1 00:00:00,063 --> 00:00:00,723 Hi folks. 2 00:00:00,723 --> 00:00:02,673 This week, I learned something new. 3 00:00:02,943 --> 00:00:07,473 We talk about sheltered Harbor certification, which is a framework for 4 00:00:07,473 --> 00:00:12,573 financial institutions to make sure that they can recover after a cyber attack. 5 00:00:12,843 --> 00:00:17,463 I think there's a lot to learn for all of us, not just financial institutions. 6 00:00:17,643 --> 00:00:18,753 Hope you enjoy the episode. 7 00:00:38,151 --> 00:00:41,241 W. Curtis Preston: Hi, and welcome to Backup Central's Restore It all podcast. 8 00:00:41,241 --> 00:00:43,941 I'm your host, w Curtis Preston, AKA Mr. 9 00:00:43,941 --> 00:00:44,511 Backup. 10 00:00:44,961 --> 00:00:48,981 And I have with me my dust collector consultant Prasanna 11 00:00:49,211 --> 00:00:50,451 Malaiyandi how's it going? 12 00:00:52,416 --> 00:00:53,226 Prasanna Malaiyandi: am good, Curtis. 13 00:00:53,226 --> 00:00:58,056 I do have to let you know I have a pretty bad allergy to 14 00:00:58,061 --> 00:01:00,916 dust, so I may not be the right 15 00:01:00,916 --> 00:01:01,316 person. 16 00:01:01,396 --> 00:01:05,146 , W. Curtis Preston: that makes you the perfect, but, but, but, but I have to 17 00:01:05,146 --> 00:01:08,056 say, you're not doing a very good job because I keep buying and buying the 18 00:01:08,056 --> 00:01:10,726 wrong, like I gotta connect this to that. 19 00:01:10,726 --> 00:01:12,016 And the thing with the thing cuz 20 00:01:12,056 --> 00:01:12,336 Prasanna Malaiyandi: know, you. 21 00:01:13,456 --> 00:01:13,516 W. Curtis Preston: you 22 00:01:13,561 --> 00:01:14,881 Prasanna Malaiyandi: You know what you really need to do. 23 00:01:14,881 --> 00:01:19,501 So for the listeners, this is Curtis is, has his wood shop up and running. 24 00:01:19,501 --> 00:01:23,431 He has a bunch of tools which produce a lot of dust, and therefore he's 25 00:01:23,436 --> 00:01:27,511 trying to build like a dust collection system to spare me from dying. 26 00:01:27,841 --> 00:01:32,341 So, um, one of the things though is like each one has a different size adapter. 27 00:01:32,701 --> 00:01:36,151 Some are one and a half inches, some are two inches 28 00:01:36,916 --> 00:01:37,186 W. Curtis Preston: One and 29 00:01:37,231 --> 00:01:38,401 Prasanna Malaiyandi: and some, 30 00:01:38,866 --> 00:01:40,456 W. Curtis Preston: two and a half, four. 31 00:01:40,756 --> 00:01:42,766 Uh, and, and then non-standard sizes. 32 00:01:42,766 --> 00:01:44,506 There's also non-standard sizes. 33 00:01:44,516 --> 00:01:44,756 Yeah. 34 00:01:45,436 --> 00:01:45,766 Prasanna Malaiyandi: Yeah. 35 00:01:45,946 --> 00:01:49,066 So what you need to do, Curtis, and I think this will help you a lot, is you 36 00:01:49,066 --> 00:01:54,106 need to draw a picture on a piece of paper with your various equipment pieces 37 00:01:54,106 --> 00:01:57,226 with the size of those, so then you can figure out what you need and what you have 38 00:01:58,216 --> 00:01:58,666 W. Curtis Preston: Yeah. 39 00:01:58,666 --> 00:02:01,246 The, you know, what's that 40 00:02:02,116 --> 00:02:02,866 Prasanna Malaiyandi: planning? 41 00:02:03,226 --> 00:02:03,406 W. Curtis Preston: Yeah. 42 00:02:03,406 --> 00:02:09,496 Well, it's not just that, like I recently found out that D DeWalt makes. 43 00:02:10,651 --> 00:02:17,176 on purpose makes non-standard sized dust ports on some of their machines because 44 00:02:17,176 --> 00:02:19,276 they sell a dust collection system. 45 00:02:19,936 --> 00:02:23,956 And so they're like, well, it works with the DeWalt dust collection system, right? 46 00:02:24,316 --> 00:02:26,716 Which I don't even see for sale anywhere. 47 00:02:26,716 --> 00:02:31,426 I'm sure it is for sale somewhere, but so like half of my tools have 48 00:02:31,426 --> 00:02:34,576 standard size ports, although they're not all the same size. 49 00:02:34,936 --> 00:02:40,816 And then some of my tools like the table, and the, the sander has 50 00:02:40,816 --> 00:02:43,426 a total non-standard, uh, port. 51 00:02:44,086 --> 00:02:49,456 Um, and so this is what is, is apparently this is a problem being 52 00:02:49,456 --> 00:02:51,676 solved by 3D printers and Etsy 53 00:02:53,271 --> 00:02:53,691 Prasanna Malaiyandi: yep. 54 00:02:54,221 --> 00:02:55,321 Oh, I could totally see. 55 00:02:55,606 --> 00:02:56,096 W. Curtis Preston: Yeah. 56 00:02:56,506 --> 00:02:56,716 Yeah. 57 00:02:56,721 --> 00:03:00,526 It's a little cottage industry of people selling, you know, the thing to the thing. 58 00:03:00,946 --> 00:03:01,846 Um, 59 00:03:01,906 --> 00:03:03,526 Prasanna Malaiyandi: You should get into this business, Curtis. 60 00:03:03,526 --> 00:03:06,916 I bet you can get a 3D scanner, right? 61 00:03:07,096 --> 00:03:08,326 3D scan? 62 00:03:08,686 --> 00:03:09,016 No, no, no. 63 00:03:09,016 --> 00:03:14,776 First you need a 3D scanner so you can scan the dust port collectors, right? 64 00:03:14,781 --> 00:03:19,096 That you have already, and then you use that to build the adapters. 65 00:03:19,186 --> 00:03:21,676 W. Curtis Preston: you know, what I do is I go down to Lowe's and, 66 00:03:21,676 --> 00:03:23,086 and, you know, use a caliper. 67 00:03:24,026 --> 00:03:25,156 , can't you just use a caliper? 68 00:03:25,906 --> 00:03:26,356 Right. 69 00:03:26,566 --> 00:03:29,956 Um, I think I could make it happen, but yeah. 70 00:03:30,016 --> 00:03:31,186 Uh, this is a thing. 71 00:03:31,396 --> 00:03:37,126 Um, but, uh, yeah, so these are the problems that I have with my 72 00:03:37,126 --> 00:03:39,016 expensive, my new expensive hobby. 73 00:03:39,706 --> 00:03:46,276 Um, but so, you know, our, our guest that, uh, we're having on, he's a, 74 00:03:46,336 --> 00:03:50,626 he's a repeat guest and last time. 75 00:03:51,431 --> 00:03:53,506 we were talk, you know, we had him on the podcast. 76 00:03:53,506 --> 00:03:57,496 He threw out this phrase, and, you know, we were immediately 77 00:03:57,496 --> 00:03:59,236 like, what, what is, what is that? 78 00:03:59,326 --> 00:04:00,196 What is that thing? 79 00:04:00,196 --> 00:04:04,426 And so we decided to have him back, uh, just to talk about that. 80 00:04:04,426 --> 00:04:05,776 We'll talk about that in a minute. 81 00:04:06,106 --> 00:04:12,046 He's been in the industry for over 30 years, um, and, um, he 82 00:04:12,046 --> 00:04:16,816 is now the enterprise architect at Presidio Network Solutions. 83 00:04:17,266 --> 00:04:19,826 Welcome to the podcast, Eric Bursley. 84 00:04:21,551 --> 00:04:24,951 Eric Bursley: All right, Thank you Curtis, and thank you Prasanna. 85 00:04:24,976 --> 00:04:25,246 W. Curtis Preston: So 86 00:04:25,481 --> 00:04:26,641 Prasanna Malaiyandi: Glad to have you back 87 00:04:27,166 --> 00:04:27,466 W. Curtis Preston: Yeah. 88 00:04:27,466 --> 00:04:31,006 So this little phrase that you threw out was this Sheltered Harbor 89 00:04:31,006 --> 00:04:34,786 certification, which, you know, I think, I think you threw a little 90 00:04:34,786 --> 00:04:38,176 shade at me saying that, you know, you were a little surprised that, uh, Mr. 91 00:04:38,206 --> 00:04:43,606 Backup didn't know about this, backup centric, uh, thing. 92 00:04:44,206 --> 00:04:47,806 Uh, so why, why don't we back up a little bit and. 93 00:04:48,451 --> 00:04:52,531 Sort of set the stage in terms of what, you know, I always want to know 94 00:04:52,641 --> 00:04:54,121 how, you know, how did we get here? 95 00:04:54,571 --> 00:04:58,651 Um, so first off, maybe let's do what real quick, like a, you 96 00:04:58,651 --> 00:05:03,211 know, a 20-second overview of what Sheltered Harbor certification is. 97 00:05:04,421 --> 00:05:08,161 Eric Bursley: So Sheltered Harbor Certification is a, 98 00:05:08,881 --> 00:05:12,391 first of all, sheltered Harbor is a nonprofit organization. 99 00:05:12,396 --> 00:05:14,641 It is an independent organization that provides. 100 00:05:15,586 --> 00:05:21,826 Um, a financial institution with an assurance that they can provide back 101 00:05:21,826 --> 00:05:27,486 to their users, their customers, that their data is resilient 102 00:05:27,491 --> 00:05:29,746 against a ransomware attack. 103 00:05:31,486 --> 00:05:38,176 So, um, with that, it it, it's supposed to, um, provide them with more confidence 104 00:05:38,416 --> 00:05:45,696 that if something happens to my bank through a ransomware attack, What 105 00:05:45,696 --> 00:05:50,731 data I had available to me yesterday will be available to me once they 106 00:05:50,731 --> 00:05:52,981 recover, typically within 24 hours. 107 00:05:54,646 --> 00:05:54,826 Prasanna Malaiyandi: and. 108 00:05:55,501 --> 00:05:58,381 Because it's Sheltered Harbor certification. 109 00:05:58,771 --> 00:06:03,811 I'm guessing, do they actually own the data and the processes and everything 110 00:06:03,811 --> 00:06:06,901 else, or are they just sort of like NIST or some of these other organizations where 111 00:06:06,901 --> 00:06:08,251 they're like, Hey, here are the standards. 112 00:06:08,251 --> 00:06:10,421 Here's like the best practices. 113 00:06:10,426 --> 00:06:13,651 Here are the things you should be following in order to be able to do. 114 00:06:13,681 --> 00:06:16,321 It's kind of like how, if you're doing credit card transaction, right, you have 115 00:06:16,321 --> 00:06:18,691 to do like P C I certification, right? 116 00:06:18,691 --> 00:06:20,401 In order to be able to handle credit cards. 117 00:06:20,401 --> 00:06:21,691 Is that kind of how this. 118 00:06:22,246 --> 00:06:25,816 Eric Bursley: So yeah, Shelton Harbor is more of a framework , um, in 119 00:06:25,816 --> 00:06:32,146 place, they make some recommendations, um, that if followed, um, you 120 00:06:32,146 --> 00:06:34,366 can apply for certification. 