1 00:00:00,960 --> 00:00:04,800 You found the backup wrap up your go-to podcast for all things 2 00:00:04,800 --> 00:00:07,350 backup recovery and cyber recovery. 3 00:00:07,890 --> 00:00:10,920 In this episode, we look at insider threats. 4 00:00:11,220 --> 00:00:15,750 Everyone's so focused on ransomware and external attacks, but what about 5 00:00:15,750 --> 00:00:17,550 the person sitting right next to you? 6 00:00:17,865 --> 00:00:21,104 You know the one with admin privilege who just got passed over for a 7 00:00:21,104 --> 00:00:25,634 promotion or that contractor in another country who just got offered 8 00:00:25,634 --> 00:00:28,244 six months salary to copy some files. 9 00:00:28,814 --> 00:00:33,075 We break down the three types of insider threats, the malicious actor, the careless 10 00:00:33,075 --> 00:00:35,745 employee, and the compromised insider. 11 00:00:36,495 --> 00:00:38,745 I share some war stories from consulting. 12 00:00:38,745 --> 00:00:43,334 Persona, brings up some recent cases like the Coinbase and Apple breaches. 13 00:00:43,665 --> 00:00:44,320 I hope you enjoy it. 14 00:00:45,420 --> 00:00:49,710 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 15 00:00:49,710 --> 00:00:54,840 Backup, and I've been passionate about backup and recovery for over 30 years. 16 00:00:55,110 --> 00:00:55,650 Ever since. 17 00:00:55,650 --> 00:00:59,160 I had to tell my boss that there were no backups of the production 18 00:00:59,160 --> 00:01:00,660 database that we had just lost. 19 00:01:01,200 --> 00:01:04,259 I don't want that to happen to you, and that's why I do this. 20 00:01:04,650 --> 00:01:09,870 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 21 00:01:10,259 --> 00:01:12,390 This is the backup wrap up. 22 00:01:26,368 --> 00:01:27,328 Welcome to the show. 23 00:01:28,198 --> 00:01:32,308 I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy who's 24 00:01:32,308 --> 00:01:35,278 really good at asking questions, but not necessarily when I need them. 25 00:01:35,278 --> 00:01:35,758 Asked. 26 00:01:36,088 --> 00:01:38,608 Persona, how's it going? 27 00:01:39,313 --> 00:01:40,633 I am good, Curtis. 28 00:01:40,663 --> 00:01:44,113 Uh, I do ask a lot of questions. 29 00:01:44,113 --> 00:01:48,073 It's not my fault because usually when we're having these conversations, 30 00:01:48,493 --> 00:01:51,433 you're in the middle of something and I'm in the middle of something. 31 00:01:51,973 --> 00:01:52,333 Right. 32 00:01:52,798 --> 00:01:53,908 we're both in the middle of something. 33 00:01:53,908 --> 00:01:57,538 You go, have you thought about the x, Y, Z parameter? 34 00:01:57,538 --> 00:01:59,413 And I'm like, that's really good thing. 35 00:01:59,413 --> 00:02:02,038 Like I'm driving, you're working. 36 00:02:02,148 --> 00:02:02,268 I. 37 00:02:02,518 --> 00:02:04,348 One of us should probably write that down. 38 00:02:04,483 --> 00:02:04,783 Yeah. 39 00:02:04,903 --> 00:02:05,323 No, no, no. 40 00:02:05,323 --> 00:02:06,373 We do write it down. 41 00:02:06,583 --> 00:02:07,093 We do. 42 00:02:07,093 --> 00:02:11,443 We text it, but then the problem is it gets lost in all the texts and that, 43 00:02:11,533 --> 00:02:14,653 would help if we didn't text each other like 157 times a day. 44 00:02:15,433 --> 00:02:17,428 I think it's actually 158, but yes. 45 00:02:18,253 --> 00:02:19,393 Yeah, yeah. 46 00:02:19,933 --> 00:02:22,873 So now I'm like, dude, I need the questions. 47 00:02:23,923 --> 00:02:25,093 And you, what did you give you? 48 00:02:25,273 --> 00:02:26,803 Like structure, gimme structure. 49 00:02:26,803 --> 00:02:27,793 Gimme a document 50 00:02:27,858 --> 00:02:28,078 Yes. 51 00:02:28,093 --> 00:02:28,693 to write it in. 52 00:02:28,693 --> 00:02:30,133 Because I'm so good at structure. 53 00:02:31,063 --> 00:02:34,093 knows, anybody that knows anything about me, knows structure. 54 00:02:34,453 --> 00:02:38,983 Well, and literally all you had to do was create a blank document in Google 55 00:02:39,253 --> 00:02:42,403 Docs and just add and share it with me. 56 00:02:42,433 --> 00:02:43,123 That's all you had to do. 57 00:02:43,123 --> 00:02:44,668 You didn't have to put any content, nothing. 58 00:02:44,833 --> 00:02:47,203 It took, it took so long to do that. 59 00:02:47,203 --> 00:02:49,958 Persona was so long, so much effort. 60 00:02:50,428 --> 00:02:51,008 Oh, Curtis, 61 00:02:52,538 --> 00:02:52,958 Anyway, 62 00:02:53,468 --> 00:02:54,888 but, but here's what, here's what. 63 00:02:54,948 --> 00:02:55,693 But, but wait. 64 00:02:55,963 --> 00:02:59,168 But before we go on, so I think one of the problems you're gonna find though, is. 65 00:03:00,148 --> 00:03:02,668 Like, you know, like in my conversations when I ask a question, 66 00:03:02,668 --> 00:03:04,588 then a follow up, then another follow up, then another follow up. 67 00:03:04,588 --> 00:03:07,348 It's like I don't always have everything up front, so I think 68 00:03:07,348 --> 00:03:08,728 the document might turn into that. 69 00:03:08,728 --> 00:03:14,698 So you might need to comment and respond or chat live about the co. The questions. 70 00:03:14,728 --> 00:03:16,678 So then we can get to the next level of questions. 71 00:03:17,038 --> 00:03:17,938 Google Meet. 72 00:03:17,998 --> 00:03:18,838 Is that what you want me to 73 00:03:19,138 --> 00:03:22,678 No, I'm just saying use it over the phone call and we'll have to 74 00:03:22,678 --> 00:03:26,218 go over the questions because it might spawn additional questions. 75 00:03:26,968 --> 00:03:27,568 Spawn. 76 00:03:27,598 --> 00:03:28,078 Spawn. 77 00:03:28,078 --> 00:03:28,528 That is that. 78 00:03:29,253 --> 00:03:29,413 a movie. 79 00:03:30,373 --> 00:03:31,453 Did you ever see that spawn? 80 00:03:31,588 --> 00:03:32,398 I did not see the movie. 81 00:03:34,333 --> 00:03:36,733 It was a graphic novel and then turned into a movie. 82 00:03:36,733 --> 00:03:38,683 I literally don't remember anything about the movie other 83 00:03:38,683 --> 00:03:40,963 than that there was a creature. 84 00:03:41,308 --> 00:03:45,148 it's also what they do in video games when like you spawn somewhere, like you come 85 00:03:45,433 --> 00:03:45,733 Yeah. 86 00:03:45,733 --> 00:03:45,913 You 87 00:03:46,123 --> 00:03:46,343 to. 88 00:03:47,383 --> 00:03:47,833 Yeah. 89 00:03:48,193 --> 00:03:48,553 Yeah. 90 00:03:49,273 --> 00:03:52,033 So this week we're gonna talk about something that comes up a 91 00:03:52,033 --> 00:03:53,893 lot, and there are some people. 92 00:03:54,988 --> 00:03:58,108 You know, there's a term that comes up a lot called rogue admin, 93 00:03:58,198 --> 00:04:02,098 which is a sort of a subset of this topic that we're gonna talk about. 94 00:04:02,098 --> 00:04:04,378 And there's some people that think that that's a boogeyman 95 00:04:04,378 --> 00:04:05,578 and that doesn't really exist. 96 00:04:06,808 --> 00:04:08,968 What we're talking about is insider threats. 97 00:04:09,238 --> 00:04:15,568 What, uh, and I think it's something that people should be concerned with. 98 00:04:15,573 --> 00:04:16,468 Do, do you agree? 99 00:04:16,543 --> 00:04:17,743 Oh yeah, a hundred percent. 100 00:04:18,163 --> 00:04:21,343 And I think the big thing with the insider threat, like these 101 00:04:21,343 --> 00:04:25,183 are people you are trusting to do something for your company, right? 102 00:04:25,183 --> 00:04:26,953 You've hired them, right? 103 00:04:26,953 --> 00:04:28,873 They have a job, they have a responsibility. 104 00:04:28,873 --> 00:04:31,963 Maybe they're managing your IT infrastructure or your application, 105 00:04:32,623 --> 00:04:38,623 but at a flip of a switch, they could do something that exposes 106 00:04:38,623 --> 00:04:42,703 your company and could potentially cause it irreparable financial harm. 107 00:04:43,693 --> 00:04:43,903 Yeah. 108 00:04:43,903 --> 00:04:46,333 Either, either accidentally or. 109 00:04:47,563 --> 00:04:51,553 I was about to say on purposely, intentionally, either 110 00:04:51,553 --> 00:04:52,873 accidentally or intentionally. 