1 00:00:01,057 --> 00:00:03,037 this week on the Restore it all podcast. 2 00:00:03,037 --> 00:00:07,447 We've got our good friend VMs, AKA Melissa Palmer, talking to 3 00:00:07,447 --> 00:00:10,897 us about ransomware and VMware. 4 00:00:11,347 --> 00:00:14,197 Uh, I don't like saying those two things together, but 5 00:00:14,197 --> 00:00:16,237 unfortunately it's happening a lot. 6 00:00:16,477 --> 00:00:17,617 Hope you enjoy the episode. 7 00:00:38,374 --> 00:00:41,374 W. Curtis Preston: Hi, and welcome to Backup Central's Restore it All podcast. 8 00:00:41,374 --> 00:00:44,044 I'm your host, w Curtis Preston, AKA Mr. 9 00:00:44,044 --> 00:00:49,234 Backup, and I have with me one of only three people who actually know and 10 00:00:49,234 --> 00:00:51,994 recognized my actual birthday today. 11 00:00:51,994 --> 00:00:54,764 Prasanna Malaiyandi, how's it going, Prasanna? 12 00:00:55,424 --> 00:00:55,844 Prasanna Malaiyandi: Good. 13 00:00:55,844 --> 00:00:57,229 Curtis, how are you doing? 14 00:00:57,229 --> 00:00:58,429 Happy birthday. 15 00:00:58,519 --> 00:01:00,349 W. Curtis Preston: why is my birthday so complicated? 16 00:01:00,739 --> 00:01:01,759 Why do I make it 17 00:01:02,059 --> 00:01:03,649 Prasanna Malaiyandi: You make it complicated. 18 00:01:03,649 --> 00:01:04,579 Exactly. 19 00:01:04,669 --> 00:01:05,239 W. Curtis Preston: I do. 20 00:01:05,269 --> 00:01:06,169 But why do I do that? 21 00:01:06,174 --> 00:01:07,159 I do it for a reason. 22 00:01:08,029 --> 00:01:08,599 Prasanna Malaiyandi: Privacy. 23 00:01:09,199 --> 00:01:09,919 W. Curtis Preston: Privacy. 24 00:01:09,924 --> 00:01:10,339 Yeah. 25 00:01:10,369 --> 00:01:15,049 So my, my Facebook, LinkedIn, et cetera. 26 00:01:15,049 --> 00:01:19,939 Birthday was yesterday, . Um, and then my actual birthday is today. 27 00:01:20,299 --> 00:01:20,689 Uh, so 28 00:01:20,719 --> 00:01:22,159 Prasanna Malaiyandi: You know how I figured that out? 29 00:01:22,309 --> 00:01:22,909 W. Curtis Preston: what's that? 30 00:01:23,389 --> 00:01:26,209 Prasanna Malaiyandi: Because I saw on Facebook it was your birthday and 31 00:01:26,209 --> 00:01:29,479 the following day I totally forgot and I wished you happy birthday. 32 00:01:29,479 --> 00:01:30,109 And that's when you 33 00:01:30,124 --> 00:01:30,544 W. Curtis Preston: and you got it 34 00:01:32,359 --> 00:01:34,429 Prasanna Malaiyandi: And you're like, oh no, it's actually today's my, 35 00:01:34,444 --> 00:01:36,904 W. Curtis Preston: got it wrong, but you got it right by getting it wrong. 36 00:01:36,904 --> 00:01:37,534 You got it right. 37 00:01:37,534 --> 00:01:38,704 Or by being delayed. 38 00:01:39,049 --> 00:01:39,919 Prasanna Malaiyandi: exactly. 39 00:01:40,114 --> 00:01:40,384 W. Curtis Preston: Yeah. 40 00:01:40,384 --> 00:01:41,224 That's kind of funny. 41 00:01:41,344 --> 00:01:44,604 Um, sometimes I tell people like when they, you know, when they wish me. 42 00:01:44,999 --> 00:01:46,319 You know, happy birthday on Facebook. 43 00:01:46,319 --> 00:01:47,789 I'm like, yeah, thanks, you know, whatever. 44 00:01:48,179 --> 00:01:51,059 Uh, you know, but if it's like work people, I'm like, Hey, just so you 45 00:01:51,059 --> 00:01:52,979 know, I actually do this for a reason. 46 00:01:53,009 --> 00:01:57,119 Like it's privacy and, and you know, your birthday is only one of 47 00:01:57,119 --> 00:02:01,739 like, uh, two in the US only one of two pieces of private information 48 00:02:01,739 --> 00:02:03,359 that are needed to impersonate you. 49 00:02:03,749 --> 00:02:07,859 So, um, you know, the, the one is, you know, so the other one is 50 00:02:07,859 --> 00:02:10,859 social security number, which you don't typically put that out there. 51 00:02:11,059 --> 00:02:13,129 Prasanna Malaiyandi: So are you sure you wanna be recording 52 00:02:13,129 --> 00:02:15,139 this on your, on the podcast and 53 00:02:15,289 --> 00:02:16,039 W. Curtis Preston: I, you know, 54 00:02:16,279 --> 00:02:16,369 Prasanna Malaiyandi: it 55 00:02:16,849 --> 00:02:19,279 W. Curtis Preston: you know, if, if a hacker is willing to 56 00:02:19,809 --> 00:02:21,829 actually follow me on the podcast 57 00:02:23,509 --> 00:02:24,259 Prasanna Malaiyandi: get a listen in. 58 00:02:24,889 --> 00:02:25,459 W. Curtis Preston: yeah. 59 00:02:25,519 --> 00:02:26,149 Yeah. 60 00:02:26,239 --> 00:02:28,759 Um, you know, hackers beware. 61 00:02:29,179 --> 00:02:30,649 Um, yeah. 62 00:02:30,649 --> 00:02:31,639 So, you 63 00:02:31,789 --> 00:02:33,859 Prasanna Malaiyandi: But what's your plan for your special day today, 64 00:02:34,039 --> 00:02:36,319 W. Curtis Preston: So I'm trying, I'm trying to coordinate 65 00:02:36,319 --> 00:02:38,269 immediately following this podcast. 66 00:02:38,269 --> 00:02:42,169 So I have a, a breakfast place, breakfast lunch place that I've been 67 00:02:42,169 --> 00:02:44,839 going to, uh, for like 25 years. 68 00:02:44,899 --> 00:02:49,549 Uh, literally my kids, most of my kid, or both of my kids most of their entire life. 69 00:02:50,089 --> 00:02:55,939 Uh, and I'm trying to arrange a, a, a lunch with, uh, my kids, their 70 00:02:55,939 --> 00:02:58,489 husbands, and, uh, the granddaughter. 71 00:02:58,849 --> 00:03:00,739 Uh, the grand dog will have to stay at home. 72 00:03:02,474 --> 00:03:04,864 but we, we, we did hang out with her all day yesterday. 73 00:03:04,864 --> 00:03:07,924 We got to watch her while my, while my daughter went, uh, went to Disney. 74 00:03:08,584 --> 00:03:09,784 Um, so. 75 00:03:11,809 --> 00:03:14,509 We should get on to the business at hand. 76 00:03:14,989 --> 00:03:20,569 Um, our guest is known for her insightful virtualization comments on Twitter, so I 77 00:03:20,569 --> 00:03:26,089 was very excited to see her now focusing on Public Enemy number one, ransomware. 78 00:03:26,509 --> 00:03:30,559 She's been in the industry over 15 years, and in independent 79 00:03:30,559 --> 00:03:35,209 technology, analyst and ransomware resiliency architect, you can follow. 80 00:03:35,704 --> 00:03:39,994 At vmiss.net welcome to the podcast, Melissa Palmer. 81 00:03:40,114 --> 00:03:42,234 AKA @vmiss 82 00:03:42,814 --> 00:03:43,924 Melissa Palmer: Hello gentlemen. 83 00:03:43,929 --> 00:03:45,464 Thank you so much for having me. 84 00:03:45,874 --> 00:03:46,564 W. Curtis Preston: how's it going? 85 00:03:46,624 --> 00:03:48,034 Uh, you know, it's funny. 86 00:03:48,034 --> 00:03:51,424 I knew I knew you and followed you for a long time and didn't 87 00:03:51,424 --> 00:03:52,864 know you had another name, 88 00:03:53,249 --> 00:03:55,369 Prasanna Malaiyandi: I, I, I, same thing as well, like, I'm like, 89 00:03:55,369 --> 00:03:58,399 I've seen like all your tweets and everything else, but I'm like, I 90 00:03:58,399 --> 00:04:00,409 didn't know your actual name either. 91 00:04:00,949 --> 00:04:04,759 I was like, who is this Melissa Palmer person responding to emails? 92 00:04:04,984 --> 00:04:05,134 W. Curtis Preston: And 93 00:04:05,179 --> 00:04:06,349 Melissa Palmer: I I get that a lot actually. 94 00:04:06,349 --> 00:04:07,869 People don't know we're the same person. 95 00:04:08,644 --> 00:04:09,154 W. Curtis Preston: Yeah. 96 00:04:09,264 --> 00:04:15,964 I, I, um, we actually, we've had a person on the podcast that, um, they continued 97 00:04:15,964 --> 00:04:18,904 to go by their Reddit handle Snorkel 42. 98 00:04:19,334 --> 00:04:22,064 It's like such a random name, you know. 99 00:04:22,364 --> 00:04:25,514 Uh, but yeah, he, like, he wasn't, he wasn't hiding or anything. 100 00:04:25,529 --> 00:04:27,309 He just preferred to go by snorkel42. 101 00:04:27,479 --> 00:04:31,349 So I'm glad to actually know and be able to use your first names. 102 00:04:31,349 --> 00:04:32,309 I'm very excited. 103 00:04:33,774 --> 00:04:39,669 Um, I, I, I am curious, so what, what made you sort of make that jump, right? 104 00:04:39,669 --> 00:04:43,149 You know, you were doing, I see that you, you know, you had background and 105 00:04:43,149 --> 00:04:48,219 backup, you know, good for you, uh, having worked at Veeam, uh, but you 106 00:04:48,219 --> 00:04:52,929 know, you, you've been spending so much time with virtualization lately. 107 00:04:53,469 --> 00:04:56,839 Uh, what, you know, what made you sort of jump over to ransomware. 108 00:04:57,939 --> 00:05:00,939 Melissa Palmer: so it's kind of funny how things work out sometimes. 109 00:05:00,999 --> 00:05:04,089 I have always been, I would say, security minded. 110 00:05:04,904 --> 00:05:07,239 , um, as long as I can remember. 111 00:05:07,239 --> 00:05:09,819 I might have been at DEF com when I was 16 years old. 112 00:05:10,479 --> 00:05:13,269 Anyway, um, so it's kind of a 113 00:05:13,274 --> 00:05:13,839 thing. 114 00:05:13,869 --> 00:05:14,109 Yeah. 115 00:05:14,154 --> 00:05:14,934 W. Curtis Preston: Is that true? 116 00:05:15,104 --> 00:05:16,989 Melissa Palmer: it's kind of a thing that has always been, 117 00:05:17,049 --> 00:05:21,669 uh, throughout my education, my master's in is in secure design. 118 00:05:21,729 --> 00:05:25,629 Throughout my career, I've been bringing it in, in Drs and drabs, 119 00:05:26,109 --> 00:05:31,269 but as ransomware started to pick up and I was really putting a big focus. 120 00:05:32,799 --> 00:05:37,269 Disaster recovery and recovery in general from at the VE perspective. 121 00:05:37,269 --> 00:05:39,099 A couple years ago, I kind of said, you know what? 122 00:05:39,099 --> 00:05:39,579 I think I really. 123 00:05:40,389 --> 00:05:44,289 pivot hard and focus on this cuz I, I just find it so interesting, 124 00:05:44,409 --> 00:05:45,759 like all aspects of it. 125 00:05:46,239 --> 00:05:50,229 Uh, and I've learned a lot and I've helped people fix a lot of things they 126 00:05:50,229 --> 00:05:52,389 had going very wrong in their environment. 127 00:05:52,389 --> 00:05:55,329 So hopefully they, they do not feel the impact of ransomware. 128 00:05:55,749 --> 00:05:58,419 So, like I said, I've had the security minded thing throughout my whole 129 00:05:58,419 --> 00:06:00,489 career and it just kind of got to the point where it was like, I'm 130 00:06:00,489 --> 00:06:02,679 gonna go further down this path now. 131 00:06:03,474 --> 00:06:07,284 Prasanna Malaiyandi: And I think we need more people like that because there's 132 00:06:07,284 --> 00:06:09,114 so much ransomware out there, right? 133 00:06:09,114 --> 00:06:10,254 There's so many issues. 134 00:06:10,254 --> 00:06:13,074 It's, and I think everyone's trying to figure out, okay, what 135 00:06:13,074 --> 00:06:14,754 are sort of those best practices? 136 00:06:14,759 --> 00:06:17,994 What are the things we should be doing to sort of help protect 137 00:06:17,999 --> 00:06:19,044 ourselves from some of this? 138 00:06:19,044 --> 00:06:23,274 So I'm glad at least there's someone in addition trying to focus on this. 139 00:06:23,274 --> 00:06:25,014 So it helps. 140 00:06:25,369 --> 00:06:27,339 W. Curtis Preston: I Is ransomware really happening? 141 00:06:27,339 --> 00:06:28,569 I mean, is it really a thing? 142 00:06:28,869 --> 00:06:31,509 Prasanna Malaiyandi: I thought that was like 2020, isn't it? 143 00:06:32,514 --> 00:06:35,214 Melissa Palmer: So one of my favorite things is I just go to 144 00:06:35,214 --> 00:06:38,694 Google and I type in ransomware, and I just see what comes up. 145 00:06:38,784 --> 00:06:41,274 I was like, I, I, I, I think it's fun. 146 00:06:41,469 --> 00:06:41,949 W. Curtis Preston: yeah. 147 00:06:41,954 --> 00:06:42,349 Yeah. 148 00:06:42,414 --> 00:06:44,664 Melissa Palmer: have a warped idea of fun as we've established. 149 00:06:44,904 --> 00:06:48,294 Um, but like I just go into Google and I type in ransomware and it, it's funny, 150 00:06:48,294 --> 00:06:51,654 the stuff that does make it to like the mainstream news and you see all these 151 00:06:52,014 --> 00:06:56,034 like people on all the news channels that like, I dunno, sometimes you get someone 152 00:06:56,034 --> 00:06:59,004 and they're like the cybersecurity expert, but they're also like the dog walking 153 00:06:59,004 --> 00:07:01,644 expert and like the cat fighting expert. 154 00:07:01,649 --> 00:07:03,084 I'm like, how do you find these people? 