be able to attack the backup software. 511 00:27:03,634 --> 00:27:04,684 So now we can do that. 512 00:27:04,684 --> 00:27:06,934 But let's say you did a really good job. 513 00:27:06,964 --> 00:27:11,434 I'm at a loss now you talked about convoluted uh, dependencies. 514 00:27:11,434 --> 00:27:14,764 Well, you know, in many cases, probably people have something like VMware. 515 00:27:15,544 --> 00:27:19,054 VMware has a trust relationship with the backup software because when 516 00:27:19,054 --> 00:27:22,054 we want to take consistent backups, every piece of software does that. 517 00:27:22,114 --> 00:27:27,304 We use APIs for the Visser infrastructure to tell us when it's ready. 518 00:27:27,874 --> 00:27:30,514 To, uh, back up consistently, whatever a vm. 519 00:27:31,264 --> 00:27:34,084 Or a volume or whatever to do federated consistency. 520 00:27:34,714 --> 00:27:39,124 Uh, in some cases we want to even delegate the infrastructure, the ability to tell 521 00:27:39,124 --> 00:27:42,904 the backup software when to start a job, what would be the content of the job. 522 00:27:43,084 --> 00:27:46,654 So we have some sort of a federated trust relationship Most. 523 00:27:47,324 --> 00:27:52,034 Organizations we talk with don't really do that, uh, granularly. 524 00:27:52,094 --> 00:27:53,804 So you, you, you have to think zero trust. 525 00:27:53,804 --> 00:27:54,764 So they don't do that. 526 00:27:54,764 --> 00:27:58,184 And if I can attack the vSphere infrastructure, let's say, if that hasn't 527 00:27:58,184 --> 00:28:03,704 been secure, I can maybe use that to stop the backup jobs to alter the backup jobs. 528 00:28:03,704 --> 00:28:06,374 So think about it, you're using immutable backup. 529 00:28:06,704 --> 00:28:10,304 I really want to destroy it because I want to encrypt your files and demand my 530 00:28:10,304 --> 00:28:12,044 ransom, and I want you to have to pay. 531 00:28:12,964 --> 00:28:14,404 But you have immutable backups. 532 00:28:14,704 --> 00:28:15,994 Ah, I can't really delete that. 533 00:28:16,564 --> 00:28:18,484 Of course, there are ways to actually delete that. 534 00:28:18,484 --> 00:28:21,544 If you didn't set it up, if you didn't set up immutability correctly, you didn't 535 00:28:21,544 --> 00:28:24,034 enable retention log and stuff like that. 536 00:28:24,454 --> 00:28:28,294 And I can maybe tamper with your system, but let's say you've done a good job. 537 00:28:28,954 --> 00:28:32,944 Um, so I want to actually, my last research, which is very effective, 538 00:28:32,944 --> 00:28:34,054 is to poison your backups. 539 00:28:34,054 --> 00:28:34,804 How do I do that? 540 00:28:35,554 --> 00:28:37,054 I break into vSphere. 541 00:28:37,624 --> 00:28:38,164 I. 542 00:28:38,824 --> 00:28:42,694 I find that it has the ability to alter the backup job, so I alter the content. 543 00:28:42,694 --> 00:28:44,164 I'm starting to back up. 544 00:28:44,164 --> 00:28:48,094 Instead of actual production VMs, I'm backing up jump my 545 00:28:48,094 --> 00:28:50,974 temp directory, my swap file. 546 00:28:51,304 --> 00:28:54,484 I just wanna make sure it's the same amount of data go that goes nightly. 547 00:28:55,294 --> 00:28:58,789 So, Now I wait for two or three months. 548 00:28:59,419 --> 00:29:01,459 So the backup jobs continue to run. 549 00:29:01,459 --> 00:29:02,959 The backup admins, is that the job? 550 00:29:03,019 --> 00:29:05,959 If you're not alert enough to find that the content has been changed, it's 551 00:29:05,959 --> 00:29:11,309 successful, and after 90 days or whatever I deem necessary, I lock your files. 552 00:29:12,559 --> 00:29:16,009 Um, now you go to the backup environment and say, oh, fine, 553 00:29:16,009 --> 00:29:17,629 I have 90 days full of backup. 554 00:29:17,629 --> 00:29:19,369 But none of them, it's all crap. 555 00:29:19,399 --> 00:29:22,609 So the only valid backup you have if youre a bank is 90 days old. 556 00:29:22,609 --> 00:29:25,519 Imagine you're calling your bank to say, where are my funds? 