111 00:04:53,143 --> 00:04:57,313 Yeah, and, and it actually, since you did talk about the accidentally 112 00:04:57,313 --> 00:05:00,883 or intentionally, I think it, one thing that we, before this call you 113 00:05:00,883 --> 00:05:04,723 were talking about is sort of like the three types of insider threats 114 00:05:04,813 --> 00:05:05,143 Yeah, 115 00:05:05,203 --> 00:05:05,653 that exist. 116 00:05:05,653 --> 00:05:06,613 Do you want to kind of go over those? 117 00:05:07,508 --> 00:05:07,798 yeah. 118 00:05:08,168 --> 00:05:10,868 So there are, there are three types of insider threats. 119 00:05:10,868 --> 00:05:17,528 One is like the active, actual person that is, um, actually. 120 00:05:18,368 --> 00:05:21,518 Looking to do harm to your organization. 121 00:05:21,518 --> 00:05:21,878 Right? 122 00:05:22,568 --> 00:05:25,298 then the second is the, 123 00:05:27,458 --> 00:05:32,678 you know, the, the, the careless person or you know, the person that isn't 124 00:05:32,678 --> 00:05:36,578 following policy or isn't concerned about security and they do things that 125 00:05:36,578 --> 00:05:40,928 cre that could create the third type of insider threat, which is technically 126 00:05:40,928 --> 00:05:43,268 not an insider, but it's an insider. 127 00:05:44,043 --> 00:05:45,393 has been compromised 128 00:05:45,568 --> 00:05:45,858 Yeah. 129 00:05:46,203 --> 00:05:48,033 they downloaded the wrong piece of software. 130 00:05:48,243 --> 00:05:53,643 They put their, uh, password on a sticky note, you know, they got on a Zoom call 131 00:05:53,763 --> 00:05:55,503 and the sticky note is in the background. 132 00:05:55,538 --> 00:05:55,828 Yeah. 133 00:05:55,923 --> 00:05:58,353 Um, you know, all, all that sort of stuff. 134 00:05:59,223 --> 00:05:59,823 are sort of the, 135 00:05:59,993 --> 00:06:00,233 Yeah. 136 00:06:00,243 --> 00:06:01,533 types that we'll talk about, 137 00:06:01,733 --> 00:06:02,003 Yeah. 138 00:06:02,093 --> 00:06:05,813 And, and, and just quickly on that too, I know a lot of times when, or 139 00:06:05,813 --> 00:06:09,293 when I mentioned it too, right, it's insider, we normally think about, oh, 140 00:06:09,293 --> 00:06:13,943 it's an employee of the company, but remember it might be a partner, it might 141 00:06:13,943 --> 00:06:16,163 be a service provider you're using. 142 00:06:16,163 --> 00:06:17,723 It might be a contractor. 143 00:06:18,443 --> 00:06:18,743 Right. 144 00:06:18,743 --> 00:06:20,663 It might not even be someone in tech. 145 00:06:20,663 --> 00:06:23,993 I think when most people think about the insider threat, they think about the first 146 00:06:23,993 --> 00:06:26,873 category, which is an actual insider. 147 00:06:26,873 --> 00:06:30,983 And, and it could be an employee, a partner, uh, a contractor, 148 00:06:31,163 --> 00:06:36,473 but someone that you have given access to your company. 149 00:06:36,473 --> 00:06:36,833 Right? 150 00:06:37,188 --> 00:06:41,813 And I do think that, uh, there, there was a, a lecture I, I saw one day. 151 00:06:42,533 --> 00:06:47,273 was actually about the merger of Cray and SGI, 152 00:06:47,333 --> 00:06:47,813 Mm-hmm. 153 00:06:48,263 --> 00:06:52,613 um, and the, the person was the cybersecurity person and he was 154 00:06:52,613 --> 00:06:55,253 describing the cybersecurity. 155 00:06:56,753 --> 00:06:58,523 Um, what would you call it? 156 00:06:59,483 --> 00:07:02,483 The, the mo of each organization. 157 00:07:02,633 --> 00:07:06,323 And he described one and I honestly, to this day, I don't remember which one was, 158 00:07:06,323 --> 00:07:12,893 which one he described as a hard crunchy interior with a soft, gooey exterior. 159 00:07:13,073 --> 00:07:16,523 And the other was a hard crunchy exterior with a soft chewy interior. 160 00:07:16,793 --> 00:07:18,863 And I think most companies are the latter. 161 00:07:19,013 --> 00:07:19,733 They have, 162 00:07:20,438 --> 00:07:21,608 Perimeter defenses. 163 00:07:21,748 --> 00:07:25,318 Perimeter defenses, but once you're inside, that's it. 164 00:07:25,318 --> 00:07:25,618 And all 165 00:07:25,738 --> 00:07:25,958 No. 166 00:07:25,978 --> 00:07:26,248 off. 167 00:07:26,248 --> 00:07:26,578 Right? 168 00:07:26,738 --> 00:07:26,958 So. 169 00:07:27,028 --> 00:07:31,138 can think of one company that I worked with that was the former, 170 00:07:31,528 --> 00:07:34,588 and it was because the type of data that they had was so sensitive. 171 00:07:34,858 --> 00:07:37,888 They were, they were very concerned about insider threats and so. 172 00:07:38,213 --> 00:07:41,543 It wasn't assumed that once you were in, you were okay. 173 00:07:41,813 --> 00:07:45,683 You needed to, you needed specific access to access different 174 00:07:45,683 --> 00:07:47,273 resources, not just from a 175 00:07:49,523 --> 00:07:53,363 you know, and, and, and like that, but also like, like where 176 00:07:53,363 --> 00:07:55,433 you were and what you were doing. 177 00:07:55,793 --> 00:07:57,743 Uh, only then would you, would 178 00:07:57,743 --> 00:08:01,103 Was this, was this the same company that basically did not 179 00:08:01,103 --> 00:08:04,313 let you do backups because backups needed to touch everything in the 180 00:08:04,493 --> 00:08:05,633 environment and they were like, Nope. 181 00:08:06,143 --> 00:08:06,443 Okay. 182 00:08:06,803 --> 00:08:07,133 Yeah. 183 00:08:07,343 --> 00:08:11,393 Well, well, I, I think that's a slight mischaracterization of that company. 184 00:08:11,543 --> 00:08:15,203 There, there was a group that didn't want to give me access to 185 00:08:15,203 --> 00:08:18,713 everything, and, and somebody had to like, Hey, hey, hey, Curtis is 186 00:08:18,713 --> 00:08:21,203 doing the thing Leave Curtis alone. 187 00:08:22,288 --> 00:08:24,448 We'll figure it out when the project is done. 188 00:08:24,448 --> 00:08:27,748 Once, once everything has access to everything, then we'll figure 189 00:08:27,748 --> 00:08:29,278 out how to sort of lock it down. 190 00:08:29,418 --> 00:08:29,708 Yeah, 191 00:08:29,818 --> 00:08:32,938 Um, but Curtis has a big enough project enough to do. 192 00:08:32,938 --> 00:08:35,998 I worked on that project 95 hours a week 193 00:08:36,623 --> 00:08:36,683 yeah. 194 00:08:37,228 --> 00:08:38,188 close to a year. 195 00:08:38,498 --> 00:08:38,788 Yeah. 196 00:08:39,478 --> 00:08:45,058 and so I, and it was so difficult that it was actually local here, 197 00:08:45,148 --> 00:08:47,488 uh, but it was like 45 minutes away. 198 00:08:48,328 --> 00:08:50,638 company got me a corporate apartment nearby. 199 00:08:50,993 --> 00:08:53,393 Um, so that I could get four hours 200 00:08:53,423 --> 00:08:53,903 I'm asleep. 201 00:08:54,863 --> 00:08:55,403 Um, 202 00:08:55,913 --> 00:08:56,273 So 203 00:08:56,333 --> 00:08:56,753 yeah. 204 00:08:56,933 --> 00:09:00,473 on this topic though, right, of the sort of the malicious insider. 205 00:09:01,208 --> 00:09:01,658 Right. 206 00:09:02,348 --> 00:09:09,158 Um, one, I don't know if you remember this case Curtis, but there was the 207 00:09:09,158 --> 00:09:12,668 scenario, actually there are two that I'm thinking of and I don't know 208 00:09:12,668 --> 00:09:13,778 if one of 'em kind of bleeds over. 209 00:09:13,778 --> 00:09:16,928 There's, remember there was a company called Unify, which 210 00:09:16,928 --> 00:09:17,798 I use their networking gear. 211 00:09:18,683 --> 00:09:19,043 Yeah. 212 00:09:19,283 --> 00:09:24,203 And they're a publicly listed networking company, and they had a whistleblower 213 00:09:24,203 --> 00:09:29,603 who came up and said, Hey, by the way, this company got attacked and 214 00:09:29,603 --> 00:09:31,373 all these credentials got leaked. 215 00:09:31,793 --> 00:09:35,993 And it turns out he was actually an employee who had stolen the 216 00:09:35,993 --> 00:09:38,723 credentials of the company and had faked the entire attack. 