155 00:07:03,084 --> 00:07:04,044 But you'll see a lot of. 156 00:07:05,019 --> 00:07:06,609 So this kind of stuff going mainstream. 157 00:07:06,609 --> 00:07:07,689 So the threat is out there. 158 00:07:07,689 --> 00:07:09,279 It's becoming more and more pervasive. 159 00:07:09,279 --> 00:07:10,839 I don't think we're gonna see less of it. 160 00:07:11,259 --> 00:07:13,359 Um, cuz people have made a lot of money this way, right? 161 00:07:13,524 --> 00:07:15,954 Prasanna Malaiyandi: When you have those, when you did your search though, right? 162 00:07:16,374 --> 00:07:19,164 What percentage do you think, or do you even think it's scratching the 163 00:07:19,164 --> 00:07:20,754 surface, like what you see publicly 164 00:07:20,859 --> 00:07:21,939 Melissa Palmer: Oh no. 165 00:07:22,314 --> 00:07:24,264 Prasanna Malaiyandi: versus like what's actually happening? 166 00:07:25,179 --> 00:07:28,089 Melissa Palmer: I don't think people fess up unless they have to. 167 00:07:28,774 --> 00:07:28,899 , right. 168 00:07:28,899 --> 00:07:29,619 Unless there's a reason. 169 00:07:29,619 --> 00:07:32,769 And that's actually a problem I had at Veeam working with 170 00:07:32,769 --> 00:07:34,689 the disaster recovery product. 171 00:07:34,689 --> 00:07:36,909 Like no one wanted to be a customer reference. 172 00:07:36,909 --> 00:07:40,629 Like, I don't wanna admit I had a disaster or a ransomware attack or something 173 00:07:40,629 --> 00:07:42,669 and I use this stuff to save my behind. 174 00:07:42,669 --> 00:07:44,139 Like I'm not admitting that. 175 00:07:44,499 --> 00:07:47,109 Um, so that was actually a challenge getting people to like publicly fast on 176 00:07:47,114 --> 00:07:51,039 say, yeah, I got ransomware and everything went to Hella, but we recovered. 177 00:07:51,039 --> 00:07:51,699 Don't worry, like. 178 00:07:51,984 --> 00:07:52,464 W. Curtis Preston: Yeah. 179 00:07:52,464 --> 00:07:55,764 And by the way, uh, that reminds me to throw out our usual disclaimer. 180 00:07:56,064 --> 00:08:00,414 Um, I work for Druva, uh,Prasanna, works for Zoom, uh, and this is not 181 00:08:00,414 --> 00:08:04,194 a, this is an independent podcast, not a podcast of either company and 182 00:08:04,194 --> 00:08:06,324 the opinions that you hear are ours. 183 00:08:06,744 --> 00:08:10,614 And, um, also, uh, we'd love to have you join the conversation. 184 00:08:10,944 --> 00:08:16,794 Just reach out to me, uh, w Curtis Preston gmail or WC Preston on Twitter. 185 00:08:17,334 --> 00:08:21,484 Uh, as long as it's up and, um, For now. 186 00:08:21,844 --> 00:08:25,984 And, uh, also please rate us, uh, just, you know, scroll down to 187 00:08:25,984 --> 00:08:29,644 your, you know, you know, most of you based on the stats I'm seeing. 188 00:08:29,644 --> 00:08:31,354 Most of you are on Apple Podcast. 189 00:08:31,564 --> 00:08:34,054 Just scroll down to the bottom there and give us some stars. 190 00:08:34,054 --> 00:08:34,924 Give us some comments. 191 00:08:35,914 --> 00:08:36,784 We love comments. 192 00:08:36,784 --> 00:08:39,394 You can tell us how much for, well, for those of you that 193 00:08:39,424 --> 00:08:43,534 are watching it on video, which you can see@backupcentral.com, 194 00:08:43,854 --> 00:08:45,114 Melissa Palmer: I didn't realize, I thought you guys 195 00:08:45,114 --> 00:08:46,474 told me the video was gonna be. 196 00:08:46,959 --> 00:08:47,919 For like outtakes and stuff. 197 00:08:47,919 --> 00:08:50,439 I've been sitting here making funny faces the whole time, like as we 198 00:08:50,439 --> 00:08:51,669 got started, like, cuz I thought you 199 00:08:51,669 --> 00:08:52,899 W. Curtis Preston: This may be the best. 200 00:08:52,989 --> 00:08:54,879 This may be the best recording ever. 201 00:08:55,029 --> 00:08:58,269 Uh, you can comment on how much you like, you know, personas, 202 00:08:58,299 --> 00:09:00,249 uh, are, are we at a tweard yet? 203 00:09:00,249 --> 00:09:02,379 You will tell me when you get to a tweard, right? 204 00:09:03,119 --> 00:09:06,489 Prasanna Malaiyandi: I think it's a, it's a, theard right, 205 00:09:06,519 --> 00:09:08,259 W. Curtis Preston: The, the a the, yeah. 206 00:09:08,259 --> 00:09:11,529 You're, you're at a tweet, but you're not at a, the when is the, the. 207 00:09:11,949 --> 00:09:12,879 Prasanna Malaiyandi: Uh, two months. 208 00:09:13,494 --> 00:09:14,064 W. Curtis Preston: Really. 209 00:09:14,424 --> 00:09:18,924 Um, so that would be, I, if you don't follow Melissa, he hasn't shaved, 210 00:09:19,164 --> 00:09:21,054 uh, or cut his hair since Covid. 211 00:09:21,864 --> 00:09:27,144 Um, so he is at, at almost at a three year beard, otherwise known as a, 212 00:09:27,499 --> 00:09:29,109 Melissa Palmer: I cannot relate to that. 213 00:09:29,109 --> 00:09:30,189 I'm sorry at all. 214 00:09:31,524 --> 00:09:33,894 Prasanna Malaiyandi: It was initially supposed to be a year, which is a year 215 00:09:33,894 --> 00:09:35,694 long beard, and it just kept going. 216 00:09:35,784 --> 00:09:36,234 So 217 00:09:36,639 --> 00:09:39,084 W. Curtis Preston: It's interesting, it's been getting grayer lately. 218 00:09:39,204 --> 00:09:39,654 Um, 219 00:09:39,744 --> 00:09:40,464 Prasanna Malaiyandi: getting grayer. 220 00:09:40,794 --> 00:09:41,094 W. Curtis Preston: what, 221 00:09:41,244 --> 00:09:41,904 Prasanna Malaiyandi: it's a stress. 222 00:09:41,909 --> 00:09:43,104 Curtis's stress. 223 00:09:43,194 --> 00:09:44,784 W. Curtis Preston: in the Molly Andi household? 224 00:09:44,994 --> 00:09:45,444 Prasanna Malaiyandi: Yeah. 225 00:09:45,474 --> 00:09:47,354 W. Curtis Preston: getting too stressed by your ransomware. 226 00:09:47,814 --> 00:09:57,084 Um, yeah, so anyway, um, yeah, I, I agree with you of how much it's 227 00:09:57,084 --> 00:10:02,364 gotten out into the, you know, the general, what, what do we call that? 228 00:10:02,364 --> 00:10:03,744 Like the general mindset. 229 00:10:03,899 --> 00:10:05,184 Melissa Palmer: don't know the regular people like 230 00:10:05,229 --> 00:10:07,104 W. Curtis Preston: um, yeah, the regular people. 231 00:10:07,134 --> 00:10:07,904 Melissa Palmer: The Normies. 232 00:10:07,974 --> 00:10:09,654 W. Curtis Preston: I see it a lot on tv. 233 00:10:09,659 --> 00:10:12,144 I'm seeing it in TV shows, right? 234 00:10:12,144 --> 00:10:14,334 I, uh, the, the, you know, I don't know if you've 235 00:10:14,649 --> 00:10:15,039 Prasanna Malaiyandi: Undeclared. 236 00:10:15,149 --> 00:10:15,469 War 237 00:10:15,924 --> 00:10:18,564 W. Curtis Preston: the undeclared war is a great show. 238 00:10:18,564 --> 00:10:19,794 Have you seen that, Melissa? 239 00:10:20,294 --> 00:10:20,644 Melissa Palmer: No, 240 00:10:20,724 --> 00:10:24,804 W. Curtis Preston: Um, you, uh, so it's, I don't remember where I saw it. 241 00:10:25,254 --> 00:10:26,214 Did I sit on Peacock? 242 00:10:26,394 --> 00:10:26,964 Thank you. 243 00:10:27,204 --> 00:10:32,604 So it's actually a B B C show and it's set in. 244 00:10:32,724 --> 00:10:38,994 Um, so yeah, so, so try to, try to sort of see how crazy this idea seems. 245 00:10:39,174 --> 00:10:41,824 So the bad guy in, you know, the bad. 246 00:10:42,529 --> 00:10:44,749 Country in the show is Russia. 247 00:10:45,019 --> 00:10:49,009 And, and the good guy in the show is, is, you know, England 248 00:10:49,009 --> 00:10:50,659 and, and, and US basically. 249 00:10:50,664 --> 00:10:51,889 But England is the target. 250 00:10:52,459 --> 00:10:58,699 And Russia in the show is using a variety of, uh, cyber attacks 251 00:10:58,879 --> 00:11:02,629 and misinformation attacks to try. 252 00:11:02,744 --> 00:11:03,309 Melissa Palmer: real. 253 00:11:03,459 --> 00:11:05,049 Like this is, wait, this is fake. 254 00:11:05,109 --> 00:11:05,499 Like, 255 00:11:05,664 --> 00:11:07,044 W. Curtis Preston: is, this is a, this is a drama. 256 00:11:07,044 --> 00:11:07,764 It's a series. 257 00:11:07,764 --> 00:11:08,604 It's a series. 258 00:11:09,024 --> 00:11:16,764 And, uh, to try and get to, basically to try and get England 259 00:11:16,794 --> 00:11:18,894 to actually declare a war. 260 00:11:19,074 --> 00:11:22,944 They, they're, they're using it, they're using this undeclared war to 261 00:11:22,944 --> 00:11:25,194 get England to actually declare a war. 262 00:11:25,614 --> 00:11:27,264 Um, and, and, and. 263 00:11:28,739 --> 00:11:30,279 It was pretty good. 264 00:11:30,369 --> 00:11:33,399 Uh, you know, they, they got a lot of the tech in there and they 265 00:11:33,399 --> 00:11:35,259 even, I even learned a few things. 266 00:11:35,319 --> 00:11:38,139 Um, so like I learned about, yeah. 267 00:11:38,139 --> 00:11:39,549 What three words have you heard of what? 268 00:11:39,549 --> 00:11:40,299 Three words? 269 00:11:41,079 --> 00:11:45,699 So there's a, there's a group that has taken, uh, every three 270 00:11:45,699 --> 00:11:48,999 meter segment in the world, right? 271 00:11:48,999 --> 00:11:54,459 Three meter squared segment in the world and has assigned three words. 272 00:11:55,524 --> 00:12:00,354 So that, so that you can, you can say, um, you know, uh, you 273 00:12:00,354 --> 00:12:02,094 can go to what three words.com. 274 00:12:02,334 --> 00:12:02,664 You can 275 00:12:02,979 --> 00:12:04,119 Melissa Palmer: this is so cool. 276 00:12:04,164 --> 00:12:06,744 W. Curtis Preston: can enter your address and like your house will 277 00:12:06,744 --> 00:12:09,894 have multiple three words segments. 278 00:12:09,899 --> 00:12:12,204 Right now it has two purposes. 279 00:12:12,384 --> 00:12:14,934 Uh, one is meeting somebody at Coachella. 280 00:12:15,564 --> 00:12:16,044 Right. 281 00:12:16,074 --> 00:12:20,154 I, I'm, I'm at Squirrel Pizza, you know, tree. 282 00:12:20,574 --> 00:12:24,414 And, and they can put that into, um, it's much easier than saying 283 00:12:24,414 --> 00:12:27,444 I'm at 1 53 negative one genome. 284 00:12:27,444 --> 00:12:27,834 Right. 285 00:12:28,164 --> 00:12:30,054 . Um, and then they can, they can find you. 286 00:12:30,059 --> 00:12:33,744 But also in a lot of the undeveloped world, there's a lot of people 287 00:12:33,744 --> 00:12:37,494 that don't have addresses and this allows them to have an address. 288 00:12:37,854 --> 00:12:38,184 Right. 289 00:12:38,184 --> 00:12:42,204 And they can buy things on Amazon, uh, and have stuff delivered to 290 00:12:42,204 --> 00:12:43,854 their house using what, three words. 291 00:12:43,854 --> 00:12:44,814 Anyway, I learned it from. 292 00:12:45,444 --> 00:12:49,914 So, um, I really don't know how we got onto this, but anyway, the Oh, oh, the 293 00:12:49,914 --> 00:12:55,824 point was that it's, it's out there in the, you know, um, I mean even, is it 294 00:12:55,824 --> 00:13:01,134 the, there's the doctor that has, um, Asperger's, that's, is that the good 295 00:13:01,134 --> 00:13:02,244 Melissa Palmer: Oh, the good doctor. 296 00:13:02,274 --> 00:13:02,514 W. Curtis Preston: Yeah. 297 00:13:02,519 --> 00:13:04,254 They had a ransomware attack, took down the 298 00:13:04,524 --> 00:13:06,684 Melissa Palmer: Grey's Anatomy had a ransomware 299 00:13:06,684 --> 00:13:07,014 episode. 300 00:13:07,014 --> 00:13:07,734 W. Curtis Preston: Grace Anatomy 301 00:13:07,914 --> 00:13:10,404 Melissa Palmer: big Grey's Anatomy fan, but then the whole Derek 302 00:13:10,404 --> 00:13:13,104 thing happened, and I don't know how I feel about it, and I'm still 303 00:13:13,109 --> 00:13:14,574 struggling with that years later. 304 00:13:14,904 --> 00:13:18,024 Um, but yes, Grey's Anatomy had a ransomware episode and I remember 305 00:13:18,024 --> 00:13:22,704 sitting it, watching it just like hysterical through the whole thing. 306 00:13:22,704 --> 00:13:23,424 I was like, 307 00:13:24,444 --> 00:13:25,404 I didn't even have words for it. 308 00:13:25,564 --> 00:13:27,924 I'm like, my favorite TV show has ran somewhere on it. 309 00:13:27,924 --> 00:13:29,284 My life is complete. 310 00:13:29,379 --> 00:13:29,889 W. Curtis Preston: yeah. 311 00:13:29,894 --> 00:13:34,659 I, I get excited when shows have backup in it and it, um, my wife 312 00:13:34,659 --> 00:13:36,669 showed me a show just yesterday. 