557 00:29:25,519 --> 00:29:26,929 And they're saying, Hmm, 558 00:29:26,944 --> 00:29:27,634 Prasanna Malaiyandi: Sorry. 559 00:29:27,649 --> 00:29:29,119 Doron Pinhas: do you have a paper receipt? 560 00:29:29,179 --> 00:29:31,369 Sorry, we don't know. 561 00:29:31,939 --> 00:29:34,099 Um, so that can be bad, right? 562 00:29:34,099 --> 00:29:34,669 So I can. 563 00:29:34,929 --> 00:29:36,879 To your point, they are convoluted. 564 00:29:36,879 --> 00:29:40,269 Trust, relationship, API gateways and services. 565 00:29:40,269 --> 00:29:44,599 To name a few examples, we scan an environment and we find, you 566 00:29:44,599 --> 00:29:47,859 know, you can find the management APIs of management consoles. 567 00:29:47,889 --> 00:29:51,099 You just scan for the REST API and through IP address and you find, 568 00:29:51,189 --> 00:29:54,249 you find, they say we have one management console and you find three. 569 00:29:54,819 --> 00:29:56,409 One of them is, is in the lab. 570 00:29:57,414 --> 00:30:00,684 Where they used to do testing two years ago, they never shut down that instance. 571 00:30:01,344 --> 00:30:02,934 And it's not protected. 572 00:30:02,934 --> 00:30:07,134 And it's, there is no time server, there is no cookie session cookie timeout, 573 00:30:07,134 --> 00:30:08,544 and it still can control production. 574 00:30:09,324 --> 00:30:13,814 So we want, so there are, it is convoluted, so I totally agree. 575 00:30:14,929 --> 00:30:20,779 The only thing I, um, I would suggest is that you can become good at fi thinking 576 00:30:20,869 --> 00:30:25,699 like a criminal, uh, or expecting what a, don't think like a criminal, but expect, 577 00:30:25,699 --> 00:30:27,559 you know, be able to expect what I do. 578 00:30:28,309 --> 00:30:32,569 And if you are at a loss, you can refer to some of the guidelines I've provided. 579 00:30:32,574 --> 00:30:34,369 Go and go ahead and read the NIST Guide. 580 00:30:34,369 --> 00:30:34,969 Go ahead and read. 581 00:30:34,969 --> 00:30:36,499 The coming is a guide. 582 00:30:36,739 --> 00:30:39,319 Snia has a lot of good re amazing resources around storage, 583 00:30:39,319 --> 00:30:41,209 security, and you'll find you can. 584 00:30:41,554 --> 00:30:45,094 Pretty easily compile a checklist of the i questions you should ask. 585 00:30:45,574 --> 00:30:48,214 And these are relatively straightforward questions. 586 00:30:48,604 --> 00:30:52,054 Where are my, where, where is, you know, one of the big areas is the control plane. 587 00:30:52,054 --> 00:30:53,644 How do I control all that stuff? 588 00:30:53,674 --> 00:30:56,464 Like we have API gateways, we have management consoles, we 589 00:30:56,464 --> 00:31:00,784 have, uh, URLs, the, I lock it down, it boils down to a list of. 590 00:31:01,594 --> 00:31:03,424 Finite amount of questions. 591 00:31:03,424 --> 00:31:05,824 So you have to roll up your sleeve and do that. 592 00:31:06,634 --> 00:31:09,664 Um, and, and as just, I don't want to talk much. 593 00:31:09,664 --> 00:31:11,344 It's not an advertisement to our company. 594 00:31:11,404 --> 00:31:14,704 We have tools that allow you to automate some of that stuff, so that 595 00:31:14,704 --> 00:31:19,664 might prove useful, but, As always in life, you don't have to use our tools. 596 00:31:19,664 --> 00:31:22,214 If you know what you're doing, you can do a good job with 597 00:31:22,219 --> 00:31:24,044 manual tools, it's still okay. 598 00:31:24,614 --> 00:31:28,814 Um, you know, woodworking, myself, you know, there are a lot of things 599 00:31:28,819 --> 00:31:30,374 you can do with manual tools. 600 00:31:30,379 --> 00:31:35,114 Power tools can save you some effort and increase predictability, but you know, 601 00:31:35,114 --> 00:31:37,124 it can, you do a fine job manually. 