217 00:09:39,698 --> 00:09:41,483 Yes, I do remember that story. 218 00:09:41,483 --> 00:09:41,993 Yeah. 219 00:09:42,233 --> 00:09:42,653 right. 220 00:09:43,088 --> 00:09:47,258 And the only way they were able to prove it was him was because they went and they 221 00:09:47,258 --> 00:09:52,448 looked back at all the data and they were like, yeah, this is actually his data. 222 00:09:52,448 --> 00:09:56,678 And I think he had set up like VPNs to download the data and turns out that, 223 00:09:56,783 --> 00:09:56,903 And 224 00:09:57,158 --> 00:09:57,338 uh, 225 00:09:57,413 --> 00:10:01,913 yeah, they, they correlated like his VPN login to the attack 226 00:10:02,138 --> 00:10:02,588 yeah. 227 00:10:02,663 --> 00:10:02,903 of that. 228 00:10:02,903 --> 00:10:03,803 I do, I do remember 229 00:10:03,848 --> 00:10:04,148 Yeah. 230 00:10:04,373 --> 00:10:04,673 Yeah. 231 00:10:05,033 --> 00:10:08,063 And that is a true, like, number one insider threat. 232 00:10:08,258 --> 00:10:08,528 Yeah. 233 00:10:08,663 --> 00:10:10,163 I think of another. 234 00:10:10,943 --> 00:10:15,233 Probably the most, the most infamous one that I can think of, and I 235 00:10:15,233 --> 00:10:18,023 believe the name was Roger Durio. 236 00:10:18,233 --> 00:10:20,453 Uh, I I, I, I 237 00:10:20,648 --> 00:10:21,473 FBI Agent. 238 00:10:21,713 --> 00:10:21,923 wrong. 239 00:10:22,583 --> 00:10:23,873 No, no. 240 00:10:23,903 --> 00:10:28,013 He was, he was a guy that he didn't like his bonus or he got 241 00:10:28,013 --> 00:10:29,423 let go or something like that. 242 00:10:29,648 --> 00:10:32,738 And so he, to find the story, you Googled logic 243 00:10:32,943 --> 00:10:33,293 Agent. 244 00:10:33,353 --> 00:10:33,573 Oh. 245 00:10:33,848 --> 00:10:34,478 that they used. 246 00:10:34,958 --> 00:10:39,278 He, he basically set off a logic bomb is what they called it, which basically 247 00:10:39,278 --> 00:10:44,528 deleted everything, And, which included like, you know, some of the backups and 248 00:10:44,633 --> 00:10:45,053 Oh, 249 00:10:45,248 --> 00:10:45,548 And, uh. 250 00:10:45,563 --> 00:10:49,313 like, if like his access or his username didn't exist or something like that. 251 00:10:49,313 --> 00:10:49,763 Right. 252 00:10:49,793 --> 00:10:50,303 Yeah. 253 00:10:50,423 --> 00:10:50,723 Yeah. 254 00:10:50,903 --> 00:10:52,133 it just blew up the whole place. 255 00:10:52,178 --> 00:10:52,468 Yeah. 256 00:10:52,553 --> 00:10:54,773 was the first really big one that I remember. 257 00:10:54,773 --> 00:10:56,873 He was caught, he was prosecuted. 258 00:10:57,233 --> 00:11:00,863 Um, but I, I think a lot of these are not caught. 259 00:11:00,893 --> 00:11:02,063 They're not prosecuted. 260 00:11:02,093 --> 00:11:02,153 Yeah. 261 00:11:02,453 --> 00:11:09,383 And when we think about this type of insider threat, like some people 262 00:11:09,388 --> 00:11:12,268 might just throw their hands up and go, well, what am I supposed to do? 263 00:11:13,673 --> 00:11:14,633 They're inside. 264 00:11:14,633 --> 00:11:19,298 What, what can somebody do to, to stop this type of insider threat? 265 00:11:19,643 --> 00:11:21,773 And this is like a lot of what we talk about, right? 266 00:11:21,773 --> 00:11:25,913 It's like, okay, do you at least have the logging and monitoring in place 267 00:11:25,913 --> 00:11:27,503 to be able to capture some of these? 268 00:11:27,503 --> 00:11:32,453 And are you using, uh, proactive security tools to actually flag for anomalies? 269 00:11:32,453 --> 00:11:36,413 Like, Hey, this person is accessing resources, they normally don't, or this 270 00:11:36,413 --> 00:11:38,573 person is downloading 20 gig files. 271 00:11:38,573 --> 00:11:39,413 Is that normal? 272 00:11:40,868 --> 00:11:42,158 From a security perspective. 273 00:11:42,158 --> 00:11:42,428 Right. 274 00:11:42,428 --> 00:11:44,768 And then I think from a backup perspective, I'm sure you 275 00:11:44,768 --> 00:11:45,968 have some ideas around this 276 00:11:46,673 --> 00:11:48,983 Well, I was gonna add to the security perspective. 277 00:11:48,983 --> 00:11:54,823 This is why we talk about the concept of leased privilege, because the idea 278 00:11:54,823 --> 00:11:58,573 is just give the person, each person. 279 00:11:58,683 --> 00:12:01,983 The power that they need to do their job, but only their job. 280 00:12:02,823 --> 00:12:08,913 it, it's probably the hardest part about proactive cybersecurity, right? 281 00:12:09,213 --> 00:12:15,693 Because it's so much easier to just give like you and me all power. 282 00:12:15,753 --> 00:12:16,203 Right? 283 00:12:16,233 --> 00:12:17,913 Uh, you, you've got root everywhere. 284 00:12:17,973 --> 00:12:18,753 Um, and 285 00:12:21,273 --> 00:12:24,243 I, another, another good story, and this is another local 286 00:12:24,243 --> 00:12:28,143 company, happens to be a clothing. 287 00:12:30,148 --> 00:12:34,948 Uh, company and I remember being sent there to install. 288 00:12:36,058 --> 00:12:37,528 I'm pretty sure it was NetBackup. 289 00:12:37,528 --> 00:12:43,138 I was there to install NetBackup and the guy walks in and he goes, he's like 290 00:12:43,738 --> 00:12:46,138 the password for all of those servers. 291 00:12:46,138 --> 00:12:47,128 It's Elvis. 292 00:12:47,188 --> 00:12:49,948 And the password for all these servers is Apollo. 293 00:12:50,923 --> 00:12:51,883 See you later. 294 00:12:51,973 --> 00:12:53,053 And he just left. 295 00:12:53,893 --> 00:12:54,163 Right. 296 00:12:54,223 --> 00:12:55,543 It was the root password right. 297 00:12:55,543 --> 00:12:56,203 That he was giving me. 298 00:12:57,313 --> 00:13:00,673 And then I'm, and so, and, and he just handed me the keys to 299 00:13:00,673 --> 00:13:02,593 the kingdom with no monitoring. 300 00:13:02,593 --> 00:13:02,743 No. 301 00:13:02,743 --> 00:13:05,593 And I'm lugging in directly as root because I'm at the 302 00:13:05,593 --> 00:13:07,153 console, so I can do that. 303 00:13:08,383 --> 00:13:10,543 and then at some point some other guy walked in and was. 304 00:13:11,668 --> 00:13:12,148 Who are you? 305 00:13:12,628 --> 00:13:16,738 Like he sees me sitting there at the server with a root prompt. 306 00:13:17,488 --> 00:13:18,178 like, who are you? 307 00:13:18,178 --> 00:13:20,038 I'm like, I'm the guy doing the thing. 308 00:13:20,278 --> 00:13:22,288 He's like, is nobody watching you? 309 00:13:22,528 --> 00:13:23,428 Is nobody, what are you? 310 00:13:24,178 --> 00:13:26,668 he like, ran out and it was like a whole thing. 311 00:13:27,118 --> 00:13:28,228 But, um, yeah. 312 00:13:28,228 --> 00:13:29,008 So that, that's. 313 00:13:30,058 --> 00:13:31,438 That's, that's what not to 314 00:13:31,698 --> 00:13:31,988 Yeah. 315 00:13:32,128 --> 00:13:34,528 the way, that's another thing that's important to do with the, with the 316 00:13:34,528 --> 00:13:35,998 concept of least privilege, right? 317 00:13:36,178 --> 00:13:39,508 Is you, you never log in as root as administrator. 318 00:13:39,508 --> 00:13:43,198 You log in and you become that and that way, and you establish, you 319 00:13:43,198 --> 00:13:46,168 can establish that both through policy and through technology. 320 00:13:46,168 --> 00:13:50,008 You can say it's just sometimes it's difficult to, to completely 321 00:13:50,098 --> 00:13:54,448 eliminate it, but you can say it's, you can only log in as root or 322 00:13:54,448 --> 00:13:56,548 administrator on the console, for 323 00:13:56,593 --> 00:13:56,863 Yeah. 324 00:13:57,328 --> 00:13:57,838 Um. 325 00:13:58,783 --> 00:14:01,933 You should never be logging in as root or administrator, uh, you 326 00:14:01,933 --> 00:14:05,203 know, directly you should be, uh, you know, suing to it or pseudo. 327 00:14:05,413 --> 00:14:08,713 And even then, you should be like, especially in Lennox and 328 00:14:08,713 --> 00:14:12,733 Unix, you should be using pseudo whenever possible to do the thing. 