313 00:13:37,704 --> 00:13:38,094 Darn it. 314 00:13:38,094 --> 00:13:39,714 I can't remember what it was, but back up. 315 00:13:39,744 --> 00:13:42,534 Oh, oh, I remember it was, there was a, I don't remember 316 00:13:42,534 --> 00:13:44,784 the show, but there was in the. 317 00:13:46,134 --> 00:13:51,384 The, this woman got interrupted because her, I'm guessing teenage son 318 00:13:51,684 --> 00:13:57,594 called her and saying, Hey, um, like I, my, I'm, my laptop is messed up. 319 00:13:57,599 --> 00:13:59,094 I can't get in my laptop or something. 320 00:13:59,099 --> 00:14:02,514 And, and so he's, and he needs the, the data and she's like, you should 321 00:14:02,514 --> 00:14:03,954 have backed it up like I told you to. 322 00:14:03,954 --> 00:14:06,254 And then she hung up on him and I was 323 00:14:06,294 --> 00:14:09,114 Melissa Palmer: I, yeah, there was a show, and this had to be years ago and 324 00:14:09,114 --> 00:14:11,394 I don't remember Trump, I'm gonna have to go figure it out afterwards, where 325 00:14:11,394 --> 00:14:15,714 like the ESXi shell was like in like 326 00:14:15,799 --> 00:14:16,149 Prasanna Malaiyandi: Oh, 327 00:14:16,179 --> 00:14:16,899 W. Curtis Preston: really? 328 00:14:17,124 --> 00:14:18,654 Melissa Palmer: And I remember losing my mind. 329 00:14:18,654 --> 00:14:21,234 I remember the guy and it was really hot, but that's all I remember. 330 00:14:21,234 --> 00:14:22,824 Like, I'm gonna have to go figure this out afterwards. 331 00:14:23,499 --> 00:14:25,539 W. Curtis Preston: That's funny because you know, normally when you 332 00:14:25,539 --> 00:14:31,419 see the sh the stuff like this in the, in tv, it's not an actual vsx. 333 00:14:31,419 --> 00:14:31,899 I shell, right? 334 00:14:31,904 --> 00:14:32,179 It's some. 335 00:14:33,024 --> 00:14:34,644 Total random thing. 336 00:14:34,764 --> 00:14:36,924 Um, and it's complete nonsense. 337 00:14:37,374 --> 00:14:39,969 Um, here's a question,Prasanna. 338 00:14:40,254 --> 00:14:43,524 Have you seen any ransomware attacks in Bollywood? 339 00:14:45,684 --> 00:14:47,304 Prasanna Malaiyandi: I don't think I have yet. 340 00:14:47,694 --> 00:14:50,004 Melissa Palmer: Oh, please, please come find me one. 341 00:14:50,009 --> 00:14:50,724 I love Bollywood 342 00:14:50,784 --> 00:14:51,324 W. Curtis Preston: know what we need. 343 00:14:51,384 --> 00:14:52,134 You know what we need? 344 00:14:52,164 --> 00:14:53,784 We need a musical, a ransomware, 345 00:14:54,429 --> 00:14:54,879 Melissa Palmer: Please. 346 00:14:54,939 --> 00:14:55,419 Oh, can we, 347 00:14:55,424 --> 00:14:56,914 W. Curtis Preston: ransomware, attack, music 348 00:14:56,919 --> 00:14:57,249 Melissa Palmer: this? 349 00:14:57,249 --> 00:14:59,919 Like, I've thought about this, I literally have thought about this. 350 00:14:59,919 --> 00:15:02,919 I used to do a lot of musical theater and college and stuff like that. 351 00:15:02,919 --> 00:15:05,589 Like I would be so into a ransomware musical. 352 00:15:05,769 --> 00:15:06,669 Like that would be amazing. 353 00:15:07,809 --> 00:15:08,619 W. Curtis Preston: This could be, this could 354 00:15:08,824 --> 00:15:10,034 Prasanna Malaiyandi: That could be awesome. 355 00:15:10,419 --> 00:15:10,839 W. Curtis Preston: yeah. 356 00:15:11,259 --> 00:15:13,089 You know, send some, send some notes. 357 00:15:13,169 --> 00:15:16,089 Melissa Palmer: I I might have come up with some alternate Taylor Swift 358 00:15:16,089 --> 00:15:17,799 lyrics about ransomware at one point. 359 00:15:17,799 --> 00:15:17,889 I'm 360 00:15:17,984 --> 00:15:21,444 Prasanna Malaiyandi: Oh, are you guys gonna get into a battle now? 361 00:15:21,639 --> 00:15:23,559 W. Curtis Preston: so you, you know, um, 362 00:15:23,694 --> 00:15:24,174 Prasanna Malaiyandi: battle. 363 00:15:24,429 --> 00:15:24,699 W. Curtis Preston: Yeah. 364 00:15:24,699 --> 00:15:30,189 So Melissa, I've actually produced a handful of parody music videos that had 365 00:15:30,234 --> 00:15:31,104 Melissa Palmer: Oh no, really? 366 00:15:31,269 --> 00:15:31,869 W. Curtis Preston: backup. 367 00:15:32,349 --> 00:15:32,889 Yeah. 368 00:15:33,189 --> 00:15:34,059 Um, and one about 369 00:15:34,169 --> 00:15:34,764 Melissa Palmer: to send me some. 370 00:15:34,764 --> 00:15:35,694 I need to see these. 371 00:15:35,829 --> 00:15:38,499 W. Curtis Preston: Um, I'll give, I'll give you a quick sample. 372 00:15:38,589 --> 00:15:40,809 Um, Walk into the lab. 373 00:15:40,809 --> 00:15:42,279 Have you seen my VM server? 374 00:15:42,279 --> 00:15:46,659 I'm, I'm so pumped about getting VMs in my server guests on a big disc. 375 00:15:46,659 --> 00:15:47,739 It's so damn freaky. 376 00:15:48,039 --> 00:15:51,309 People like, man, that's downright sneaky strolling into server rooms. 377 00:15:51,339 --> 00:15:53,919 VMs have some massive appeal moving on to guests. 378 00:15:53,919 --> 00:15:56,919 Even database aside for real, putting in some Hyper V. 379 00:15:56,924 --> 00:15:57,969 Microsoft said it's free. 380 00:15:57,969 --> 00:15:58,989 Should have done it sooner. 381 00:15:59,169 --> 00:16:00,279 Thing my boss would agree. 382 00:16:00,669 --> 00:16:02,079 Uh, the um, 383 00:16:02,254 --> 00:16:03,064 Melissa Palmer: That's good. 384 00:16:03,189 --> 00:16:06,849 W. Curtis Preston: Um, the, the chorus is I'm gonna build VMs, got 385 00:16:06,849 --> 00:16:08,679 at least 20 gifts in my server. 386 00:16:08,709 --> 00:16:10,539 I'm on virtual, getting rid of servers. 387 00:16:10,539 --> 00:16:12,099 VMs are so awesome. 388 00:16:12,489 --> 00:16:15,069 It's, it's, uh, what was the original, what was the original song? 389 00:16:15,099 --> 00:16:16,929 Um, what was that song? 390 00:16:18,249 --> 00:16:18,429 What was 391 00:16:18,534 --> 00:16:22,749 Melissa Palmer: Uh, We're, we're gonna go pop some uh uh, McLemore 392 00:16:22,809 --> 00:16:23,349 W. Curtis Preston: McLemore. 393 00:16:23,349 --> 00:16:23,679 Yeah. 394 00:16:23,679 --> 00:16:24,939 I'm gonna pop some tags. 395 00:16:24,939 --> 00:16:25,449 Yeah, yeah. 396 00:16:25,509 --> 00:16:28,389 Anyway, it is available on, it is available on YouTube. 397 00:16:28,389 --> 00:16:30,549 I'll throw a link for those of you that are 398 00:16:30,669 --> 00:16:33,999 Melissa Palmer: I've been rewriting Taylor Swift songs lately on a 399 00:16:33,999 --> 00:16:37,329 regular basis just because I don't know why I do this, but I do. 400 00:16:37,329 --> 00:16:38,349 And I used to do demos. 401 00:16:38,349 --> 00:16:40,299 That was my sign of doing a demo. 402 00:16:40,299 --> 00:16:42,849 Like, am I ready to cold do this on stage or something? 403 00:16:43,179 --> 00:16:45,609 Can I sing Taylor Swift while I do the demo? 404 00:16:45,849 --> 00:16:48,759 Like just sing my thing, click through all my stuff, whatever. 405 00:16:48,759 --> 00:16:51,609 And that was like my sign of like, you can't get me on this nowhere. 406 00:16:51,609 --> 00:16:52,389 What happens? 407 00:16:52,389 --> 00:16:53,139 I'm good to go. 408 00:16:53,169 --> 00:16:55,539 Like I have to be able to sing a Taylor Swift song while doing the 409 00:16:55,779 --> 00:16:56,589 W. Curtis Preston: that's okay. 410 00:16:56,589 --> 00:17:02,709 I just have to tell you a ran a random, this is, uh, so, uh, several 411 00:17:02,709 --> 00:17:05,949 years ago when I was underemployed, I started doing Uber right. 412 00:17:06,339 --> 00:17:07,899 And then it just turned out I liked it. 413 00:17:07,899 --> 00:17:10,779 So I do it when I'm bored, like I go out and do. 414 00:17:11,154 --> 00:17:12,084 Uber, right. 415 00:17:12,504 --> 00:17:16,104 And, um, like, and also I'm, I'm an extrovert stuck at home, 416 00:17:16,104 --> 00:17:18,324 so I, you know, it's my outlet. 417 00:17:18,684 --> 00:17:24,954 But one night I picked up this couple and the woman had just 418 00:17:25,044 --> 00:17:31,104 broken up with her best friend of like many years over a guy, right? 419 00:17:31,464 --> 00:17:36,144 And she gets in her car, she gets in my car, and she is inconsolable like she's. 420 00:17:37,164 --> 00:17:41,424 Bawling, like just, just ridiculously over the top, bawling her eyes out. 421 00:17:41,694 --> 00:17:46,074 And then she goes, she's, she just, she just, uh, she touches me on 422 00:17:46,074 --> 00:17:50,124 the shoulder and she goes, can you, can you play some Taylor Swift? 423 00:17:50,544 --> 00:17:54,654 Can you play, play some Taylor Swift, any Taylor Swift song and just go, you 424 00:17:54,654 --> 00:17:57,474 know, uh, and I was just like, oh my God. 425 00:17:57,474 --> 00:17:59,544 And then I just, I just said, Hey, you. 426 00:18:00,209 --> 00:18:01,379 Uh, Hey Siri. 427 00:18:01,384 --> 00:18:03,599 Play, play Taylor Swift on Spotify. 428 00:18:03,599 --> 00:18:03,989 Stop it. 429 00:18:04,049 --> 00:18:04,319 Nope. 430 00:18:04,349 --> 00:18:04,649 Nope. 431 00:18:04,679 --> 00:18:05,369 I don't want it. 432 00:18:05,519 --> 00:18:05,819 Sorry. 433 00:18:05,819 --> 00:18:09,239 It started doing it, uh, and it picked a breakup song, 434 00:18:09,884 --> 00:18:10,234 Melissa Palmer: Aw. 435 00:18:10,589 --> 00:18:12,929 W. Curtis Preston: which of course all of them are right. 436 00:18:12,934 --> 00:18:15,749 And so, uh, it didn't, and it, it didn't help. 437 00:18:16,019 --> 00:18:21,089 Anyway, so we were talking about ransomware. 438 00:18:21,809 --> 00:18:22,739 Um, 439 00:18:22,974 --> 00:18:23,554 Melissa Palmer: We were. 440 00:18:23,589 --> 00:18:24,699 Prasanna Malaiyandi: in the general public 441 00:18:24,779 --> 00:18:28,409 W. Curtis Preston: yeah, because, because it is so huge, right? 442 00:18:29,019 --> 00:18:30,189 Prasanna Malaiyandi: And the impact too, right? 443 00:18:30,189 --> 00:18:33,609 It's no longer, Hey, it's just this backend company that gets impacted. 444 00:18:33,609 --> 00:18:33,789 Right? 445 00:18:33,789 --> 00:18:36,619 It's like hospitals, schools, right? 446 00:18:36,819 --> 00:18:41,229 Every, every company, every organization is, yeah. 447 00:18:41,769 --> 00:18:42,069 Is at. 448 00:18:42,219 --> 00:18:42,789 W. Curtis Preston: Yeah. 449 00:18:43,029 --> 00:18:44,769 So what do, what do you think? 450 00:18:44,859 --> 00:18:50,979 Um, it, it, it, you know, looking out there from a security, I know from a 451 00:18:50,979 --> 00:18:55,989 backup perspective, um, what do you think from a security perspective, 452 00:18:56,049 --> 00:19:00,519 what do you think are the things that most people get wrong when they're 453 00:19:00,594 --> 00:19:02,274 Melissa Palmer: They don't have their stuff backed up. 454 00:19:02,274 --> 00:19:02,544 Can we 455 00:19:02,544 --> 00:19:02,934 start with 456 00:19:03,199 --> 00:19:03,599 W. Curtis Preston: Okay. 457 00:19:03,599 --> 00:19:04,039 Okay. 458 00:19:04,044 --> 00:19:04,119 We 459 00:19:04,164 --> 00:19:05,394 Melissa Palmer: like, can we just start there? 460 00:19:05,424 --> 00:19:07,494 Because like there's this weird cross pollination between 461 00:19:07,494 --> 00:19:08,634 backup and insecurity at 462 00:19:08,634 --> 00:19:08,874 W. Curtis Preston: There. 463 00:19:08,874 --> 00:19:09,384 There is. 464 00:19:09,384 --> 00:19:10,344 There is there. 465 00:19:10,344 --> 00:19:11,394 By the way, we used to be 466 00:19:11,394 --> 00:19:13,134 Melissa Palmer: have it backed up, we used to, 467 00:19:13,374 --> 00:19:15,024 W. Curtis Preston: We used to be enemies, but we're over that. 468 00:19:15,084 --> 00:19:15,414 Yeah. 469 00:19:15,474 --> 00:19:15,774 Yeah. 470 00:19:16,434 --> 00:19:17,274 Melissa Palmer: it's ridiculous. 471 00:19:17,274 --> 00:19:19,794 Like if you don't have your BA stuff backed up, how do you think 472 00:19:19,794 --> 00:19:20,844 you're ever gonna recover it? 473 00:19:20,844 --> 00:19:23,994 And the amount of people that don't have their stuff backed up still or don't have 474 00:19:23,994 --> 00:19:25,704 everything backed up is still astounding. 475 00:19:25,704 --> 00:19:28,824 W. Curtis Preston: When you do, do you run into, you don't run into 476 00:19:28,824 --> 00:19:31,734 corporate people that don't have their stuff backed up, do you? 477 00:19:32,604 --> 00:19:32,754 Oh. 478 00:19:33,054 --> 00:19:33,544 Melissa Palmer: Yeah, 479 00:19:34,429 --> 00:19:35,199 W. Curtis Preston: It hurts me. 480 00:19:35,199 --> 00:19:36,189 It hurts me. 481 00:19:36,294 --> 00:19:36,684 Melissa Palmer: it hurts. 