121 00:06:35,026 --> 00:06:40,186 And if you follow their framework, um, strictly, they would be able to 122 00:06:40,191 --> 00:06:44,156 provide you with that certification saying that, yes, you are good. 123 00:06:44,806 --> 00:06:51,406 Um, and that, um, you can, uh, put our name on your website 124 00:06:51,406 --> 00:06:53,086 that your data is gonna be safe. 125 00:06:53,596 --> 00:06:54,596 Um, so what is the. 126 00:06:55,126 --> 00:06:58,336 Prasanna Malaiyandi: And that is, when you say that you can get that 127 00:06:58,336 --> 00:07:02,266 certification, is that a customer, like a bank in your example, or is that 128 00:07:02,266 --> 00:07:04,726 like a vendor who provides the service? 129 00:07:05,221 --> 00:07:08,611 Eric Bursley: It's typically the, the bank gets the certification, the bank 130 00:07:08,611 --> 00:07:10,801 is applying for the certification. 131 00:07:11,251 --> 00:07:15,271 Um, now in order to achieve that certification, the bank has to have 132 00:07:15,271 --> 00:07:17,551 certain things already in place. 133 00:07:18,271 --> 00:07:21,751 Um, the first of which is a data vault. 134 00:07:22,036 --> 00:07:24,136 For their backup data. 135 00:07:24,466 --> 00:07:31,096 Um, so, you know, following the traditional 3 21 rule, um, that offsite 136 00:07:31,096 --> 00:07:39,256 copy would be an immutable copy that is operationally air gapped, um, and 137 00:07:40,366 --> 00:07:48,196 also scanned for any vulnerabilities so that you would be able to determine a 138 00:07:48,816 --> 00:07:51,546 specific point in which you are clean. 139 00:07:52,366 --> 00:07:59,251 To restore, um, into an integrated recovery environment or an i r e. 140 00:07:59,971 --> 00:08:02,911 Um, so it, it's a set of processes. 141 00:08:03,141 --> 00:08:08,881 It's not just, I have tape which tape is traditionally immutable, um, but 142 00:08:08,886 --> 00:08:15,241 I am also actively scanning my data vault that is immutable so that I know 143 00:08:15,241 --> 00:08:17,251 which restore points I can restore. 144 00:08:19,931 --> 00:08:25,721 W. Curtis Preston: So, uh, yeah, so, so a lot of questions that come up there. 145 00:08:25,781 --> 00:08:30,041 So the first would be, what is it about banks? 146 00:08:31,161 --> 00:08:36,496 that make them want to be to, to, to achieve a certification like this. 147 00:08:36,496 --> 00:08:39,676 What you know, why isn't this just for everybody? 148 00:08:40,561 --> 00:08:43,321 Eric Bursley: Well, the, the process. 149 00:08:43,696 --> 00:08:46,876 Could be applied for everybody. 150 00:08:47,026 --> 00:08:51,586 Um, but sheltered Harbor is focusing on the financial industry in particular. 151 00:08:52,066 --> 00:08:57,196 Um, mostly because if we don't have access to our money, we can't do anything. 152 00:08:57,826 --> 00:09:00,346 Um, so that was their primary target around this. 153 00:09:00,351 --> 00:09:04,366 But the process that they have, it's solid for all in. 154 00:09:06,711 --> 00:09:10,696 and, and Presidio recommends this for all industries as well. 155 00:09:10,726 --> 00:09:17,686 Um, and, and one of my feature workshops I talk about, um, data immutability. 156 00:09:17,866 --> 00:09:22,876 And that that, uh, third copy of your data, that offsite copy should be 157 00:09:22,881 --> 00:09:28,366 in a separate authentication domain so that it is protected against 158 00:09:28,426 --> 00:09:30,926 any sort of credential compromise. 159 00:09:31,876 --> 00:09:37,276 It's immutable, but it Shelter Harbor adds onto that and says it's also 160 00:09:37,306 --> 00:09:43,816 verifiable that you know when to restore and how are you going to restore into 161 00:09:43,821 --> 00:09:45,496 a a disaster recovery environment. 162 00:09:46,936 --> 00:09:48,196 Prasanna Malaiyandi: Interesting. 163 00:09:48,406 --> 00:09:52,156 So, yeah, like Curtis said, I have a ton of questions just like 164 00:09:52,156 --> 00:09:53,566 popping up in my head right now. 165 00:09:53,896 --> 00:09:56,866 Um, you talked about, one aspect that I wanna go back to is 166 00:09:56,866 --> 00:09:58,576 like that operational air gap. 167 00:09:59,401 --> 00:09:59,851 Right. 168 00:09:59,911 --> 00:10:02,851 And sort of how do they define that? 169 00:10:02,851 --> 00:10:05,341 Because I know I've heard about, okay, strict air gap where it's 170 00:10:05,346 --> 00:10:07,141 like physical isolation completely. 171 00:10:07,381 --> 00:10:09,871 Sometimes we talk about virtual air gaps. 172 00:10:10,111 --> 00:10:15,481 Is operational air gap different in some way or has some unique characteristics? 173 00:10:15,961 --> 00:10:18,991 Eric Bursley: So one of the unique characteristics is that 174 00:10:18,991 --> 00:10:20,871 it's typically firewalled. 175 00:10:21,361 --> 00:10:26,101 From the production environment, um, typically through some natted 176 00:10:26,131 --> 00:10:33,661 firewall that allows from the protected environment outbound to pull the 177 00:10:33,666 --> 00:10:36,511 data back into the environment. 178 00:10:36,511 --> 00:10:40,261 So it's not a, it's never a push, uh, environment from production 179 00:10:40,261 --> 00:10:43,741 into the backup because that has a potential for compromise. 180 00:10:43,981 --> 00:10:45,361 But if it's a pull. 181 00:10:45,736 --> 00:10:47,956 In the environment, that is schedulable. 182 00:10:48,196 --> 00:10:52,156 No firewall ports need to be opened up at any time from production in, because 183 00:10:52,156 --> 00:10:58,816 it's an outbound connection and it's able to log in to the production environment 184 00:10:59,206 --> 00:11:05,836 and through that process, pull in a specific restore point, scanning it in 185 00:11:06,066 --> 00:11:10,516 the process for known vulnerabilities, and then continually scanning it in 186 00:11:10,516 --> 00:11:12,616 the future for future vulnerabilities. 187 00:11:12,926 --> 00:11:13,286 Prasanna Malaiyandi: Gotcha. 188 00:11:13,406 --> 00:11:17,036 And when you talk about the pull mechanism, that totally makes sense. 189 00:11:17,036 --> 00:11:21,836 When it lands in the vault, is it sort of in an isolated spot? 190 00:11:21,836 --> 00:11:24,296 Like, I'm just wondering in my head like it's kind of like you wanna make 191 00:11:24,296 --> 00:11:26,186 sure whatever's in the vault is sort of. 192 00:11:27,001 --> 00:11:32,221 valid has been verified that there are no compromises in it and you 193 00:11:32,221 --> 00:11:35,851 can't necessarily trust the production not to have any, because you don't 194 00:11:35,856 --> 00:11:36,841 know what the state is there. 195 00:11:37,351 --> 00:11:41,311 And so I guess when you're transferring the data, are you sort of transferring 196 00:11:41,316 --> 00:11:45,181 it into an isolated bucket inside of the vault that then gets scanned 197 00:11:45,186 --> 00:11:48,581 and verified before it's sort of marked as verified, and valid. 198 00:11:48,601 --> 00:11:50,851 So nothing bad can happen of that. 199 00:11:51,436 --> 00:11:54,436 Eric Bursley: So it is a continual process. 200 00:11:54,436 --> 00:12:00,796 The initial pull is scanned, uh, against the current known vulnerabilities 201 00:12:00,946 --> 00:12:05,266 using machine learning, ar artificial intelligence, but then future restore 202 00:12:05,271 --> 00:12:08,086 points are also scanned at those points. 203 00:12:08,726 --> 00:12:13,516 , but it's also scanned during a recovery operation, which it, it's critical to 204 00:12:13,516 --> 00:12:18,466 have that integrated recovery environment that's separate from production. 205 00:12:19,936 --> 00:12:20,416 Okay. 206 00:12:20,536 --> 00:12:24,376 Um, and through that integrated recovery environment, again, it's 207 00:12:24,376 --> 00:12:29,346 network isolated from production, you can actually determine a safe point. 208 00:12:30,421 --> 00:12:31,591 to bring things back up. 209 00:12:31,681 --> 00:12:36,451 You may be able to have, um, a, a particular application server restored 210 00:12:36,661 --> 00:12:43,831 two point B, but then pull clean data in from production to bring it more current. 211 00:12:44,311 --> 00:12:48,451 So it, it just provides you that specific point that you 212 00:12:48,451 --> 00:12:50,961 can be assured that you are. 213 00:12:51,811 --> 00:12:52,021 W. Curtis Preston: Yeah. 214 00:12:52,021 --> 00:12:56,071 You know, th this brings up a, a topic that I've been looking 215 00:12:56,071 --> 00:13:00,241 at a lot lately, which is I, if. 216 00:13:00,781 --> 00:13:04,381 We're going to, um, cuz it's one thing. 217 00:13:04,861 --> 00:13:07,051 I don't know, there's a lot of things going on in my head. 218 00:13:07,141 --> 00:13:07,771 All right. 219 00:13:08,041 --> 00:13:12,691 So, uh, you know, I, I, I hear you talking about pre-scan and 220 00:13:12,691 --> 00:13:15,301 post-scan and that all sounds great. 221 00:13:15,751 --> 00:13:19,501 Um, I'm gonna throw out a little shade and say if the pre-scan at the 222 00:13:19,501 --> 00:13:22,321 backup finds the ransomware, why didn? 223 00:13:23,221 --> 00:13:26,881 Like some regular virus scanning tool. 224 00:13:26,881 --> 00:13:27,751 Find it already. 225 00:13:27,751 --> 00:13:30,661 I don't, I, I don't, I don't know why that, why one would work 226 00:13:30,661 --> 00:13:31,891 and the other would not work. 227 00:13:32,341 --> 00:13:35,611 Um, but I'm not saying it's not a good idea to do it. 228 00:13:35,611 --> 00:13:38,041 I'm just, it's just, that popped up in my head. 229 00:13:38,626 --> 00:13:41,956 Eric Bursley: Well, that that speaks to the maturity model of the 230 00:13:41,956 --> 00:13:44,566 organization's security infrastructure. 