1 00:00:01,114 --> 00:00:04,954 Sometimes those of us in technology think that the solution to every 2 00:00:04,954 --> 00:00:09,334 problem is a new piece of gear or a great piece of software. 3 00:00:09,814 --> 00:00:13,084 I've been guilty of this a lot lately when I've been thinking about 4 00:00:13,084 --> 00:00:15,195 how to prevent data exfiltration. 5 00:00:15,645 --> 00:00:19,005 If we could just get the right AI tool in there, we could spot it as 6 00:00:19,005 --> 00:00:21,015 it's happening and shut it down. 7 00:00:21,525 --> 00:00:27,255 This week's guest is a cyber expert who reminded me that I T has three sides. 8 00:00:27,585 --> 00:00:30,045 He thinks the focus should be on process. 9 00:00:30,135 --> 00:00:32,685 Then people then technology. 10 00:00:33,059 --> 00:00:35,729 Hi, I'm w Curtis press an AKA Mr. 11 00:00:35,729 --> 00:00:36,269 Backup. 12 00:00:36,629 --> 00:00:40,139 I've been specializing in backup and Dr for over 30 years. 13 00:00:40,379 --> 00:00:43,739 And I've written four O'Reilly books on the topic like me. 14 00:00:43,859 --> 00:00:47,549 This podcast is dedicated to those of you who are tasked with 15 00:00:47,549 --> 00:00:49,739 the difficult job of backup Dr. 16 00:00:49,919 --> 00:00:50,909 And data protection. 17 00:00:51,419 --> 00:00:54,269 This is backup, centrals, restore it all. 18 00:01:15,062 --> 00:01:17,942 W. Curtis Preston: Hi, and welcome to Backup Central's Restore It All podcast. 19 00:01:17,952 --> 00:01:18,692 I'm your host, W. 20 00:01:18,692 --> 00:01:20,332 Curtis Preston, aka Mr. 21 00:01:20,342 --> 00:01:24,772 Backup, and today I have with me a guy who gave me some really good advice. 22 00:01:24,772 --> 00:01:27,052 It was really good advice up until it wasn't. 23 00:01:28,042 --> 00:01:31,117 Prasanna Malaiyandi How's it going, Prasanna 24 00:01:31,607 --> 00:01:32,437 Prasanna Malaiyandi: I'm good, Curtis. 25 00:01:32,467 --> 00:01:35,757 I'm curious what this good advice is that was good at the time 26 00:01:35,807 --> 00:01:42,377 W. Curtis Preston: this silver bullet that you gave me called the FCC complaint 27 00:01:44,427 --> 00:01:47,507 Prasanna Malaiyandi: Yeah, I'm surprised not a lot of people know about this. 28 00:01:47,547 --> 00:01:51,177 if you have an issue with your cell phone provider or your cable company, right? 29 00:01:51,617 --> 00:01:52,567 Or internet provider. 30 00:01:52,567 --> 00:01:56,007 you call them in, you complain to them, they give you the runaround, 31 00:01:56,007 --> 00:01:59,677 and then you spend weeks and weeks, and nothing ever happens. 32 00:01:59,957 --> 00:02:01,327 W. Curtis Preston: and you're not anywhere. 33 00:02:01,497 --> 00:02:02,237 Prasanna Malaiyandi: exactly. 34 00:02:02,437 --> 00:02:06,797 And then you have this magic thing called the FCC, where you can actually file 35 00:02:06,797 --> 00:02:12,597 a complaint, and say, hey, my billing is off, or my service isn't right, and 36 00:02:12,997 --> 00:02:16,897 the provider literally has to respond to you within, I think it's 72 hours. 37 00:02:17,692 --> 00:02:18,872 W. Curtis Preston: I had never heard of such a thing. 38 00:02:18,882 --> 00:02:20,522 And, and being a person who... 39 00:02:20,882 --> 00:02:23,642 Having, worked for the government at a point, I definitely understand 40 00:02:23,642 --> 00:02:25,002 the inefficiency of government. 41 00:02:25,002 --> 00:02:28,452 So the idea that something could be so efficient was definitely. 42 00:02:28,792 --> 00:02:29,652 a surprise. 43 00:02:29,982 --> 00:02:35,332 the last time I did this ironically enough, now, as this story comes full 44 00:02:35,332 --> 00:02:39,322 circle, I was having problems with Cox as my internet, service provider. 45 00:02:39,782 --> 00:02:41,412 I put in an FCC complaint. 46 00:02:41,842 --> 00:02:45,392 And in the end, we did figure out the problem. 47 00:02:45,822 --> 00:02:50,162 And then I changed to Verizon 5G internet. 48 00:02:50,622 --> 00:02:53,022 And everything was fine until it wasn't. 49 00:02:53,022 --> 00:02:55,612 And then I decided to use this magic bullet again. 50 00:02:56,074 --> 00:02:58,044 I got the call within 72 hours. 51 00:02:58,104 --> 00:03:01,904 During the time that they were working on it, it went from being an intermittent 52 00:03:01,904 --> 00:03:04,514 problem to being all the time. 53 00:03:05,444 --> 00:03:10,264 The official response from Verizon is I will obviously be, Paraphrasing 54 00:03:10,364 --> 00:03:12,864 slightly., yeah, you're right. 55 00:03:13,004 --> 00:03:13,864 We suck. 56 00:03:14,054 --> 00:03:16,754 You should probably get a different ISP. 57 00:03:17,484 --> 00:03:20,294 By the way, I'm not just complaining about like low speeds. 58 00:03:20,614 --> 00:03:22,114 My internet would just drop. 59 00:03:22,474 --> 00:03:26,394 Sometimes in the middle of recording one of these episodes, my internet would just 60 00:03:27,714 --> 00:03:32,954 but basically they said the reason your internet is just dropping, it's congestion 61 00:03:33,274 --> 00:03:36,094 and you should probably get another ISP. 62 00:03:36,324 --> 00:03:38,144 That was their official response. 63 00:03:38,634 --> 00:03:38,984 I was. 64 00:03:39,364 --> 00:03:40,864 dumbfounded, right? 65 00:03:40,964 --> 00:03:48,254 So again, story come full circle, Cox will be back, in six days, they 66 00:03:48,254 --> 00:03:52,524 will be installing the fiber version, because I don't have a lot of choices. 67 00:03:52,822 --> 00:03:57,442 Our guest today is the host of the cyber pros podcast, a short form 68 00:03:57,442 --> 00:04:01,882 podcast, which by the way, it makes it very different from this podcast. 69 00:04:02,482 --> 00:04:06,202 A short form podcast that has five questions and nine minutes. 70 00:04:06,622 --> 00:04:10,162 He's our second former special forces member and we're excited 71 00:04:10,162 --> 00:04:11,482 to have him on the podcast. 72 00:04:11,722 --> 00:04:14,122 Welcome to the show, Rick Mischka. 73 00:04:14,345 --> 00:04:14,955 Rick Mischka: Hello, gents. 74 00:04:15,015 --> 00:04:18,235 W. Curtis Preston: So what do you cover in nine minutes on that podcast 75 00:04:18,980 --> 00:04:21,900 Rick Mischka: Yeah, you know, in 2020 I got bored and I wanted to build a 76 00:04:21,900 --> 00:04:25,945 cybersecurity network and I want to do it fast and So we had the idea 77 00:04:25,945 --> 00:04:30,415 of doing a short form kind of video podcast that that would be be quick. 