482 00:19:36,714 --> 00:19:37,914 Or they don't have everything backed up. 483 00:19:37,914 --> 00:19:40,914 Like, well, this was too expensive to back up before, so we weren't backing it up. 484 00:19:40,914 --> 00:19:41,214 I'm like, well, 485 00:19:41,214 --> 00:19:42,444 how expensive is it if 486 00:19:42,639 --> 00:19:45,369 Prasanna Malaiyandi: Or yeah, or someone just spun up something, right? 487 00:19:45,369 --> 00:19:46,959 Your shadow it use cases, right? 488 00:19:46,959 --> 00:19:49,029 And they're like, Hey, corporate, it didn't know about this. 489 00:19:49,029 --> 00:19:50,559 And so no backups were done. 490 00:19:50,739 --> 00:19:51,309 W. Curtis Preston: yeah. 491 00:19:51,339 --> 00:19:51,639 Okay. 492 00:19:51,639 --> 00:19:54,549 I, yeah, I can, you know, I think, I think the second part Yeah. 493 00:19:54,549 --> 00:19:57,279 That you said, Melissa, like they missed, they missed something that I 494 00:19:57,414 --> 00:19:59,364 Melissa Palmer: I like, I, I can't tell you how many times like working 495 00:19:59,364 --> 00:20:02,454 for a backup vendor, they would be like, well, it's too expensive to 496 00:20:02,454 --> 00:20:07,074 back up this over here cuz it's only test dev, so we don't back it up. 497 00:20:07,104 --> 00:20:08,724 I'm like, okay, it's test dev. 498 00:20:08,729 --> 00:20:10,284 That's where you're doing all your active development. 499 00:20:10,284 --> 00:20:11,184 You're not backing it up. 500 00:20:11,184 --> 00:20:12,474 So what happens if that goes away? 501 00:20:12,479 --> 00:20:14,604 And they're like, but it's not production. 502 00:20:14,604 --> 00:20:16,884 I'm like, it's not production until something happens. 503 00:20:16,974 --> 00:20:18,264 Then you realize it's production. 504 00:20:18,699 --> 00:20:19,359 W. Curtis Preston: My, my 505 00:20:19,464 --> 00:20:19,704 Melissa Palmer: that. 506 00:20:19,704 --> 00:20:20,784 I think that was a common thing. 507 00:20:20,904 --> 00:20:24,624 W. Curtis Preston: My favorite test dev story, and this, this is an old story. 508 00:20:24,774 --> 00:20:28,374 Uh, by the way, this month I'll have been in the industry 30 years, Melissa. 509 00:20:28,974 --> 00:20:33,984 Um, and so this is like 28 years ago. 510 00:20:34,014 --> 00:20:39,574 Um, we had a developer group came to me and said, we need 511 00:20:39,574 --> 00:20:41,044 to restore this directory tree. 512 00:20:41,044 --> 00:20:46,384 And they handed me a directory tree that started with /tmp right? 513 00:20:46,894 --> 00:20:50,404 And, and I said, we don't back up temp. 514 00:20:50,614 --> 00:20:52,194 Like it's well documented. 515 00:20:52,194 --> 00:20:56,254 We don't back up temp, we don't back up, you know, temp, right? 516 00:20:56,464 --> 00:20:59,914 And this was an HP server, which I don't know what they do 517 00:20:59,914 --> 00:21:01,594 these days, but Temp was in ram. 518 00:21:02,164 --> 00:21:08,404 And so what happened was they rebooted and what went away was a directory, a source 519 00:21:08,404 --> 00:21:12,904 code tree that was like 15 developers. 520 00:21:13,809 --> 00:21:19,189 Storing their source code tree in temp and um, for like months. 521 00:21:19,849 --> 00:21:21,409 And they're like, you don't understand. 522 00:21:21,409 --> 00:21:22,309 This is really important. 523 00:21:22,309 --> 00:21:23,809 I'm like, you don't understand. 524 00:21:23,809 --> 00:21:24,079 You were 525 00:21:24,274 --> 00:21:25,174 Melissa Palmer: backed it up. 526 00:21:25,219 --> 00:21:26,989 W. Curtis Preston: source code in. 527 00:21:28,744 --> 00:21:30,964 Melissa Palmer: You know that song, that Beyonce, that like made really pop. 528 00:21:30,964 --> 00:21:32,554 Or if you like it, then you should've put a ring on it. 529 00:21:32,614 --> 00:21:33,904 Like that song. 530 00:21:34,114 --> 00:21:36,124 If you like it, then you should've backed it up. 531 00:21:36,274 --> 00:21:36,994 Very simple. 532 00:21:37,789 --> 00:21:40,819 W. Curtis Preston: Yeah, I, I, I do see, uh, and Prasanna, you've 533 00:21:40,819 --> 00:21:41,989 run into it as well, right? 534 00:21:41,989 --> 00:21:47,449 Like people not backing up, you know, either, either not having backups or, 535 00:21:47,449 --> 00:21:50,569 you know, we, the, the last episode we talked about, you know, a company 536 00:21:50,574 --> 00:21:53,149 that had a homegrown backups, right? 537 00:21:53,239 --> 00:21:54,199 Um, that was 538 00:21:54,259 --> 00:21:57,319 Prasanna Malaiyandi: or, or not even backing up everything 539 00:21:57,319 --> 00:21:59,179 required for that application. 540 00:21:59,749 --> 00:22:00,499 W. Curtis Preston: right, 541 00:22:00,529 --> 00:22:01,099 Prasanna Malaiyandi: Hey, I 542 00:22:01,159 --> 00:22:02,374 Melissa Palmer: it's application dependency. 543 00:22:02,374 --> 00:22:03,904 Mapping's, the worst part of all this 544 00:22:04,204 --> 00:22:04,804 W. Curtis Preston: Yeah. 545 00:22:05,224 --> 00:22:05,374 Yeah. 546 00:22:05,374 --> 00:22:07,984 That's why, you know, you know, going all the way back. 547 00:22:07,984 --> 00:22:12,364 That's why I've always just been a fan of, you know, back up all the things. 548 00:22:12,754 --> 00:22:13,204 Right. 549 00:22:13,209 --> 00:22:15,274 Back up all the servers and all the directories. 550 00:22:15,274 --> 00:22:18,784 I know it costs more money, but, um, what, 551 00:22:18,904 --> 00:22:22,504 Melissa Palmer: Ah, but how much will a ransomware attack cost you these days? 552 00:22:22,504 --> 00:22:23,104 To Ching? 553 00:22:23,104 --> 00:22:24,184 There's your justification. 554 00:22:24,184 --> 00:22:24,874 Here's your budget. 555 00:22:24,874 --> 00:22:25,684 Go protect your stuff. 556 00:22:25,684 --> 00:22:25,864 Now. 557 00:22:25,864 --> 00:22:26,314 Finally, 558 00:22:26,314 --> 00:22:27,154 W. Curtis Preston: Exactly. 559 00:22:27,154 --> 00:22:30,424 Prasanna Malaiyandi: What, one question I have, I know we'll get to it probably 560 00:22:30,424 --> 00:22:34,114 at some point, but with virtualization, does it make it easier to sort of figure 561 00:22:34,114 --> 00:22:36,214 out like everything that's needed, 562 00:22:37,219 --> 00:22:41,629 Melissa Palmer: It depends of course, cuz everything in it depends. 563 00:22:41,779 --> 00:22:44,779 Uh, if everything's hosted in the virtualization environment, 564 00:22:44,784 --> 00:22:45,709 then yeah, it's simple. 565 00:22:45,709 --> 00:22:48,709 But when you get into crazy stuff like well this database is on the Oracle 566 00:22:48,709 --> 00:22:51,889 Rack cluster over there and that's not virtualized cuz Oracle and virtualization 567 00:22:52,009 --> 00:22:53,149 we're not even gonna go there. 568 00:22:53,419 --> 00:22:58,549 Um, that's when you get a little dicey with stuff like that. 569 00:22:58,789 --> 00:23:00,559 Or, you know, especially with hybrid cloud now too. 570 00:23:00,559 --> 00:23:03,579 If you have a app that spans like on-prem in the cloud, then. 571 00:23:04,579 --> 00:23:05,179 Good luck guys. 572 00:23:05,179 --> 00:23:06,799 I hope you actually know what you're doing. 573 00:23:08,659 --> 00:23:11,089 Prasanna Malaiyandi: But would you say though, in the virtualized 574 00:23:11,089 --> 00:23:15,859 environment that for those applications which are fully virtualized, 575 00:23:15,904 --> 00:23:16,714 Melissa Palmer: love this question 576 00:23:16,729 --> 00:23:16,939 Prasanna Malaiyandi: it 577 00:23:17,044 --> 00:23:19,354 Melissa Palmer: we're gonna go down a dark path right after this. 578 00:23:19,549 --> 00:23:21,679 Prasanna Malaiyandi: it makes it a little easier where maybe it doesn't 579 00:23:21,679 --> 00:23:25,279 cover, like you said, a hundred percent of your environment, but it covers 580 00:23:25,279 --> 00:23:27,019 some good chunk of your environment 581 00:23:27,109 --> 00:23:27,649 Melissa Palmer: All right, let, 582 00:23:27,859 --> 00:23:30,889 Prasanna Malaiyandi: you have a general solution and the rest of it you can focus 583 00:23:31,129 --> 00:23:32,149 Melissa Palmer: Let's go with that. 584 00:23:32,209 --> 00:23:36,409 If you're an organization that's a hundred percent virtualized, which if you're 585 00:23:36,409 --> 00:23:41,029 a company that was started in the last 10 to 20 years, you probably are right? 586 00:23:41,699 --> 00:23:42,189 Yeah. 587 00:23:42,799 --> 00:23:45,859 Just back up the whole virtualization environment and you're good to go. 588 00:23:46,339 --> 00:23:48,109 But you know what else that means? 589 00:23:49,099 --> 00:23:52,609 That's a really big juicy target for the ransomware actors. 590 00:23:52,609 --> 00:23:56,089 They can come in, come through your virtualization environment 591 00:23:56,089 --> 00:23:59,989 and ransomware you a hundred times faster and a hundred times worse. 592 00:24:00,019 --> 00:24:03,289 If they get Es Xi or vCenter, yay. 593 00:24:03,754 --> 00:24:04,264 W. Curtis Preston: Right. 594 00:24:04,369 --> 00:24:06,439 Prasanna Malaiyandi: I think that's one thing that isn't talked about a lot 595 00:24:06,529 --> 00:24:07,189 Melissa Palmer: It's not. 596 00:24:07,249 --> 00:24:09,109 It's not, and it drives me up a wall. 597 00:24:10,864 --> 00:24:13,774 W. Curtis Preston: You brought up an interesting topic there, and I 598 00:24:13,774 --> 00:24:19,744 don't think it's one that's discussed enough, and that is, environments 599 00:24:19,744 --> 00:24:26,194 like vCenter are being targeted as a thing that they're not just targeting 600 00:24:26,199 --> 00:24:28,444 the VMs, they're targeting vCenter. 601 00:24:28,494 --> 00:24:29,634 Melissa Palmer: They're going after vm. 602 00:24:29,694 --> 00:24:31,794 The VMware infrastructure itself, not just the VMs. 603 00:24:31,794 --> 00:24:35,874 I mean, any Windows server you pop these days is probably a vm, right? 604 00:24:35,934 --> 00:24:37,704 If it's OnPrem, no, no, no. 605 00:24:37,704 --> 00:24:41,364 They're going after vCenter, which is a management interface, and the 606 00:24:41,364 --> 00:24:44,514 S X I hosts, they are going after the VMware environment as a whole. 607 00:24:45,294 --> 00:24:45,804 W. Curtis Preston: Yeah. 608 00:24:45,804 --> 00:24:48,414 And that, that sort of hurts, right? 609 00:24:48,414 --> 00:24:48,954 Because like you 610 00:24:48,984 --> 00:24:50,784 Melissa Palmer: go up to the backup environments too. 611 00:24:51,114 --> 00:24:53,454 W. Curtis Preston: because, uh, yes, no, we, we talk about 612 00:24:53,454 --> 00:24:55,704 that a lot on this podcast. 613 00:24:55,734 --> 00:25:03,174 Um, that, um, and it, you know, and I know, I know this, I know this reaches 614 00:25:03,179 --> 00:25:06,354 out to your former employer, but backup environments that are exclusively 615 00:25:06,354 --> 00:25:10,764 Windows based, uh, bug me, right? 616 00:25:11,184 --> 00:25:15,504 Uh, right , um, because I am worried about that, 617 00:25:15,714 --> 00:25:17,994 Melissa Palmer: Because windows is just like the most secure thing ever. 618 00:25:17,994 --> 00:25:19,854 Like how many vulnerabilities out there? 619 00:25:19,854 --> 00:25:20,844 Target windows. 620 00:25:20,844 --> 00:25:20,994 Like, 621 00:25:20,994 --> 00:25:21,834 come on guys. 622 00:25:22,314 --> 00:25:25,344 W. Curtis Preston: no one, no ransomware, no one has Windows, 623 00:25:25,344 --> 00:25:28,074 laptops that they then bring, that get infected, and then they bring it 624 00:25:28,194 --> 00:25:28,614 Melissa Palmer: No. 625 00:25:28,614 --> 00:25:29,574 Never. 626 00:25:29,574 --> 00:25:30,174 Never. 627 00:25:30,224 --> 00:25:34,634 Prasanna Malaiyandi: You're talking about VMware, does sort of this ransomware 628 00:25:34,664 --> 00:25:39,944 angle also affect like the VMware cloud offerings as well in your mind, or do 629 00:25:40,214 --> 00:25:45,854 you think it's more about the on-prem customer deployed implementations? 630 00:25:45,884 --> 00:25:48,104 Melissa Palmer: would say if, if I was, so, I, I, you know, you 631 00:25:48,104 --> 00:25:50,924 know, you've heard the whole red verse blue team thing, right? 632 00:25:50,924 --> 00:25:53,204 So I would say I'm usually like a blue team or a defender, 633 00:25:53,204 --> 00:25:54,134 recover, all that kinda stuff. 634 00:25:54,134 --> 00:25:57,254 I got, like, when it comes to VMware, I got like a little bit of red team in me. 635 00:25:57,254 --> 00:25:59,054 I gotta be honest, like I got some red team in there. 