231 00:13:44,926 --> 00:13:49,246 Some organizations don't have a SEIM in place. 232 00:13:49,246 --> 00:13:57,166 They don't have a current, um, Antivirus that it includes, um, artificial 233 00:13:57,166 --> 00:14:00,586 or AI ml into those technologies. 234 00:14:00,766 --> 00:14:06,616 So based on the NIST framework, they're not preventing the infection from coming 235 00:14:06,616 --> 00:14:12,136 in, and it's up to the recovery process of the NIST framework to bring you back. 236 00:14:12,466 --> 00:14:16,606 Preferably, it is a multi-faced approach like NIST calls. 237 00:14:18,811 --> 00:14:23,761 W. Curtis Preston: Yeah, it is just that, you know, as big of a fan as I 238 00:14:23,761 --> 00:14:28,711 am, a backup, if you're relying on your backup system to let you know you got 239 00:14:28,711 --> 00:14:34,441 a virus or malware of any kind, uh, I don't know what to tell you anyway. 240 00:14:34,621 --> 00:14:37,441 I, yeah, but I'm not saying that that doesn't happen. 241 00:14:37,441 --> 00:14:40,081 I'm just saying I'm not sure I agree with that plan. 242 00:14:40,561 --> 00:14:46,471 Um, There's been a thought that I've been thinking a lot about lately and, and, and 243 00:14:46,471 --> 00:14:53,641 it comes from the fact that we know, based on the stuff that's been published, that 244 00:14:53,641 --> 00:15:00,301 the average dwell time or the mean dwell time of malware is well over 60 days. 245 00:15:01,081 --> 00:15:08,251 So if, if, if the malware has been in your environment for, for a long time, and, 246 00:15:08,251 --> 00:15:11,551 and maybe it hasn't deployed, maybe it hasn't done anything, maybe it hasn't, 247 00:15:11,641 --> 00:15:17,131 um, um, you know, encrypted any data, and then it doesn't generally wreak 248 00:15:17,136 --> 00:15:18,706 havoc until it starts encrypting data. 249 00:15:19,711 --> 00:15:26,461 Um, and, but you, meanwhile you've probably created weeks and weeks 250 00:15:26,461 --> 00:15:31,501 and weeks of backups of the machine with the malware still on it, 251 00:15:31,771 --> 00:15:35,161 which you didn't notice, right. 252 00:15:35,761 --> 00:15:36,961 You can scan all you want. 253 00:15:36,961 --> 00:15:39,901 Some of this stuff isn't noticeable or, or you know, it's 254 00:15:39,901 --> 00:15:41,311 easy once you find it, right. 255 00:15:41,341 --> 00:15:46,711 Once you find it, you get the signature and then you can um, right, you can then 256 00:15:46,711 --> 00:15:48,901 you can scan for that specific signature. 257 00:15:49,351 --> 00:15:51,961 But a general scan doesn't necessarily pick it up. 258 00:15:52,921 --> 00:15:56,731 So then my question is, well, what does the organization do? 259 00:15:56,791 --> 00:15:58,951 And you know, what would be my recommendation? 260 00:16:00,771 --> 00:16:04,276 Um, you know, and of course then they're, they're free to do whatever they want. 261 00:16:04,276 --> 00:16:07,006 I know some people have talked about, well, I need to restore 262 00:16:07,006 --> 00:16:08,956 from before I even got infected. 263 00:16:10,456 --> 00:16:12,286 That is an option. 264 00:16:12,856 --> 00:16:18,196 But to me that if, if the dwell time is 60 days, or, or it could be, it 265 00:16:18,196 --> 00:16:23,356 could be as much as 120 days from what I've seen, um, that doesn't 266 00:16:23,356 --> 00:16:25,666 seem like a viable option to me. 267 00:16:26,341 --> 00:16:33,541 To start from a greenfield, restore the, the VM image from 121 days ago, 268 00:16:34,411 --> 00:16:36,961 and then somehow bring it, right? 269 00:16:36,961 --> 00:16:42,691 Because, um, it just, it gets, and you, and then you look at the, um, the 270 00:16:42,691 --> 00:16:50,791 complications involved with, um, all of the, um, different ways in which we. 271 00:16:52,291 --> 00:16:58,501 OSS and non oss, you know, things like containers, um, and applications, and we 272 00:16:58,501 --> 00:17:03,421 have VMs and we have physical servers and on-premise VMs on, uh, cloud-based VMs. 273 00:17:04,801 --> 00:17:08,941 This is just like deciding that, making that decision. 274 00:17:09,301 --> 00:17:13,921 Um, it just seems really, uh, a difficult one that I think 275 00:17:13,921 --> 00:17:15,151 environments have to decide. 276 00:17:16,591 --> 00:17:18,991 I know there was, there was no question anywhere in that 277 00:17:21,136 --> 00:17:21,886 Prasanna Malaiyandi: I was waiting. 278 00:17:21,891 --> 00:17:23,986 I was like, should I tell Curtis he's on a rant? 279 00:17:24,286 --> 00:17:24,676 Eric Bursley: Right. 280 00:17:24,736 --> 00:17:25,396 So 281 00:17:25,576 --> 00:17:29,326 that, that's essentially where a partner like Presidio can come in. 282 00:17:29,326 --> 00:17:36,196 We can help advise, um, specifically leveraging a tool that, um, I help 283 00:17:36,196 --> 00:17:38,356 produce called our ransomware workshop. 284 00:17:39,136 --> 00:17:44,026 It is a free offering that we offer our clients, two and a half 285 00:17:44,026 --> 00:17:48,466 hours of discussion with one of our cybersecurity analysts, a data 286 00:17:48,466 --> 00:17:51,576 center analyst, which focuses on primary storage and backup recovery. 287 00:17:52,426 --> 00:17:58,456 And working with a C level as well as the engineers at a specific customer 288 00:17:59,496 --> 00:18:04,306 identify potential problems such as you don't have a SEIM in place, you don't 289 00:18:04,306 --> 00:18:09,556 have a current antivirus solution in place such as CrowdStrike or cyber reason. 290 00:18:09,886 --> 00:18:16,126 Um, you don't have a, a good initial protection of that. 291 00:18:16,336 --> 00:18:20,506 And then, , you know, from a backup recovery standpoint, what are you using? 292 00:18:20,506 --> 00:18:22,366 How are you backing up your data? 293 00:18:22,366 --> 00:18:24,646 Are you following the 3 21 rule? 294 00:18:24,646 --> 00:18:30,856 Do you have an operationally air gap vault for that offsite copy? 295 00:18:31,696 --> 00:18:37,156 Those are the questions that we bring up, and then we can help address some 296 00:18:37,156 --> 00:18:42,046 of those problems over time, whether it's a financial customer or not. 297 00:18:42,106 --> 00:18:42,436 Okay. 298 00:18:42,546 --> 00:18:42,826 This. 299 00:18:43,426 --> 00:18:44,686 Offered to everybody. 300 00:18:44,746 --> 00:18:49,576 Um, and then once we understand the direction you need to go with 301 00:18:49,576 --> 00:18:55,486 that vision, um, that we provide, um, we can then start chipping away 302 00:18:55,486 --> 00:18:57,076 at those questions that you have. 303 00:18:57,526 --> 00:19:01,726 Um, and we do that as an diagnostic type of service. 304 00:19:01,731 --> 00:19:07,366 So, um, outside of the vendors, we may bring up vendors in the conversation, 305 00:19:07,546 --> 00:19:12,886 but we're trying to solve that business, uh, problem and then aligning. 306 00:19:13,306 --> 00:19:16,716 Those requirements to a technology vendor, 307 00:19:19,646 --> 00:19:21,356 Prasanna Malaiyandi: I think having that process, that 308 00:19:21,356 --> 00:19:22,556 approach totally makes sense. 309 00:19:22,556 --> 00:19:26,156 And just going back to Curtis's rant, quote unquote rant, right? 310 00:19:26,396 --> 00:19:28,826 I think honestly, it's going to depend, right? 311 00:19:28,831 --> 00:19:33,236 I don't think you can say that we will always go back 121 days, 312 00:19:33,236 --> 00:19:37,016 or the best option is always to go pick the latest copy, right? 313 00:19:37,021 --> 00:19:40,616 I think it is going to depend on the value of the data, how long it takes to recover 314 00:19:40,616 --> 00:19:42,896 the importance of that application, right? 315 00:19:42,896 --> 00:19:46,296 All of these things, and I think it's sort of a recovery. 316 00:19:47,586 --> 00:19:47,771 Right. 317 00:19:47,861 --> 00:19:49,901 And hopefully you've already planned this ahead of time. 318 00:19:49,901 --> 00:19:50,141 Right. 319 00:19:50,141 --> 00:19:53,651 And you know, okay, this is the importance of this data, but it's sort of one of 320 00:19:53,651 --> 00:19:58,241 those things that at recovery time, you execute your plan in your runbook that you 321 00:19:58,306 --> 00:20:03,041 W. Curtis Preston: yeah, I think it was a rant because I see a lot of people 322 00:20:03,041 --> 00:20:07,346 talking about, Well, we're just gonna scan, you know, we, we, our, we have 323 00:20:07,346 --> 00:20:11,396 backup software that will, you know, we, we can identify the, the hash, we 324 00:20:11,396 --> 00:20:12,926 can give the hash to the backup product. 325 00:20:12,931 --> 00:20:15,896 It can scan for that, you know, we know where the malware is. 326 00:20:16,016 --> 00:20:19,496 And then we'll just restore from before the malware hit. 327 00:20:19,976 --> 00:20:24,776 And, and I just wanna say, um, to 121 days ago that, that's what, that's 328 00:20:24,776 --> 00:20:26,456 why I just, it, it, you're right. 329 00:20:26,456 --> 00:20:27,416 It's not simple. 330 00:20:27,446 --> 00:20:28,106 Um, 331 00:20:28,721 --> 00:20:29,351 Eric Bursley: It's not 332 00:20:29,546 --> 00:20:31,136 Prasanna Malaiyandi: and I think Eric had brought it up earlier. 333 00:20:32,951 --> 00:20:33,251 Eric Bursley: yeah. 334 00:20:33,281 --> 00:20:37,031 You don't necessarily have to restore to 120 days ago. 335 00:20:37,151 --> 00:20:42,491 You can restore from the latest copy of just the data that is clean. 