329 00:14:12,973 --> 00:14:13,303 Yeah. 330 00:14:13,453 --> 00:14:15,013 run pseudo sh 331 00:14:15,433 --> 00:14:16,783 Yep, exactly. 332 00:14:16,873 --> 00:14:19,153 prompt and then you do the thing and then you get out. 333 00:14:19,153 --> 00:14:22,813 You should, the best practice would be to, again, you can establish this through. 334 00:14:23,308 --> 00:14:28,048 Policy, as you can say, when you're doing things that require root, do this. 335 00:14:28,163 --> 00:14:28,453 Yeah. 336 00:14:28,708 --> 00:14:33,928 Um, and, and, and you should try to limit the number of things that require root, 337 00:14:34,073 --> 00:14:34,363 Yeah, 338 00:14:34,888 --> 00:14:36,148 Um, yeah. 339 00:14:36,388 --> 00:14:41,878 so one thing to also mention, I know with this topic we're discussing mainly around 340 00:14:41,878 --> 00:14:46,468 like people accessing infrastructure, deleting infrastructure, but as part 341 00:14:46,468 --> 00:14:49,618 of insider threat, you also have to think about people exfiltrating data. 342 00:14:51,058 --> 00:14:51,508 Yes, 343 00:14:51,778 --> 00:14:52,918 And that's one thing. 344 00:14:52,918 --> 00:15:00,388 So I think just earlier this week, uh, I read an article where Apple was suing a 345 00:15:00,448 --> 00:15:06,688 former employee who had worked on Division Pro classes and had left and joined Snap 346 00:15:07,678 --> 00:15:08,098 mm. 347 00:15:08,308 --> 00:15:10,768 and basically before he had left. 348 00:15:11,518 --> 00:15:13,858 Sorry, I just, I just came to me. 349 00:15:14,053 --> 00:15:16,513 Either Snap or Metas glasses. 350 00:15:16,513 --> 00:15:18,493 I don't know, one of those similar sort of companies. 351 00:15:18,613 --> 00:15:21,823 And before he left, he basically didn't say where he's going. 352 00:15:21,823 --> 00:15:25,543 He gave two weeks notice and then he started downloading a bunch of documents 353 00:15:25,543 --> 00:15:28,453 onto USB drives and walking out with it. 354 00:15:28,453 --> 00:15:32,203 And so Apple sued to basically say, you stole our ip. 355 00:15:32,203 --> 00:15:33,223 Which is critical, right? 356 00:15:33,223 --> 00:15:34,693 When you're trying to be competitive, 357 00:15:34,843 --> 00:15:35,263 yeah, 358 00:15:35,503 --> 00:15:35,653 right? 359 00:15:35,833 --> 00:15:39,433 And so that's another thing to also think about from, uh, insider threat, 360 00:15:39,433 --> 00:15:40,783 is it's also the exfiltration. 361 00:15:41,248 --> 00:15:41,608 Yeah. 362 00:15:41,698 --> 00:15:41,998 Yeah. 363 00:15:42,448 --> 00:15:44,188 And again, that's why you monitor things. 364 00:15:44,188 --> 00:15:46,618 That's why you, you know, and, and when you have something like 365 00:15:46,618 --> 00:15:51,748 that where you have an employee or contractor that leaves, uh, you 366 00:15:51,748 --> 00:15:53,488 should have an offboarding process. 367 00:15:53,488 --> 00:15:57,838 That includes looking at their accounts, looking at their hardware that they 368 00:15:57,838 --> 00:16:00,178 have, uh, and then doing forensic. 369 00:16:00,388 --> 00:16:05,158 Uh, especially anybody that you think that you in any way suspect, right? 370 00:16:05,268 --> 00:16:05,558 Yeah. 371 00:16:05,578 --> 00:16:06,793 pharyngeal, pharyngeal. 372 00:16:08,008 --> 00:16:13,258 We could do digital forensics against that laptop or any other device. 373 00:16:13,408 --> 00:16:16,888 And you, you, you would be amazed at the kinds of things that you 374 00:16:16,888 --> 00:16:20,878 can uncover by having a, you know, a, a, a digital forensics, uh, 375 00:16:20,983 --> 00:16:21,193 Yeah, 376 00:16:21,418 --> 00:16:21,988 process. 377 00:16:22,063 --> 00:16:24,973 and it, but it was interesting though because I was reading the article 378 00:16:24,973 --> 00:16:29,803 and they were saying whatever the guy did, and whatever Apple's policies 379 00:16:29,803 --> 00:16:33,763 are, they're like, we couldn't fully determine what he actually stole 380 00:16:34,798 --> 00:16:35,218 Yeah. 381 00:16:35,953 --> 00:16:38,263 because he had sort of covered his tracks. 382 00:16:39,193 --> 00:16:39,553 Yeah. 383 00:16:40,633 --> 00:16:45,433 from a backup perspective, really it's, the big thing is, is, is applying to, 384 00:16:45,433 --> 00:16:46,843 you know, two things come to mind. 385 00:16:46,843 --> 00:16:50,623 One is applying the concept of least privilege to the backups. 386 00:16:50,863 --> 00:16:54,223 And, and, and I think we, I think we talked about this in the past. 387 00:16:54,223 --> 00:16:56,143 We, we could have a whole other, we should have a whole other 388 00:16:56,173 --> 00:16:57,883 episode about how to do that. 389 00:16:58,363 --> 00:17:01,933 Um, and, and then the other thing that comes to mind is, again. 390 00:17:02,623 --> 00:17:06,943 Immutable, immutable, immutable, immutable that no matter how much power someone has, 391 00:17:06,943 --> 00:17:09,073 they shouldn't be able to prematurely. 392 00:17:12,028 --> 00:17:13,783 You're struggling with words today, Curtis? 393 00:17:14,443 --> 00:17:17,083 They shouldn't be able to prematurely. 394 00:17:17,113 --> 00:17:17,653 That's weird. 395 00:17:17,653 --> 00:17:19,933 I don't know why that's so, it's a struggle today. 396 00:17:20,323 --> 00:17:27,763 Delete backups prior to their, uh, expiration date um, um. 397 00:17:28,918 --> 00:17:32,818 And so that's what, that's where true immutability comes into play. 398 00:17:33,508 --> 00:17:35,158 Um, so let's talk about the, 399 00:17:35,198 --> 00:17:38,938 you, you forgot you, you forgot one, which I'm quite surprised. 400 00:17:39,808 --> 00:17:40,888 what the 3, 2, 1 rule. 401 00:17:41,338 --> 00:17:41,558 No. 402 00:17:42,028 --> 00:17:42,388 Oh, 403 00:17:43,238 --> 00:17:43,768 Four eyes. 404 00:17:45,043 --> 00:17:45,643 Oh yeah. 405 00:17:45,643 --> 00:17:45,823 The, 406 00:17:46,208 --> 00:17:46,498 Yeah. 407 00:17:46,573 --> 00:17:49,123 well, that falls under the, basically the whole lease privilege thing. 408 00:17:49,123 --> 00:17:50,023 But, but yeah. 409 00:17:50,023 --> 00:17:53,683 Another thing you could do with backups is the, the, this thing called four eyes 410 00:17:53,953 --> 00:17:57,253 or, uh, MPA multi person authentication. 411 00:17:57,643 --> 00:18:01,843 And that's where if you're doing these things, which are dangerous 412 00:18:01,843 --> 00:18:06,283 things like reducing the retention on backups, deleting policy configurations. 413 00:18:07,668 --> 00:18:09,738 maybe prematurely expiring backups. 414 00:18:09,828 --> 00:18:10,158 Right? 415 00:18:10,458 --> 00:18:11,178 Whatever it is. 416 00:18:11,178 --> 00:18:15,078 If you're doing any of these things, it requires a second person authentication, 417 00:18:15,498 --> 00:18:17,958 um, and often referred to as for eyes. 418 00:18:17,988 --> 00:18:18,198 Yep. 419 00:18:18,618 --> 00:18:18,908 Yeah. 420 00:18:19,308 --> 00:18:19,728 Good point. 421 00:18:20,988 --> 00:18:23,868 So let's talk about the, let's talk about the second person. 422 00:18:24,168 --> 00:18:26,088 And this, this is the, 423 00:18:26,548 --> 00:18:27,088 Second or, 424 00:18:28,248 --> 00:18:30,168 the second type of insider 425 00:18:30,328 --> 00:18:30,628 Thank you. 426 00:18:30,678 --> 00:18:33,108 which is this, this, um. 427 00:18:33,733 --> 00:18:39,403 Um, lackadaisical, lazy, a person who just doesn't care. 428 00:18:39,493 --> 00:18:42,343 Or maybe let's just face it, maybe they're just dumb. 429 00:18:42,583 --> 00:18:45,133 Maybe they just, they shouldn't be in it. 430 00:18:46,123 --> 00:18:51,643 Um, or that they shouldn't have privileges that can do damage. 431 00:18:51,673 --> 00:18:52,033 Right. 432 00:18:52,093 --> 00:18:56,623 And we've talked about, this is where the thing that comes to 433 00:18:56,623 --> 00:18:58,938 mind here is like, know before. 434 00:18:59,553 --> 00:18:59,973 Mm-hmm. 435 00:19:00,253 --> 00:19:06,283 The, this idea of, of a company that you use test the cyber 436 00:19:06,283 --> 00:19:09,253 intelligence of your team. 437 00:19:09,433 --> 00:19:09,853 Right. 