602 00:31:37,124 --> 00:31:38,474 So that's, that's, 603 00:31:38,474 --> 00:31:38,984 still fine. 604 00:31:39,164 --> 00:31:43,034 So, to her question, it's complex, but it's possible to, to actually 605 00:31:43,124 --> 00:31:46,124 build a framework to add it your environment in, in a more, uh, 606 00:31:47,614 --> 00:31:51,454 Comprehensive way and, and, and, and reduce the attack surface noticeably. 607 00:31:51,554 --> 00:31:55,544 W. Curtis Preston: The, cuz I, you know, you were saying, you know, you don't 608 00:31:55,544 --> 00:31:59,024 necessarily want to plug your company, but at the same time that, that's where I 609 00:31:59,024 --> 00:32:01,424 wanted to go next because I, I'm curious. 610 00:32:01,724 --> 00:32:07,844 So you, you're able to do this, um, you know, this, uh, automated check 611 00:32:07,844 --> 00:32:09,584 to check all of these settings. 612 00:32:10,154 --> 00:32:13,964 I, is that the service that your company provides or what, what else do 613 00:32:13,969 --> 00:32:15,494 you, you know, where, where do you go 614 00:32:15,539 --> 00:32:19,439 Doron Pinhas: yeah, so ultimately one of those days, you know, we 615 00:32:19,499 --> 00:32:24,119 hope that organizations that want to automate a framework to check. 616 00:32:24,659 --> 00:32:27,419 On a daily basis or an ongoing basis or after exchange that 617 00:32:27,419 --> 00:32:29,069 they're always locked down. 618 00:32:29,639 --> 00:32:33,419 They might be looking into something like what Continuity provides, which is an. 619 00:32:34,589 --> 00:32:37,529 Engine that automates all of those checks that gets automated. 620 00:32:37,589 --> 00:32:41,309 It's like an antivirus if you want it, or like a vulnerability management tools. 621 00:32:41,309 --> 00:32:44,909 It gets automatic updates where all the vendor best practices, the latest 622 00:32:44,909 --> 00:32:49,799 CVEs, the latest recommendations from framework like NIST and niso 623 00:32:49,799 --> 00:32:51,749 and PCI and HIPAA are implemented. 624 00:32:51,749 --> 00:32:55,319 And you, you can get automated compliance reports and if you've done something 625 00:32:55,319 --> 00:32:57,809 wrong, you'll know what went wrong. 626 00:32:58,144 --> 00:33:01,054 What is this syntax I need to use to fix the problem? 627 00:33:01,054 --> 00:33:01,924 And you can start over. 628 00:33:01,954 --> 00:33:06,274 So you, you know, we provide those tools to automate a frequent 629 00:33:06,274 --> 00:33:07,774 mode of validation, right? 630 00:33:07,774 --> 00:33:12,664 So that's something, uh, that can be helpful and we advocate that. 631 00:33:13,144 --> 00:33:15,904 Uh, so, so that's how we make our living. 632 00:33:16,204 --> 00:33:20,494 But we are also working with organizations to do one-off assessments. 633 00:33:21,274 --> 00:33:23,134 Uh, no strings attached. 634 00:33:23,134 --> 00:33:24,874 If you want to understand how material you are. 635 00:33:25,679 --> 00:33:28,229 You know, we can definitely talk and first of all, share with you. 636 00:33:28,229 --> 00:33:32,819 We'll happily do that because we learn so much from the, those interactions. 637 00:33:33,314 --> 00:33:35,714 And we want to give some of that back, right? 638 00:33:35,714 --> 00:33:39,944 So, uh, if you want to just run a one-time scan, you can approach us. 639 00:33:39,944 --> 00:33:43,934 You can even approach your, uh, trusted, uh, security consultant and 640 00:33:43,934 --> 00:33:45,854 ask them if they can do a scan for you. 641 00:33:46,514 --> 00:33:48,854 Um, there are not too many options. 642 00:33:48,859 --> 00:33:52,184 We are, we know, pretty unique, but they can use our software. 643 00:33:52,184 --> 00:33:56,624 A lot of, uh, um, uh, there are many consultant firms out there that 644 00:33:56,624 --> 00:33:59,534 have access to our technology and can use it to run a scan for you. 645 00:33:59,534 --> 00:34:02,174 And even if that's a one time scan, you will understand. 646 00:34:02,819 --> 00:34:06,299 What you're doing well, where you have issues, what are the 647 00:34:06,299 --> 00:34:07,919 priorities of those issues? 