1 00:00:00,050 --> 00:00:03,800 You found the backup wrap up your go-to podcast for all things 2 00:00:03,800 --> 00:00:06,200 backup recovery and cyber recovery. 3 00:00:06,650 --> 00:00:10,850 In this episode, we're talking about something that keeps me up at night, 4 00:00:12,020 --> 00:00:14,030 ransomware attacks on backups. 5 00:00:14,689 --> 00:00:18,805 A recent study showed that 96% of ransomware attacks. 6 00:00:19,460 --> 00:00:21,890 Now target your backup infrastructure. 7 00:00:22,490 --> 00:00:26,360 96%. Why do they do this? 8 00:00:26,360 --> 00:00:27,560 Well, it's simple. 9 00:00:27,650 --> 00:00:31,280 I think, uh, if they can take out your ability to recover, 10 00:00:31,340 --> 00:00:32,870 they've got you over a barrel. 11 00:00:33,380 --> 00:00:37,250 You're way more likely to pay that ransom if your backups are toast. 12 00:00:38,360 --> 00:00:43,519 Sadly, that same study showed that only about 25% of organizations 13 00:00:43,670 --> 00:00:47,330 actually felt confident that they could defend against those attacks. 14 00:00:48,200 --> 00:00:49,519 That's a serious gap. 15 00:00:50,149 --> 00:00:54,290 Persona and I break down the numbers, talk about what immutability is and 16 00:00:54,290 --> 00:00:58,819 why it's your friend, and discuss what you could do right now to stop handing 17 00:00:58,819 --> 00:01:00,800 over the keys to your backup kingdom. 18 00:01:01,900 --> 00:01:05,800 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 19 00:01:05,800 --> 00:01:10,870 Backup, and I've been passionate about backup and recovery for over 30 years. 20 00:01:11,230 --> 00:01:11,920 Ever since. 21 00:01:11,920 --> 00:01:15,460 I had to tell my boss that there were no backups of the production 22 00:01:15,460 --> 00:01:17,020 database that we had just lost. 23 00:01:17,500 --> 00:01:18,730 I don't want that to happen to me. 24 00:01:18,880 --> 00:01:21,610 I don't want that to happen to you, and that's why I do this. 25 00:01:21,910 --> 00:01:27,040 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 26 00:01:27,340 --> 00:01:29,320 . This is the backup wrap up. 27 00:01:44,411 --> 00:01:46,451 Hi, and welcome to the backup wrap up. 28 00:01:46,451 --> 00:01:51,041 I'm your host w Curtis Preston, AKA, Mr. Backup, and I have with 29 00:01:51,041 --> 00:01:57,251 me a guy who is so proud of me in my recent car maintenance Attempt. 30 00:01:57,461 --> 00:01:58,001 Attempt. 31 00:01:58,181 --> 00:01:58,511 Yeah. 32 00:01:59,121 --> 00:02:00,151 Prasanna Malaiyandi. 33 00:02:00,166 --> 00:02:00,566 How's it going? 34 00:02:00,566 --> 00:02:01,096 Prasanna, 35 00:02:01,631 --> 00:02:02,771 I am good. 36 00:02:03,041 --> 00:02:04,691 But to 37 00:02:04,746 --> 00:02:07,001 wait, you're not gonna tell me you weren't proud of me. 38 00:02:07,476 --> 00:02:07,751 no, no. 39 00:02:08,231 --> 00:02:12,761 To be fair, your current vehicle requires almost zero maintenance. 40 00:02:14,651 --> 00:02:14,981 Yeah. 41 00:02:14,981 --> 00:02:17,081 Except for what I did to it. 42 00:02:17,081 --> 00:02:17,561 could do that. 43 00:02:17,561 --> 00:02:18,071 You could do. 44 00:02:19,001 --> 00:02:20,531 Yeah, yeah. 45 00:02:20,621 --> 00:02:23,981 Well, there is what I told you I discovered there, there is actually, 46 00:02:24,041 --> 00:02:28,481 uh, people highly recommend changing the, the, I don't know, 47 00:02:28,481 --> 00:02:32,021 gear, oil or whatever for the, the. 48 00:02:32,606 --> 00:02:33,386 For the motor. 49 00:02:33,476 --> 00:02:37,586 Um, uh, but like at a hundred thousand miles, which I have passed. 50 00:02:38,016 --> 00:02:38,236 Yes. 51 00:02:38,726 --> 00:02:38,996 um, 52 00:02:39,336 --> 00:02:41,036 do you also do your air filters? 53 00:02:42,146 --> 00:02:44,906 um, uh, no I haven't done that. 54 00:02:44,906 --> 00:02:46,316 I know I'm supposed to do that, but 55 00:02:47,471 --> 00:02:48,791 At like 20,000 miles and how 56 00:02:48,806 --> 00:02:48,986 yeah. 57 00:02:51,161 --> 00:02:52,421 You blew past that Justice sco. 58 00:02:55,241 --> 00:02:58,601 Yeah, just a, six times past that. 59 00:02:59,021 --> 00:03:02,051 Um, I have been doing the tires though. 