438 00:19:10,183 --> 00:19:11,563 And, and I'm a big fan of that. 439 00:19:11,563 --> 00:19:15,283 I, I don't wanna necessarily endorse know before, I don't, I'm sure they 440 00:19:15,283 --> 00:19:18,103 have competitors, but they're, they're, they're, they're the ones that I, 441 00:19:18,103 --> 00:19:21,943 that, that I know of, the, the most, we used them, uh, at a previous employer. 442 00:19:22,513 --> 00:19:26,448 And, um, I do want to make the point. 443 00:19:27,163 --> 00:19:37,243 Though that if you identify someone who, um, is not doing the right things, it's 444 00:19:37,243 --> 00:19:38,708 not about publicly shaming that person. 445 00:19:39,673 --> 00:19:40,093 Right. 446 00:19:40,573 --> 00:19:45,103 It's about, um, identifying the weakness doing education. 447 00:19:45,523 --> 00:19:49,393 Now, if you identify the weakness, you do the education and then 448 00:19:49,693 --> 00:19:51,103 nothing sticks. 449 00:19:52,633 --> 00:19:57,133 Um, at some point you, I don't think you should be considering 450 00:19:58,123 --> 00:20:00,913 punitive things, right? 451 00:20:02,383 --> 00:20:08,383 Having said that, at some point, if a person repeatedly drinks acid. 452 00:20:09,448 --> 00:20:14,038 Perhaps they shouldn't be in the department that produces acid. 453 00:20:14,293 --> 00:20:14,575 Yeah, 454 00:20:14,612 --> 00:20:16,142 it's like the risk profile, right? 455 00:20:16,487 --> 00:20:16,817 Yeah. 456 00:20:16,817 --> 00:20:17,747 The risk profile. 457 00:20:17,752 --> 00:20:21,647 If, if they're, if they're, if they continue to show being a high risk person, 458 00:20:22,097 --> 00:20:30,167 which is what things like no before do, um, then perhaps it's, it's time to 459 00:20:30,167 --> 00:20:34,307 move them to a less secure, uh, role. 460 00:20:34,667 --> 00:20:37,157 Yeah, I agree with that and I think. 461 00:20:38,402 --> 00:20:42,482 That's something that's probably easy for many companies to 462 00:20:42,482 --> 00:20:44,642 onboard, like most companies have. 463 00:20:44,642 --> 00:20:48,302 Like, Hey, here's your standard cybersecurity policy training. 464 00:20:48,302 --> 00:20:53,132 You should be doing this like once a year and refresh based basically once a year. 465 00:20:53,822 --> 00:20:54,032 Right. 466 00:20:54,032 --> 00:20:56,312 That way everyone sort of has like a bare minimum, 467 00:20:56,972 --> 00:20:57,422 Yeah. 468 00:20:57,482 --> 00:20:57,872 right? 469 00:20:58,382 --> 00:20:58,892 Because 470 00:20:58,952 --> 00:21:01,772 do believe in, I believe in very frequent. 471 00:21:02,072 --> 00:21:02,372 Yeah. 472 00:21:02,577 --> 00:21:02,867 Yeah. 473 00:21:02,897 --> 00:21:06,377 Rather than one giant training once a year, I believe in like monthly or 474 00:21:06,377 --> 00:21:08,327 quarterly, smaller amounts of training. 475 00:21:08,687 --> 00:21:13,727 Because what you're really trying to do is you're really trying to keep it forefront, 476 00:21:13,982 --> 00:21:14,252 Yeah. 477 00:21:14,447 --> 00:21:17,687 to keep that in mind of like, listen, you have power, you 478 00:21:17,687 --> 00:21:19,097 have abilities to do things. 479 00:21:19,097 --> 00:21:23,327 We're not concerned so much about you, but about someone who might become you. 480 00:21:23,462 --> 00:21:23,762 Yeah. 481 00:21:23,927 --> 00:21:25,337 Um, and do bad things, 482 00:21:25,577 --> 00:21:28,757 And also the testing, like I like with no before, right? 483 00:21:28,757 --> 00:21:30,857 It sends out fake emails. 484 00:21:31,307 --> 00:21:31,727 Yeah. 485 00:21:31,727 --> 00:21:34,757 That gets you to try to click and try to phish users and then they're 486 00:21:34,757 --> 00:21:36,257 like, Hey, you did something wrong. 487 00:21:36,557 --> 00:21:38,867 Let's go do some additional training to help you understand 488 00:21:39,167 --> 00:21:40,097 what you should be doing. 489 00:21:40,697 --> 00:21:40,997 Yeah. 490 00:21:40,997 --> 00:21:47,807 And I do believe in some type of reward to people who identify the 491 00:21:47,807 --> 00:21:50,897 fake emails and then, uh, report them. 492 00:21:51,257 --> 00:21:51,557 Yeah. 493 00:21:51,557 --> 00:21:52,007 Right. 494 00:21:52,277 --> 00:21:56,237 Um, I, I, I, I'm a much bigger fan of the carrot over the stick, 495 00:21:56,387 --> 00:21:56,687 Yeah. 496 00:21:57,017 --> 00:22:00,857 Um, and I think I do, I do remember this was somebody that 497 00:22:01,187 --> 00:22:03,917 came on the pod where they, um. 498 00:22:04,877 --> 00:22:06,737 They said that the company had sent out 499 00:22:06,887 --> 00:22:07,457 Flowers 500 00:22:07,847 --> 00:22:09,257 that it, the flowers, yeah. 501 00:22:09,257 --> 00:22:09,647 On's 502 00:22:10,397 --> 00:22:14,837 on Valentine's Day that the flowers were delivered or at the front desk 503 00:22:14,987 --> 00:22:15,317 Click 504 00:22:15,347 --> 00:22:16,097 the person? 505 00:22:16,817 --> 00:22:17,117 Yeah. 506 00:22:17,447 --> 00:22:19,817 And then I think they had said that. 507 00:22:20,747 --> 00:22:24,287 I think it was a woman who received flowers and she like blew it off 508 00:22:24,287 --> 00:22:27,347 because she's like, my husband won't send me flowers or something like that. 509 00:22:27,347 --> 00:22:27,647 Right? 510 00:22:27,947 --> 00:22:28,397 Yeah. 511 00:22:28,517 --> 00:22:31,667 Oh, it, it was the person was a cyber person 512 00:22:32,147 --> 00:22:32,148 yeah, 513 00:22:32,327 --> 00:22:34,907 the, the hus, the wife was somewhat knowledgeable 514 00:22:34,937 --> 00:22:34,938 yeah. 515 00:22:34,967 --> 00:22:37,697 cyber stuff, and she's like, my husband would never send me flowers. 516 00:22:38,687 --> 00:22:42,377 I remember this, I remember saying that a few minutes. 517 00:22:43,007 --> 00:22:44,477 Everybody thought that they were loved. 518 00:22:44,987 --> 00:22:45,317 Yep. 519 00:22:46,577 --> 00:22:47,897 That, that was a little cruel, I think. 520 00:22:47,897 --> 00:22:51,047 But, but I, but I like this idea of constantly testing it, you know, and 521 00:22:51,047 --> 00:22:56,237 stuff and using the carrot and, and, and, and not to stick, but, um, and so 522 00:22:56,447 --> 00:22:58,697 the, the, the third category is really. 523 00:22:59,117 --> 00:23:02,687 The first category, it's just that, and basically how to respond to 524 00:23:02,687 --> 00:23:04,967 it is, is kind of mostly the same. 525 00:23:05,087 --> 00:23:08,567 And that the third category being you now have an insider 526 00:23:08,567 --> 00:23:10,247 that is, that isn't an insider. 527 00:23:11,057 --> 00:23:15,767 have someone who has used some of the techniques like phishing, uh, social 528 00:23:15,767 --> 00:23:19,967 engineering, uh, by the way, social engineering, my favorite reference. 529 00:23:19,967 --> 00:23:22,847 And so again, go watch sneakers please, if you 530 00:23:23,012 --> 00:23:23,252 Yep. 531 00:23:23,417 --> 00:23:23,837 sneakers. 532 00:23:23,837 --> 00:23:25,607 I love that movie first off. 533 00:23:25,607 --> 00:23:28,217 It's just a good time and it's got so many stars in there. 534 00:23:28,307 --> 00:23:28,597 Yeah. 535 00:23:29,327 --> 00:23:32,297 And although there's some tech that's like, okay, come on. 536 00:23:32,327 --> 00:23:34,667 You know, like the magic box that can unencrypt everything. 537 00:23:34,727 --> 00:23:35,897 Sure, we'll let that go. 538 00:23:35,987 --> 00:23:39,157 But there's the, the scenes that they do there on social engineering. 539 00:23:39,247 --> 00:23:40,387 And I'm thinking about. 540 00:23:40,747 --> 00:23:44,797 Scene with, uh, Robert Redford, where he's got like a, it's supposed to be 541 00:23:44,797 --> 00:23:47,887 like a box of cake and like balloons, and he's supposed to be let in. 542 00:23:48,217 --> 00:23:48,817 Uh, he's like, oh, 543 00:23:48,907 --> 00:23:49,327 Oh, yeah, 544 00:23:49,867 --> 00:23:50,737 yeah, I can't do his thing. 545 00:23:50,857 --> 00:23:51,817 I can't reach my badge. 