336 00:20:43,601 --> 00:20:44,171 Okay. 337 00:20:44,291 --> 00:20:48,611 Um, not everything on the system is encrypted, so you need to pull the 338 00:20:48,641 --> 00:20:52,831 data prior to the full encryption that ransomware is going to. 339 00:20:53,456 --> 00:20:59,156 That is a point, then you can start saying, okay, how did it get in looking 340 00:20:59,156 --> 00:21:05,126 for the executable in that environment and then removing it or deactivating it. 341 00:21:05,366 --> 00:21:13,676 And it's critical to look not just for static files, but also um, Shell less, 342 00:21:13,676 --> 00:21:20,396 or I should say, um, script, less sort of, um, vulnerabilities because 343 00:21:20,396 --> 00:21:23,306 they're able to actually execute some of these processes in memory 344 00:21:23,306 --> 00:21:25,316 without writing anything out to disk. 345 00:21:25,481 --> 00:21:25,811 Prasanna Malaiyandi: Yeah. 346 00:21:26,141 --> 00:21:30,071 I think the other thing is when you're also doing that recovery, sort of 347 00:21:30,281 --> 00:21:33,521 doing it in an isolated fashion, right? 348 00:21:33,521 --> 00:21:33,851 Where 349 00:21:33,856 --> 00:21:36,551 maybe you don't have that network connectivity, right? 350 00:21:36,551 --> 00:21:39,731 So they can't call out to their C N C servers, right? 351 00:21:39,731 --> 00:21:41,771 Their command and control servers and get additional 352 00:21:41,771 --> 00:21:43,061 information and kickstart things. 353 00:21:43,776 --> 00:21:44,066 Eric Bursley: E. 354 00:21:44,071 --> 00:21:44,516 Exactly. 355 00:21:44,516 --> 00:21:49,106 And there are OEMs that offer these types of solutions and, and 356 00:21:49,106 --> 00:21:50,936 Presidio can recommend them all. 357 00:21:50,936 --> 00:21:53,726 And these are not a limited list of solutions either. 358 00:21:54,026 --> 00:21:59,426 Um, but they're, um, solutions that can become safe Harbor 359 00:21:59,456 --> 00:22:01,226 certified when deployed. 360 00:22:01,616 --> 00:22:05,726 Um, they're not in itself guaranteeing safe harbor. 361 00:22:05,726 --> 00:22:07,286 You still have to implement them, right? 362 00:22:07,286 --> 00:22:08,906 You still have to create your run. 363 00:22:09,746 --> 00:22:12,386 Um, and any sort of automation around it. 364 00:22:12,566 --> 00:22:17,776 Um, but they definitely give you a leg up, uh, around achieving that certification. 365 00:22:18,881 --> 00:22:20,951 Prasanna Malaiyandi: and would you get that certification? 366 00:22:21,836 --> 00:22:23,321 , that's for a point in time. 367 00:22:23,321 --> 00:22:23,561 Right. 368 00:22:23,561 --> 00:22:27,221 Is there sort of audits done things you have to show, like 369 00:22:27,221 --> 00:22:31,571 as your environment changes, as things happen to keep up to date? 370 00:22:31,571 --> 00:22:33,551 Or is it sort of a one and done thing? 371 00:22:33,776 --> 00:22:35,936 Eric Bursley: You do have to get re certified. 372 00:22:36,026 --> 00:22:39,746 Um, over time, um, this is because policies do change, 373 00:22:39,751 --> 00:22:41,486 recommendations do change. 374 00:22:41,816 --> 00:22:45,686 Um, technologies do change, you know, containers, for example. 375 00:22:45,926 --> 00:22:49,046 Um, how are you protecting your container workload? 376 00:22:49,126 --> 00:22:49,566 It's. 377 00:22:50,396 --> 00:22:56,366 Regardless of what the original intent of immutable containers are, people are 378 00:22:57,446 --> 00:22:59,186 persisting data in their containers. 379 00:22:59,306 --> 00:23:00,836 How are you protecting those? 380 00:23:01,256 --> 00:23:06,446 The data as well as the ecosystem of your Kubernetes or your Docker, uh, 381 00:23:06,451 --> 00:23:08,336 automation system that goes into it. 382 00:23:08,341 --> 00:23:10,436 There are strategies around that. 383 00:23:11,351 --> 00:23:13,811 Prasanna Malaiyandi: I'm gonna take Curtis's favorite question that he 384 00:23:13,811 --> 00:23:19,811 loves to ask in topic, actually, which is, Does Safe Harbor Certification 385 00:23:19,811 --> 00:23:22,361 talk Anything about SaaS applications? 386 00:23:24,131 --> 00:23:25,031 Eric Bursley: It is. 387 00:23:27,191 --> 00:23:34,826 I would say that it doesn't necessarily, um, Dictate one way or the other. 388 00:23:35,036 --> 00:23:39,716 It does say that you are protecting your data in this fashion. 389 00:23:39,716 --> 00:23:46,706 So if you're using a SaaS uh provider such as Microsoft 365, are you backing it up? 390 00:23:47,246 --> 00:23:50,636 And then are you storing that data in a vault? 391 00:23:51,716 --> 00:23:55,376 Um, and that you can actually do an operational recovery? 392 00:23:56,741 --> 00:23:59,801 You know, same, same thing with salesforce.com. 393 00:23:59,831 --> 00:24:05,291 They just started implementing backup through their API for salesforce.com. 394 00:24:05,831 --> 00:24:12,311 Are you protecting that data, storing it in a vault and that becomes 395 00:24:12,341 --> 00:24:15,221 that, that, you know, sort of. 396 00:24:15,596 --> 00:24:17,726 Ecosystem that that pattern. 397 00:24:17,846 --> 00:24:21,866 So they're not dictating SaaS, they're not dictating on-prem, 398 00:24:21,866 --> 00:24:23,366 they're not dictating cloud. 399 00:24:23,606 --> 00:24:28,076 What they are saying is that you have a copy of your data in a vault 400 00:24:28,076 --> 00:24:29,936 that is operationally air gapped. 401 00:24:30,686 --> 00:24:34,016 Prasanna Malaiyandi: Yeah, I was referring also mainly to like SaaS applications. 402 00:24:34,016 --> 00:24:36,686 But you covered it, Eric, like Microsoft 365. 403 00:24:36,686 --> 00:24:39,656 Because a lot of times Right, people are, Curtis, you and I hear this all 404 00:24:39,656 --> 00:24:43,046 the time, it's like, Hey, Microsoft 365, there's no need to back it up. 405 00:24:43,376 --> 00:24:43,766 Right. 406 00:24:43,766 --> 00:24:47,216 And I know that's one of, uh, Curtis's big pet peeves. 407 00:24:47,606 --> 00:24:49,076 Eric Bursley: It, it's one of mine too. 408 00:24:49,076 --> 00:24:50,816 I hear a lot. 409 00:24:50,936 --> 00:24:54,836 Um, every one of my customers are not backing up their 410 00:24:54,836 --> 00:24:56,496 Microsoft 365 environment. 411 00:24:56,921 --> 00:24:59,171 And I advise them that they should. 412 00:24:59,171 --> 00:25:03,641 And then I describe the differences between archive, which they do 413 00:25:03,641 --> 00:25:08,021 provide any true backup solution, which they don't provide. 414 00:25:09,926 --> 00:25:14,861 W. Curtis Preston: So, um, I should probably take notes 415 00:25:14,861 --> 00:25:15,761 so that I can keep track. 416 00:25:17,141 --> 00:25:20,321 , my questions are coming in various, in various ways, but the 417 00:25:20,321 --> 00:25:22,091 one that's in my head right now. 418 00:25:22,331 --> 00:25:29,231 So I know that you have this, this concept of, um, uh, alliance partners and I do 419 00:25:29,231 --> 00:25:32,621 see, you know, a couple of companies on there, obviously that I recognize. 420 00:25:33,311 --> 00:25:36,941 There's only one that says endorsed. 421 00:25:37,421 --> 00:25:39,431 Um, and I'm, and it's Dell. 422 00:25:39,821 --> 00:25:44,681 And it says, uh, they, they can help your financial institution expedite sheltered 423 00:25:44,681 --> 00:25:50,471 Harbor Data Protective certification with long name the first turnkey data 424 00:25:50,471 --> 00:25:54,011 vaulting solution to receive endorsement for meeting all of the requirements 425 00:25:54,011 --> 00:25:55,331 of the Sheltered Harbor standard. 426 00:25:55,691 --> 00:25:56,771 That's interesting. 427 00:25:56,951 --> 00:26:02,501 So there wa there there was some sort of process that they went through to 428 00:26:02,501 --> 00:26:05,291 satisfy someone at Sheltered Harbor. 429 00:26:05,351 --> 00:26:06,071 Enough. 430 00:26:06,696 --> 00:26:10,586 that they can say, this solution meets all of the requirements. 431 00:26:11,216 --> 00:26:17,186 Um, and, and the, because there are other companies, right, that are on 432 00:26:17,186 --> 00:26:20,996 there listed as alliance partners that would be competitors of Dell. 433 00:26:21,506 --> 00:26:25,046 Um, and, and by the way, before we continue a little bit farther, I'm just, 434 00:26:25,046 --> 00:26:26,486 I forgot to throw out our disclaimer. 435 00:26:27,026 --> 00:26:30,836 Uh, I work for Druva, Prasanna, works for Zoom, and uh, although 436 00:26:30,836 --> 00:26:33,686 we're talking about very, you know, stuff right up our neighborhood, 437 00:26:33,686 --> 00:26:37,736 this is an independent podcast and the opinions that here are ours. 438 00:26:38,066 --> 00:26:40,556 And, uh, if you wanna join the conversation, please reach 439 00:26:40,556 --> 00:26:41,936 out to me at w Curtis Preston. 440 00:26:42,521 --> 00:26:48,401 On Twitter, I'm sorry, WC Preston on Twitter or w Curtis Preston gmail. 441 00:26:48,851 --> 00:26:53,591 And, um, you know, and say, Hey, I got stuff to talk about in this neighborhood. 442 00:26:54,131 --> 00:26:58,751 Um, and uh, also be sure to rate us, um, just scroll down to the bottom. 443 00:26:58,841 --> 00:27:01,211 You're probably listening on Apple Podcast. 444 00:27:01,601 --> 00:27:02,231 Most of you are. 445 00:27:02,471 --> 00:27:03,791 Just scroll down to the bottom there. 446 00:27:03,791 --> 00:27:05,411 Click, click five stars. 447 00:27:05,411 --> 00:27:06,581 Hey, give us six stars. 448 00:27:06,586 --> 00:27:07,271 I'm fine with that. 449 00:27:07,571 --> 00:27:09,371 And, uh, give us a comment. 450 00:27:09,371 --> 00:27:09,941 We love that. 451 00:27:10,556 --> 00:27:14,726 Um, so yeah, so I see that like some companies are, are listed as alliance 452 00:27:14,726 --> 00:27:20,126 partners, but only one is listed as endorsed, which surprised me honestly. 453 00:27:20,186 --> 00:27:26,546 Uh, organizations like this don't tend to endorse it, actually uses that word. 454 00:27:27,176 --> 00:27:28,406 Uh, any thoughts on that? 455 00:27:29,381 --> 00:27:34,481 Eric Bursley: Well, the Dell Cyber Recovery Solution was one of the first 456 00:27:34,486 --> 00:27:37,791 to market, um, with their solution. 