636 00:25:59,414 --> 00:26:02,864 Um, it kind of comes down to level of effort, right? 637 00:26:03,194 --> 00:26:08,054 If you've deployed VMware cloud the right way, it's probably harder to get into. 638 00:26:08,579 --> 00:26:11,489 Then your traditional on-prem infrastructure, if you've done 639 00:26:11,489 --> 00:26:16,079 everything right, if I have everybody, if everybody can log into my Cloud 640 00:26:16,079 --> 00:26:19,349 V center anyway, and I put it on the internet, then it's a target, right? 641 00:26:19,349 --> 00:26:20,219 Like that kind of thing. 642 00:26:20,549 --> 00:26:24,509 Um, but I would say I've seen a lot of the easier targets are 643 00:26:24,509 --> 00:26:25,889 still the on-prem kind of stuff. 644 00:26:25,894 --> 00:26:27,449 So that's where people go first. 645 00:26:27,809 --> 00:26:30,539 Um, but I, I, I think that everything is a target. 646 00:26:30,539 --> 00:26:34,169 There's kind of a misnomer that the cloud is more secure, right? 647 00:26:34,754 --> 00:26:36,824 Not, it's sometimes a little harder. 648 00:26:36,824 --> 00:26:40,004 So why there's enough low hanging fruit and data centers, why not start there? 649 00:26:40,064 --> 00:26:40,334 Prasanna Malaiyandi: Yeah. 650 00:26:40,364 --> 00:26:41,984 Well, I go after that harder target. 651 00:26:41,984 --> 00:26:42,314 Yeah. 652 00:26:42,464 --> 00:26:42,854 Melissa Palmer: Yeah. 653 00:26:42,959 --> 00:26:45,659 W. Curtis Preston: Do you want to, for those that don't know what a red and 654 00:26:45,659 --> 00:26:48,059 blue team are, you wanna, uh, fill that? 655 00:26:48,164 --> 00:26:50,024 Melissa Palmer: Yeah, I will. 656 00:26:50,024 --> 00:26:52,664 So if, if you think about it in two different ways, uh, 657 00:26:52,694 --> 00:26:54,584 red team is more like offense. 658 00:26:54,734 --> 00:26:58,754 Like I am the person penetration testing and actively trying to 659 00:26:58,814 --> 00:27:02,474 break stuff and trying to figure out where the weaknesses are. 660 00:27:02,859 --> 00:27:04,539 The blue team is really defense. 661 00:27:04,569 --> 00:27:05,739 I'm the defender. 662 00:27:06,039 --> 00:27:09,459 Um, I'm trying to make sure the red teamers can't break everything cause 663 00:27:09,459 --> 00:27:13,479 I'm trying to secure it and I really feel that backup and recovery does also 664 00:27:13,484 --> 00:27:15,009 fall under the blue team too, right? 665 00:27:15,009 --> 00:27:17,619 Like if I'm, if everything does go to hell, we are ransomware. 666 00:27:17,619 --> 00:27:21,489 We're gonna try, we're putting everything in place now so we can recover later. 667 00:27:22,319 --> 00:27:22,649 W. Curtis Preston: Yeah. 668 00:27:22,649 --> 00:27:26,339 I actually know a guy that is a physical pen tester. 669 00:27:26,999 --> 00:27:33,029 Um, and yeah, his, his job is to physically like to 670 00:27:33,029 --> 00:27:34,589 not, he doesn't break in. 671 00:27:35,099 --> 00:27:36,329 He uses 672 00:27:36,434 --> 00:27:36,674 Melissa Palmer: no. 673 00:27:36,674 --> 00:27:37,544 He gets someone to let him in 674 00:27:37,544 --> 00:27:38,204 the door. 675 00:27:38,609 --> 00:27:41,439 W. Curtis Preston: engineering and then his job is to get to somewhere 676 00:27:41,439 --> 00:27:42,549 where he's not supposed to be. 677 00:27:42,579 --> 00:27:45,399 And take a picture and then, and then get, and then get the hell out. 678 00:27:47,594 --> 00:27:48,674 Melissa Palmer: but that's very valid. 679 00:27:48,704 --> 00:27:49,154 Right? 680 00:27:49,304 --> 00:27:52,454 It's, it's all, there's all different layers and levels of security. 681 00:27:52,724 --> 00:27:53,594 That actually sounds fun. 682 00:27:53,594 --> 00:27:54,914 I think I'd be good at something like that. 683 00:27:55,124 --> 00:27:58,364 I know you can't tell how tall I am, but I'm like five feet tall. 684 00:27:58,454 --> 00:27:59,594 I'm like, wait, like nothing. 685 00:27:59,594 --> 00:28:03,074 So I'm like a tiny little unsuspecting, put a big smile on my face, put some pink 686 00:28:03,074 --> 00:28:04,634 on, like I could probably get it anywhere. 687 00:28:04,709 --> 00:28:04,949 W. Curtis Preston: yeah. 688 00:28:04,949 --> 00:28:11,009 I, I think, I think a female physical pen tester would be a, a, a force 689 00:28:11,009 --> 00:28:12,379 to be reckoned with , I think. 690 00:28:14,039 --> 00:28:15,389 You know, um, 691 00:28:15,524 --> 00:28:17,054 Prasanna Malaiyandi: career opportunity, Melissa. 692 00:28:17,159 --> 00:28:20,909 W. Curtis Preston: just, you know, just play the . It's a little innocent. 693 00:28:20,939 --> 00:28:24,149 I'm not doing anything, you know, I'm lost. 694 00:28:24,719 --> 00:28:26,699 Play, play on all our biases. 695 00:28:26,879 --> 00:28:28,799 That would be mean, but very effective. 696 00:28:29,369 --> 00:28:32,159 Um, so, okay, so we talked about, you know, we talked 697 00:28:32,159 --> 00:28:33,029 about backing up everything. 698 00:28:33,029 --> 00:28:38,489 We talked about the fact that that vCenter is a target, so you need to learn, and, 699 00:28:38,489 --> 00:28:40,529 and I'm, you know, hyper V is a target. 700 00:28:40,859 --> 00:28:42,449 Linux is a target as well. 701 00:28:42,449 --> 00:28:43,649 Like everything's a target. 702 00:28:43,724 --> 00:28:44,594 Melissa Palmer: kvm. 703 00:28:44,654 --> 00:28:45,974 Everything is a target. 704 00:28:45,974 --> 00:28:49,214 But here's the thing that people don't do, and like I said, I'm generally a 705 00:28:49,214 --> 00:28:51,044 blue teamer, but I got some red teaming. 706 00:28:51,374 --> 00:28:54,104 What comes to VMware and I'm kind of thinking, okay, I'm 707 00:28:54,104 --> 00:28:55,604 like a ransomware person. 708 00:28:55,604 --> 00:28:56,144 What do I want? 709 00:28:56,324 --> 00:28:57,074 I wanna make money. 710 00:28:57,104 --> 00:28:59,684 I wanna make you pay the ransom, which means I'm gonna do as much 711 00:28:59,684 --> 00:29:02,744 damage as quickly as possible before you figure out I'm. 712 00:29:03,234 --> 00:29:03,794 W. Curtis Preston: Right. 713 00:29:04,634 --> 00:29:06,044 Melissa Palmer: VMware, kind of VMware. 714 00:29:06,074 --> 00:29:07,304 I'm, I'm, I'm kind of like torn right now. 715 00:29:07,304 --> 00:29:07,574 I don't know. 716 00:29:07,574 --> 00:29:08,504 What's a better target? 717 00:29:08,564 --> 00:29:09,824 VMware or your backups? 718 00:29:09,914 --> 00:29:10,514 Probably both. 719 00:29:10,514 --> 00:29:12,854 If you get two people in there right, hit 'em at the same time. 720 00:29:12,914 --> 00:29:14,504 That way you can't recover and everything's gone. 721 00:29:14,954 --> 00:29:19,154 Um, but I'm just looking for a high impact way to wreak havoc. 722 00:29:20,159 --> 00:29:22,859 Hit the VMware environment, that's gonna be fast. 723 00:29:22,889 --> 00:29:27,059 Um, I do nerdy stuff like read ransomware, release notes, and I can't remember 724 00:29:27,059 --> 00:29:30,029 which strain it was, but they're like, oh, we redid something and now 725 00:29:30,029 --> 00:29:31,559 we encrypt, you know, much faster. 726 00:29:31,564 --> 00:29:33,029 We use more CPU threads, right? 727 00:29:33,029 --> 00:29:38,069 So you've got this big, massive vfu host sitting there with all these CPUs in it. 728 00:29:38,099 --> 00:29:42,569 Once you power everything down so you can encrypt it, boom, it's gonna go so fast. 729 00:29:42,569 --> 00:29:46,049 You're probably not even gonna notice before everything is encrypted. 730 00:29:46,229 --> 00:29:50,939 Prasanna Malaiyandi: And this encryption, does that happen at the vCenter level 731 00:29:50,939 --> 00:29:54,089 or is it literally you pop each VM one 732 00:29:54,134 --> 00:29:55,574 Melissa Palmer: no, you don't even have to do that. 733 00:29:55,574 --> 00:29:56,084 This is cake. 734 00:29:56,084 --> 00:29:57,134 Let me explain how this works. 735 00:29:57,164 --> 00:30:01,544 So, a VMware cluster is usually a bunch of physical servers in a cluster. 736 00:30:02,054 --> 00:30:06,884 We need shared resources so that these VMs can move around the cluster based on 737 00:30:06,884 --> 00:30:10,364 load balancing and if something fails, restarted, all that kind of stuff. 738 00:30:10,574 --> 00:30:14,414 So the shared resources are basically, um, network and storage, 739 00:30:14,654 --> 00:30:17,354 which means if I have eight nodes in my cluster, let's just use that. 740 00:30:18,359 --> 00:30:21,809 That one host is connected to all the data stores and they 741 00:30:21,809 --> 00:30:23,339 all see the same thing, right? 742 00:30:23,339 --> 00:30:26,969 So if I get into one host, I can see all the storage for the whole cluster. 743 00:30:27,809 --> 00:30:30,359 Now, when we get to the storage level or the data store level, 744 00:30:30,364 --> 00:30:33,389 in VMware, a VM is just a file. 745 00:30:33,839 --> 00:30:34,529 It's a file. 746 00:30:34,529 --> 00:30:35,099 They're encrypting. 747 00:30:35,099 --> 00:30:35,609 It's not, it's. 748 00:30:36,144 --> 00:30:37,094 at the file level, right? 749 00:30:37,094 --> 00:30:40,244 They just encrypt all the files on the data store, pretty much. 750 00:30:40,244 --> 00:30:42,284 It's not like I have to go VM by vm. 751 00:30:42,524 --> 00:30:46,034 They're just files at that point, which is why it happens so 752 00:30:46,039 --> 00:30:47,534 quick and why it's so dangerous. 753 00:30:47,804 --> 00:30:47,984 Prasanna Malaiyandi: yeah. 754 00:30:48,464 --> 00:30:52,934 And unlike like your traditional file system, right, these data store files 755 00:30:52,934 --> 00:30:54,884 are pretty large in size, right? 756 00:30:54,904 --> 00:30:55,394 Melissa Palmer: Yeah. 757 00:30:55,394 --> 00:30:55,874 Yeah. 758 00:30:57,944 --> 00:31:01,304 W. Curtis Preston: Regarding the, you know, or, or go, you know, go 759 00:31:01,304 --> 00:31:03,104 after V center or go after backup. 760 00:31:03,284 --> 00:31:09,434 Um, the, the big, the big concern that I have, not just cuz generally what 761 00:31:09,439 --> 00:31:12,044 you know, if they're going after the backup system, historically it's been 762 00:31:12,044 --> 00:31:15,374 to just take it out, take it out of the equation, cuz they're gonna do 763 00:31:15,374 --> 00:31:18,584 damage somewhere else and they don't want the backup system used to recover. 764 00:31:19,284 --> 00:31:24,804 um, you can pretty easily get at least a doomsday copy. 765 00:31:25,074 --> 00:31:28,524 Like if you're, if you're doing an on-prem system, most of them have the ability 766 00:31:28,524 --> 00:31:33,264 to get something in the cloud, uh, to u to use to, to, you can deal with that. 767 00:31:33,424 --> 00:31:36,179 Melissa Palmer: hopefully people have half a brainer putting a copy of their backup 768 00:31:36,179 --> 00:31:37,799 data in the cloud, like just by default, 769 00:31:37,799 --> 00:31:38,009 right? 770 00:31:38,014 --> 00:31:39,719 Like hopefully, hopefully. 771 00:31:40,034 --> 00:31:44,384 W. Curtis Preston: is some of the encryption methods used by some of the 772 00:31:44,384 --> 00:31:52,334 backup vendors aren't that great and that they can also use basically the backups 773 00:31:52,334 --> 00:31:55,484 that, you know, you talked about how do I get paid the most if I'm a ransomware 774 00:31:55,709 --> 00:31:56,549 Melissa Palmer: Yeah, exactly. 775 00:31:56,624 --> 00:31:59,564 W. Curtis Preston: If you can figure out the, the encryption 776 00:31:59,564 --> 00:32:02,054 method used by the backup server. 777 00:32:02,324 --> 00:32:04,394 Now, not only do you have you. 778 00:32:05,414 --> 00:32:09,644 All the D, you have unencrypted copies of everything, right? 779 00:32:09,674 --> 00:32:13,394 That, and then you can do an extortion attack, right? 780 00:32:13,394 --> 00:32:14,714 You can say, Hey, I 781 00:32:14,749 --> 00:32:18,449 Melissa Palmer: I love the, I love me a good cup of extortion in the morning. 782 00:32:18,449 --> 00:32:19,379 Like, come on. 783 00:32:20,099 --> 00:32:22,229 That's how you, that's how you and, and like that's how you 784 00:32:22,229 --> 00:32:23,279 get people to pay too, right? 785 00:32:23,309 --> 00:32:27,299 Ooh, I found pictures of your ct c o doing a little something, something. 786 00:32:27,299 --> 00:32:27,869 I'm gonna take 787 00:32:27,924 --> 00:32:28,704 Prasanna Malaiyandi: whammy. 