648 00:34:08,429 --> 00:34:12,029 What does it mean to your business in terms of, you know, not adhering 649 00:34:12,029 --> 00:34:15,209 to industry standards and regulations If you are in a regulated segment, 650 00:34:16,109 --> 00:34:17,429 uh, sometimes that's enough. 651 00:34:17,434 --> 00:34:21,329 That's just, that's a starting point that can, uh, get you going 652 00:34:21,329 --> 00:34:24,299 because now you have a better clarity instead of understanding that, 653 00:34:24,329 --> 00:34:25,709 you know, I'm probably not good. 654 00:34:26,429 --> 00:34:30,659 You'll know exactly what works well for you and where do you have issues. 655 00:34:30,659 --> 00:34:36,074 So that's, In a sense, this is what our, uh, product does, and we make a living 656 00:34:36,074 --> 00:34:38,024 out of selling it to those organizations. 657 00:34:38,024 --> 00:34:42,014 Choose to be standardized 24 7 and be accountable. 658 00:34:42,434 --> 00:34:43,394 We hope, uh, 659 00:34:44,114 --> 00:34:47,174 W. Curtis Preston: For what it's worth, uh, you know, I'm a fan of that, right? 660 00:34:47,174 --> 00:34:48,794 I'm a fan of automation. 661 00:34:48,794 --> 00:34:52,244 I'm a fan of, uh, you know, I mean, I, I like the fact that you 662 00:34:52,249 --> 00:34:54,464 have the check first off period. 663 00:34:54,464 --> 00:34:54,674 Right? 664 00:34:54,674 --> 00:34:55,604 I'm a fan of that. 665 00:34:56,114 --> 00:34:58,634 The idea, and, and, and those are good, right? 666 00:34:58,634 --> 00:35:00,434 Those, those one time checks are good. 667 00:35:00,439 --> 00:35:03,044 It's good to have a consultant look at your stuff once in a while to make 668 00:35:03,049 --> 00:35:04,274 sure that you're doing the right stuff. 669 00:35:04,769 --> 00:35:10,529 But there's nothing like just having something continually checking because, 670 00:35:10,829 --> 00:35:17,879 you know, um, there are always new CVEs, there are always new vulnerabilities 671 00:35:17,879 --> 00:35:19,679 and things that you need to patch. 672 00:35:19,799 --> 00:35:26,279 I think patching is the thing that most people get behind on the most, right? 673 00:35:26,279 --> 00:35:29,819 There's that one time configuration of making sure we separate this and that 674 00:35:29,819 --> 00:35:31,409 and we're using MFA and we're using. 675 00:35:31,784 --> 00:35:36,764 Um, you know, the, the proper, uh, usernames and passwords and not 676 00:35:36,764 --> 00:35:40,664 using root root, you know, you, that should hopefully be a one-time thing. 677 00:35:40,964 --> 00:35:45,194 I think it's the, the patch management, uh, and other things, 678 00:35:45,194 --> 00:35:47,054 maybe recommendations change over time. 679 00:35:47,924 --> 00:35:53,114 Uh, that, that's the one where it's like, it, it would be nice to have something 680 00:35:53,384 --> 00:35:59,624 that just tells me, Hey, a new CBE came out, you know, and, and, uh, you know, 681 00:35:59,624 --> 00:36:01,664 the vendor has patched it already. 682 00:36:01,844 --> 00:36:04,484 You need to go, you know, you need to go patch it right 683 00:36:04,484 --> 00:36:06,584 away or else you're at risk. 684 00:36:06,959 --> 00:36:07,169 Prasanna Malaiyandi: Yeah. 685 00:36:07,379 --> 00:36:07,799 I think 686 00:36:07,919 --> 00:36:09,329 Doron Pinhas: So you, you'll get that. 687 00:36:09,359 --> 00:36:09,989 Yeah, go ahead, 688 00:36:10,304 --> 00:36:10,754 W. Curtis Preston: Yeah. 689 00:36:10,769 --> 00:36:12,599 Prasanna Malaiyandi: I think the other thing, Curtis too, and I 690 00:36:12,599 --> 00:36:15,839 know we've talked about this in previous podcasts, is like people's 691 00:36:15,839 --> 00:36:17,579 environment is never static, right? 692 00:36:17,609 --> 00:36:20,729 You're always getting new devices in some group or another, right? 693 00:36:20,729 --> 00:36:22,649 New applications being spun up, right? 