457 00:27:37,796 --> 00:27:41,921 It is a very strong solution that is powered by their Power Protect gated 458 00:27:41,921 --> 00:27:48,491 domain product, um, that can provide you with an immutable, um, solution. 459 00:27:49,481 --> 00:27:54,281 Um, the cyber recovery vault, leveraging all of Dell's technology. 460 00:27:54,521 --> 00:27:56,381 Dell PowerEdge, Dell Switch. 461 00:27:58,061 --> 00:28:03,401 Um, partnership with Sonic Wall Firewall, um, as well as Avamar 462 00:28:03,401 --> 00:28:07,451 or Networker or the Power Protect, uh, data Protection Appliance. 463 00:28:07,871 --> 00:28:10,701 Um, it, it's an all-encompassing solution. 464 00:28:10,706 --> 00:28:18,821 So Sheltered Harbor was able to say if implemented via this process, it 465 00:28:18,821 --> 00:28:23,081 gives you that leg up, making it super simple to achieve our certification. 466 00:28:24,161 --> 00:28:26,141 They were one of the first to market to do that. 467 00:28:26,976 --> 00:28:33,221 , um, since, um, that happened, we've had this thing called a pandemic that 468 00:28:33,221 --> 00:28:36,281 shut down a lot of those processes. 469 00:28:36,611 --> 00:28:41,891 Um, and Shelton Harbor couldn't go through, um, some of the other OEMs, um, 470 00:28:41,891 --> 00:28:43,961 that wanted to achieve this certification. 471 00:28:44,351 --> 00:28:50,081 Um, And one of those processes, uh, like I said, was the ability to 472 00:28:50,321 --> 00:28:55,691 pull the data into the vault rather than pushing it into the vault. 473 00:28:56,141 --> 00:29:04,241 Um, w with that, um, since the pandemic is nearing at its end, um, other 474 00:29:04,631 --> 00:29:11,072 products are becoming, um, able to achieve the certification, although they 475 00:29:11,077 --> 00:29:13,301 haven't been fully endorsed by Sheldon. 476 00:29:14,336 --> 00:29:14,816 W. Curtis Preston: Gotcha. 477 00:29:14,876 --> 00:29:15,356 Gotcha. 478 00:29:16,016 --> 00:29:16,646 Um, 479 00:29:16,831 --> 00:29:19,141 Prasanna Malaiyandi: I think that was why in the beginning I was wondering, Eric, 480 00:29:19,141 --> 00:29:20,641 around sort of that certification, right? 481 00:29:20,641 --> 00:29:24,661 If it was the customer, like the bank, or if it was a vendor who was actually 482 00:29:24,661 --> 00:29:27,001 getting the certification, right. 483 00:29:27,021 --> 00:29:30,701 Um, I could see that in the case of Dell is like, Hey, we have everything 484 00:29:30,701 --> 00:29:35,081 packaged together so it becomes easier for the bank or the customer 485 00:29:35,081 --> 00:29:36,971 to just start, deploy and use it. 486 00:29:37,361 --> 00:29:37,661 Right. 487 00:29:37,661 --> 00:29:40,271 But that's why I was wondering like where it actually ends up being. 488 00:29:40,331 --> 00:29:40,721 Eric Bursley: Right. 489 00:29:40,811 --> 00:29:45,301 And yeah, the sheltered harbor is granted by the financial 490 00:29:45,521 --> 00:29:47,591 institution that is seeking it. 491 00:29:47,891 --> 00:29:49,811 Um, there's actually a process that they go through. 492 00:29:49,811 --> 00:29:54,701 They have to register as a client of Sheed Harbor and based on how much. 493 00:29:55,391 --> 00:30:01,751 Money their institution has, they pay to that specific level and then they 494 00:30:01,751 --> 00:30:05,861 go through that process to validate that they have the solution in place. 495 00:30:06,221 --> 00:30:11,321 Um, there are definitely other solutions outside of the cyber recovery vault 496 00:30:11,321 --> 00:30:13,361 from Dell that can achieve this. 497 00:30:13,391 --> 00:30:15,061 It, it's not just limited to that product. 498 00:30:16,076 --> 00:30:20,576 W. Curtis Preston: Uh, I, I'm assuming, um, , you know, if somebody want, if 499 00:30:20,581 --> 00:30:24,506 a, if a financial organization wanted to join, there would be, there's some 500 00:30:24,506 --> 00:30:29,876 sort of fee that you need to provide to achieve certification, given that there's 501 00:30:29,876 --> 00:30:32,156 gonna be a cost involved with somebody 502 00:30:32,351 --> 00:30:32,621 Eric Bursley: Right. 503 00:30:32,621 --> 00:30:33,071 Yes. 504 00:30:33,101 --> 00:30:37,391 The, there is a, uh, stair stepped approach based on the financial holdings 505 00:30:37,391 --> 00:30:39,731 that the, uh, financial institution has. 506 00:30:40,001 --> 00:30:42,581 Um, and, and that is published on their website. 507 00:30:44,106 --> 00:30:46,626 Prasanna Malaiyandi: I look at it similar to like when an organization 508 00:30:46,626 --> 00:30:48,336 goes through like a SOC two audit, right? 509 00:30:48,336 --> 00:30:49,566 It's kind of like that, right? 510 00:30:49,566 --> 00:30:52,596 You're getting certified that yes, everything's in place, 511 00:30:52,596 --> 00:30:55,206 everything's good to go with the solutions that you've chosen, 512 00:30:55,656 --> 00:30:55,986 Eric Bursley: Right. 513 00:30:55,991 --> 00:30:56,016 E. 514 00:30:56,356 --> 00:30:56,716 Exactly. 515 00:30:56,736 --> 00:31:02,036 And this actually would help with the insurance organizations as well, because. 516 00:31:02,871 --> 00:31:07,431 Many insurance companies are saying you need to have certain things in place 517 00:31:07,431 --> 00:31:11,931 in order to get, you know us to pay for 518 00:31:11,931 --> 00:31:12,561 an incident. 519 00:31:13,281 --> 00:31:14,001 Right, exactly. 520 00:31:14,001 --> 00:31:14,781 To get a rate. 521 00:31:15,081 --> 00:31:18,921 If a financial institution goes to an insurance provider and say, Hey, 522 00:31:19,071 --> 00:31:25,011 we just received this Safe Harbor certification, the insurance company 523 00:31:25,011 --> 00:31:29,841 can actually come back and say, you've done all these check boxes. 524 00:31:30,561 --> 00:31:34,941 So we're gonna give you a lower rate, or we're gonna offer you a policy 525 00:31:34,941 --> 00:31:39,261 where if the financial institution didn't have this, then they would have 526 00:31:39,266 --> 00:31:41,211 to go manually check that themselves. 527 00:31:42,861 --> 00:31:45,711 So it, it can streamline your insurance process as well. 528 00:31:46,856 --> 00:31:47,756 W. Curtis Preston: Yeah, it's it. 529 00:31:47,936 --> 00:31:51,986 What do you think it or, or have you heard that it could 530 00:31:51,991 --> 00:31:56,216 also assist in lower rates or 531 00:31:56,361 --> 00:31:58,491 Eric Bursley: That would be up to the insurance company, but I would 532 00:31:58,491 --> 00:32:03,921 imagine so because it's gonna be less likely that you're unable 533 00:32:03,921 --> 00:32:05,691 to recover in a timely fashion. 534 00:32:08,221 --> 00:32:11,096 That's one of the things that the insurance company wants to do is 535 00:32:11,096 --> 00:32:16,266 ensure that you get back to operational effectiveness as soon as possible. 536 00:32:16,556 --> 00:32:20,526 Um, get back to business achieving this certification. 537 00:32:21,611 --> 00:32:26,081 Can't assure you that you would be able to be back up and running within 24 hours. 538 00:32:27,986 --> 00:32:30,446 Prasanna Malaiyandi: It's like I, like Curtis said at the start of this, 539 00:32:30,446 --> 00:32:34,646 right, it was like the first time we had heard about this term, right? 540 00:32:34,646 --> 00:32:36,086 In being in the backup space. 541 00:32:36,091 --> 00:32:36,296 Right. 542 00:32:36,296 --> 00:32:38,876 And I'm wondering like, is it more common? 543 00:32:39,146 --> 00:32:44,156 Like, is this a well known certification in like the financial institutions 544 00:32:44,156 --> 00:32:45,416 and in the insurance business? 545 00:32:45,416 --> 00:32:51,416 Or is this something new and upcoming that is going to take, um, time to achieve 546 00:32:51,421 --> 00:32:55,346 critical mass, but it is like a future standard that everyone's looking toward. 547 00:32:56,516 --> 00:32:59,456 Eric Bursley: Say that it's more of a future standard at this point. 548 00:32:59,516 --> 00:33:02,336 I was just talking with a financial customer yesterday. 549 00:33:02,786 --> 00:33:06,236 He was unaware of Shelton Harbor. 550 00:33:06,241 --> 00:33:10,586 He actually had to go look it up, and then he was extremely intrigued, uh, 551 00:33:10,586 --> 00:33:13,046 around the framework that it offers. 552 00:33:13,256 --> 00:33:17,456 Um, and we're gonna have a follow up conversation, um, with him regarding 553 00:33:17,456 --> 00:33:22,976 our ransomware workshop that we have so that he can understand the value. 554 00:33:23,891 --> 00:33:27,551 You know, protecting his data more with the data vault, um, and how 555 00:33:27,551 --> 00:33:31,061 we would implement that so that he can achieve sheltered harbor. 556 00:33:31,391 --> 00:33:35,201 Um, I also gave him a reference of one of my larger financial customers that 557 00:33:35,201 --> 00:33:39,131 is currently in the process of getting Sheltered Harbor certification so that he 558 00:33:39,131 --> 00:33:40,841 can have a one-on-one conversation with. 559 00:33:41,921 --> 00:33:42,411 Prasanna Malaiyandi: Nice. 560 00:33:42,521 --> 00:33:45,461 W. Curtis Preston: Yeah, I, I will say, you know, when I first heard about it, 561 00:33:45,461 --> 00:33:51,041 and you know, just the first few words, my first worry, which doesn't appear to be 562 00:33:51,041 --> 00:33:57,491 the case, but my first worry was that this was just, even though it's a nonprofit, 563 00:33:57,491 --> 00:33:58,871 I mean, anybody can start a nonprofit. 