788 00:32:29,704 --> 00:32:30,124 W. Curtis Preston: Wow. 789 00:32:30,164 --> 00:32:32,234 You go right for the, you go right for the ju. 790 00:32:33,599 --> 00:32:33,929 Melissa Palmer: I do. 791 00:32:33,929 --> 00:32:34,109 I 792 00:32:34,259 --> 00:32:37,979 W. Curtis Preston: I I was just thinking like, you know, the CEO's, cuz you know, 793 00:32:37,979 --> 00:32:41,969 the thing is you showed me an email system and I'll show you, I'll show you 794 00:32:41,969 --> 00:32:43,439 emails that shouldn't have been sent. 795 00:32:43,919 --> 00:32:44,399 Right. 796 00:32:45,049 --> 00:32:45,399 Um, 797 00:32:45,779 --> 00:32:46,469 Melissa Palmer: yeah, let's go with that. 798 00:32:46,559 --> 00:32:47,489 It's a little more tamer. 799 00:32:47,489 --> 00:32:47,729 Like 800 00:32:47,879 --> 00:32:48,629 W. Curtis Preston: Yeah. 801 00:32:48,959 --> 00:32:49,559 Yeah. 802 00:32:49,619 --> 00:32:55,559 Uh, emails that, um, I, you know, I've known, you know, and, and like even 803 00:32:55,559 --> 00:32:59,459 in places where, you know, we, you know, I've been in the corporate world 804 00:32:59,459 --> 00:33:04,019 for 30 years now, and it's changed over the years when we talk about 805 00:33:04,019 --> 00:33:05,879 things like sexual harassment, right? 806 00:33:06,329 --> 00:33:09,959 Um, it ha it ha it has changed, right? 807 00:33:10,379 --> 00:33:15,734 Um, But like, what a lot of it has done is it's just gone closeted, right? 808 00:33:15,734 --> 00:33:19,154 It's like, you know, so guys still talk amongst each other, but 809 00:33:19,154 --> 00:33:21,644 they still do it on email, right? 810 00:33:21,704 --> 00:33:21,974 And you're 811 00:33:22,154 --> 00:33:23,294 Melissa Palmer: Oh, I've got some stories about 812 00:33:23,444 --> 00:33:25,244 W. Curtis Preston: Oh, I'm, I am absolutely sure 813 00:33:25,514 --> 00:33:26,114 Melissa Palmer: I got stories. 814 00:33:26,264 --> 00:33:27,554 W. Curtis Preston: I am sure you do. 815 00:33:28,064 --> 00:33:31,784 Uh, but that's what, if I were, if I were a hacker, I would be going after 816 00:33:31,784 --> 00:33:35,984 the backups and I would be going after backups specifically where I could 817 00:33:35,984 --> 00:33:37,694 figure out the encryption mechanism. 818 00:33:38,584 --> 00:33:42,914 and that I can, maybe, I can't decrypt the data directly, but what I can do is 819 00:33:42,914 --> 00:33:47,924 I can get administrative access to the backup server and then I can restore 820 00:33:47,924 --> 00:33:49,994 whatever I want, wherever I want. 821 00:33:50,354 --> 00:33:53,414 And a lot of people, a lot of people aren't watching their backup 822 00:33:53,609 --> 00:33:54,029 Melissa Palmer: one. 823 00:33:54,149 --> 00:33:54,509 No, they're 824 00:33:54,884 --> 00:33:55,454 W. Curtis Preston: Right. 825 00:33:55,514 --> 00:33:59,804 Um, not like, not like they should be because, well, let me ask you this. 826 00:33:59,804 --> 00:34:02,204 So you, you, you've dealt with a lot of backup folk. 827 00:34:02,399 --> 00:34:02,969 Melissa Palmer: I have. 828 00:34:04,409 --> 00:34:07,679 W. Curtis Preston: It, it's, it's still this thing of like, nobody wants to do it. 829 00:34:07,679 --> 00:34:08,069 Right. 830 00:34:08,079 --> 00:34:09,639 And so it's the junior person 831 00:34:09,959 --> 00:34:12,539 Melissa Palmer: I will say, I will say one of my specializations 832 00:34:12,539 --> 00:34:15,359 when I worked with backup was also monitoring the backup systems. 833 00:34:15,359 --> 00:34:18,329 And I was telling everybody, you realize you need to be monitoring 834 00:34:18,329 --> 00:34:21,779 these two for like a number of reasons, especially like if you're 835 00:34:21,779 --> 00:34:24,389 ransomware and you go to Restore and you realize your backups weren't running. 836 00:34:24,389 --> 00:34:28,679 Like that's a big one too, but kind of looking at like, Hey, like why is Bob 837 00:34:28,679 --> 00:34:31,529 from accounting restoring a VM at 3:00 AM. 838 00:34:32,294 --> 00:34:34,274 Bob from accounting shouldn't be doing that. 839 00:34:34,274 --> 00:34:35,834 Like what is going on here? 840 00:34:35,894 --> 00:34:38,624 Well, someone got his credentials and he had access to the backup server. 841 00:34:38,714 --> 00:34:39,434 Hello? 842 00:34:39,779 --> 00:34:41,609 W. Curtis Preston: yeah, yeah. 843 00:34:41,759 --> 00:34:43,979 Um, least privilege, right? 844 00:34:44,009 --> 00:34:44,129 The 845 00:34:44,444 --> 00:34:45,164 Melissa Palmer: One of my favorites. 846 00:34:45,164 --> 00:34:47,744 That is probably like my number one, I talk to people about 847 00:34:47,749 --> 00:34:49,514 like, let's start there please. 848 00:34:49,589 --> 00:34:50,159 W. Curtis Preston: yeah. 849 00:34:50,159 --> 00:34:50,669 Yeah. 850 00:34:50,984 --> 00:34:52,394 Melissa Palmer: Especially when it comes to VMware, right? 851 00:34:52,394 --> 00:34:53,744 Like Bob, I like Bob. 852 00:34:53,774 --> 00:34:56,294 I'm gonna pick on Bob from accounting now, like Bob from Accounting 853 00:34:56,294 --> 00:34:58,544 shouldn't be able to log into vCenter. 854 00:34:58,544 --> 00:34:59,774 I'm just putting that out there 855 00:34:59,864 --> 00:35:02,414 W. Curtis Preston: Yeah, I know Bob from accounting's, an idiot. 856 00:35:02,464 --> 00:35:04,084 Prasanna Malaiyandi: Are there other things you would recommend 857 00:35:04,084 --> 00:35:08,734 sort of as like best practices to sort of reducing the risk of 858 00:35:08,734 --> 00:35:11,284 ransomware in a vCenter environment? 859 00:35:11,389 --> 00:35:12,679 Melissa Palmer: put vCenter on the internet. 860 00:35:12,679 --> 00:35:14,899 If you go to Showdan, it's all over the place. 861 00:35:14,899 --> 00:35:16,189 People still do this. 862 00:35:16,339 --> 00:35:18,829 People put their ES x I hosts on the internet too. 863 00:35:18,859 --> 00:35:20,149 Do not do this, please. 864 00:35:20,149 --> 00:35:22,969 And I know, but Melissa, there's valid reason that we would do this. 865 00:35:22,969 --> 00:35:25,369 And if you do it in a protected manner and blah, blah, blah, and 866 00:35:25,369 --> 00:35:26,509 you think it's safe, well whatever. 867 00:35:26,509 --> 00:35:28,429 Nothing's safe these days, fine. 868 00:35:28,459 --> 00:35:29,059 Fight me on it. 869 00:35:29,059 --> 00:35:29,899 But like, let's start there. 870 00:35:29,899 --> 00:35:30,799 Let's start with the basics. 871 00:35:31,099 --> 00:35:32,029 Um, that's important. 872 00:35:32,029 --> 00:35:34,279 Principle least privilege is a big thing. 873 00:35:34,879 --> 00:35:40,054 Um, Having a good strong E S X I root password is a good thing. 874 00:35:40,294 --> 00:35:43,024 Not having it written on or in a file on your desktop. 875 00:35:43,024 --> 00:35:43,414 What was it? 876 00:35:43,414 --> 00:35:47,704 I, so I follow a lot of this stuff and I can't remember, oh, it was some 877 00:35:47,704 --> 00:35:50,944 big hack and I can't remember which one right now, but it was really going 878 00:35:50,949 --> 00:35:56,224 around Twitter and like someone found the password file that was on someone's 879 00:35:56,224 --> 00:35:59,554 desktop and whoever posted on Twitter, it was all redacted with the passwords 880 00:35:59,559 --> 00:36:04,984 out, but they had every password to all of the infrastructure in a notepad file. 881 00:36:05,389 --> 00:36:08,449 So someone got into someone's desktop, cuz that's when a lot of it happens. 882 00:36:08,449 --> 00:36:12,049 They get access to your desktop or your PC or whatever they found it. 883 00:36:12,349 --> 00:36:13,099 And guess what? 884 00:36:13,099 --> 00:36:15,299 Now I have the root password for E S X I. 885 00:36:15,304 --> 00:36:17,299 I have the keys to the whole kingdom. 886 00:36:17,299 --> 00:36:17,779 Like, don't 887 00:36:17,869 --> 00:36:20,479 W. Curtis Preston: You know, the, the thing is these things sound so 888 00:36:20,479 --> 00:36:30,079 stupid, but you know that, you know, like so many of the hacks that happen, 889 00:36:30,109 --> 00:36:34,549 ransomware and, and, uh, and otherwise they're, because of really stupid stuff. 890 00:36:34,549 --> 00:36:35,659 Like not installing 891 00:36:35,704 --> 00:36:36,514 Prasanna Malaiyandi: human error. 892 00:36:36,979 --> 00:36:37,369 W. Curtis Preston: right? 893 00:36:37,429 --> 00:36:43,099 Not installing a patch, having your root passwords up on a thing, um, you know, 894 00:36:43,294 --> 00:36:44,434 Prasanna Malaiyandi: saved in a browser. 895 00:36:44,524 --> 00:36:44,884 Right? 896 00:36:44,884 --> 00:36:45,574 Your password. 897 00:36:45,649 --> 00:36:46,189 Melissa Palmer: Like don't do 898 00:36:46,369 --> 00:36:46,879 W. Curtis Preston: yeah. 899 00:36:47,239 --> 00:36:54,019 Um, the, so, so it's like the, these seem like really basic things, but 900 00:36:54,019 --> 00:36:57,709 if everybody in the world did these really basic things, there would be 901 00:36:57,714 --> 00:37:01,309 a significantly, um, smaller amount of ransomware, I think, in the 902 00:37:01,314 --> 00:37:03,124 Prasanna Malaiyandi: But I have a question about that though. 903 00:37:04,324 --> 00:37:06,544 I agree with everything you guys have said. 904 00:37:07,209 --> 00:37:10,984 . But if you got rid of all the low hanging fruits, wouldn't 905 00:37:10,984 --> 00:37:13,414 everything else become much har, 906 00:37:13,609 --> 00:37:14,779 Melissa Palmer: Well, that's the thing, right? 907 00:37:14,784 --> 00:37:16,399 Once we get through this and we 908 00:37:16,414 --> 00:37:17,434 Prasanna Malaiyandi: It'll be the next level. 909 00:37:17,434 --> 00:37:17,764 Yeah. 910 00:37:18,019 --> 00:37:18,709 Melissa Palmer: that's the thing, right? 911 00:37:18,709 --> 00:37:21,289 So like these threat actors are out there doing this stuff day in and day out. 912 00:37:21,289 --> 00:37:23,809 Like, uh, it is like if I'm a threat actor, like. 913 00:37:24,494 --> 00:37:27,454 . I bet they, I bet these gangs have like VMware specialists working 914 00:37:27,454 --> 00:37:29,164 for them at this point, that all they do is go in and home. 915 00:37:29,164 --> 00:37:31,144 VMware, I'm sure they have a backup specialist that they 916 00:37:31,144 --> 00:37:32,044 know all the backup systems. 917 00:37:32,049 --> 00:37:35,164 They just go like, you have to understand that these threat actors are specialized. 918 00:37:35,169 --> 00:37:35,344 Right. 919 00:37:35,344 --> 00:37:36,724 Of course there's generalists. 920 00:37:36,964 --> 00:37:39,814 Um, you have the whole ransomware as a service thing where they just get in 921 00:37:39,814 --> 00:37:42,844 and they kind of hand it over to the threat actors and all that kind of stuff. 922 00:37:43,174 --> 00:37:46,614 So like all these people do is, and they're generally probably 923 00:37:46,619 --> 00:37:49,984 pretty smart people, is like, I'm just gonna figure out every way I. 924 00:37:50,689 --> 00:37:52,289 Just own VMware. 925 00:37:52,289 --> 00:37:54,169 And that's, that's, that's what they do day in and day out, right. 926 00:37:54,169 --> 00:37:56,719 So it, it's hard to compete that with that kind of stuff. 927 00:37:56,719 --> 00:37:59,779 And once we clear up the basics, yes, there's gonna be another area to target. 928 00:38:00,139 --> 00:38:02,899 There's gonna be something new to exploit. 929 00:38:03,199 --> 00:38:06,109 Um, those zero days are gonna come out and people aren't gonna patch 'em 930 00:38:06,114 --> 00:38:08,839 and everybody's watching it, right? 931 00:38:08,844 --> 00:38:12,544 Like I read, um, All the CVEs and stuff like that. 932 00:38:12,544 --> 00:38:16,024 Like they're just sitting there going, oh, I can exploit this and off to the races. 933 00:38:16,024 --> 00:38:17,674 Like it's, it's a big thing. 934 00:38:17,674 --> 00:38:19,714 There's no, there's no silver bullet. 935 00:38:19,714 --> 00:38:21,184 There's no one size fits all. 936 00:38:21,184 --> 00:38:21,844 It's just 937 00:38:22,339 --> 00:38:22,999 W. Curtis Preston: Well, I know. 938 00:38:23,114 --> 00:38:23,644 Melissa Palmer: mitigate the risk. 939 00:38:23,644 --> 00:38:24,094 Right? 940 00:38:24,239 --> 00:38:24,334 W. Curtis Preston: Yeah. 941 00:38:24,334 --> 00:38:29,344 That, that's why my approach when talking to people has been, just assume that 942 00:38:29,344 --> 00:38:31,264 ransomware is going to get into your 943 00:38:31,384 --> 00:38:32,254 Melissa Palmer: Assume breach. 