78 00:04:30,415 --> 00:04:34,535 We actually thought six minutes could fit in in six questions could fit in nine 79 00:04:34,535 --> 00:04:36,545 minutes, but we were way wrong on that. 80 00:04:36,725 --> 00:04:39,255 So, so we pivoted down to five. 81 00:04:39,255 --> 00:04:43,095 And, and honestly, the first and last question are more, you know, who are you? 82 00:04:43,095 --> 00:04:43,555 What do you do? 83 00:04:43,555 --> 00:04:43,895 And then. 84 00:04:44,245 --> 00:04:46,865 You know, tell us a fun story or typically we ask, you know, what's your 85 00:04:46,865 --> 00:04:48,405 favorite piece of retro technology? 86 00:04:49,155 --> 00:04:51,855 The three middle questions are really the ones that we get kind 87 00:04:51,855 --> 00:04:54,185 of the, the meat of conversation. 88 00:04:54,185 --> 00:04:57,645 And it's, it's, you know, why do you love being a cybersecurity professional? 89 00:04:58,425 --> 00:05:03,315 Why do you think cybersecurity should, or is, or isn't a top concern? 90 00:05:03,675 --> 00:05:05,425 And then just what insights do you want to share? 91 00:05:05,875 --> 00:05:09,135 Whatever they share with us in those five questions, we then 92 00:05:09,135 --> 00:05:10,685 actually do something interesting. 93 00:05:11,055 --> 00:05:12,295 We, we. 94 00:05:12,570 --> 00:05:17,780 We record bonus content afterwards, and we focus that bonus content 95 00:05:17,790 --> 00:05:22,090 on one, education, two, a little bit of marketing, and then three, 96 00:05:22,370 --> 00:05:24,260 we focus on knowledge, right? 97 00:05:24,270 --> 00:05:27,160 Just, just what knowledge do they want to share even more of? 98 00:05:27,460 --> 00:05:30,050 And we typically do that in 30 seconds to three minutes. 99 00:05:30,310 --> 00:05:31,310 And so now... 100 00:05:31,955 --> 00:05:35,275 Our podcast guests get a full week of exposure. 101 00:05:35,685 --> 00:05:37,335 They get the full podcast release. 102 00:05:37,335 --> 00:05:39,525 They get a bunch of bonus contests released around it. 103 00:05:39,845 --> 00:05:42,695 We're able to bring in a lot of people through a number of different doors. 104 00:05:43,085 --> 00:05:45,905 And man, it's, it's just been a lot of fun. 105 00:05:46,095 --> 00:05:49,615 I've been able to connect a lot of people to, to really 106 00:05:49,615 --> 00:05:50,675 just kind of grow the network. 107 00:05:50,675 --> 00:05:53,495 You know, a couple of the podcast guests got together and wrote a book. 108 00:05:53,855 --> 00:05:56,885 A couple of the podcast guests got together and started a company. 109 00:05:57,095 --> 00:05:57,635 So. 110 00:05:58,430 --> 00:05:59,320 Awesome, right? 111 00:05:59,820 --> 00:06:00,640 So been fun. 112 00:06:00,720 --> 00:06:01,080 Yeah. 113 00:06:01,915 --> 00:06:05,115 W. Curtis Preston: I like it I'd like to hear the five questions 114 00:06:07,155 --> 00:06:09,215 So they're the same five questions for everybody 115 00:06:09,730 --> 00:06:12,090 Rick Mischka: typically, unless we get somebody who's a specialist 116 00:06:12,090 --> 00:06:14,610 in something, so it's who are you and what do you do, right? 117 00:06:14,620 --> 00:06:16,690 That's We'll call that one question. 118 00:06:17,040 --> 00:06:20,760 And then why do you love being a cybersecurity professional? 119 00:06:20,760 --> 00:06:24,240 That question will change if they're a professional in cloud, if data backup, you 120 00:06:24,240 --> 00:06:27,390 know, so if you were on, we would ask you that question a little bit differently. 121 00:06:27,810 --> 00:06:32,420 And then the third question we ask, you know, cybersecurity is a top concern. 122 00:06:32,430 --> 00:06:33,620 Do you believe that's true? 123 00:06:33,640 --> 00:06:37,590 And in, in the industry you're in, how does that, how does that interact? 124 00:06:38,040 --> 00:06:39,670 And then the fourth question is just. 125 00:06:40,010 --> 00:06:41,090 What insight do you want to share? 126 00:06:41,190 --> 00:06:44,830 Here's your, you know, if you've done your job, you have five minutes to talk 127 00:06:44,830 --> 00:06:46,760 and, and about anything you want to talk 128 00:06:47,640 --> 00:06:48,260 and then. 129 00:06:48,915 --> 00:06:52,215 If you're a first time guest, we always ask if, what's your favorite 130 00:06:52,215 --> 00:06:53,715 piece of retro technology is. 131 00:06:54,495 --> 00:07:00,205 Usually I get some, you know, usually I get all sorts of things. 132 00:07:00,205 --> 00:07:02,355 Usually it's, you know, Apple computers, Commodores, things like that. 133 00:07:02,525 --> 00:07:05,655 I had somebody come back and say the, the semi automatic pistol. 134 00:07:05,655 --> 00:07:07,075 And I was like, that's technology. 135 00:07:07,075 --> 00:07:07,975 So here we go. 136 00:07:07,985 --> 00:07:10,195 We're going down to completely different conversation. 137 00:07:10,515 --> 00:07:11,585 And I have to laugh. 138 00:07:11,605 --> 00:07:14,175 I actually useless trivia. 139 00:07:14,175 --> 00:07:16,875 I actually just bought one of my favorite pieces of retro 140 00:07:16,875 --> 00:07:18,365 technology in its new form. 141 00:07:18,715 --> 00:07:19,915 The Motorola Razr. 142 00:07:20,545 --> 00:07:25,105 So I have newest, the newest flip phone version, and it's so cool 143 00:07:25,105 --> 00:07:28,925 because you can actually set it to, show you as if you were using 144 00:07:28,935 --> 00:07:30,865 the original Motorola Razr, it's 145 00:07:31,010 --> 00:07:32,080 Prasanna Malaiyandi: that is awesome. 146 00:07:32,335 --> 00:07:32,645 Rick Mischka: Yeah, 147 00:07:32,795 --> 00:07:32,955 W. Curtis Preston: I 148 00:07:32,955 --> 00:07:35,105 had the original Motorola Razr 149 00:07:36,895 --> 00:07:37,615 Rick Mischka: as did I. 150 00:07:37,695 --> 00:07:39,105 And so it's fun. 151 00:07:39,125 --> 00:07:41,515 I get to be the butt of my own question. 152 00:07:42,430 --> 00:07:45,250 Prasanna Malaiyandi: What is probably one of the most interesting 153 00:07:45,330 --> 00:07:49,090 insights from cybersecurity answers that you've received? 154 00:07:49,975 --> 00:07:50,455 Rick Mischka: Yeah. 155 00:07:50,455 --> 00:07:52,785 You know, actually I'll start with the one I get the most of. 156 00:07:53,110 --> 00:07:57,550 The most insights I get are the idea that cybersecurity has 157 00:07:57,550 --> 00:07:59,320 to focus on the people, right? 158 00:08:01,480 --> 00:08:07,210 Dozens of different ways that conversation plays out, but that's the most talked 159 00:08:07,210 --> 00:08:11,890 about is, is the people, cybersecurity, burnout, talent acquisition, security 160 00:08:11,890 --> 00:08:14,980 gap, whatever that looks like, and it's, it's quite interesting, but the 161 00:08:14,980 --> 00:08:21,050 most interesting one that I've ever had was actually the use of artificial 162 00:08:21,050 --> 00:08:27,120 intelligence and machine learning as it pertains to cybersecurity. 