564 00:33:59,546 --> 00:34:04,796 That it was just a marketing arm, marketing leg, whatever, you know, 565 00:34:04,796 --> 00:34:08,756 that, you know, like, like in this case it would, I, I would accuse 566 00:34:08,756 --> 00:34:11,636 Dell of it since they were the first one to get endorsed, right. 567 00:34:11,636 --> 00:34:13,016 That Dell went and started this. 568 00:34:13,736 --> 00:34:15,836 So that they could give themselves certification. 569 00:34:15,836 --> 00:34:17,336 I'm not accusing Dell of anything. 570 00:34:17,486 --> 00:34:21,326 I'm just saying I was worried that I would, that that's what I 571 00:34:21,326 --> 00:34:25,436 would find is that I would find a marketing driven organization. 572 00:34:25,796 --> 00:34:28,556 And that does not appear to be the case. 573 00:34:28,556 --> 00:34:33,686 It appears that it, this is led by the financial industries or 574 00:34:33,686 --> 00:34:39,116 the, the financial institutions and the associations, uh, thereof. 575 00:34:39,146 --> 00:34:40,946 Does that, does that sound about. 576 00:34:41,891 --> 00:34:43,511 Eric Bursley: That would be correct, Curtis. 577 00:34:44,561 --> 00:34:45,041 W. Curtis Preston: Yeah. 578 00:34:45,251 --> 00:34:48,491 Um, and the, the worry of 579 00:34:48,571 --> 00:34:49,261 Prasanna Malaiyandi: your other worry? 580 00:34:49,751 --> 00:34:53,591 W. Curtis Preston: well, well, that, that the worry came from the fact that 581 00:34:53,591 --> 00:34:56,291 there is this dual certification, right? 582 00:34:56,291 --> 00:34:59,201 The certification is for the company, but then there's also this 583 00:34:59,201 --> 00:35:02,171 potential endorsement of the vendors. 584 00:35:02,591 --> 00:35:07,241 And, uh, so I was worried that this was just a big ruse for the vendors to 585 00:35:07,241 --> 00:35:09,101 have a, to put another badge on their. 586 00:35:10,426 --> 00:35:12,686 but it doesn't appear to be the case. 587 00:35:13,196 --> 00:35:13,946 Um 588 00:35:14,081 --> 00:35:14,501 Eric Bursley: Yeah. 589 00:35:14,831 --> 00:35:19,091 For Dell to come out and say that they were endorsed, it is not, 590 00:35:19,541 --> 00:35:22,171 you know, checking the box and say you're certified if you have it. 591 00:35:23,096 --> 00:35:27,731 . You can be certified if you have it, but you also have other processes 592 00:35:27,911 --> 00:35:32,921 that you have to implement around your enterprise maturity to ensure 593 00:35:33,071 --> 00:35:35,771 that you have this process in place. 594 00:35:36,071 --> 00:35:38,731 Dell gives you a leg up with their solution. 595 00:35:39,206 --> 00:35:39,746 W. Curtis Preston: Yeah. 596 00:35:39,941 --> 00:35:42,251 Eric Bursley: but like I was saying, there are other solutions 597 00:35:42,251 --> 00:35:43,721 that can do this as well. 598 00:35:43,721 --> 00:35:46,901 Now it's just a matter of time before they also get endorse. 599 00:35:47,246 --> 00:35:47,486 W. Curtis Preston: Yeah. 600 00:35:47,486 --> 00:35:52,466 Actually, the fact that the website is kind of a little behind, sort of backs 601 00:35:52,466 --> 00:35:56,846 up the fact that this isn't a marketing driven thing, , because if this was 602 00:35:56,846 --> 00:36:00,716 marketing driven, this would be up to date with all those other companies, right? 603 00:36:00,776 --> 00:36:04,196 Um, and they, they, they throw as much money as they need 604 00:36:04,201 --> 00:36:05,816 to, to, to get it updated. 605 00:36:06,356 --> 00:36:07,016 Um, 606 00:36:08,306 --> 00:36:08,726 Prasanna Malaiyandi: The 607 00:36:08,966 --> 00:36:09,466 W. Curtis Preston: Go ahead. 608 00:36:09,586 --> 00:36:12,686 Prasanna Malaiyandi: the one, the other question I had though is I 609 00:36:12,686 --> 00:36:14,936 think this is a great certification. 610 00:36:15,386 --> 00:36:21,806 I just feel it's yet another isolated, separate process rather than thinking 611 00:36:21,806 --> 00:36:25,916 holistically and integrating into some other existing framework. 612 00:36:26,966 --> 00:36:28,946 Uh, to elaborate a bit, right? 613 00:36:28,946 --> 00:36:30,986 This is just focused on backup. 614 00:36:30,986 --> 00:36:33,086 Can you recover your data, right? 615 00:36:33,086 --> 00:36:36,056 Rather than sort of encompassing, okay, do you have the appropriate 616 00:36:36,056 --> 00:36:37,856 cybersecurity measures in place? 617 00:36:38,186 --> 00:36:41,096 And thinking from, let's start from who or let's look 618 00:36:41,096 --> 00:36:42,326 holistically at your environment. 619 00:36:42,746 --> 00:36:46,306 Make sure you're just not looking at authorization and login in, 620 00:36:46,306 --> 00:36:49,496 in that environment, but also across your entire infrastructure. 621 00:36:49,496 --> 00:36:49,706 Right? 622 00:36:49,706 --> 00:36:51,866 Do you have the right level, sort of the. 623 00:36:52,316 --> 00:36:55,016 things, Curtis, that we've talked with Snorkel 42 about, right. 624 00:36:55,016 --> 00:37:00,626 It's do you have like lease privilege set up and do you have those front 625 00:37:00,626 --> 00:37:05,036 end cyber monitoring tools to look for malware on production? 626 00:37:06,151 --> 00:37:06,511 W. Curtis Preston: MFA 627 00:37:06,986 --> 00:37:08,936 Prasanna Malaiyandi: like just, and mfa, right? 628 00:37:08,941 --> 00:37:14,096 It's just seems like this is just such a small portion of things that can go wrong. 629 00:37:14,096 --> 00:37:17,216 It's a great effort, no doubt about it, but it just feels a 630 00:37:17,216 --> 00:37:20,546 little isolated and siloed really, when people should be thinking. 631 00:37:21,311 --> 00:37:23,381 Broadly across their entire organization. 632 00:37:23,426 --> 00:37:24,716 Eric Bursley: Well, e Exactly. 633 00:37:24,721 --> 00:37:29,336 And that's where Presidio would talk about the NIST framework so 634 00:37:29,336 --> 00:37:34,826 that you can, uh, identify, protect, detect, respond, and then recover. 635 00:37:35,381 --> 00:37:40,931 In the terms of the NIST framework, this is addressing the recovery operation. 636 00:37:41,171 --> 00:37:43,181 Are you able to successfully recover? 637 00:37:43,481 --> 00:37:48,551 Um, but I agree with you that they have to have other processes in place and that 638 00:37:48,551 --> 00:37:53,381 leads to their enterprise maturity around do they have the right authorization, 639 00:37:53,381 --> 00:37:55,781 authentication systems in place? 640 00:37:56,021 --> 00:37:57,011 Are they monitoring? 641 00:37:57,011 --> 00:37:58,991 Do they have two factor authentication? 642 00:37:59,261 --> 00:38:01,151 Um, do they have geolocation? 643 00:38:01,496 --> 00:38:04,346 Turned on in their Azure ad, for example. 644 00:38:04,526 --> 00:38:11,786 Um, how are they protecting their users, um, from a user, um, education standpoint? 645 00:38:12,086 --> 00:38:17,006 Um, you know, are they using products like no before and other similar 646 00:38:17,006 --> 00:38:24,746 products that actually educate users and test users on their functional, um, 647 00:38:24,776 --> 00:38:28,846 day-to-day operations that they don't get a ransomware infection to begin? 648 00:38:31,186 --> 00:38:35,866 W. Curtis Preston: So I'm gonna not push back or argue with you persona, 649 00:38:35,871 --> 00:38:37,516 necessarily with the comment. 650 00:38:37,516 --> 00:38:39,076 I, I, I, I agree. 651 00:38:39,076 --> 00:38:43,376 And yet, as a backup guy, I'm saying, well, at least somebody's 652 00:38:43,381 --> 00:38:50,236 looking after the backups because so many, so much of the anti. 653 00:38:50,656 --> 00:38:55,606 Ransomware and malware efforts is all on the online stuff, and no one's 654 00:38:55,611 --> 00:38:58,846 paying any attention to the backups, which is something that, you know, 655 00:38:58,846 --> 00:39:03,436 we talk about a lot on this podcast where we're saying, Hey, they are 656 00:39:03,441 --> 00:39:07,606 coming for your backups, or they're directly attacking your backup system. 657 00:39:07,786 --> 00:39:08,716 Prasanna Malaiyandi: It's a starting point, 658 00:39:08,786 --> 00:39:09,146 right? 659 00:39:09,286 --> 00:39:11,956 W. Curtis Preston: My, my only thing when I look at, it's like, well, 660 00:39:12,546 --> 00:39:17,266 it would be nice if organizations who weren't financial organizations 661 00:39:18,106 --> 00:39:22,336 could, could get a similar level of attention to their backup environment. 662 00:39:22,426 --> 00:39:22,846 Right. 663 00:39:23,326 --> 00:39:27,526 Um, and they specifically say, you're only welcome to join and get certification 664 00:39:27,526 --> 00:39:29,146 if you're a financial institution. 665 00:39:29,866 --> 00:39:32,266 Um, and I'm like, Hey, you know, there. 666 00:39:33,441 --> 00:39:35,971 I don't know, a couple of hundred other industries I can think of that 667 00:39:35,971 --> 00:39:37,591 could really benefit from that as well. 668 00:39:38,341 --> 00:39:44,791 Eric Bursley: There's nothing stopping the, um, other industries from using 669 00:39:44,791 --> 00:39:47,401 the framework that Sheltered Harbor has. 670 00:39:47,641 --> 00:39:51,211 It's just a matter of, you know, getting the certification. 671 00:39:51,421 --> 00:39:53,551 Right now, it is just a financial industry. 672 00:39:54,031 --> 00:39:58,621 Um, you know, they may extend that out at some point in the future. 673 00:39:58,861 --> 00:40:00,201 Um, that would be up. 674 00:40:01,531 --> 00:40:02,011 W. Curtis Preston: Yeah. 675 00:40:02,551 --> 00:40:04,731 And who and who is them, by the way? 676 00:40:06,061 --> 00:40:07,591 Eric Bursley: Shelter harbor.org. 677 00:40:07,831 --> 00:40:07,891 W. Curtis Preston: no. 678 00:40:07,891 --> 00:40:09,311 I know you meant sheltered harbor. 679 00:40:10,501 --> 00:40:14,281 There are people who, where, where do these people work? 680 00:40:14,341 --> 00:40:16,891 Are they, are they, do they work for Shelter Harbor? 