694 00:36:22,649 --> 00:36:27,329 New deployments, new servers, and so having that ongoing check where it's 695 00:36:27,329 --> 00:36:31,679 like, Hey, we can now make it more efficient for you to bring online these 696 00:36:31,679 --> 00:36:35,159 applications rather than going through sort of the entire security audit 697 00:36:35,159 --> 00:36:36,479 and everything else that you might. 698 00:36:36,789 --> 00:36:39,699 Have to do, which might elongate the time you need by weeks. 699 00:36:40,239 --> 00:36:40,449 Right. 700 00:36:40,449 --> 00:36:44,499 The other thing also I was thinking is there's also, from what I've read, and 701 00:36:44,499 --> 00:36:47,769 I don't know, Darron, if your product supports, I'm guessing it supports 702 00:36:47,774 --> 00:36:49,659 public clouds as well as endpoints. 703 00:36:50,499 --> 00:36:50,769 Doron Pinhas: Yep. 704 00:36:51,129 --> 00:36:51,459 Prasanna Malaiyandi: Okay. 705 00:36:51,729 --> 00:36:52,029 Right. 706 00:36:52,029 --> 00:36:55,989 So as people are looking to go to the cloud, right, sometimes they're also 707 00:36:55,989 --> 00:36:57,519 looking at multi-cloud strategies. 708 00:36:57,884 --> 00:37:00,824 Right where maybe they're an expert at AWS and they're trying to figure 709 00:37:00,824 --> 00:37:05,024 out, can I use Azure GCP for certain workloads or because of regionality 710 00:37:05,024 --> 00:37:08,414 or services being available and, but they're not the experts. 711 00:37:08,419 --> 00:37:11,654 And so to get up to speed and learn, okay, what is the mapping and what are the 712 00:37:11,654 --> 00:37:16,154 best practices in AW or in GCP or Azure takes time and they're not the experts. 713 00:37:16,154 --> 00:37:17,354 They don't have the resources. 714 00:37:17,359 --> 00:37:19,484 And having a tool like this that can automate. 715 00:37:19,799 --> 00:37:22,409 And say like, Hey, here are your best practices. 716 00:37:22,409 --> 00:37:24,179 Are you doing things in the right way or not? 717 00:37:24,179 --> 00:37:27,899 And giving you that guidance and be like, yep, this is how you should be doing 718 00:37:27,904 --> 00:37:29,909 things, I think can go a long way as well. 719 00:37:30,489 --> 00:37:33,639 Doron Pinhas: Yeah, I totally agree, and I just want to add that over the 720 00:37:33,639 --> 00:37:37,779 course of running a business, right, I've been in this position for 17 years. 721 00:37:37,779 --> 00:37:38,649 I'm proud of that. 722 00:37:39,339 --> 00:37:43,899 You know, people stay at an organization for years and over the span of years. 723 00:37:43,959 --> 00:37:47,019 You know, if you take a look at the, if you're running a, an IT shop 724 00:37:47,019 --> 00:37:49,359 and you take a look at how you have run your business five years ago. 725 00:37:49,859 --> 00:37:51,749 Four years ago, three, two years ago. 726 00:37:52,079 --> 00:37:55,199 You'll see that there are sometimes, there are tectonic 727 00:37:55,199 --> 00:37:57,119 changes over those spans, right? 728 00:37:57,119 --> 00:37:59,399 We change one of our major vendors. 729 00:37:59,399 --> 00:38:01,559 We move from one backup vendor to another. 730 00:38:01,559 --> 00:38:03,719 We change from tapes to discs. 731 00:38:03,719 --> 00:38:05,909 We start adding cloud. 732 00:38:06,529 --> 00:38:11,299 Tertiary copies now, each one of those, and, and if you look three, four years 733 00:38:11,299 --> 00:38:12,679 back, you'll see tectonic changes. 734 00:38:12,679 --> 00:38:15,379 But each one of those steps, they happen on a monthly basis. 735 00:38:15,409 --> 00:38:20,029 You know, we throw away our own library and bring in a new vtl and, 736 00:38:20,034 --> 00:38:21,349 you know, something like, and, and. 737 00:38:21,619 --> 00:38:22,879 And we have like five of those. 738 00:38:22,879 --> 00:38:25,039 So you know, they live like four or five years. 739 00:38:25,039 --> 00:38:27,829 So, you know, every year we change one and we have tapes and we have 740 00:38:27,859 --> 00:38:31,429 discs, and we've, every new release, we have different frameworks, we have 741 00:38:31,429 --> 00:38:33,199 new releases, management consoles. 