60 00:03:02,531 --> 00:03:03,461 Uh, 61 00:03:03,671 --> 00:03:04,841 haven't been doing it though. 62 00:03:05,531 --> 00:03:08,681 I was saying, versus like before your previous car, you 63 00:03:08,681 --> 00:03:10,181 used to do everything on that 64 00:03:10,226 --> 00:03:11,726 Yeah, I had to do a lot, right. 65 00:03:11,756 --> 00:03:14,996 Um, brake jobs and I haven't needed a brake job on this because of the way 66 00:03:14,996 --> 00:03:17,066 the brakes work on the, uh, Tesla. 67 00:03:17,906 --> 00:03:21,506 Um, but yeah, but I get, but I had, I got to crank my car up. 68 00:03:21,656 --> 00:03:25,916 Uh, which for those that don't know Teslas, they gotta be just a 69 00:03:25,916 --> 00:03:27,296 little different with everything. 70 00:03:27,941 --> 00:03:31,061 And there's these pressure points that, you know, you don't just 71 00:03:31,061 --> 00:03:34,421 have a little pinch weld where you put the, the jack on you. 72 00:03:34,481 --> 00:03:37,301 You have a pressure point that you, you have to use that. 73 00:03:37,901 --> 00:03:42,071 And so it's, it's more difficult than normal to 74 00:03:42,101 --> 00:03:44,261 reason you do that though is because the battery pack, right? 75 00:03:44,261 --> 00:03:44,651 The battery 76 00:03:44,831 --> 00:03:44,981 Yeah. 77 00:03:44,986 --> 00:03:46,031 I, I, I get it. 78 00:03:46,151 --> 00:03:49,061 of the body, and so it's down there because low center of 79 00:03:49,436 --> 00:03:53,171 It just, it just would've been nice for them to give us two pressure points 80 00:03:53,921 --> 00:03:56,531 on the same area so that we could. 81 00:03:56,771 --> 00:03:57,191 do that 82 00:03:57,851 --> 00:03:58,211 Huh, 83 00:03:58,631 --> 00:03:59,561 Most cars don't do that. 84 00:04:00,461 --> 00:04:04,931 well, most cars you would lift it up and then you would put the jacks stand 85 00:04:04,961 --> 00:04:08,171 underneath like the wheel infrastructure. 86 00:04:08,231 --> 00:04:09,521 But this doesn't have that, right? 87 00:04:10,770 --> 00:04:11,010 and you 88 00:04:11,100 --> 00:04:12,630 I survived, car survived. 89 00:04:12,690 --> 00:04:14,550 I have the new, the new pan on there. 90 00:04:15,120 --> 00:04:15,990 Um, yeah. 91 00:04:15,990 --> 00:04:16,680 Very exciting. 92 00:04:17,010 --> 00:04:20,580 Um, uh, yeah, yeah. 93 00:04:20,700 --> 00:04:21,900 Speaking of surviving, 94 00:04:22,980 --> 00:04:23,340 about today? 95 00:04:23,820 --> 00:04:24,330 yeah. 96 00:04:24,480 --> 00:04:30,570 So this episode, um, we're going to, uh, just talk a little bit 97 00:04:30,570 --> 00:04:34,805 about, you know, we, we, we, we, what, what are you laughing at? 98 00:04:35,505 --> 00:04:37,215 As I said, surviving. 99 00:04:37,215 --> 00:04:39,045 Do you know what song popped into my head? 100 00:04:40,665 --> 00:04:41,355 I got nothing. 101 00:04:41,925 --> 00:04:42,795 Destiny's Child. 102 00:04:42,795 --> 00:04:43,365 I'm a survivor. 103 00:04:45,210 --> 00:04:45,900 I'm a survivor. 104 00:04:49,470 --> 00:04:50,730 Yeah, I like it. 105 00:04:51,480 --> 00:04:54,570 Um, and we want you to be a survivor too, right? 106 00:04:54,600 --> 00:04:57,240 Uh, we want your environment to. 107 00:04:57,800 --> 00:05:00,620 Survive, uh, a ransomware attack, right? 108 00:05:00,620 --> 00:05:04,730 That is the whole point of the book that I just finished, uh, writing, 109 00:05:05,180 --> 00:05:08,670 which is coming out, it's gonna be like right after the, the first of the year. 110 00:05:09,510 --> 00:05:10,110 Um. 111 00:05:11,290 --> 00:05:13,150 By the way, I have to, I have to reminisce. 112 00:05:13,510 --> 00:05:20,080 Um, this is very reminiscent of my very first book that was going to 113 00:05:20,080 --> 00:05:23,260 come out in the Christmas of 99. 114 00:05:23,650 --> 00:05:24,100 Right. 