163 00:08:27,780 --> 00:08:34,220 And biometrics and the insights that they shared were fascinating because their 164 00:08:34,220 --> 00:08:38,660 company had just gotten acquired, was, was putting a bunch of venture capital dollars 165 00:08:38,660 --> 00:08:45,590 into this solution that were actually selling some of the, the solution to. 166 00:08:46,115 --> 00:08:51,975 Tesla, the way you walk up to your car will unlock the car for you 167 00:08:51,975 --> 00:08:56,395 because it knows your gate, along with facial rec and other biometrics. 168 00:08:56,395 --> 00:08:57,845 And it's fascinating. 169 00:08:57,845 --> 00:08:59,795 It was, it was mind blowing what can do. 170 00:08:59,805 --> 00:09:00,215 So 171 00:09:00,940 --> 00:09:02,270 Prasanna Malaiyandi: it's interesting you bring that up, Rick. 172 00:09:02,270 --> 00:09:05,810 So recently my wife and I, we binge watched all the Mission Impossible movies. 173 00:09:06,310 --> 00:09:09,360 And there's, I don't know if you remember, but there's a one Mission Impossible 174 00:09:09,360 --> 00:09:13,520 where it's like, they have to imitate to be the guy and walk through a secure 175 00:09:13,520 --> 00:09:15,600 area where it does a gait analysis. 176 00:09:15,900 --> 00:09:18,530 And I was just thinking, I was like, wow, technology it's come. 177 00:09:18,530 --> 00:09:19,470 It's like real now. 178 00:09:19,520 --> 00:09:21,180 or the other day I was watching Minority Report. 179 00:09:21,180 --> 00:09:22,490 It's like all this stuff they're doing. 180 00:09:22,490 --> 00:09:24,490 It's that's now become like reality. 181 00:09:25,715 --> 00:09:29,015 Rick Mischka: You should add the Mission Impossible theme to the start of, of this 182 00:09:29,055 --> 00:09:29,295 podcast 183 00:09:31,905 --> 00:09:36,085 W. Curtis Preston: Yeah I just rewatched that one again to Prasanna and of course 184 00:09:36,595 --> 00:09:41,885 that technology was defeated by uploading a different gate analysis The first time 185 00:09:41,935 --> 00:09:48,505 I saw a computer used to do something that that literally I went wow actually 186 00:09:48,505 --> 00:09:52,385 okay The very first thing I remember seeing a computer do something that made 187 00:09:52,385 --> 00:09:58,712 me do wow was when I was in my teens you could go to a police station in Kissimmee 188 00:09:58,712 --> 00:10:02,802 Florida That's where I was from And you could give them an address and they 189 00:10:02,802 --> 00:10:06,852 could print out turn by turn directions of how to get to there And I remember 190 00:10:06,852 --> 00:10:12,872 going That's the most amazing I've ever seen but the second thing was I was a 191 00:10:12,872 --> 00:10:20,022 consultant at a communications company that was using simulation modeling in 192 00:10:20,062 --> 00:10:27,182 a computer to test their device like to harden their device by like in a 193 00:10:27,182 --> 00:10:31,612 computer hitting it with a softball in a computer dropping that device on the 194 00:10:31,612 --> 00:10:34,312 ground Do you know what that device was 195 00:10:34,724 --> 00:10:37,014 Rick Mischka: The Nokia phone from back in the day? 196 00:10:37,784 --> 00:10:40,064 W. Curtis Preston: It was the Motorola Razr my friend 197 00:10:40,924 --> 00:10:43,164 Rick Mischka: Fair, there's the full circle. 198 00:10:44,074 --> 00:10:49,334 W. Curtis Preston: Yeah Yeah I was working at Motorola in Schaumburg Illinois 199 00:10:49,757 --> 00:10:50,427 Prasanna Malaiyandi: Crazy. 200 00:10:51,107 --> 00:10:54,727 W. Curtis Preston: yeah it was amazing to me what they do One of the things I'm 201 00:10:54,727 --> 00:11:00,604 very concerned about is data exfiltration cause as a backup and recovery person 202 00:11:00,614 --> 00:11:07,694 I can stop a lot of things I can stop a pure ransomware attack by just restoring 203 00:11:07,694 --> 00:11:11,754 the data but what I can't stop if the data is exfiltrated there's nothing I 204 00:11:11,754 --> 00:11:22,339 can do So the question is so I think that AI and ML are the next thing for 205 00:11:22,449 --> 00:11:29,019 basically doing the equivalent of gate analysis on the outgoing traffic for a 206 00:11:29,019 --> 00:11:34,239 typical company and then noticing when something is very different and calling 207 00:11:34,239 --> 00:11:41,779 it out and stopping it automatically So far I'm not hearing A lot of 208 00:11:41,779 --> 00:11:44,514 agreement on that when I talk to folks 209 00:11:44,769 --> 00:11:47,129 Prasanna Malaiyandi: are you talking mainly Curtis about 210 00:11:47,129 --> 00:11:49,139 anomaly detection based on 211 00:11:49,824 --> 00:11:50,484 W. Curtis Preston: Yes 212 00:11:50,679 --> 00:11:52,549 Prasanna Malaiyandi: looking for data exfiltration? 213 00:11:52,549 --> 00:11:52,954 Okay. 214 00:11:53,064 --> 00:11:53,784 W. Curtis Preston: Yes 215 00:11:55,199 --> 00:11:59,719 Rick Mischka: Yeah, I mean, I will say, I think people got a little out over their 216 00:11:59,719 --> 00:12:04,309 skis looking at, you know, unsupervised machine learning and trying to train 217 00:12:04,309 --> 00:12:07,319 it to baseline and then anomaly detect. 218 00:12:07,459 --> 00:12:13,819 And you end up with either a lot of false positives or you end up with... 219 00:12:14,594 --> 00:12:20,184 Just a lot of data that the machine learning model is still working on. 220 00:12:20,654 --> 00:12:26,704 And I think the world is seeing kind of, I don't want to call it a 221 00:12:26,704 --> 00:12:31,854 reversion, but an add in to a lot of that unsupervised machine learning 222 00:12:31,854 --> 00:12:33,594 with supervised machine learning. 223 00:12:33,594 --> 00:12:38,014 That's trained on data models of both benign and malicious data 224 00:12:38,474 --> 00:12:43,684 that allows those supervised models to say, okay, here's the 14 or 40 225 00:12:43,684 --> 00:12:45,904 or whatever number you want of. 226 00:12:47,839 --> 00:12:50,489 Threat vectors that we know, right? 227 00:12:50,489 --> 00:12:53,109 EXE files, documents, things like that. 228 00:12:54,219 --> 00:12:57,519 When you have as much data as we have now, you can train these supervised 229 00:12:57,519 --> 00:13:03,029 machine learning models to say, Oh, 98, 99 percent of the time we can catch 230 00:13:03,029 --> 00:13:05,209 something and we don't need anomaly. 231 00:13:05,779 --> 00:13:10,449 And so I think that was the miss for, for me, that's what I'm seeing is people 232 00:13:10,449 --> 00:13:14,419 jump right to unsupervised thinking that anomaly detection was the only way. 233 00:13:14,769 --> 00:13:19,679 And we went from signature known crap to let's figure out what the user is doing 234 00:13:19,679 --> 00:13:21,369 and hope their behavior doesn't change. 