742 00:38:33,199 --> 00:38:35,899 Every four or five years the architecture changes. 743 00:38:35,899 --> 00:38:39,709 So whenever something like that happens, for me, it's new. 744 00:38:39,769 --> 00:38:44,179 But if you are relying on an industry backed whatever, uh, library of 745 00:38:44,179 --> 00:38:47,209 checks that, you know, should cover everything, and we learn a 746 00:38:47,209 --> 00:38:49,999 lot from our, uh, user community. 747 00:38:50,354 --> 00:38:52,664 They'll tell us, oh, we started looking into this. 748 00:38:53,474 --> 00:38:54,824 Are you familiar with it? 749 00:38:55,154 --> 00:38:56,354 Say, Hmm, interesting. 750 00:38:56,354 --> 00:38:57,164 Let's take a look. 751 00:38:57,224 --> 00:38:58,184 Let's take a look together. 752 00:38:58,184 --> 00:38:58,964 What did you find? 753 00:38:58,964 --> 00:39:04,214 Some of them are, so there is a sort of a community feedback here and uh, 754 00:39:04,424 --> 00:39:08,234 maybe it's new for your organization, but it's probably not new for others. 755 00:39:08,234 --> 00:39:13,064 And there is definitely an opportunity to have a much better starting point. 756 00:39:13,364 --> 00:39:14,984 So, you know, I'm deploying. 757 00:39:15,689 --> 00:39:20,009 Uh, a cloud target backup, you know, and I wanna make sure that I pass 758 00:39:20,009 --> 00:39:24,209 all of the checks so I run a quick scan when it's not yet production, 759 00:39:24,209 --> 00:39:25,889 and I find what I'm doing well. 760 00:39:25,889 --> 00:39:28,319 And if there is room for improvement, usually there is. 761 00:39:28,319 --> 00:39:32,819 So, you know, an ounce of prevention is worth, uh, a pound of KiOR, right? 762 00:39:32,819 --> 00:39:35,759 So think about your, uh, immune system. 763 00:39:35,789 --> 00:39:40,349 Let's say it would've run once a year for a day, and then it would stop shut 764 00:39:40,349 --> 00:39:41,519 down for a day the rest of the year. 765 00:39:41,519 --> 00:39:42,419 That's not great. 766 00:39:43,079 --> 00:39:47,009 It's better than nothing, but so that's so, so to, to Curtis's point. 767 00:39:47,519 --> 00:39:47,759 Yeah. 768 00:39:47,759 --> 00:39:49,049 One time scan is awesome. 769 00:39:49,739 --> 00:39:53,189 It's important to know if something is wrong, but you know you have to 770 00:39:53,189 --> 00:39:57,689 be, or it's better to be continual. 771 00:39:58,019 --> 00:39:58,309 Prasanna Malaiyandi: Yeah. 772 00:39:59,549 --> 00:40:00,899 W. Curtis Preston: Yeah, I like that a lot. 773 00:40:00,959 --> 00:40:07,799 Um, so the, you know, I'd, I'd like to wrap up, but what I, what I am curious 774 00:40:07,799 --> 00:40:13,199 about early on, you alluded to, I mean, we've kind of discussed some of the 775 00:40:13,199 --> 00:40:14,879 things that you recommend that people do. 776 00:40:15,749 --> 00:40:18,509 Besides obviously running the continual scan. 777 00:40:19,019 --> 00:40:23,129 Um, are there some other things that you recommend people do to secure 778 00:40:23,129 --> 00:40:24,689 their storage and backup environment? 779 00:40:24,729 --> 00:40:25,409 Doron Pinhas: Yeah, sure. 780 00:40:25,409 --> 00:40:26,159 So I think. 781 00:40:27,644 --> 00:40:33,344 The first thing to do is to get to know a little bit more about I, I would even read 782 00:40:33,344 --> 00:40:35,504 a little bit about the business threats. 783 00:40:36,134 --> 00:40:38,294 What can possibly go wrong, right? 784 00:40:38,294 --> 00:40:41,144 So maybe, uh, I'm not sure we'll have time to go there today. 785 00:40:41,684 --> 00:40:42,554 Why is it important? 786 00:40:42,554 --> 00:40:43,784 Really get a good grasp. 787 00:40:44,324 --> 00:40:46,244 Uh, it's not a difficult read. 788 00:40:46,244 --> 00:40:50,984 If you go to the Snea site, you go and, uh, take a look at the NIST or IZO guide. 