681 00:40:16,891 --> 00:40:18,061 Do they work for banks? 682 00:40:18,061 --> 00:40:19,561 And this is like their side gig. 683 00:40:19,561 --> 00:40:19,891 What? 684 00:40:20,611 --> 00:40:21,511 You know, because 685 00:40:22,606 --> 00:40:25,516 Eric Bursley: Yeah, I, I don't get into that, so I don't 686 00:40:25,516 --> 00:40:25,966 know. 687 00:40:26,056 --> 00:40:29,896 Um, I believe that they're an independent organization outside 688 00:40:29,896 --> 00:40:32,926 of the banking industry that's assisting the banking industry. 689 00:40:33,286 --> 00:40:36,376 Um, reading their backstory, they came from the banking 690 00:40:36,376 --> 00:40:37,846 industry and financial industry. 691 00:40:39,466 --> 00:40:41,536 W. Curtis Preston: Oh, uh, this says it's actually a 692 00:40:41,536 --> 00:40:45,136 nonprofit subsidiary of FS Isaac. 693 00:40:45,676 --> 00:40:49,276 So that's the Financial Services information sharing and analysis 694 00:40:49,281 --> 00:40:51,976 Center for those of you that don't live banking world. 695 00:40:52,696 --> 00:40:56,596 Um, and devoted to the coordinating the development 696 00:40:56,596 --> 00:40:57,556 of the Shelter Harbor Standard. 697 00:40:57,796 --> 00:40:58,366 I like that. 698 00:40:58,876 --> 00:40:59,596 Um, 699 00:41:00,526 --> 00:41:04,066 Prasanna Malaiyandi: Is there framework available online, do you know? 700 00:41:04,546 --> 00:41:05,476 Or do you have to 701 00:41:05,671 --> 00:41:07,231 W. Curtis Preston: I've been, I've been scrolling around. 702 00:41:07,231 --> 00:41:08,681 I didn't see the framework anywhere. 703 00:41:09,271 --> 00:41:09,691 Eric Bursley: Right. 704 00:41:09,691 --> 00:41:14,851 So you have to become one of their clients to get all of 705 00:41:14,851 --> 00:41:17,521 the requirements, um, in place. 706 00:41:17,791 --> 00:41:22,411 Um, the OEMs have those requirements, um, so that, you 707 00:41:22,416 --> 00:41:24,271 know, they can tell you what it is. 708 00:41:24,271 --> 00:41:30,031 But when you apply for membership, then you're going to get the 709 00:41:30,031 --> 00:41:33,781 actual certification requirements to go and check the box. 710 00:41:34,621 --> 00:41:37,351 Prasanna Malaiyandi: See, this is what annoys me though, is that it's 711 00:41:37,351 --> 00:41:39,211 like, this is a great framework. 712 00:41:39,211 --> 00:41:40,621 We want everyone to use this. 713 00:41:40,801 --> 00:41:45,541 I know they want the financials, but it's broadly applicable, and yet 714 00:41:45,631 --> 00:41:49,111 you have to jump through all these hoops just to even try to get to 715 00:41:49,116 --> 00:41:51,601 see the list of, hey, what's there? 716 00:41:51,736 --> 00:41:52,006 W. Curtis Preston: yeah. 717 00:41:52,006 --> 00:41:55,396 So I'm gonna, I'm gonna have to disagree with what you said earlier, Eric, 718 00:41:55,396 --> 00:41:58,146 when you said there's nothing stopping them from implementing the standard. 719 00:41:58,696 --> 00:41:59,716 Uh, yeah, it is. 720 00:41:59,721 --> 00:42:03,946 They don't even, I can't even find out what the standard is if they can't join. 721 00:42:04,096 --> 00:42:06,796 Eric Bursley: on their website they tell you that you need to 722 00:42:06,796 --> 00:42:11,446 implement a data vault and that you have to have a resiliency plan in 723 00:42:11,446 --> 00:42:12,016 W. Curtis Preston: Right. 724 00:42:12,756 --> 00:42:13,106 Eric Bursley: Um, 725 00:42:13,936 --> 00:42:16,156 Prasanna Malaiyandi: Or, or I would say that you could work with 726 00:42:16,156 --> 00:42:18,526 the company like Presidio, right? 727 00:42:18,526 --> 00:42:23,386 Who knows these standards and who's providing a more holistic thing, right? 728 00:42:23,386 --> 00:42:25,876 So it is possible, 729 00:42:26,221 --> 00:42:26,611 Eric Bursley: Right. 730 00:42:26,611 --> 00:42:26,941 It is 731 00:42:27,316 --> 00:42:29,896 Prasanna Malaiyandi: but it's not as easy for anyone to be like, Hey, what is there? 732 00:42:30,556 --> 00:42:30,796 Right. 733 00:42:30,801 --> 00:42:33,616 I think that's my problem is it shouldn't be a secret 734 00:42:34,951 --> 00:42:35,671 W. Curtis Preston: And, and yeah. 735 00:42:35,671 --> 00:42:37,051 And I don't think it's secret per se. 736 00:42:37,201 --> 00:42:38,191 I, I agree with you, Eric. 737 00:42:38,191 --> 00:42:41,281 I mean, I'm looking, they have like why Sheltered Harbor? 738 00:42:41,281 --> 00:42:45,001 And they, they've got a nice little page on the, the different stuff. 739 00:42:45,091 --> 00:42:50,131 Um, I don't know, maybe the, somewhere between where they are and I don't know. 740 00:42:50,861 --> 00:42:56,761 I, I don't know why they would, I, I think maybe there could be a, these are. 741 00:42:57,511 --> 00:42:58,831 20 things you need to do. 742 00:42:58,831 --> 00:43:00,421 I think they're giving a high level plan. 743 00:43:00,421 --> 00:43:01,891 Perhaps they could do a low level plan. 744 00:43:01,891 --> 00:43:05,701 Perhaps they could say, Hey, you can't join, but hey, for a hundred 745 00:43:05,701 --> 00:43:08,101 bucks you could have the, whatever, whatever it is we're missing. 746 00:43:08,371 --> 00:43:11,851 Um, but, uh, or maybe we're not missing that much. 747 00:43:11,881 --> 00:43:12,361 I don't know. 748 00:43:13,921 --> 00:43:15,691 , we don't know what we don't know. 749 00:43:16,261 --> 00:43:22,231 Um, yeah, but it, I applaud the, I applaud the effort to make backups 750 00:43:22,231 --> 00:43:24,721 more resilient, uh, and to, and. 751 00:43:25,591 --> 00:43:28,741 also, what I'm seeing here is the resiliency plan. 752 00:43:28,951 --> 00:43:31,591 That's what it's really about, right? 753 00:43:31,621 --> 00:43:36,661 It's, it's almost less about what backup product that you use. 754 00:43:37,771 --> 00:43:40,261 It is definitely about how you use it, right? 755 00:43:40,741 --> 00:43:46,291 Um, but it's about what, earlier we had this discussion about 756 00:43:46,441 --> 00:43:48,691 how are we going to, with the. 757 00:43:50,321 --> 00:43:53,491 Scenarios that you, that you've got in terms of infection and encryption 758 00:43:53,491 --> 00:43:56,251 and what decisions are you gonna make. 759 00:43:56,701 --> 00:43:59,881 That's what you need to discuss upfront, right? 760 00:44:00,061 --> 00:44:00,361 Okay. 761 00:44:00,361 --> 00:44:04,681 We've got aws, we've got VMware, we've got physical machines, we've 762 00:44:04,686 --> 00:44:07,591 got these kind of application servers, we've got a file server. 763 00:44:07,681 --> 00:44:12,421 Here's what we need to make the decision upfront, what we're gonna 764 00:44:12,421 --> 00:44:13,921 do with all those various things. 765 00:44:14,011 --> 00:44:14,401 Right? 766 00:44:14,431 --> 00:44:15,391 Given there are different. 767 00:44:15,481 --> 00:44:19,651 Eric Bursley: What Well, exactly, and, and part of their framework, they talk 768 00:44:19,651 --> 00:44:21,481 about an incident management plan. 769 00:44:21,811 --> 00:44:27,061 You know, do you have an incident response process? 770 00:44:27,271 --> 00:44:32,671 Um, and it, it can be as simple as, you know, filling out a ServiceNow ticket 771 00:44:32,671 --> 00:44:39,021 and, um, either an automated or a manual process kicks off a, a security. 772 00:44:40,336 --> 00:44:43,771 , um, as we call it here, um, which is different than your operational 773 00:44:43,771 --> 00:44:47,761 or disaster recovery re restore of your application following 774 00:44:47,761 --> 00:44:48,991 that incident response plan. 775 00:44:48,991 --> 00:44:53,041 You know, calling the insurance carrier, Hey, so-and-so was infected. 776 00:44:53,041 --> 00:44:54,901 It took down this specific system. 777 00:44:54,901 --> 00:44:59,401 We are in the process of recovering it and they know from their incident 778 00:44:59,851 --> 00:45:06,241 response plan that they have to have that current system isolated so that it 779 00:45:06,241 --> 00:45:08,411 can be investigated for future forensic. 780 00:45:09,256 --> 00:45:09,676 W. Curtis Preston: Yeah. 781 00:45:09,686 --> 00:45:12,121 Eric Bursley: um, a proper communications plan. 782 00:45:12,121 --> 00:45:14,971 Who's talking to who, who's making decisions? 783 00:45:15,211 --> 00:45:20,131 Um, you know, how are you going to get back to normal operations? 784 00:45:20,131 --> 00:45:24,151 Because if you fail over to that isolated recovery environment, 785 00:45:24,451 --> 00:45:27,781 eventually that's going to cost you more money than you would like. 786 00:45:27,811 --> 00:45:30,991 So how do you bring that back into your production 787 00:45:30,991 --> 00:45:32,641 environment, which may be on pre. 788 00:45:33,256 --> 00:45:40,486 and your, uh, i r e, your integrated, uh, recovery environment could be up in aws. 789 00:45:40,876 --> 00:45:45,016 Um, are you testing your backups? 790 00:45:45,286 --> 00:45:50,296 Something that many of my customers don't do regularly. 791 00:45:50,506 --> 00:45:55,276 Um, I wish they would, but, um, they're not testing their environment to verify 792 00:45:55,546 --> 00:45:58,486 that one, are their backups good? 793 00:45:58,576 --> 00:46:00,256 But are they operationally? 794 00:46:01,481 --> 00:46:06,046 um, not just, I have my exchange server or SQL server backed up, but I'm able to 795 00:46:06,106 --> 00:46:11,076 bring it back up, test it with your active directory, verify ports are functional, 796 00:46:11,081 --> 00:46:14,386 verify that I'm able to send and receive messages, and then shut it down. 797 00:46:14,386 --> 00:46:16,186 Is this is a valid restore point. 