546 00:23:51,817 --> 00:23:53,017 Can you, can he buzz me in? 547 00:23:53,017 --> 00:23:53,887 And the guy buzzes him 548 00:23:53,982 --> 00:23:54,272 yeah, 549 00:23:54,397 --> 00:23:54,727 right. 550 00:23:55,477 --> 00:23:57,068 doesn't hurt that he looks like Robert Redford, but. 551 00:23:57,367 --> 00:23:57,427 yeah. 552 00:23:58,132 --> 00:24:00,502 But again, remember, I know a guy 553 00:24:00,697 --> 00:24:01,087 Yep. 554 00:24:01,132 --> 00:24:07,252 does physical penetration testing and he said he has never not gotten into a 555 00:24:07,252 --> 00:24:11,212 place, his job is to get into a place that he's not supposed to get into. 556 00:24:11,542 --> 00:24:16,252 Take a photo and then get the hell out before he gets shot, literally. 557 00:24:16,642 --> 00:24:17,062 Okay? 558 00:24:17,482 --> 00:24:19,942 And uh, and he said he is always, he's always gotten in. 559 00:24:20,107 --> 00:24:20,557 Yep. 560 00:24:20,932 --> 00:24:23,392 engineering is an incredibly powerful thing, right? 561 00:24:23,452 --> 00:24:25,852 Uh, people want to be nice, they wanna be helpful, you 562 00:24:25,957 --> 00:24:30,577 Yeah, so there's an article I recently read in the news about 563 00:24:30,937 --> 00:24:32,707 this third type of insider threat. 564 00:24:33,097 --> 00:24:37,627 So Coinbase, uh, I don't know if you know, they had a data breach recently 565 00:24:38,017 --> 00:24:38,437 Mm-hmm. 566 00:24:38,827 --> 00:24:42,037 and it turns, and I don't remember how many tens of thousands 567 00:24:42,037 --> 00:24:43,297 of account data got leaked. 568 00:24:44,347 --> 00:24:50,527 It turns out that what had happened is bad actors had bribed a contracting firm 569 00:24:50,527 --> 00:24:52,927 in India who Coinbase outsources to. 570 00:24:54,427 --> 00:24:59,077 And that Indian contracting firm basically handed over, 571 00:24:59,422 --> 00:24:59,902 Wow. 572 00:25:00,277 --> 00:25:03,277 account information from Coinbase to these bad actors? 573 00:25:04,612 --> 00:25:06,262 So I'm not allowed to make any Indian jokes. 574 00:25:06,262 --> 00:25:06,532 Right. 575 00:25:06,787 --> 00:25:07,027 No, 576 00:25:10,237 --> 00:25:11,377 it doesn't have to be Indian. 577 00:25:11,377 --> 00:25:13,687 It could be any, it could be a contractor anywhere. 578 00:25:13,687 --> 00:25:13,897 Right. 579 00:25:13,897 --> 00:25:17,557 But everyone's always open to a certain value, right. 580 00:25:17,947 --> 00:25:18,277 everyone. 581 00:25:18,277 --> 00:25:19,117 Yeah, everyone 582 00:25:19,357 --> 00:25:19,927 As a price. 583 00:25:20,197 --> 00:25:21,457 everyone has a price. 584 00:25:21,457 --> 00:25:21,517 Yeah. 585 00:25:21,577 --> 00:25:25,867 Um, and, um, the. 586 00:25:26,947 --> 00:25:32,197 I, I do, I do think that, again, not, not against India, but there 587 00:25:32,197 --> 00:25:38,077 are a number of countries, India, Philippines, um, not sure where else 588 00:25:38,077 --> 00:25:43,687 people do this kind of thing, but what's happening is there, there's an economic 589 00:25:43,687 --> 00:25:48,487 disparity between us and this other country, and that's why we're there. 590 00:25:48,547 --> 00:25:48,937 Right. 591 00:25:50,077 --> 00:25:54,577 And I just think you should take that into consideration when you're thinking. 592 00:25:55,327 --> 00:25:59,887 About, again, going back to lease privilege, give them the ability 593 00:25:59,887 --> 00:26:03,487 to do what they need to do, but realize that there is an economic 594 00:26:03,487 --> 00:26:08,767 disparity, which would, I think make them, when I say easier to 595 00:26:08,767 --> 00:26:10,477 bribe, it's not, it's not that they. 596 00:26:11,257 --> 00:26:12,217 they're personally easier 597 00:26:12,397 --> 00:26:12,687 Yeah. 598 00:26:12,787 --> 00:26:17,047 It's the amount of money, like if I offer them a million bucks, that's a lot more. 599 00:26:17,122 --> 00:26:17,422 Yeah. 600 00:26:17,467 --> 00:26:19,627 I, I, I don't even have to offer a million bucks. 601 00:26:19,627 --> 00:26:21,877 I can offer 'em a hundred thousand and it means so much more to 602 00:26:22,117 --> 00:26:22,357 Yeah, 603 00:26:22,447 --> 00:26:24,577 than, um, you know, whatever. 604 00:26:24,637 --> 00:26:25,177 try and do it. 605 00:26:25,267 --> 00:26:25,507 Yeah. 606 00:26:25,567 --> 00:26:27,187 it's something that you should take into account, 607 00:26:27,487 --> 00:26:32,647 Yeah, and this is where I think it's important to vet your contractors, 608 00:26:32,647 --> 00:26:37,897 your third parties, right, even on an ongoing basis to make sure, 609 00:26:37,897 --> 00:26:39,487 do they have policies in place? 610 00:26:39,697 --> 00:26:44,047 Are they also doing the same sort of monitoring and auditing that you do to 611 00:26:44,047 --> 00:26:46,837 be able to catch these sort of things because you are giving them access to your 612 00:26:46,837 --> 00:26:48,997 systems and your customer data, right? 613 00:26:48,997 --> 00:26:49,297 So. 614 00:26:49,807 --> 00:26:56,257 There's also, uh, there's the famous target story as well, um, where Target 615 00:26:56,257 --> 00:27:01,567 was, um, breached because of a device. 616 00:27:02,782 --> 00:27:06,712 That was connected to their air conditioning system. 617 00:27:07,012 --> 00:27:08,452 That's what, that's what I remember. 618 00:27:08,692 --> 00:27:11,452 And, and it basically, it was traced back to poor cybersecurity 619 00:27:11,452 --> 00:27:13,462 practices on the part of 620 00:27:13,672 --> 00:27:16,252 The um, air, the HVAC system. 621 00:27:16,252 --> 00:27:16,522 Yeah. 622 00:27:17,122 --> 00:27:20,572 Um, so you're, you're, you're always, you're only as strong as your weakest 623 00:27:20,572 --> 00:27:21,967 link and your links everywhere. 624 00:27:22,162 --> 00:27:23,842 You're, you're always, you're only as 625 00:27:23,842 --> 00:27:24,772 strong as your weakest link. 626 00:27:26,002 --> 00:27:26,872 One of your links includes 627 00:27:26,872 --> 00:27:27,617 every one of your suppliers. 628 00:27:29,467 --> 00:27:32,467 remember we talked to someone who was doing penetration testing. 629 00:27:32,467 --> 00:27:35,197 They needed to break into a company. 630 00:27:35,197 --> 00:27:38,977 They tried going through their networks, they couldn't get in, and then they 631 00:27:38,977 --> 00:27:43,147 ended up realizing in their lobby they had a TV of a certain brand, so they 632 00:27:43,147 --> 00:27:47,047 went and bought it from the local store, and then they found a vulnerability 633 00:27:47,047 --> 00:27:51,457 on it, and then they basically got into the company through their tv. 634 00:27:51,791 --> 00:27:53,171 yeah, that was Dwayne Lalo. 635 00:27:53,201 --> 00:27:55,451 And that was a great, I, I loved his story. 636 00:27:55,451 --> 00:27:58,331 I loved, uh, we should link to that whole episode here. 637 00:27:59,381 --> 00:28:04,061 That like if you haven't seen or listened to that episode, you really should. 638 00:28:04,151 --> 00:28:07,601 And one of my favorite parts that he go, that he goes into there is 639 00:28:07,601 --> 00:28:11,471 how much he loves the backup system from a red teaming perspective. 640 00:28:11,471 --> 00:28:11,621 Right? 641 00:28:11,621 --> 00:28:15,821 Again, red teaming is the, the sort of proactive. 642 00:28:17,206 --> 00:28:21,886 or proactively attacking a company for the purposes of looking 643 00:28:21,886 --> 00:28:22,996 for vulnerabilities, right. 644 00:28:23,171 --> 00:28:23,561 Yeah. 645 00:28:23,806 --> 00:28:25,696 opposed to the blue team, which is the defense team, 646 00:28:25,931 --> 00:28:26,201 Yep. 647 00:28:26,266 --> 00:28:28,606 uh, which is our, our friend Mike Saylor. 648 00:28:28,901 --> 00:28:29,171 Yep. 649 00:28:29,896 --> 00:28:33,496 So, um, yeah, we need to have Dwayne back on. 650 00:28:33,526 --> 00:28:34,816 I'm sure he is, got more stories, 651 00:28:34,871 --> 00:28:35,381 Oh yeah. 652 00:28:35,476 --> 00:28:37,216 yeah, so again. 