789 00:40:51,074 --> 00:40:53,954 You'll have a framework for, in the NIST guide, there are about 790 00:40:53,954 --> 00:40:57,734 30 different areas you should be looking into, get familiar with. 791 00:40:57,734 --> 00:41:00,494 What are the components you need to consider to build. 792 00:41:00,989 --> 00:41:03,089 Secure framework, choose. 793 00:41:03,239 --> 00:41:06,209 So, you know, so the first step is, you know, get a little bit more 794 00:41:06,209 --> 00:41:07,739 knowledge about storage security. 795 00:41:08,699 --> 00:41:11,219 Five years ago, it was not accessible to datas. 796 00:41:11,459 --> 00:41:14,069 There are plenty of resources in our site, you know, it's 797 00:41:14,319 --> 00:41:17,219 www.continuitysoftware.com resources. 798 00:41:17,219 --> 00:41:21,689 You'll find a library of research and guidelines and advice and 799 00:41:21,689 --> 00:41:23,189 useful links to other sites. 800 00:41:23,189 --> 00:41:26,129 So there is plenty of material out there to get educated. 801 00:41:26,459 --> 00:41:30,599 The second thing I would encourage to do is to define, at least at 802 00:41:30,599 --> 00:41:35,369 a high level, a set of security standards you'd expect to have. 803 00:41:36,269 --> 00:41:44,189 And you can draw, uh, um, uh, intuition or, or, or guidelines from the set 804 00:41:44,189 --> 00:41:48,299 documents, either or NIST or other frameworks, build a set of baselines 805 00:41:48,389 --> 00:41:52,649 like, so I want to lock down devices, I want to have password complexities. 806 00:41:52,649 --> 00:41:57,629 I want to whatever, set up session cookies or session timeouts. 807 00:41:57,629 --> 00:41:59,639 I want to, you know, these are my baselines. 808 00:42:00,239 --> 00:42:00,659 W. Curtis Preston: Mm-hmm. 809 00:42:00,854 --> 00:42:04,274 Doron Pinhas: Define those baselines and then, you know, find a way to 810 00:42:04,274 --> 00:42:06,134 periodically review your settings. 811 00:42:06,134 --> 00:42:11,564 You know, it's, um, it takes a little, uh, doing, but all the 812 00:42:11,564 --> 00:42:12,824 building blocks are out there. 813 00:42:13,214 --> 00:42:16,484 If you want to use automation, then we would be very happy 814 00:42:16,484 --> 00:42:18,074 to help you achieve that. 815 00:42:19,064 --> 00:42:20,924 You can even script that yourself, right? 816 00:42:20,924 --> 00:42:25,754 So it's not everyone has to buy a power saw, right? 817 00:42:25,754 --> 00:42:26,594 You can rent it. 818 00:42:27,194 --> 00:42:27,464 Right? 819 00:42:27,464 --> 00:42:33,224 So, but you know, Close the knowledge gap, understand what is there to check. 820 00:42:33,224 --> 00:42:34,124 It's a finalist. 821 00:42:34,124 --> 00:42:35,624 There are 13 different areas. 822 00:42:36,014 --> 00:42:37,304 There are different ways to look at it. 823 00:42:37,304 --> 00:42:38,024 It's structured. 824 00:42:39,494 --> 00:42:42,644 Pick and choose the, the things that are important to your business 825 00:42:43,004 --> 00:42:46,514 and find a way to put repetition into validating that you're clean. 826 00:42:46,574 --> 00:42:49,544 This way whenever you roll out something new and it always happens, 827 00:42:50,084 --> 00:42:53,354 you have a, at least a point where you can, you know, validate your design. 828 00:42:53,354 --> 00:42:55,244 So these are three things that you can easily do. 829 00:42:55,994 --> 00:43:00,524 Um, and again, our sites has a lot of nice videos that simulate 830 00:43:00,524 --> 00:43:02,564 how, you know, how hackers thinks. 831 00:43:02,809 --> 00:43:05,149 What they can do in a specific scenario. 832 00:43:05,719 --> 00:43:09,619 Uh, when you start thinking like that, uh, it can be even interesting 833 00:43:10,279 --> 00:43:13,729 is to to think a little bit like a hacker and, and build better designs. 