944 00:38:32,344 --> 00:38:32,944 Thank you. 945 00:38:33,664 --> 00:38:35,674 let's, just, let's just stop playing around. 946 00:38:35,704 --> 00:38:36,454 Assume breach. 947 00:38:36,454 --> 00:38:37,294 How do you recover? 948 00:38:37,324 --> 00:38:38,164 How do you stop them? 949 00:38:38,164 --> 00:38:39,004 How do you recover? 950 00:38:39,214 --> 00:38:42,094 W. Curtis Preston: And how do you, and how do you limit the blast? 951 00:38:42,544 --> 00:38:42,694 Right. 952 00:38:43,024 --> 00:38:44,944 How do you, you know, we, you know, I 953 00:38:45,064 --> 00:38:47,124 Melissa Palmer: do you, how do you limit, the amount of damage 954 00:38:47,124 --> 00:38:48,264 they can do and then recover. 955 00:38:48,444 --> 00:38:48,924 W. Curtis Preston: I know, 956 00:38:48,954 --> 00:38:49,934 Melissa Palmer: That's where it has 957 00:38:49,959 --> 00:38:52,209 W. Curtis Preston: And a, and a great for those that are, you know, if you're 958 00:38:52,239 --> 00:38:56,019 listening to this and you're on, because you're a fan of @vmiss, that's great. 959 00:38:56,289 --> 00:39:00,219 Uh, you should check out this other guy that we, we had on a podcast. 960 00:39:00,224 --> 00:39:03,039 We went pretty deep into this Snorkel 42. 961 00:39:03,189 --> 00:39:04,659 I'll put a link in the show notes. 962 00:39:04,959 --> 00:39:08,889 Um, so we, you know, he went into things like, um, what do you call it? 963 00:39:08,889 --> 00:39:11,799 Um, um, limiting. 964 00:39:12,174 --> 00:39:13,794 Melissa Palmer: U Rack reference? 965 00:39:13,794 --> 00:39:14,994 Like how did he come up with 42? 966 00:39:15,099 --> 00:39:15,549 W. Curtis Preston: You know what 967 00:39:15,574 --> 00:39:15,864 Prasanna Malaiyandi: I 968 00:39:16,014 --> 00:39:17,574 Melissa Palmer: Rack or is it like, what's that 969 00:39:17,649 --> 00:39:19,509 W. Curtis Preston: know, we didn't ask, we didn't ask. 970 00:39:19,524 --> 00:39:20,664 Prasanna Malaiyandi: Oh, Hitchhiker's guide. 971 00:39:20,694 --> 00:39:21,294 Melissa Palmer: the Universe? 972 00:39:21,369 --> 00:39:21,609 W. Curtis Preston: Yeah. 973 00:39:21,609 --> 00:39:22,419 The Hitchhikers guide. 974 00:39:22,419 --> 00:39:22,689 Yeah. 975 00:39:23,229 --> 00:39:23,619 Yeah. 976 00:39:23,634 --> 00:39:26,634 Prasanna Malaiyandi: He posts on Reddit all the time on the CIS admin forum, so, 977 00:39:26,709 --> 00:39:27,129 W. Curtis Preston: Yeah. 978 00:39:27,189 --> 00:39:31,179 Um, and you know, he, he talked a lot about limit limit limiting 979 00:39:31,179 --> 00:39:34,359 or stopping lateral movement within your company, period. 980 00:39:34,659 --> 00:39:36,579 Cuz it's, it's, it's the kind of thing where people. 981 00:39:37,314 --> 00:39:42,804 I've only been in literally one company, one company in my entire 982 00:39:42,804 --> 00:39:47,184 career where lateral movement had been completely shut off. 983 00:39:47,634 --> 00:39:48,054 Right. 984 00:39:48,144 --> 00:39:51,984 And, and I, and I only knew that was because backup was really, really hard. 985 00:39:52,554 --> 00:39:55,074 like we, we had to go in and, yeah. 986 00:39:55,079 --> 00:39:58,464 And I had, there, there's a, there's a great story, which I won't retell right 987 00:39:58,464 --> 00:40:00,594 now, but it ends up with me losing. 988 00:40:01,494 --> 00:40:04,134 Stuff at late at night. 989 00:40:04,584 --> 00:40:08,454 Um, and, uh, because of they did that. 990 00:40:08,454 --> 00:40:10,164 But that's the kind of thing you have to do. 991 00:40:10,374 --> 00:40:14,094 Look at it's, it's, it's like the, it's like the concept of least privilege. 992 00:40:14,394 --> 00:40:17,724 Look at your network, figure out which servers need to talk to which servers 993 00:40:18,024 --> 00:40:19,944 and make that happen and nothing else. 994 00:40:21,414 --> 00:40:25,284 Um, what, anything else that you're, you're thinking about Melissa, 995 00:40:25,554 --> 00:40:26,394 Melissa Palmer: Oh, there's so much. 996 00:40:26,454 --> 00:40:27,504 There's, there's so much. 997 00:40:27,564 --> 00:40:32,184 It's just like, it's a ridiculous amount of stuff and it's little stuff, right? 998 00:40:32,184 --> 00:40:35,544 It's like leaving s ssh on making sure it's turned off by detail fault. 999 00:40:35,544 --> 00:40:36,474 That's a good way to get in. 1000 00:40:36,804 --> 00:40:39,504 Uh, anything, anybody who has access to vCenter, right? 1001 00:40:39,504 --> 00:40:39,594 We 1002 00:40:39,624 --> 00:40:40,434 Prasanna Malaiyandi: RDP 1003 00:40:40,689 --> 00:40:41,409 W. Curtis Preston: about rdp? 1004 00:40:42,234 --> 00:40:46,254 Melissa Palmer: Well, the good news is vCenter is a Linux-based appliance. 1005 00:40:46,959 --> 00:40:50,409 So you can't already p to vCenter anymore, at least if there's still 1006 00:40:50,409 --> 00:40:51,969 some Windows vCenters around there. 1007 00:40:51,969 --> 00:40:52,989 Wish they probably are 1008 00:40:53,289 --> 00:40:54,069 W. Curtis Preston: there, there. 1009 00:40:54,489 --> 00:40:55,329 Melissa Palmer: I shouldn't say that. 1010 00:40:55,334 --> 00:40:57,249 See, I feel weird like saying all this stuff. 1011 00:40:57,249 --> 00:41:00,279 Like I hate going places and be like, well here's how you break into word. 1012 00:41:00,279 --> 00:41:01,239 Really screw it up. 1013 00:41:01,509 --> 00:41:03,909 Um, I feel like I shouldn't be doing that, but I'm sure 1014 00:41:03,999 --> 00:41:05,469 W. Curtis Preston: Yeah, I mean, 1015 00:41:05,594 --> 00:41:05,829 Melissa Palmer: stuff. 1016 00:41:06,069 --> 00:41:09,219 Um, I think there's still some Windows V centers hanging around. 1017 00:41:10,304 --> 00:41:11,319 . Um, but the same thing with the V Center, right? 1018 00:41:11,319 --> 00:41:13,179 Don't, don't have SSH on there either. 1019 00:41:13,179 --> 00:41:16,629 Turn off all the ssh s it's really simple to do, but people like it. 1020 00:41:16,629 --> 00:41:17,499 It's like a thing, right? 1021 00:41:17,499 --> 00:41:20,709 Like, oh, it's easier to ssh and go do whatever I have to do, but you forget to 1022 00:41:20,709 --> 00:41:22,359 turn it off afterwards, stuff like that. 1023 00:41:22,869 --> 00:41:25,989 Um, VMware's actually been very good about, um, they have like a whole 1024 00:41:25,989 --> 00:41:29,319 ransomware page where they list everything out that they suggest and stuff like that. 1025 00:41:29,319 --> 00:41:32,109 And that's like a good reading starting point for anybody. 1026 00:41:32,109 --> 00:41:35,829 But people, people just get like sloppy and, and I get that 1027 00:41:35,829 --> 00:41:37,329 and I have found like being. 1028 00:41:38,274 --> 00:41:38,694 It's weird. 1029 00:41:38,694 --> 00:41:41,424 I have like two personalities, like which Melissa's gonna show up? 1030 00:41:41,454 --> 00:41:46,644 Is it VMware, Melissa and infrastructure VMware's infrastructure? 1031 00:41:46,704 --> 00:41:47,544 Melissa's gonna show up. 1032 00:41:47,544 --> 00:41:49,914 Or is security Melissa gonna show up? 1033 00:41:49,974 --> 00:41:51,174 Are they gonna show up together? 1034 00:41:51,174 --> 00:41:52,134 Like who knows, right? 1035 00:41:52,134 --> 00:41:53,844 It's like I've got these two personalities. 1036 00:41:54,144 --> 00:41:57,054 Um, and I've noticed that there is not a lot of cross 1037 00:41:57,054 --> 00:41:58,554 pollination in this space, right? 1038 00:41:58,559 --> 00:42:01,674 There's not a lot of VMware people doing security and there's not a lot of 1039 00:42:02,124 --> 00:42:03,354 security people that really understand. 1040 00:42:04,599 --> 00:42:08,784 and I've seen this gap for a very long time, and I'm like trying to 1041 00:42:09,354 --> 00:42:11,934 bridge it with some of my blog posts and my content and stuff like that. 1042 00:42:11,934 --> 00:42:13,314 So I'll be putting more effort into there. 1043 00:42:13,319 --> 00:42:16,584 But you know, you really gotta the two organ, the two teams 1044 00:42:16,589 --> 00:42:19,194 really just need to work together. 1045 00:42:19,359 --> 00:42:21,669 Prasanna Malaiyandi: that's interesting that you mentioned like, yeah, security 1046 00:42:21,669 --> 00:42:23,739 and virtualization teams not necessarily 1047 00:42:23,874 --> 00:42:27,394 Melissa Palmer: Like I can tell you, every time I see a VMware ransomware 1048 00:42:27,399 --> 00:42:29,544 article in the news, it is factually. 1049 00:42:30,484 --> 00:42:34,164 , like, I don't know where they're getting their information from, from, but it's 1050 00:42:34,164 --> 00:42:36,564 like usually wrong most of the time. 1051 00:42:36,834 --> 00:42:39,354 And I'm just like, people don't understand these things. 1052 00:42:39,479 --> 00:42:39,879 Prasanna Malaiyandi: Yeah. 1053 00:42:40,299 --> 00:42:43,749 I wonder if it's kind of like back in the day, how backup and 1054 00:42:43,749 --> 00:42:47,049 virtualization teams never talked to each other and everything was broken. 1055 00:42:47,054 --> 00:42:48,609 Maybe if they need something like that. 1056 00:42:49,194 --> 00:42:51,954 Melissa Palmer: I remember those days and I feel old saying that, 1057 00:42:51,954 --> 00:42:53,384 but I, I do remember those days. 1058 00:42:54,084 --> 00:42:54,504 W. Curtis Preston: Do you remember? 1059 00:42:54,564 --> 00:42:55,134 You remember? 1060 00:42:55,134 --> 00:42:56,124 Uh, what was it? 1061 00:42:56,184 --> 00:42:57,054 Uh, V C B. 1062 00:42:57,084 --> 00:42:58,134 You remember V c b 1063 00:42:58,224 --> 00:42:58,974 Melissa Palmer: Yeah. 1064 00:43:00,024 --> 00:43:02,784 W. Curtis Preston: I said, I said that it stood for very crappy backup. 1065 00:43:02,789 --> 00:43:03,384 That's what I said. 1066 00:43:03,384 --> 00:43:03,714 It stood 1067 00:43:03,834 --> 00:43:04,914 Melissa Palmer: Yeah, I remember 1068 00:43:05,004 --> 00:43:06,804 W. Curtis Preston: Um, yeah, that was 1069 00:43:06,944 --> 00:43:07,304 Melissa Palmer: More backup 1070 00:43:07,674 --> 00:43:08,394 W. Curtis Preston: 1.0. 1071 00:43:08,844 --> 00:43:09,804 Um, yeah. 1072 00:43:09,804 --> 00:43:13,764 So e everything you just said about VMware, I would take, and I would 1073 00:43:13,769 --> 00:43:17,034 use, I would say exactly the same thing about backup teams, right? 1074 00:43:17,814 --> 00:43:20,304 And they're often, they're often very junior. 1075 00:43:20,724 --> 00:43:22,734 Melissa Palmer: So what happens when we have to get the VMware 1076 00:43:22,734 --> 00:43:25,104 team, the backup team, and the security team in the same room? 1077 00:43:25,104 --> 00:43:25,344 What is 1078 00:43:25,449 --> 00:43:26,649 Prasanna Malaiyandi: And network and network team. 1079 00:43:26,649 --> 00:43:27,369 Don't forget that. 1080 00:43:27,474 --> 00:43:28,884 Melissa Palmer: the network team too while we're at it. 1081 00:43:28,944 --> 00:43:31,644 W. Curtis Preston: Well, I, I mean, hopefully these attacks 1082 00:43:31,644 --> 00:43:34,434 have become so common, right. 1083 00:43:34,439 --> 00:43:39,924 You know, um, Druva did a, a survey and, and half of the companies 1084 00:43:40,284 --> 00:43:43,104 said that they had been hit with ransomware in the last three years. 1085 00:43:43,194 --> 00:43:43,614 Right. 1086 00:43:44,214 --> 00:43:45,354 Um, and. 1087 00:43:46,924 --> 00:43:51,064 You know, hopefully things are become, because you know, if I back up, if I 1088 00:43:51,064 --> 00:43:53,074 look at traditionally backup and Dr. 1089 00:43:53,884 --> 00:44:00,814 Um, you could often, you could often say things like, well, if, if a meteor hits 1090 00:44:00,814 --> 00:44:05,854 or if, if a, you know, if the earthquake takes out, I live in San Diego, right. 1091 00:44:05,854 --> 00:44:09,874 If the earthquake and, and suddenly Arizona becomes beach freight property, 1092 00:44:10,024 --> 00:44:11,554 I'm gonna be dead and I won't care. 1093 00:44:11,794 --> 00:44:12,124 Right. 1094 00:44:12,124 --> 00:44:14,584 And the, and the odds of that are, you know, right. 1095 00:44:14,674 --> 00:44:14,854 But, 1096 00:44:14,889 --> 00:44:15,719 Melissa Palmer: And that's the 1097 00:44:15,909 --> 00:44:17,379 W. Curtis Preston: but you can't say that with, with 1098 00:44:17,559 --> 00:44:18,729 Melissa Palmer: the problem with DR. 1099 00:44:19,419 --> 00:44:20,709 And all the traditional dr. 1100 00:44:20,709 --> 00:44:22,719 I like to say that ransomware is a disaster, right? 