653 00:28:38,231 --> 00:28:42,596 The, the, the second group of the, the, the, you know, the lame people 654 00:28:42,596 --> 00:28:45,956 creates the third group, which essentially becomes the first group, 655 00:28:45,986 --> 00:28:46,206 Yep. 656 00:28:46,316 --> 00:28:46,736 right? 657 00:28:47,096 --> 00:28:50,966 And so this is why, again, going back, this is why that yes, 658 00:28:50,966 --> 00:28:51,956 you need to do all the things. 659 00:28:51,956 --> 00:28:54,086 You need to do the monitoring, but you also need to do. 660 00:28:54,816 --> 00:29:00,456 concept of leach privilege and, uh, just limiting what an individual person can do. 661 00:29:00,606 --> 00:29:00,966 Right. 662 00:29:01,356 --> 00:29:08,856 And, um, you know, the HVAC controller be able to send controls reports of 663 00:29:08,856 --> 00:29:14,046 how cold it is, and that's it, it shouldn't be able to log to a server. 664 00:29:14,251 --> 00:29:14,541 Yeah. 665 00:29:14,736 --> 00:29:17,016 that's a, you know, that's exact exactly the kind of 666 00:29:17,016 --> 00:29:18,006 thing we're talking about here. 667 00:29:18,326 --> 00:29:18,746 Limiting. 668 00:29:18,776 --> 00:29:23,366 And, and you know, our former employer was really good at that with, with, 669 00:29:23,696 --> 00:29:27,686 you know, the cloud design, where it's like the, their S3 buckets could 670 00:29:27,686 --> 00:29:32,096 only be talked to by the systems that, you know, did the backups. 671 00:29:32,096 --> 00:29:32,336 Right? 672 00:29:32,461 --> 00:29:32,661 Yeah. 673 00:29:32,756 --> 00:29:36,956 even though it's S3, and technically you can get to that from anywhere, but 674 00:29:36,956 --> 00:29:41,336 they had configured it so that only their systems could write to it, right? 675 00:29:41,546 --> 00:29:41,786 Yeah. 676 00:29:42,146 --> 00:29:43,586 um, so even if. 677 00:29:43,911 --> 00:29:46,371 The, the, the, uh, what would you call it? 678 00:29:46,371 --> 00:29:50,661 The, the credentials to access that S3 account got compromised. 679 00:29:50,811 --> 00:29:52,971 You wouldn't actually be able to get to them, right. 680 00:29:53,031 --> 00:29:53,601 To get to it. 681 00:29:54,351 --> 00:29:57,081 the kind of thing that we're talking about is locking down as much as you can. 682 00:29:57,081 --> 00:29:58,521 Again, it's so hard, 683 00:29:58,671 --> 00:29:58,891 Yep. 684 00:29:59,391 --> 00:29:59,811 right? 685 00:30:00,141 --> 00:30:04,971 The, the responding to the insider threat is probably the biggest. 686 00:30:06,161 --> 00:30:07,391 Challenge that you have. 687 00:30:07,451 --> 00:30:07,901 Right. 688 00:30:08,081 --> 00:30:10,931 And uh, and I do just want to throw out a couple of stats here. 689 00:30:11,201 --> 00:30:17,921 Uh, there was this, uh, great report from gul I, I don't know how to pronounce that. 690 00:30:17,921 --> 00:30:21,641 G-U-R-U-C-U l.com. 691 00:30:22,061 --> 00:30:25,631 They had their 2024 insider threat, which by the way, it gave us the whole. 692 00:30:26,336 --> 00:30:33,956 Idea to do this episode, and they showed that in 2024, uh, so in 2023, only 40, I'm 693 00:30:33,956 --> 00:30:40,526 sorry, 40% of people companies responding, said that they had no insider uh, attacks. 694 00:30:40,586 --> 00:30:41,006 Right. 695 00:30:41,156 --> 00:30:41,576 Um, 696 00:30:42,011 --> 00:30:42,521 That they knew of. 697 00:30:42,656 --> 00:30:44,246 number that they knew of. 698 00:30:44,276 --> 00:30:44,546 Yeah. 699 00:30:44,996 --> 00:30:47,816 That number in 2024 went down to 17%. 700 00:30:48,971 --> 00:30:49,211 Yeah. 701 00:30:49,466 --> 00:30:52,166 so basically 83%. 702 00:30:52,751 --> 00:30:55,151 Felt that they had had some kind of insider attack. 703 00:30:55,361 --> 00:30:55,571 Yeah. 704 00:30:55,961 --> 00:31:00,341 Um, they also described, uh, that the insider attacks are more 705 00:31:00,341 --> 00:31:01,931 difficult to respond to, right? 706 00:31:01,931 --> 00:31:04,241 They're more costly, they're more, they take more time. 707 00:31:04,601 --> 00:31:10,811 Um, and, um, according to this, uh, another interesting, so basically they 708 00:31:10,811 --> 00:31:16,061 said 45% felt that it took a week or longer to recover from an insider attack. 709 00:31:16,361 --> 00:31:18,491 Uh, I thought that was, um, 710 00:31:19,331 --> 00:31:19,451 you, 711 00:31:19,451 --> 00:31:19,452 know. 712 00:31:20,681 --> 00:31:23,771 They said 55% within one day, and I'm like, really? 713 00:31:23,866 --> 00:31:30,286 so I know on the podcast we talk a lot about natural disasters and ransomware. 714 00:31:30,316 --> 00:31:31,726 And ransomware recovery, right. 715 00:31:33,166 --> 00:31:37,846 Would you say that insider threats are. 716 00:31:38,866 --> 00:31:43,786 Sort of like the next, not necessarily the next wave, but like the things that 717 00:31:43,786 --> 00:31:48,556 are kind of like important, but people aren't necessarily thinking about or 718 00:31:48,556 --> 00:31:53,206 don't have a full plan in place because it's much harder to, like you said, to 719 00:31:53,206 --> 00:31:57,196 protect against, than say like ransomware attacks or other things where there 720 00:31:57,196 --> 00:32:01,846 are like certain best practices that people have and just it hasn't matured 721 00:32:01,846 --> 00:32:03,556 in the insider threat side of things. 722 00:32:04,351 --> 00:32:09,421 Well, I think that there, there's like a Venn diagram between malware 723 00:32:09,421 --> 00:32:11,551 attacks and insider threats. 724 00:32:11,551 --> 00:32:11,851 Right? 725 00:32:11,851 --> 00:32:16,321 And, and, and it's, it's not a circle, but it, there's a, there's a huge, like 80% I 726 00:32:16,521 --> 00:32:16,941 Mm-hmm. 727 00:32:17,641 --> 00:32:18,511 um, what's, what's 728 00:32:18,631 --> 00:32:19,121 Overlap. 729 00:32:20,161 --> 00:32:21,331 and, um. 730 00:32:21,871 --> 00:32:26,851 And a lot of the things that we're doing to be able to detect and respond to 731 00:32:26,851 --> 00:32:31,411 ransomware attacks will also be able to detect and respond to an insider threat. 732 00:32:31,861 --> 00:32:39,661 But I do think that more people need to specifically be doing design, 733 00:32:39,841 --> 00:32:44,611 looking at design considerations that would help mitigate. 734 00:32:46,216 --> 00:32:48,321 Specifically a rant, uh, an insider attack. 735 00:32:48,406 --> 00:32:48,706 Right? 736 00:32:49,176 --> 00:32:54,216 So much of this, so much of everything in the cyber world, it's like, 737 00:32:54,216 --> 00:32:55,626 it's, well, it's just like backups. 738 00:32:56,076 --> 00:32:58,836 Backups are no good if you didn't make 'em before you need 'em, right? 739 00:32:59,016 --> 00:33:01,656 Cyber defense is no good unless you do it before you need it. 740 00:33:01,656 --> 00:33:01,956 Yeah. 741 00:33:01,956 --> 00:33:06,936 if you do this beforehand, it makes the attack much less likely, and it 742 00:33:06,936 --> 00:33:09,786 also makes the attack less damaging. 743 00:33:09,786 --> 00:33:10,026 You, 744 00:33:10,116 --> 00:33:10,386 Yeah. 745 00:33:10,416 --> 00:33:11,916 you minimize the. 746 00:33:13,086 --> 00:33:13,981 Um, uh, the, 747 00:33:14,046 --> 00:33:14,796 Last radius. 748 00:33:15,251 --> 00:33:15,541 Yeah, 749 00:33:15,906 --> 00:33:19,146 I was also thinking some of the conversations we'd had with Mike, right? 750 00:33:19,146 --> 00:33:22,986 It's like maybe you should be considering insider threat as part of 751 00:33:22,986 --> 00:33:27,936 your tabletop exercises and walking through that as, and not just focused 752 00:33:27,936 --> 00:33:31,266 on sort of like the ransomware side of things or other things like that. 753 00:33:32,286 --> 00:33:33,006 absolutely. 754 00:33:33,846 --> 00:33:34,776 Insider threat. 755 00:33:34,806 --> 00:33:35,436 The, 756 00:33:36,121 --> 00:33:36,241 I 757 00:33:36,726 --> 00:33:37,086 no, no. 758 00:33:37,806 --> 00:33:38,106 was gonna 759 00:33:38,136 --> 00:33:39,216 the silent killer. 760 00:33:41,886 --> 00:33:42,816 Silent but deadly. 