235 00:13:21,619 --> 00:13:22,959 And they missed the step. 236 00:13:22,959 --> 00:13:27,689 And I think, you know, good companies, EDR endpoint detection response 237 00:13:27,689 --> 00:13:30,739 vendors, a lot of the new managed detection response solutions that 238 00:13:30,739 --> 00:13:32,629 are bringing in XDR solutions. 239 00:13:33,254 --> 00:13:37,214 have realized that and they can make that model better by adding 240 00:13:37,214 --> 00:13:39,304 in a supervised model as well. 241 00:13:40,714 --> 00:13:43,364 I, I think that's the path we need to get to, to actually 242 00:13:43,364 --> 00:13:46,384 see it be extremely useful, but 243 00:13:47,616 --> 00:13:50,456 Prasanna Malaiyandi: I think one of the challenges also with anomaly detection 244 00:13:50,496 --> 00:13:55,626 is, especially with these unsupervised models, you get so many sort of false 245 00:13:55,626 --> 00:13:59,256 positives, where it's hey, the user just did something different, but it's normal. 246 00:13:59,256 --> 00:14:00,996 And the model has never seen it before. 247 00:14:00,996 --> 00:14:02,576 And of course, it's going to flag something. 248 00:14:03,216 --> 00:14:07,696 And as a, as a security engineer trying to go through those logs and figure 249 00:14:07,696 --> 00:14:12,506 out, okay, what's a real threat, what is a false positive, that kills so much 250 00:14:12,506 --> 00:14:15,916 of your time that what I've heard is a lot of people are like, screw it, it's 251 00:14:15,916 --> 00:14:17,256 not worth it, let me just turn it off. 252 00:14:18,756 --> 00:14:19,356 Rick Mischka: It's true. 253 00:14:19,356 --> 00:14:23,086 And, and, and, you know, I think the other thing that, that people forgot was 254 00:14:24,016 --> 00:14:27,236 They jumped towards the technology and they forgot that there's a whole lot of 255 00:14:27,236 --> 00:14:31,646 process and people that need to be in place for the, for the technology to work. 256 00:14:32,036 --> 00:14:34,386 you know, I know everybody knows the PBT framework. 257 00:14:34,386 --> 00:14:38,156 It's, it's used in almost every technology model ever. 258 00:14:38,276 --> 00:14:40,806 it was actually created in the sixties by a guy by the name of 259 00:14:40,806 --> 00:14:43,076 Harold Levitt as the diamond model. 260 00:14:43,086 --> 00:14:47,326 There was four points to it, but when we do. 261 00:14:47,751 --> 00:14:52,071 An analysis of somebody's cybersecurity posture doesn't matter what machine 262 00:14:52,071 --> 00:14:55,001 learning models doesn't matter what technology they have for us. 263 00:14:55,001 --> 00:14:59,431 The technology is only about 10 percent of the solution that we 264 00:14:59,441 --> 00:15:00,991 present that they should be looking at. 265 00:15:01,441 --> 00:15:03,201 And we talk about, okay. 266 00:15:03,591 --> 00:15:05,891 30 percent is, is, is the people. 267 00:15:05,901 --> 00:15:06,961 Can you provide those? 268 00:15:06,961 --> 00:15:11,641 Do you need people to be outsourced or managed from, you 269 00:15:11,641 --> 00:15:12,831 know, managed service provider? 270 00:15:13,121 --> 00:15:15,931 And then 60 percent of it is, here's your process. 271 00:15:15,971 --> 00:15:19,241 If you have a good process, the technology will work, but most people 272 00:15:19,241 --> 00:15:21,131 just, like you said, turn it on. 273 00:15:21,151 --> 00:15:25,641 All of a sudden they have triple the, the, the alerts and they 274 00:15:25,641 --> 00:15:26,421 don't know how to handle it. 275 00:15:28,136 --> 00:15:33,416 W. Curtis Preston: Yeah it's interesting I think that was a good point about that 276 00:15:34,546 --> 00:15:41,926 people think that technology is just going to solve the problem when in reality Even 277 00:15:41,936 --> 00:15:48,986 if the it was able to detect an anomaly there's still a human being That is going 278 00:15:48,986 --> 00:15:53,776 to have to read that information view that information and respond to that 279 00:15:53,776 --> 00:15:58,136 information because you're not at least I wouldn't think the average person is 280 00:15:58,146 --> 00:16:06,336 not going to automatically start shutting off outgoing communications based on an 281 00:16:06,336 --> 00:16:10,356 anomaly especially if there's so many false positives So there's got to be 282 00:16:10,526 --> 00:16:15,786 that person involved Rick I'd like to ask you about that 30 60 percent that's 283 00:16:16,316 --> 00:16:21,436 it's interesting that you put so much focus on the process like it felt I don't 284 00:16:21,436 --> 00:16:26,076 know if anything I if I was guessing I'd be like 50 50 between the people 285 00:16:26,076 --> 00:16:28,476 and the process thoughts about that 286 00:16:30,821 --> 00:16:34,461 Rick Mischka: you know, I think, I think we all agree that the technology 287 00:16:34,461 --> 00:16:35,991 is, is just a component, right? 288 00:16:35,991 --> 00:16:38,571 It's, it's supposed to make us better, faster, easier, 289 00:16:38,571 --> 00:16:39,591 whatever they want to look at. 290 00:16:40,851 --> 00:16:46,491 And some would argue that the people side of the house should be, you know, higher 291 00:16:47,071 --> 00:16:49,191 rated, higher percentage of what you do. 292 00:16:51,406 --> 00:16:57,486 In today's world where we automate a lot of things, you can remove a human 293 00:16:57,496 --> 00:17:01,436 for, you know, X number of automations that you do, but I'm going to take it 294 00:17:01,436 --> 00:17:06,226 even further as to why we place such an emphasis on the process side, and 295 00:17:06,226 --> 00:17:11,136 that's everything a company focuses on their business objectives, their 296 00:17:11,136 --> 00:17:13,716 continuity, their resilience, right? 297 00:17:13,736 --> 00:17:17,036 None of those are cyber security based, but all of those have to have 298 00:17:17,036 --> 00:17:20,986 a process in place for people to know. 299 00:17:21,321 --> 00:17:22,831 Hey, that's what my job is. 300 00:17:23,161 --> 00:17:25,891 That's what I'm supposed to be doing to progress this company, 301 00:17:26,131 --> 00:17:29,761 to make more revenue, to drive bottom bottom line goals. 302 00:17:30,141 --> 00:17:30,831 And so. 303 00:17:31,471 --> 00:17:36,081 If you can create great process, you create great culture and you don't 304 00:17:36,091 --> 00:17:40,181 need as many humans because the humans you have are able to just do more. 305 00:17:41,716 --> 00:17:43,766 Prasanna Malaiyandi: You're being more efficient with what you have rather 306 00:17:43,766 --> 00:17:49,476 than trying to add a whole bunch of more people to make up for the lack of process 307 00:17:50,261 --> 00:17:52,211 Rick Mischka: said it so much better in 12 seconds. 