798 00:46:17,236 --> 00:46:24,286 It So having that, um, resiliency plan in place, I think is probably the more 799 00:46:24,286 --> 00:46:27,916 important part of having Shelter Harbor certification than just the data. 800 00:46:28,396 --> 00:46:28,816 Prasanna Malaiyandi: And 801 00:46:29,086 --> 00:46:29,686 W. Curtis Preston: Yeah. 802 00:46:32,236 --> 00:46:35,806 Prasanna Malaiyandi: And is a lot of this, I'm guessing, is automated as well, right? 803 00:46:35,806 --> 00:46:41,746 Because I can't imagine doing this sort of verification and recovery processes. 804 00:46:43,786 --> 00:46:48,946 In a periodic fashion, like given the scale of some of this data. 805 00:46:49,231 --> 00:46:53,671 Eric Bursley: Well, some of the products that are offered such as, uh, VMware's 806 00:46:53,701 --> 00:47:01,531 Cloud, disaster Recovery, or Cohesity Fort Knox, or, um, rubrics, um, solution, 807 00:47:01,711 --> 00:47:06,931 um, that they call a cloud vault, actually automate that testing for you. 808 00:47:07,141 --> 00:47:12,241 They can actually spin up an environment from time to time and validate those 809 00:47:12,241 --> 00:47:15,001 solutions in place in their cloud. 810 00:47:15,811 --> 00:47:20,161 Which is isolated, validate the solution and then shut it back down 811 00:47:20,161 --> 00:47:21,781 again, not costing you any money. 812 00:47:22,201 --> 00:47:24,661 So there are solutions like that. 813 00:47:24,991 --> 00:47:29,671 The Dell solution, it, it's something that you would have to manually spin up. 814 00:47:29,701 --> 00:47:31,891 You could probably automate that process. 815 00:47:32,221 --> 00:47:38,221 Um, but even products like Veeam that by itself couldn't achieve this. 816 00:47:38,941 --> 00:47:42,121 They have the solution built in with their data labs. 817 00:47:42,886 --> 00:47:46,216 Functionality to automate the testing of backup. 818 00:47:48,796 --> 00:47:49,276 W. Curtis Preston: Yeah. 819 00:47:49,276 --> 00:47:51,496 Yeah, and, and you know, and I would be remiss. 820 00:47:52,066 --> 00:47:55,396 If I, if I didn't say that Druva has a, has a similar capability, 821 00:47:55,846 --> 00:48:05,416 um, the, the question, the, um, no, I'm just, it should, this is such 822 00:48:05,416 --> 00:48:08,506 a, I, I think the biggest thing is. 823 00:48:09,046 --> 00:48:11,566 We need to have this discussion upfront. 824 00:48:12,556 --> 00:48:12,646 , right? 825 00:48:13,416 --> 00:48:17,866 So many people, they wait until they get that ransomware attack 826 00:48:18,346 --> 00:48:21,676 and, and then they have, and then they have the meeting, right? 827 00:48:21,681 --> 00:48:23,866 They're like, oh yeah, we got, we got good backups, we got it, 828 00:48:24,226 --> 00:48:25,576 we got it in the cloud, right? 829 00:48:25,576 --> 00:48:28,066 We got a copy in the cloud, or we got, you know, whatever it is that they're 830 00:48:28,096 --> 00:48:29,476 doing, whatever it is that they're doing. 831 00:48:29,476 --> 00:48:34,396 And even if they've got a, uh, an air gap copy, if they're not 832 00:48:34,396 --> 00:48:36,556 having this discussion upfront. 833 00:48:37,611 --> 00:48:40,981 Of how are we going to do, what, what are we gonna do? 834 00:48:41,041 --> 00:48:44,131 Like, you, you know, you, you talked about Eric quite a bit about like, who's 835 00:48:44,131 --> 00:48:48,481 gonna make, who makes the decision, who talks to whom, who communicates to the, 836 00:48:48,486 --> 00:48:50,611 to the stakeholders, all of those things. 837 00:48:50,971 --> 00:48:57,721 Um, if you, if you don't have that plan set in advance, uh, it's gonna 838 00:48:57,721 --> 00:49:00,241 be a, it's gonna be a really bad day. 839 00:49:00,721 --> 00:49:03,931 Um, and you're gonna have, you know, I, I, I hate to. 840 00:49:05,431 --> 00:49:07,321 We won't use the, we won't use their name, 841 00:49:07,356 --> 00:49:08,446 Prasanna Malaiyandi: Who do you wanna pick on? 842 00:49:08,476 --> 00:49:09,736 Yeah, who do you wanna pick on today? 843 00:49:09,811 --> 00:49:10,681 W. Curtis Preston: well, okay. 844 00:49:10,681 --> 00:49:11,791 Maybe I'll throw their name out. 845 00:49:11,791 --> 00:49:13,021 Rackspace, right. 846 00:49:13,021 --> 00:49:18,031 You look at, you look at what Rackspace did when, when they had their outage. 847 00:49:18,541 --> 00:49:23,761 Then they tested their recovery plan and it was three weeks 848 00:49:24,901 --> 00:49:26,881 before they got the first. 849 00:49:27,721 --> 00:49:33,451 Uh, exchange server up and running and you know, and because they had made 850 00:49:33,451 --> 00:49:36,991 the quick, uh, and I'm not even saying whether a decision or wrong or right, 851 00:49:36,996 --> 00:49:40,891 but the fact that they had made the decision to go over to Microsoft 365 852 00:49:41,581 --> 00:49:46,171 because exchange was down and then, and then they restored the exchange 853 00:49:46,176 --> 00:49:49,441 servers and it took them two to three weeks to get the exchange servers up. 854 00:49:50,011 --> 00:49:53,401 And then it's like, okay, well how do we get the, the email out of 855 00:49:53,401 --> 00:49:55,111 these exchange servers over to 360? 856 00:49:55,936 --> 00:50:00,046 Oh, well the only way we can do that now is PSTs it. 857 00:50:00,046 --> 00:50:02,956 just felt like the whole thing was shooting from the hip the entire 858 00:50:02,956 --> 00:50:04,816 time and this was never planned. 859 00:50:05,446 --> 00:50:10,636 Um, if it was planned, uh, not a good plan. 860 00:50:11,071 --> 00:50:11,771 Prasanna Malaiyandi: Poor planning 861 00:50:12,466 --> 00:50:12,676 Eric Bursley: Right. 862 00:50:12,916 --> 00:50:13,306 Well, I, 863 00:50:13,696 --> 00:50:14,866 W. Curtis Preston: So yeah, just gotta have that. 864 00:50:14,866 --> 00:50:16,546 You just gotta have that decision upfront. 865 00:50:17,056 --> 00:50:17,716 Um, 866 00:50:17,806 --> 00:50:22,696 Eric Bursley: can't say what their recovery plan was now, but when I worked 867 00:50:22,696 --> 00:50:29,176 at Rackspace many years ago, they, they had a plan that was more valid. 868 00:50:29,961 --> 00:50:30,311 Prasanna Malaiyandi: Mm. 869 00:50:32,041 --> 00:50:33,641 Things have changed maybe over time. 870 00:50:33,796 --> 00:50:36,346 Eric Bursley: yeah, things have changed since I, I left there. 871 00:50:36,346 --> 00:50:40,156 I, I was on the sales side of things and I was able to talk about their 872 00:50:40,156 --> 00:50:43,936 operational and disaster recovery processes that they had in place 873 00:50:44,206 --> 00:50:49,036 because at the time it managed, hosted exchange was one of their main features. 874 00:50:49,456 --> 00:50:53,146 Since then, Microsoft 365 has been stealing their market share. 875 00:50:53,986 --> 00:51:02,356 Um, Obviously because of this event, they didn't have a well-documented process. 876 00:51:02,971 --> 00:51:03,211 Prasanna Malaiyandi: Yeah. 877 00:51:03,496 --> 00:51:08,416 Eric Bursley: Um, and my wife was actually affected by that . It was 878 00:51:08,471 --> 00:51:09,141 Prasanna Malaiyandi: Oh no. 879 00:51:09,346 --> 00:51:12,916 Eric Bursley: yeah, it was not fun for her company for a couple of weeks. 880 00:51:14,911 --> 00:51:15,451 Prasanna Malaiyandi: Oof. 881 00:51:17,311 --> 00:51:18,451 Well, hopefully they got their emails. 882 00:51:21,736 --> 00:51:24,826 Eric Bursley: Um, they're still working on it is my under. 883 00:51:26,051 --> 00:51:27,031 Prasanna Malaiyandi: Oh man. 884 00:51:27,331 --> 00:51:28,381 That is crazy. 885 00:51:28,381 --> 00:51:30,421 It's been like two months almost. 886 00:51:30,886 --> 00:51:34,456 Eric Bursley: Yeah, there, um, she had to manually type in calendar 887 00:51:34,456 --> 00:51:37,396 entries, um, for the majority of her 888 00:51:37,501 --> 00:51:38,251 Prasanna Malaiyandi: Oh my gosh. 889 00:51:40,741 --> 00:51:41,521 Crazy. 890 00:51:42,521 --> 00:51:45,281 W. Curtis Preston: All right, well, uh, we're starting to have technical 891 00:51:45,281 --> 00:51:48,821 issues, so I need to shut this puppy down, but it sounds like, you know, 892 00:51:49,361 --> 00:51:52,601 we, we all agree that this is something that people should do, whether 893 00:51:52,601 --> 00:51:54,251 they're financial institution or not. 894 00:51:54,251 --> 00:51:59,501 They should look at these requirements, like definitely the air gap copy and, 895 00:51:59,561 --> 00:52:05,711 uh, and, and testing and decision making and planning way upfront specifically 896 00:52:05,711 --> 00:52:11,081 for a cyber recovery plan, not a disaster recovery plan, because, you know, it's 897 00:52:11,081 --> 00:52:12,551 a, it's a very, very different thing. 898 00:52:12,881 --> 00:52:16,811 Well, um, I'm sitting here in the blind and so I'm gonna 899 00:52:16,811 --> 00:52:19,481 thank Eric for joining us. 900 00:52:22,326 --> 00:52:22,826 Eric Bursley: All right. 901 00:52:22,826 --> 00:52:23,306 Thank you. 902 00:52:24,576 --> 00:52:28,366 W. Curtis Preston: And thanks for, uh, I don't know what to say with this technical 903 00:52:28,366 --> 00:52:29,326 problems that we're having today. 904 00:52:29,326 --> 00:52:30,526 But thanks for being here. 905 00:52:31,441 --> 00:52:34,381 Prasanna Malaiyandi: Yeah, I Anytime Curtis, and thanks Eric 906 00:52:34,381 --> 00:52:36,541 for teaching me something new that I'd never heard about before. 907 00:52:36,541 --> 00:52:38,101 I'm gonna have to go look up Sheltered Harbor 908 00:52:38,596 --> 00:52:39,196 Eric Bursley: All right. 909 00:52:39,466 --> 00:52:40,036 Thank you. 910 00:52:40,426 --> 00:52:43,936 W. Curtis Preston: And thanks to our listeners, uh, we would be nothing 911 00:52:43,936 --> 00:52:48,526 without you and remember to subscribe so that you can restore it all.