761 00:33:42,816 --> 00:33:43,026 Wait, 762 00:33:43,086 --> 00:33:43,326 Yeah. 763 00:33:43,446 --> 00:33:43,776 else. 764 00:33:44,406 --> 00:33:51,396 Um, no, I, I definitely think more, given that a significant portion 765 00:33:51,396 --> 00:33:55,266 of, of cyber attacks are from an insider threat, I believe that that 766 00:33:55,266 --> 00:33:57,816 particular report gave 83% as a stat. 767 00:33:58,866 --> 00:34:02,826 It, it's, it's, I, I don't think enough attention is paid 768 00:34:03,066 --> 00:34:04,641 to the insider threat concern. 769 00:34:05,016 --> 00:34:05,286 Yep. 770 00:34:05,706 --> 00:34:07,866 And just going back to sort of that Apple example, right. 771 00:34:08,346 --> 00:34:12,726 There is intellectual property claims which might be worth billions of 772 00:34:12,726 --> 00:34:15,031 dollars at that are at stake, right? 773 00:34:15,131 --> 00:34:17,031 If you don't handle the insider threat, 774 00:34:17,946 --> 00:34:22,916 Yeah, by the way, another movie that really gets into the concept of an 775 00:34:22,916 --> 00:34:28,136 insider threat in social engineering is a somewhat maligned movie called Takedown 776 00:34:28,136 --> 00:34:31,256 From 2000, it started Skeet Ulrich. 777 00:34:31,286 --> 00:34:35,816 And it's the, it's the somewhat fictionalized story of Kevin Mitnick who 778 00:34:36,116 --> 00:34:38,036 is, uh, you know, he was a black hat. 779 00:34:38,636 --> 00:34:42,746 You know what we used to call a, you know, a black hat hacker that, um, that 780 00:34:42,926 --> 00:34:45,296 got was, he was num, FBI's most wanted 781 00:34:45,381 --> 00:34:45,461 Hmm. 782 00:34:45,746 --> 00:34:49,286 He got prosecuted and he turned, he turned good guy towards the end. 783 00:34:49,706 --> 00:34:54,176 Um, he, he, he's, I should mention not everybody in the 784 00:34:54,176 --> 00:34:55,826 cyber world was a fan of Kevin. 785 00:34:55,826 --> 00:35:01,046 He, he's no longer with us, but I, I, he had some issues with like, allegedly like 786 00:35:01,046 --> 00:35:02,276 taking credit for other people's work, 787 00:35:02,396 --> 00:35:02,636 Yeah. 788 00:35:02,786 --> 00:35:03,116 But. 789 00:35:04,181 --> 00:35:06,851 The, it's another movie that you can watch and get some stuff. 790 00:35:06,851 --> 00:35:12,431 And one of the things that I happen in there, by the way, the, the, um, the, 791 00:35:12,431 --> 00:35:14,411 the real thing happened against Deck, 792 00:35:14,696 --> 00:35:15,206 Hmm. 793 00:35:15,581 --> 00:35:16,841 Um, digital Equipment 794 00:35:16,851 --> 00:35:17,141 Yeah. 795 00:35:18,071 --> 00:35:21,971 And in the movie, I believe they refer to them as Binary Equipment Corporation 796 00:35:24,581 --> 00:35:27,461 is sort of like in, uh, what's the movie? 797 00:35:27,521 --> 00:35:28,481 What's the show? 798 00:35:28,886 --> 00:35:29,546 Best robot. 799 00:35:30,236 --> 00:35:30,776 Evil core. 800 00:35:31,016 --> 00:35:32,396 Robot, they talk about, 801 00:35:32,996 --> 00:35:33,476 Evil core. 802 00:35:33,476 --> 00:35:33,506 I. 803 00:35:33,536 --> 00:35:35,636 They call it Steel Mountain instead 804 00:35:35,651 --> 00:35:36,101 Oh yeah. 805 00:35:36,311 --> 00:35:36,551 Yep. 806 00:35:36,551 --> 00:35:37,391 Steel Mountain. 807 00:35:37,556 --> 00:35:37,916 Mountain. 808 00:35:38,021 --> 00:35:38,411 Yep. 809 00:35:38,576 --> 00:35:42,956 Um, yeah, so, so one of the things is, one of the things that he did was 810 00:35:45,026 --> 00:35:45,146 um. 811 00:35:46,406 --> 00:35:50,366 He called in to a person and said, Hey, uh, you do you guys 812 00:35:50,366 --> 00:35:53,516 have the, the patch of, has the guy been by to put on the patch? 813 00:35:53,966 --> 00:35:54,536 And they're like, no. 814 00:35:54,536 --> 00:35:56,336 And he goes, oh man, that it's really important. 815 00:35:56,336 --> 00:35:57,026 We gotta put in this patch. 816 00:35:57,026 --> 00:35:58,316 I'm gonna send my guy right away. 817 00:35:58,496 --> 00:36:02,156 And he sends this guy, his guy is there not to put in a patch, 818 00:36:02,156 --> 00:36:03,836 but to put in the malware, right? 819 00:36:04,076 --> 00:36:06,781 So it was like a, it was like a two-tiered social engineering attack. 820 00:36:07,871 --> 00:36:11,921 And, um, and then, you know, and then basically his right hand man gets in 821 00:36:11,921 --> 00:36:15,281 there and puts in the back door that they then use to attack the company. 822 00:36:15,971 --> 00:36:18,491 Uh, you know, this is the problem. 823 00:36:18,491 --> 00:36:20,141 You know, we gotta get rid of all the people, dude. 824 00:36:20,231 --> 00:36:20,861 It's ai. 825 00:36:20,921 --> 00:36:21,821 People are the problems. 826 00:36:21,821 --> 00:36:24,161 ai, uh, and, 827 00:36:24,251 --> 00:36:27,611 To our listeners, we are not trying to replace you and say 828 00:36:27,611 --> 00:36:29,171 you do not have a job anymore. 829 00:36:29,411 --> 00:36:32,051 Please continue to listen and support this podcast. 830 00:36:32,351 --> 00:36:34,991 If you like this, please go to your favorite podcast 831 00:36:34,991 --> 00:36:37,211 catcher and like subscribe. 832 00:36:37,211 --> 00:36:38,021 Leave us a comment. 833 00:36:38,021 --> 00:36:38,771 We love it. 834 00:36:38,801 --> 00:36:43,241 You can catch us, watch our videos, and see our lovely faces on YouTube 835 00:36:43,661 --> 00:36:45,251 under the backup wrap up channel. 836 00:36:47,621 --> 00:36:49,481 We got one comment that said we looked homeless. 837 00:36:49,481 --> 00:36:50,021 I'm like, really? 838 00:36:50,081 --> 00:36:54,461 And then he, and then he said like, you know, I was just joking, like, ah, okay. 839 00:36:54,761 --> 00:36:59,081 It's, it's a couple of bearded guys, back when, back when you had your longer 840 00:36:59,366 --> 00:36:59,816 Yeah, 841 00:37:00,326 --> 00:37:02,366 One of us looked a little homeless, I'm just saying. 842 00:37:03,236 --> 00:37:03,596 Anyway. 843 00:37:05,396 --> 00:37:05,816 All right. 844 00:37:05,816 --> 00:37:06,476 Well that's good. 845 00:37:06,476 --> 00:37:10,766 That's that Thus end of the lesson on the insider threat episode, 846 00:37:10,766 --> 00:37:11,816 that's another movie reference. 847 00:37:11,816 --> 00:37:13,736 So that's a reference to the Untouchables, 848 00:37:13,806 --> 00:37:13,886 Hmm 849 00:37:13,946 --> 00:37:18,626 is the movie with Elliot, with Kevin Costner playing Elliot 850 00:37:18,626 --> 00:37:20,126 Ness, taking down Al Capone, 851 00:37:20,366 --> 00:37:20,486 hmm. 852 00:37:20,576 --> 00:37:21,356 by Robert De Niro. 853 00:37:21,416 --> 00:37:23,186 Anyway, thus send it the lesson. 854 00:37:23,426 --> 00:37:27,371 Anyway, um, thanks as always. 855 00:37:28,451 --> 00:37:29,322 Any time, I guess. 856 00:37:29,591 --> 00:37:31,991 documents, get to my, get 857 00:37:32,036 --> 00:37:33,266 I'll get you questions. 858 00:37:33,746 --> 00:37:35,966 I'll add questions with more questions. 859 00:37:35,966 --> 00:37:36,446 How about that? 860 00:37:37,241 --> 00:37:38,171 Of course, of course, of 861 00:37:38,281 --> 00:37:38,501 Yes, 862 00:37:38,531 --> 00:37:39,521 course, of course, of course. 863 00:37:39,521 --> 00:37:42,311 And thank you to you listeners, if you're still with us. 864 00:37:42,341 --> 00:37:43,031 Thank you. 865 00:37:43,331 --> 00:37:45,366 And uh, that is a wrap. 866 00:37:48,276 --> 00:37:52,956 The backup wrap up is written, recorded, and produced by me w Curtis Preston. 867 00:37:53,526 --> 00:37:58,326 If you need backup or Dr. Consulting content generation or expert witness 868 00:37:58,326 --> 00:38:00,906 work, check out backup central.com. 869 00:38:01,626 --> 00:38:04,746 You can also find links from my O'Reilly Books on the same website. 870 00:38:05,406 --> 00:38:09,396 Remember, this is an independent podcast and any opinions that 871 00:38:09,396 --> 00:38:13,326 you hear are those of the speaker and not necessarily an employer. 872 00:38:14,226 --> 00:38:14,916 Thanks for listening.