308 00:17:53,726 --> 00:17:56,326 W. Curtis Preston: You should have them on your nine minute podcast Sure 309 00:17:57,281 --> 00:17:57,681 Rick Mischka: Perfect. 310 00:18:00,286 --> 00:18:03,826 W. Curtis Preston: Rick based on all the people that you've talked to what 311 00:18:03,826 --> 00:18:10,396 do you think are one of the things that we like to ask people is if you were if 312 00:18:10,406 --> 00:18:15,971 you had carte blanche at an environment What are the the top five things that you 313 00:18:15,991 --> 00:18:22,351 think people maybe aren't doing that they should be doing right So we can throw 314 00:18:22,351 --> 00:18:28,766 out the for me the three obvious ones right Good password management MFA And 315 00:18:28,816 --> 00:18:34,056 patch management right So assuming that we're doing those three things what else 316 00:18:34,056 --> 00:18:36,506 do you think companies should be doing 317 00:18:36,589 --> 00:18:40,559 Rick Mischka: For me, the first one I always tell companies is, is create 318 00:18:40,559 --> 00:18:45,469 an incident response plan that allows you to grow cybersecurity culture. 319 00:18:45,914 --> 00:18:49,424 But that cybersecurity isn't thing that's controlling your business. 320 00:18:49,824 --> 00:18:53,934 I think too many times they're like, well, I'm, I'm beholden to this regulation 321 00:18:53,934 --> 00:19:01,804 or I have this type of data that I have to secure and they, they stop doing 322 00:19:01,814 --> 00:19:04,564 good business to do good cybersecurity. 323 00:19:04,564 --> 00:19:06,884 And I think you you can flip that around. 324 00:19:07,374 --> 00:19:08,024 Quite a bit. 325 00:19:08,314 --> 00:19:11,604 And I think, you know, that that's one of the top ones for me. 326 00:19:12,004 --> 00:19:16,154 The second one, it really focuses on the human side, the people side. 327 00:19:17,464 --> 00:19:20,964 everyone makes the joke, we need cybersecurity 328 00:19:20,964 --> 00:19:22,999 professionals and we want to. 329 00:19:23,529 --> 00:19:27,399 You know, we want somebody who's new to the business, but we need them to have a 330 00:19:27,399 --> 00:19:30,059 CISSP and 14 years of experience, right? 331 00:19:30,059 --> 00:19:35,539 So, entry level position and, and I just, whenever I talk to, you know, 332 00:19:35,539 --> 00:19:42,689 small to mid sized businesses or mid market folks, I explain to them, go find 333 00:19:42,689 --> 00:19:45,024 somebody who's hungry to do the job. 334 00:19:45,364 --> 00:19:50,184 And train them how you want the job done or, or, or paid for their training to 335 00:19:50,184 --> 00:19:52,674 get the job to where they need to be. 336 00:19:53,034 --> 00:19:55,784 And you don't need somebody who has a CISSP. 337 00:19:55,784 --> 00:19:57,554 You don't even need somebody who has a degree. 338 00:19:57,824 --> 00:20:01,844 If you have somebody who's hungry, who's done the certification bootcamps, they're 339 00:20:01,844 --> 00:20:06,944 willing to step in and learn, likely stay with you longer for those reasons. 340 00:20:07,374 --> 00:20:10,114 And I think, you know, even the big enterprise companies are starting 341 00:20:10,114 --> 00:20:11,864 to finally have this moment. 342 00:20:12,274 --> 00:20:13,984 If I go get the college grad. 343 00:20:14,749 --> 00:20:18,229 And I trained him and get him a bunch of certifications in that first year. 344 00:20:19,204 --> 00:20:21,474 He or she is going to stay far longer. 345 00:20:22,984 --> 00:20:26,304 The third thing I would say is you need to understand your 346 00:20:26,304 --> 00:20:28,254 cybersecurity edges, right? 347 00:20:28,534 --> 00:20:30,514 Are you a fully cloud edge? 348 00:20:30,524 --> 00:20:32,684 And do you know what that means, right? 349 00:20:32,684 --> 00:20:37,964 You're using AWS or Azure, but you're also using software as a service applications. 350 00:20:38,014 --> 00:20:39,754 Do you understand the differences? 351 00:20:39,754 --> 00:20:42,234 Do you understand that there's an endpoint edge? 352 00:20:42,444 --> 00:20:46,204 Every user is on an endpoint, so how can you protect your users from 353 00:20:46,204 --> 00:20:50,814 themselves by finding a solution that matches your needs on those endpoints? 354 00:20:51,364 --> 00:20:52,384 And then your network. 355 00:20:52,774 --> 00:20:55,174 Some people don't have a network, and that's okay, right? 356 00:20:55,174 --> 00:20:58,034 They've gone straight, you know, VPN to the internet, call it good. 357 00:20:58,564 --> 00:21:02,284 But understand what those three are, understand how you, how you can cover 358 00:21:02,284 --> 00:21:06,464 those, and that will lead you down a really good cybersecurity journey. 359 00:21:06,884 --> 00:21:10,369 And lastly, Here's my brown nose moment for you guys. 360 00:21:10,739 --> 00:21:14,799 I recommend that everybody understands what actual data backup needs to mean to 361 00:21:14,799 --> 00:21:15,179 them 362 00:21:15,519 --> 00:21:21,569 So if they have an incident, they can recover and not rely on their insurance 363 00:21:21,569 --> 00:21:27,359 company to provide them with investigators and forensics and responders, and 364 00:21:27,359 --> 00:21:29,169 then not pay them anyways, so. 365 00:21:30,219 --> 00:21:31,229 Those are my four. 366 00:21:31,239 --> 00:21:33,229 Those are the four I tend to talk about the most. 367 00:21:33,789 --> 00:21:36,669 W. Curtis Preston: Go 368 00:21:37,309 --> 00:21:37,919 That my 369 00:21:38,659 --> 00:21:38,769 that's 370 00:21:38,769 --> 00:21:41,804 my world cup moment there what do you 371 00:21:42,882 --> 00:21:47,322 Prasanna Malaiyandi: Oh I like those four ideas or things that people should be 372 00:21:47,322 --> 00:21:51,642 considering Rick for the first one when you're talking about the incident response 373 00:21:52,032 --> 00:21:57,482 do you find that a lot of companies are woefully prepared they're ostrich with 374 00:21:57,482 --> 00:22:00,252 head buried in the sand It's not going to happen to me I don't need to worry 375 00:22:00,252 --> 00:22:05,302 about this sort of thing Or do you think that's started to change given all the 376 00:22:05,312 --> 00:22:09,292 recent activity around ransomware and data exfiltration and other things like that 377 00:22:10,152 --> 00:22:11,912 Rick Mischka: I think it's changing. 378 00:22:11,912 --> 00:22:15,502 I don't think, I don't think we're anywhere near where it needs to be. 379 00:22:15,992 --> 00:22:20,032 I believe people are starting to have those moments where, well, 380 00:22:20,092 --> 00:22:21,642 do I have a continuity plan? 381 00:22:21,662 --> 00:22:21,932 Right? 