1101 00:44:23,739 --> 00:44:25,899 Your disaster recovery plan is a great place to start. 1102 00:44:25,899 --> 00:44:29,139 But here's the thing, how many organizations didn't actually bother? 1103 00:44:29,139 --> 00:44:33,279 Cause we're gonna accept the risk of the meteor strike cuz it's not gonna happen. 1104 00:44:33,729 --> 00:44:34,089 W. Curtis Preston: Right, 1105 00:44:34,239 --> 00:44:35,919 Prasanna Malaiyandi: Versus ransomware, which is so much 1106 00:44:36,009 --> 00:44:36,519 Melissa Palmer: gonna happen. 1107 00:44:36,524 --> 00:44:37,509 It's not if it's 1108 00:44:37,869 --> 00:44:38,079 W. Curtis Preston: Yeah. 1109 00:44:38,079 --> 00:44:42,399 I remember being in a, in, in a, in a meeting trying to work with a large. 1110 00:44:43,129 --> 00:44:49,339 Company, defense contractor and, and, and, and they were basically saying, yeah, if, 1111 00:44:49,339 --> 00:44:53,569 if, you know, if, if that hit, if that happens, I will be dead and I won't care. 1112 00:44:53,749 --> 00:44:56,599 That was literally his official position. 1113 00:44:57,079 --> 00:44:58,009 Let's move on. 1114 00:44:58,009 --> 00:44:58,729 Move on. 1115 00:44:58,729 --> 00:45:00,259 He said . I was like, 1116 00:45:00,339 --> 00:45:02,709 Prasanna Malaiyandi: But one question I have, so we're saying 1117 00:45:02,709 --> 00:45:04,269 that ransomware is common, right? 1118 00:45:04,269 --> 00:45:09,429 People are hit with it, but are there sort of best practices like, Hey, 1119 00:45:09,429 --> 00:45:13,029 here's what you should be doing, and not just in silos, like the backup 1120 00:45:13,034 --> 00:45:16,719 team has stuff that they talk about the VMware, like you said, VMware published 1121 00:45:16,724 --> 00:45:18,519 something on how to prevent it, but. 1122 00:45:18,779 --> 00:45:24,329 Sort of looking holistically across all these organizations, security, networking, 1123 00:45:24,359 --> 00:45:27,089 virtualization, backup teams, right? 1124 00:45:27,239 --> 00:45:30,239 To come together as, Hey, here's really what you guys should be 1125 00:45:30,239 --> 00:45:33,869 talking about before, letting each team sort of figure things out. 1126 00:45:34,689 --> 00:45:37,329 Melissa Palmer: So here's the interesting thing, part interesting thing. 1127 00:45:37,569 --> 00:45:42,069 I think until the tail end of 2022, the number one way threat actors got 1128 00:45:42,069 --> 00:45:44,319 in was through phishing attacks, right? 1129 00:45:44,319 --> 00:45:45,939 Someone clicked a link in the email. 1130 00:45:46,749 --> 00:45:49,464 , that was the number one way, but I believe in the later half of the year, 1131 00:45:49,644 --> 00:45:53,904 and you guys might know better, it switched to vulnerabilities, right? 1132 00:45:53,904 --> 00:45:57,564 Vulnerabilities are now the number one way threat actors are getting in. 1133 00:45:57,984 --> 00:46:00,084 So I think we really need to start with. 1134 00:46:00,384 --> 00:46:02,784 How are they getting in and starting there? 1135 00:46:02,934 --> 00:46:07,014 And each piece right kind of starts with cleaning up their house, 1136 00:46:07,014 --> 00:46:09,714 the VMware vulnerabilities, cuz there are VMware vulnerabilities. 1137 00:46:09,714 --> 00:46:12,684 Like everybody likes to talk about hypervisor escapes. 1138 00:46:12,689 --> 00:46:14,844 Like, that's like the classic VMware hacking thing. 1139 00:46:14,849 --> 00:46:17,514 Like, hahaha hypervisor escape. 1140 00:46:17,514 --> 00:46:19,674 I'm gonna be, and I'm gonna take over the hose. 1141 00:46:19,704 --> 00:46:21,654 Like I, it drives me up a wall. 1142 00:46:21,654 --> 00:46:25,134 I'm like, that's all anybody ever thinks of when they think about virtualization 1143 00:46:25,134 --> 00:46:26,814 insecurity as a hypervisor escape. 1144 00:46:26,874 --> 00:46:27,444 And that does not. 1145 00:46:28,449 --> 00:46:28,909 , no one cares. 1146 00:46:28,909 --> 00:46:29,839 That's not what's gonna get you. 1147 00:46:29,929 --> 00:46:30,199 Right. 1148 00:46:31,249 --> 00:46:33,679 So if we start with something like vulnerabilities, right? 1149 00:46:33,769 --> 00:46:35,869 Everybody's gotta clean their own house, right? 1150 00:46:35,869 --> 00:46:38,239 All the VMware team, the network team, the storage team, the backup 1151 00:46:38,244 --> 00:46:40,609 team, cuz backup software has vulnerabilities sometimes too. 1152 00:46:40,609 --> 00:46:43,579 Like anything can be vulnerable. 1153 00:46:43,699 --> 00:46:47,239 So let's look at the way that the threat actors are getting in and 1154 00:46:47,239 --> 00:46:48,739 everybody clean up their house. 1155 00:46:48,739 --> 00:46:51,319 And then let's all get together and talk about how we clean up 1156 00:46:51,319 --> 00:46:52,489 our house and go from there. 1157 00:46:52,779 --> 00:46:53,319 W. Curtis Preston: Yeah. 1158 00:46:53,469 --> 00:46:56,589 I think if, if we look at like all these teams, right? 1159 00:46:56,709 --> 00:47:01,059 What they all have in common is let's get good passwords in a password 1160 00:47:01,064 --> 00:47:04,959 management system, whatever you have, let's make sure that patch management 1161 00:47:04,959 --> 00:47:10,439 and patch installs is, is top of the top of the priority, right? 1162 00:47:10,619 --> 00:47:11,919 Get MFA. 1163 00:47:12,659 --> 00:47:13,044 . Right. 1164 00:47:13,284 --> 00:47:17,514 Um, and, you know, and, and, and, and, and monitoring and, and also 1165 00:47:17,514 --> 00:47:18,804 the concept of least privilege. 1166 00:47:18,954 --> 00:47:23,664 How are you, how are you implementing these concepts in your environment? 1167 00:47:23,664 --> 00:47:26,454 Security team, backup team s you know, 1168 00:47:26,604 --> 00:47:27,744 Melissa Palmer: Security team too, right? 1169 00:47:27,744 --> 00:47:28,794 They don't get a free pass. 1170 00:47:28,794 --> 00:47:31,904 It's not like I'm the security person, so I don't have to update my software. 1171 00:47:31,909 --> 00:47:33,204 Like it doesn't work that way. 1172 00:47:33,204 --> 00:47:35,184 Like you're, you're the same as everybody else, 1173 00:47:35,424 --> 00:47:38,184 W. Curtis Preston: Yeah, because I think if you, if you just, if you 1174 00:47:38,184 --> 00:47:44,454 just put in like, so many hacks are simply based on zero zero day 1175 00:47:44,454 --> 00:47:47,874 vulnerabilities that came out six months ago that have been, that have been 1176 00:47:47,964 --> 00:47:48,474 Melissa Palmer: and no one 1177 00:47:48,654 --> 00:47:50,694 W. Curtis Preston: that no one patched, right? 1178 00:47:50,934 --> 00:47:53,544 You know, you look, you look at what happened at Rackspace. 1179 00:47:53,874 --> 00:47:57,844 The Rackspace, they're calling it a zero day vulnerability, but it was actually 1180 00:47:57,849 --> 00:48:00,054 fixed only because it was unknown. 1181 00:48:01,209 --> 00:48:04,389 Prior to that, but it was actually fixed by the patch that came 1182 00:48:04,389 --> 00:48:05,889 out a month before the attack, 1183 00:48:07,434 --> 00:48:11,364 Melissa Palmer: And I think, um, I remember was it Exchange or something? 1184 00:48:11,364 --> 00:48:14,034 I don't remember what, but I remember seeing this go around. 1185 00:48:14,034 --> 00:48:15,624 It was, uh, some microsofty thing. 1186 00:48:15,629 --> 00:48:17,994 I don't know if it was like RDP or Exchange R d p, 1187 00:48:18,114 --> 00:48:19,464 ransomware Deployment Protocol. 1188 00:48:19,824 --> 00:48:19,974 Um, 1189 00:48:20,949 --> 00:48:24,859 W. Curtis Preston: they've, I. 1190 00:48:25,074 --> 00:48:29,784 Melissa Palmer: Um, so it was something that, it was like a lot of, uh, 1191 00:48:29,784 --> 00:48:31,914 windows-based ransomware going around, but it was the same thing, like the 1192 00:48:31,919 --> 00:48:35,274 vulnerability used was like six months old and no one had bothered to patch it so, 1193 00:48:35,574 --> 00:48:35,904 Prasanna Malaiyandi: Yeah. 1194 00:48:35,974 --> 00:48:36,464 W. Curtis Preston: Yeah, 1195 00:48:37,944 --> 00:48:41,544 Prasanna Malaiyandi: So, uh, I know we talked about like each house cleaning up. 1196 00:48:41,694 --> 00:48:46,644 I think though, the other thing that these four groups need coordinated with is when 1197 00:48:46,704 --> 00:48:50,604 they do get hit by ransomware though, what does their response look like? 1198 00:48:50,604 --> 00:48:53,784 I feel that a lot of organizations don't have that. 1199 00:48:53,799 --> 00:48:55,689 Melissa Palmer: of Worm as my friend. 1200 00:48:55,909 --> 00:48:57,979 Prasanna Malaiyandi: I know a lot of organizations don't have that plan. 1201 00:48:57,984 --> 00:49:02,209 In fact, Curtis, when we had Tony from Spec Spectra Logic on the call, right? 1202 00:49:02,209 --> 00:49:04,459 Talking through like what happened when Spectra Logic 1203 00:49:04,459 --> 00:49:05,959 got hit with ransomware, right? 1204 00:49:05,959 --> 00:49:08,269 His big thing was like, I don't even know where to start. 1205 00:49:08,749 --> 00:49:09,079 Right? 1206 00:49:09,079 --> 00:49:11,839 And luckily they had cyber insurance they had just signed 1207 00:49:11,839 --> 00:49:13,819 up for the month before, right? 1208 00:49:13,939 --> 00:49:17,299 And so they had experts who would come in and sort of guide them through that. 1209 00:49:17,299 --> 00:49:19,999 But a lot of these organizations like, it's almost like you have 1210 00:49:19,999 --> 00:49:22,669 to do that fire drill right ahead of time and be like, Hey, 1211 00:49:22,689 --> 00:49:23,199 Melissa Palmer: have it. 1212 00:49:23,259 --> 00:49:24,099 That's what you have to do. 1213 00:49:24,099 --> 00:49:24,969 You have to practice 1214 00:49:25,509 --> 00:49:25,869 W. Curtis Preston: Honestly, uh, 1215 00:49:25,959 --> 00:49:27,849 Melissa Palmer: DR test, ransomware recovery test. 1216 00:49:27,879 --> 00:49:31,059 W. Curtis Preston: I want us to do an entirely separate recording on that. 1217 00:49:31,069 --> 00:49:32,259 I, I, I agree with you. 1218 00:49:32,409 --> 00:49:35,109 We're already, we're already over our normal time. 1219 00:49:35,499 --> 00:49:38,169 Uh, and we, and I don't wanna shortchange that topic. 1220 00:49:38,169 --> 00:49:42,189 I think that topic is, is dead onPrasanna and, uh, and I 1221 00:49:42,189 --> 00:49:43,359 think Melissa should come back. 1222 00:49:43,359 --> 00:49:44,259 What do you think, Melissa? 1223 00:49:44,364 --> 00:49:44,854 Prasanna Malaiyandi: Yeah. 1224 00:49:45,699 --> 00:49:46,329 Melissa Palmer: Absolutely. 1225 00:49:46,329 --> 00:49:46,969 I'd love to come back. 1226 00:49:47,019 --> 00:49:47,439 W. Curtis Preston: All right. 1227 00:49:47,529 --> 00:49:48,009 All right. 1228 00:49:48,369 --> 00:49:51,099 Well, I have a birthday lunch waiting for me. 1229 00:49:51,279 --> 00:49:52,269 Melissa Palmer: You do. 1230 00:49:52,299 --> 00:49:53,619 W. Curtis Preston: I'm gonna go do that. 1231 00:49:53,919 --> 00:49:58,779 And, um, Melissa, uh, this, this has been great, uh, exciting and, and I'd love to 1232 00:49:58,779 --> 00:50:04,989 hear, you know, uh, somebody talk about backup and security all at the same time, 1233 00:50:05,259 --> 00:50:06,279 Melissa Palmer: I know it's fun, right? 1234 00:50:06,279 --> 00:50:07,839 There's like, how many of us are there out there? 1235 00:50:07,839 --> 00:50:08,979 I don't think there's many of us. 1236 00:50:08,979 --> 00:50:10,959 It's so nice to be able to have a conversation about it. 1237 00:50:11,109 --> 00:50:12,369 W. Curtis Preston: yeah, and thanks again. 1238 00:50:13,984 --> 00:50:14,654 Prasanna Malaiyandi: Anytime. 1239 00:50:14,659 --> 00:50:17,094 Nice to meet you, Melissa, and looking forward to having you back on. 1240 00:50:17,724 --> 00:50:18,564 Melissa Palmer: Absolutely. 1241 00:50:18,594 --> 00:50:20,484 W. Curtis Preston: All right, and thanks again to our listeners. 1242 00:50:20,694 --> 00:50:21,894 We're nothing without you. 1243 00:50:22,254 --> 00:50:25,674 Remember to subscribe so that you can restore it all 1244 00:50:26,304 --> 00:50:27,354 Prasanna Malaiyandi: Happy birthday Curtis. 1245 00:50:27,534 --> 00:50:27,954 W. Curtis Preston: and. 1246 00:50:27,984 --> 00:50:28,614 Melissa Palmer: birthday.