834 00:43:14,479 --> 00:43:17,989 If you want to make your house burglar proof, you should just take 835 00:43:17,989 --> 00:43:21,529 a look outside and think critical and say, I can get in through here. 836 00:43:22,099 --> 00:43:23,539 What about the basement door? 837 00:43:24,259 --> 00:43:25,699 What about my Tesla keys? 838 00:43:26,449 --> 00:43:27,079 And so on. 839 00:43:27,084 --> 00:43:30,559 So, uh, I can hide in the Tesla. 840 00:43:32,054 --> 00:43:36,734 Uh, yeah, back seat and wait for you to open the garage doors. 841 00:43:38,354 --> 00:43:39,044 W. Curtis Preston: Yeah, I, 842 00:43:39,104 --> 00:43:40,094 Doron Pinhas: that, that's my advice. 843 00:43:40,094 --> 00:43:41,774 It's pretty straightforward, so. 844 00:43:42,764 --> 00:43:47,654 W. Curtis Preston: yeah, I like the, um, I, I think, uh, we'll put some 845 00:43:47,654 --> 00:43:51,854 links in the show notes, uh, to the, to the things that you talked about. 846 00:43:52,199 --> 00:43:53,579 I like that idea a lot. 847 00:43:53,639 --> 00:43:56,549 Um, basically just make yourself more knowledgeable. 848 00:43:56,969 --> 00:43:58,019 Is, is the key. 849 00:43:58,019 --> 00:44:04,019 Cuz I, I do think that, you know, our folks tend to be backup centric, 850 00:44:04,049 --> 00:44:09,839 um, security, you know, they're learning security and a lot of backup 851 00:44:09,839 --> 00:44:12,209 folks are often junior folks, right? 852 00:44:12,209 --> 00:44:14,549 The, this is the job they were able to get. 853 00:44:15,059 --> 00:44:18,269 And mainly because nobody else wanted it, right? 854 00:44:18,719 --> 00:44:19,949 Um, yeah. 855 00:44:19,949 --> 00:44:22,559 I mean, that's how, that's how I got my first job in backup. 856 00:44:23,009 --> 00:44:29,249 And so yeah, this is definitely the part of that, the part of the world 857 00:44:29,249 --> 00:44:31,919 that you really need to go to, right? 858 00:44:31,924 --> 00:44:34,349 You really need to increase your cybersecurity knowledge. 859 00:44:34,369 --> 00:44:38,369 If you don't have that, if you were listening to this episode and these, 860 00:44:38,399 --> 00:44:42,419 uh, acronyms that, that, uh, we were, you know, rattling off like nist, if 861 00:44:42,419 --> 00:44:46,229 those are foreign to you, Definitely follow the links in the show guides 862 00:44:46,229 --> 00:44:48,839 to, um, to, to learn more about that. 863 00:44:48,839 --> 00:44:51,839 Well, uh, Doran, I want to thank you for, for coming on the show 864 00:44:53,304 --> 00:44:53,814 Doron Pinhas: Perfect. 865 00:44:53,814 --> 00:44:54,924 It was my pleasure. 866 00:44:55,224 --> 00:44:56,214 Thank you for having me. 867 00:44:57,029 --> 00:44:57,759 W. Curtis Preston: and Prasanna. 868 00:44:57,779 --> 00:45:01,199 You, uh, continue to get all the blame for my Tesla, but, 869 00:45:01,199 --> 00:45:02,839 uh, I'm glad you're here anyway. 870 00:45:04,109 --> 00:45:04,559 Prasanna Malaiyandi: Yeah. 871 00:45:04,649 --> 00:45:07,139 Thanks Curtis and nice to meet you Doran, and thanks for 872 00:45:07,139 --> 00:45:08,039 answering all the questions. 873 00:45:08,039 --> 00:45:13,889 I think it's a very compelling, uh, solution, right. 874 00:45:13,894 --> 00:45:18,029 And solves a very specific problem that I think there's, like you mentioned, right? 875 00:45:18,029 --> 00:45:20,159 There's a huge blind spot to this. 876 00:45:20,159 --> 00:45:22,289 So I think it's very valuable. 877 00:45:22,294 --> 00:45:26,489 And Curtis, I hope one day that you will thank me that, that you bought your Tesla. 878 00:45:26,489 --> 00:45:29,939 So I'll just, uh, I'm not gonna hold my breath for that day, but. 879 00:45:30,164 --> 00:45:32,144 W. Curtis Preston: There's this, there's this other person in my 880 00:45:32,144 --> 00:45:36,494 house that is still blaming you, but, uh, we'll, we'll, we'll see. 881 00:45:36,494 --> 00:45:37,964 Maybe, maybe one day. 882 00:45:38,294 --> 00:45:40,844 Uh, well, anyway, I, I want to thank our listeners. 883 00:45:41,054 --> 00:45:45,134 You know, you, you are why we do this, and remember to subscribe 884 00:45:45,194 --> 00:45:47,304 so that you can restore it all.