382 00:22:21,962 --> 00:22:24,672 A lot of companies I talked to, they're like, well, we have, we 383 00:22:24,672 --> 00:22:26,202 have a disaster recovery plan. 384 00:22:26,202 --> 00:22:27,372 And I'm like, okay, that's great. 385 00:22:27,622 --> 00:22:27,802 Right? 386 00:22:27,972 --> 00:22:30,552 If, if a hurricane hits you, you know how to fix the problem. 387 00:22:30,842 --> 00:22:37,732 But An incident response plan can encompass your business continuity, your 388 00:22:37,732 --> 00:22:44,652 disaster recovery, and all of your, your security systems planning in one document. 389 00:22:45,082 --> 00:22:48,382 And if it's done correctly, I think what most people say 390 00:22:48,382 --> 00:22:49,512 is, well, we have the plan. 391 00:22:50,952 --> 00:22:52,192 Have you tested it? 392 00:22:52,542 --> 00:22:54,292 Have you played the tabletop? 393 00:22:54,402 --> 00:22:56,002 All right, let's nerd out. 394 00:22:56,062 --> 00:23:00,102 And, and even though you might have never played Dungeons and Dragons, let's go play 395 00:23:00,102 --> 00:23:05,382 the tabletop game with, you know, whatever you want to play, get your entire group 396 00:23:05,382 --> 00:23:07,652 in, and let's see what it looks like. 397 00:23:07,912 --> 00:23:14,772 Usually the point that it fails on is not on the catching of it, 398 00:23:14,772 --> 00:23:16,392 not on the data backing up, right? 399 00:23:16,402 --> 00:23:17,782 Not on, on recovery. 400 00:23:18,132 --> 00:23:23,002 It's, it's on, Communication. 401 00:23:24,792 --> 00:23:29,852 don't follow or have a good communication path, which leads to their cyber 402 00:23:29,852 --> 00:23:32,572 insurance company telling them, Oh, you didn't meet our requirements. 403 00:23:32,572 --> 00:23:35,692 We're not paying you for what you had to do to go recover. 404 00:23:36,252 --> 00:23:40,132 And they also forget about the legal aspect. 405 00:23:40,152 --> 00:23:43,662 You know, they're, they think, Oh, I need an attorney after the 406 00:23:43,662 --> 00:23:50,862 fact to help me understand what my Requirements are to my customers. 407 00:23:50,862 --> 00:23:53,692 If I've given up my customer data or my employees, if I've given 408 00:23:53,692 --> 00:23:55,962 up their data, they don't realize 409 00:23:56,772 --> 00:23:57,362 what was that 410 00:23:57,962 --> 00:23:59,222 Prasanna Malaiyandi: That's too late though right 411 00:23:59,452 --> 00:24:00,272 Rick Mischka: it's too late. 412 00:24:00,282 --> 00:24:03,432 And, and what they don't realize is you can actually protect. 413 00:24:03,992 --> 00:24:09,052 and get under that, that, that lawyer umbrella, that cone of 414 00:24:09,052 --> 00:24:13,932 silence, you know, as it were, you can get on that early as you're 415 00:24:13,932 --> 00:24:15,542 creating the incident response plan. 416 00:24:15,812 --> 00:24:19,902 You can have somebody that looks at that plan and says, okay, you now have a, 417 00:24:19,992 --> 00:24:23,712 you know, an attorney client privilege. 418 00:24:24,007 --> 00:24:27,477 You don't have to share some of this information with your insurance company. 419 00:24:27,717 --> 00:24:31,987 You don't have to share this with the general public and here's why. 420 00:24:32,097 --> 00:24:36,697 And so moving the legal and the communication stuff up earlier 421 00:24:36,697 --> 00:24:41,677 in the plan and really hammering it home, the rest of the plan is. 422 00:24:42,052 --> 00:24:43,412 process and technology, right? 423 00:24:43,412 --> 00:24:44,062 Let's be real. 424 00:24:44,222 --> 00:24:45,792 It's, Oh, we found the problem. 425 00:24:45,792 --> 00:24:46,652 We fixed the problem. 426 00:24:46,982 --> 00:24:51,292 So, you know, those are, I think that's the interesting part that people are 427 00:24:51,292 --> 00:24:55,012 starting to finally get this, Hey, wait, there are, there are attorneys, 428 00:24:55,322 --> 00:25:00,432 there are insurance companies out there who are just, you know, available, 429 00:25:00,682 --> 00:25:02,112 but not available at the end. 430 00:25:02,262 --> 00:25:04,162 Let's, let's see how we can move this forward. 431 00:25:05,017 --> 00:25:09,947 W. Curtis Preston: Yeah that would be my I've been pretty consistent with that as 432 00:25:09,947 --> 00:25:16,087 well that basically probably the biggest point of having these discussions up front 433 00:25:16,427 --> 00:25:21,817 with creating that incident response plan and doing those tabletop exercises and by 434 00:25:21,817 --> 00:25:26,857 the way for the record I never played D D But but I like the idea of a tabletop 435 00:25:26,857 --> 00:25:32,017 exercise but I'm just not I'm just not that big of a nerd but I love all the D 436 00:25:32,267 --> 00:25:38,547 nerds but they wouldn't let me play anyway sorry I'm a sad childhood That you're even 437 00:25:38,547 --> 00:25:45,517 excluded from nerdhood but I digress The thing that we talk about this a lot is 438 00:25:45,547 --> 00:25:51,627 this idea of creating those relationships up front Don't have an incident and 439 00:25:51,627 --> 00:25:57,797 then Oh we need to find a cyber security firm We need to find a lawyer We need to 440 00:25:57,797 --> 00:26:05,997 find whatever you need to create those relationships up front because it's like 441 00:26:05,997 --> 00:26:11,297 having a large company in the United States and not having a legal department 442 00:26:11,762 --> 00:26:15,842 I don't know how it is in other parts of the world but we live in such a litigious 443 00:26:15,842 --> 00:26:21,282 society You're going to be sued for something And so you have to have a lawyer 444 00:26:21,292 --> 00:26:24,772 right and of course you have to have a lawyer hopefully so that you have the 445 00:26:24,772 --> 00:26:28,352 right paperwork so that you don't get sued But then you have a lawyer in case you 446 00:26:28,372 --> 00:26:33,292 do get sued You need a cybersecurity team and you need cybersecurity professionals 447 00:26:33,292 --> 00:26:38,682 on your side so that when you get a cyber attack because it is a when not an 448 00:26:38,682 --> 00:26:43,982 if You have those people in your corner right Does that match what you're saying 449 00:26:44,245 --> 00:26:44,945 Rick Mischka: Spot on. 450 00:26:44,995 --> 00:26:45,345 Yeah. 451 00:26:45,475 --> 00:26:49,005 And it goes back to what we talked about, about that 60 percent process. 452 00:26:49,545 --> 00:26:52,795 If you have an incident response plan, there's your process. 453 00:26:53,220 --> 00:26:55,900 And all you do is go and say, yep, we know this works. 454 00:26:56,370 --> 00:26:57,640 Just follow the process. 455 00:26:57,830 --> 00:26:58,270 So, 456 00:26:58,664 --> 00:27:02,664 Prasanna Malaiyandi: I like that I also wanted to touch just given our area 457 00:27:02,664 --> 00:27:07,464 that we always like to talk about I'm glad that you talked about backup Rick 458 00:27:07,544 --> 00:27:13,434 because I feel that a lot of times people forget about it when it comes to sort 459 00:27:13,434 --> 00:27:18,984 of incident responses Or even like you said try doing like the tabletop exercise 460 00:27:18,994 --> 00:27:23,694 try out the thing right Even for backup It's like how often do people go verify 461 00:27:23,704 --> 00:27:29,034 Do their backups work Are they able to recover their data or are they able to 462 00:27:29,034 --> 00:27:33,724 test out their disaster recovery plans I think that becomes really important as 463 00:27:33,734 --> 00:27:39,099 part of the process Piece and spelling out Yes periodically you do want to test 464 00:27:39,099 --> 00:27:42,129 these things to make sure that things are still working because the last 465 00:27:42,129 --> 00:27:46,329 thing you want is hey you got attacked Now you need to recover Oops I forgot 466 00:27:46,329 --> 00:27:49,499 to do this or oops I forgot to do that And so now your environment's kind of 467 00:27:49,499 --> 00:27:52,329 in shambles and you're all scrambling trying to get things back up and running 468 00:27:53,559 --> 00:27:56,779 Rick Mischka: or they just haven't hardened their backups because 469 00:27:56,779 --> 00:27:59,459 they haven't checked them in, in, you know, three months and 470 00:28:00,109 --> 00:28:01,889 now your backups are just as bad. 471 00:28:02,694 --> 00:28:03,164 what just 472 00:28:03,424 --> 00:28:04,034 X filled. 473 00:28:04,034 --> 00:28:06,164 So hopefully that doesn't happen, but it can. 474 00:28:06,764 --> 00:28:07,024 So 475 00:28:07,864 --> 00:28:12,274 W. Curtis Preston: Yeah The backups are increasingly both a target in terms of 476 00:28:12,274 --> 00:28:16,424 to take them out so that the cyber attack will be more successful and also to use 477 00:28:16,424 --> 00:28:21,184 them as a source for data exfiltration I'm trying to raise the awareness of that 478 00:28:21,204 --> 00:28:26,684 within the cybersecurity world And so if the cyber folks hear anything from me it 479 00:28:26,684 --> 00:28:31,894 should be that somewhere in the corner you talk about that hiring a college 480 00:28:31,924 --> 00:28:36,714 kid and then training them right That's there's also normally a college kid 481 00:28:37,004 --> 00:28:41,794 Maybe not even a college kid That's the person in the corner doing the backups 482 00:28:42,024 --> 00:28:47,354 because it was the only job he could get and he didn't necessarily he's not 483 00:28:47,354 --> 00:28:50,944 that person you were when you said when you were talking about find the person 484 00:28:50,944 --> 00:28:56,834 who has the desire to do this job that's hungry often with the backup the person 485 00:28:56,834 --> 00:29:00,394 was just hungry for a job they weren't hungry necessarily for the site for the 486 00:29:00,759 --> 00:29:04,769 Doing the backups No one is no one's in college going man I really hoped that 487 00:29:04,769 --> 00:29:06,759 somebody hires me as a backup admin 488 00:29:07,559 --> 00:29:09,649 Prasanna Malaiyandi: Except you Mr Backup Except 489 00:29:09,729 --> 00:29:14,599 W. Curtis Preston: no not even I know no this is yeah it's how I got my 490 00:29:14,599 --> 00:29:18,369 job I wanted to be in computers I did want to be in computers and I took 491 00:29:18,369 --> 00:29:22,969 the job as backup person Because that was the job I could get and it got 492 00:29:22,969 --> 00:29:28,169 me into the big bank and and then I just Accidentally never got out of it 493 00:29:30,169 --> 00:29:31,669 So that's how I ended up specializing 494 00:29:31,669 --> 00:29:31,739 in 495 00:29:32,019 --> 00:29:32,609 Prasanna Malaiyandi: as I say. 496 00:29:32,829 --> 00:29:35,349 W. Curtis Preston: Yeah the rest is history yeah I like 497 00:29:35,349 --> 00:29:39,539 that I really like this idea, of figuring out where your edges are. 498 00:29:39,579 --> 00:29:41,339 Because back in the day, right? 499 00:29:41,369 --> 00:29:43,699 The edges were the edge of the building, right? 500 00:29:44,799 --> 00:29:46,779 Nobody had computers outside the building. 501 00:29:46,899 --> 00:29:48,529 All the computers were inside the building. 502 00:29:48,529 --> 00:29:49,779 We had a data center. 503 00:29:49,869 --> 00:29:51,529 It was the center of the data, right? 504 00:29:51,579 --> 00:29:57,399 That was the way that things were, but now your edges are everywhere, right? 505 00:29:57,449 --> 00:30:02,419 there, all this work from home that's going on, and the SaaS and the, the 506 00:30:02,419 --> 00:30:05,479 cloud data centers, the PaaS services. 507 00:30:05,969 --> 00:30:12,419 You're, you are, I wonder if you don't have a handle on that today, 508 00:30:13,709 --> 00:30:18,919 how does one go about, figuring out where their IT department has scrawled 509 00:30:18,929 --> 00:30:23,009 to, I can't imagine how you could start doing something like that. 510 00:30:23,232 --> 00:30:25,332 Rick Mischka: know, I've, I've seen an interesting trend 511 00:30:26,242 --> 00:30:28,322 of companies who have gone. 512 00:30:28,872 --> 00:30:33,922 The way of not having any location, my wife's company actually has done that. 513 00:30:33,922 --> 00:30:36,462 They have no buildings that they pay rent for. 514 00:30:36,832 --> 00:30:43,752 They provide a stipend for every one of their employees to go find a coworking 515 00:30:43,752 --> 00:30:48,412 space, which is, which really cool for them, but now you're on public wifi for 516 00:30:48,422 --> 00:30:52,222 the most part, and they don't have any. 517 00:30:52,697 --> 00:30:54,997 Firewalls, they have no network security. 518 00:30:55,117 --> 00:30:59,237 Everything they, they do is, is, in the cloud, right? 519 00:30:59,347 --> 00:31:06,017 Access is through a SaaS application and they made the intelligent 520 00:31:06,017 --> 00:31:14,057 decision that they didn't need all of this network security they needed 521 00:31:14,537 --> 00:31:19,547 to make sure that their employees were protected on the end points. 522 00:31:20,322 --> 00:31:20,672 Right? 523 00:31:20,682 --> 00:31:24,122 Typically a laptop provided to them or a mobile device. 524 00:31:24,772 --> 00:31:28,312 And then they took it one step further and said, all of our data is in the cloud. 525 00:31:28,332 --> 00:31:30,732 They're accessing everything that's somewhere in the cloud. 526 00:31:31,052 --> 00:31:33,332 We need a security broker. 527 00:31:33,612 --> 00:31:35,792 We need a workload protection solution. 528 00:31:36,112 --> 00:31:38,202 And that's how we're covering our edges. 529 00:31:38,882 --> 00:31:42,242 But there's still people hanging on to, well, I need all three edges. 530 00:31:43,142 --> 00:31:43,712 Do you? 531 00:31:44,112 --> 00:31:48,082 I don't, I don't know, but understand why you think you need that. 532 00:31:48,372 --> 00:31:52,202 The most important edge today is, is wherever your users are accessing 533 00:31:52,202 --> 00:31:54,272 the data, find a way to secure that. 534 00:31:54,582 --> 00:31:57,282 And you've secured a majority of, of. 535 00:31:58,987 --> 00:32:02,827 Now, that doesn't mean you can't still have your users click on something stupid. 536 00:32:02,997 --> 00:32:04,327 you can't train stupidity. 537 00:32:04,507 --> 00:32:06,637 So, it's gonna happen. 538 00:32:06,927 --> 00:32:09,397 But at least if you have protection where they're clicking on it, 539 00:32:09,597 --> 00:32:11,177 hopefully you'll catch it a lot sooner. 540 00:32:11,427 --> 00:32:12,367 or worst case... 541 00:32:12,742 --> 00:32:18,082 You fall back to your data backups who are far more protected from someone like you 542 00:32:18,082 --> 00:32:20,242 or the, or the kid that just wanted a job. 543 00:32:20,857 --> 00:32:21,127 Prasanna Malaiyandi: Yeah. 544 00:32:21,237 --> 00:32:25,187 or, and the other thing is hopefully you can also reduce the blast radius, right? 545 00:32:26,752 --> 00:32:27,072 W. Curtis Preston: Yeah. 546 00:32:27,072 --> 00:32:29,222 And you've got to do both. 547 00:32:29,242 --> 00:32:31,182 You've got to train the users. 548 00:32:31,672 --> 00:32:32,962 And then you've got to. 549 00:32:33,212 --> 00:32:37,242 Prepare to respond when the users don't do what you trained them to do. 550 00:32:37,492 --> 00:32:41,202 I mentioned this a lot on the podcast, but at that bank where I worked, we 551 00:32:41,202 --> 00:32:44,602 constantly trained new employees that one of the things that we always told 552 00:32:44,602 --> 00:32:48,382 them over and over again is no one in the IT department will ever call 553 00:32:48,382 --> 00:32:49,792 you and ask you for your password. 554 00:32:50,252 --> 00:32:54,102 And then the next day after their new employee training, we would call 555 00:32:54,102 --> 00:32:55,472 them and ask them for their password. 556 00:32:56,022 --> 00:33:00,482 And they would give it to us a sadly high percentage of the time. 557 00:33:02,062 --> 00:33:04,922 And, people will, and sometimes you'll just access sometimes 558 00:33:04,922 --> 00:33:09,262 you'll, it takes a moment Of just not paying attention, right? 559 00:33:09,262 --> 00:33:11,782 A little bit too much muscle memory, clicking on something. 560 00:33:12,062 --> 00:33:15,242 so even smart people that are trained and normally do the right thing 561 00:33:15,252 --> 00:33:17,112 can also click on the wrong thing. 562 00:33:17,502 --> 00:33:22,192 I know, I remember doing that once when I thought I was talking to 563 00:33:22,192 --> 00:33:27,092 LifeLock because my employer at the time had subscribed us all to LifeLock. 564 00:33:27,932 --> 00:33:32,282 it was a spear phishing attack because, it was like they knew 565 00:33:32,282 --> 00:33:33,602 that I was using LifeLock. 566 00:33:34,217 --> 00:33:37,567 And so they went right after me, or maybe it was just, I don't know if it was just 567 00:33:37,567 --> 00:33:42,037 a random phishing attack, but, but I logged into what I thought was my LifeLock 568 00:33:42,107 --> 00:33:47,887 account and, it very much was not, and I immediately did all the I needed to do. 569 00:33:47,997 --> 00:33:48,207 Prasanna Malaiyandi: yeah. 570 00:33:48,307 --> 00:33:50,887 I also remember the other story, Curtis, you told, just going 571 00:33:50,887 --> 00:33:51,877 back to muscle memory, right? 572 00:33:51,877 --> 00:33:56,242 It's, I remember you had a story where, You got an MFA request and 573 00:33:56,242 --> 00:33:59,522 you're like, but I don't remember making that MFA request, remember? 574 00:34:00,062 --> 00:34:03,252 And were like, yeah, but you actually did do that, right? 575 00:34:03,292 --> 00:34:05,292 And it's I think it can go both ways, right? 576 00:34:05,312 --> 00:34:05,662 The muscle 577 00:34:05,762 --> 00:34:06,872 W. Curtis Preston: yeah, absolutely. 578 00:34:07,002 --> 00:34:10,912 I remember that where I got an MFA request and via muscle memory, I was like, yeah. 579 00:34:10,912 --> 00:34:11,172 Boom. 580 00:34:11,172 --> 00:34:11,182 Boom. 581 00:34:11,182 --> 00:34:11,952 And then I was like, wait. 582 00:34:12,382 --> 00:34:13,242 what did I just do? 583 00:34:13,952 --> 00:34:15,202 What did I just approve? 584 00:34:16,242 --> 00:34:21,312 And what it was because I had opened up, Chrome and it had 37 tabs and one 585 00:34:21,312 --> 00:34:26,462 of those tabs was authentication via that, the system that was doing an MFA. 586 00:34:26,472 --> 00:34:28,232 So I breathe the sigh of relief. 587 00:34:28,552 --> 00:34:30,112 I appreciate those four things. 588 00:34:30,212 --> 00:34:33,102 see Rick, we probably could have done this podcast in nine minutes, 589 00:34:33,382 --> 00:34:35,082 and done just those four things. 590 00:34:35,342 --> 00:34:36,662 we should all be like you. 591 00:34:36,962 --> 00:34:39,132 I appreciate brevity where I find it. 592 00:34:39,242 --> 00:34:40,962 but no one ever finds it on this podcast. 593 00:34:41,532 --> 00:34:42,042 so thanks. 594 00:34:42,082 --> 00:34:44,972 Thanks a lot, Rick, for coming on and talking about, one 595 00:34:44,972 --> 00:34:45,952 of our favorite subjects. 596 00:34:46,367 --> 00:34:47,287 Rick Mischka: thank you guys for having me. 597 00:34:47,287 --> 00:34:48,817 This was so much fun. 598 00:34:50,827 --> 00:34:53,157 W. Curtis Preston: And, thanks Prasanna for reminding me of that sad 599 00:34:53,157 --> 00:34:55,007 moment in, in my personal history. 600 00:34:55,230 --> 00:34:56,310 Prasanna Malaiyandi: Anytime, Curtis. 601 00:34:56,310 --> 00:34:58,190 I always try to bring you down. 602 00:34:58,200 --> 00:35:00,180 And Rick, it was as well 603 00:35:01,560 --> 00:35:01,870 W. Curtis Preston: All right. 604 00:35:02,080 --> 00:35:03,480 Thanks again to our listeners. 605 00:35:03,690 --> 00:35:04,860 we'd be nothing without you. 606 00:35:05,120 --> 00:35:09,080 Be sure to subscribe on, wherever you listen to the podcast so 607 00:35:09,080 --> 00:35:10,720 that you can restore it all.