115 00:05:24,490 --> 00:05:29,560 And we did all this work because there was a trade show called Lisa Large 116 00:05:29,560 --> 00:05:31,510 Installation System Administration. 117 00:05:31,750 --> 00:05:33,820 And the company that I worked for at the time was a. 118 00:05:34,075 --> 00:05:35,215 Sponsor it, Lisa. 119 00:05:35,725 --> 00:05:40,345 And, uh, so we really wanted to have the book to come out in time 120 00:05:40,345 --> 00:05:42,955 for that show so that we could like give it away at the show and all, 121 00:05:42,955 --> 00:05:43,945 you know, that kind of stuff, right? 122 00:05:44,575 --> 00:05:48,745 And, um, we, we, we, we succeeded, right? 123 00:05:48,775 --> 00:05:52,435 Uh, the, the show was like in the first half of December and. 124 00:05:53,155 --> 00:05:58,225 The, and it was in San Diego, by the way, interestingly enough, and I, because the 125 00:05:58,225 --> 00:06:00,025 company that I worked for was a sponsor. 126 00:06:00,475 --> 00:06:05,095 I was able to go back, um, into the sponsorship area 127 00:06:05,485 --> 00:06:07,225 when nobody else was there. 128 00:06:07,285 --> 00:06:13,855 And, uh, true story, the first copy of my book that I ever saw and, uh, obtained 129 00:06:14,095 --> 00:06:16,045 was stolen from the O'Reilly booth. 130 00:06:19,090 --> 00:06:19,310 Boo. 131 00:06:20,485 --> 00:06:23,815 I literally went in there, I saw my own book, and I was so excited. 132 00:06:23,815 --> 00:06:24,745 I just had to take one. 133 00:06:25,015 --> 00:06:28,165 And I'm pretty sure the statute of limitations on petty theft is, 134 00:06:28,165 --> 00:06:30,415 has, uh, uh, ran out at this point? 135 00:06:30,655 --> 00:06:34,585 that you also, uh, nearly lost the 136 00:06:35,905 --> 00:06:36,025 is. 137 00:06:36,175 --> 00:06:36,955 because 138 00:06:36,985 --> 00:06:37,645 No, not, no. 139 00:06:38,395 --> 00:06:41,485 Yeah, it is the, it is the same book that I nearly lost, uh, the Yeah. 140 00:06:41,575 --> 00:06:41,845 Yep. 141 00:06:41,935 --> 00:06:42,565 Absolutely. 142 00:06:42,655 --> 00:06:43,165 At Disney. 143 00:06:43,405 --> 00:06:43,675 Yeah. 144 00:06:44,305 --> 00:06:48,355 Uh, anyway, so, uh, just, just reminiscent of that, but. 145 00:06:49,270 --> 00:06:56,230 We talk a lot about, um, the fact that you need to prepare your infrastructure, 146 00:06:56,440 --> 00:07:00,460 your specifically your backup infrastructure for a ransomware attack. 147 00:07:00,880 --> 00:07:06,550 And so, uh, I thought that, uh, I, I, I went out and I looked for a couple 148 00:07:06,550 --> 00:07:11,260 of, uh, articles or, or studies to see if I could, you know, back that up. 149 00:07:11,340 --> 00:07:13,440 But before we get to sort of the studies, right? 150 00:07:13,440 --> 00:07:13,530 I 151 00:07:14,220 --> 00:07:18,540 it's probably useful to talk about like, why should a person care 152 00:07:18,540 --> 00:07:20,010 about their backup infrastructure? 153 00:07:20,010 --> 00:07:23,880 Because isn't ransomware all about cyber criminals attacking production 154 00:07:23,880 --> 00:07:28,050 instances, encrypting data, stealing data from production, right? 155 00:07:28,050 --> 00:07:29,040 All that sort of stuff. 156 00:07:29,910 --> 00:07:31,740 So yes it is, 157 00:07:31,958 --> 00:07:34,838 Everything that you said is correct except for the word all. 158 00:07:35,258 --> 00:07:38,978 So if you take out, when you said it's all about attacking, uh, 159 00:07:39,008 --> 00:07:44,738 primary infrastructure, it's not, um, it is very much about also 160 00:07:44,738 --> 00:07:46,568 attacking your backup infrastructure. 161 00:07:46,748 --> 00:07:48,188 So why would they do that? 162 00:07:48,188 --> 00:07:51,188 It, I think the answer is obvious, but perhaps it's not. 163 00:07:51,428 --> 00:07:54,458 If they can take out your backup infrastructure, if they can encrypt 164 00:07:54,458 --> 00:07:56,438 that, if they can delete that. 165 00:07:56,633 --> 00:08:01,553 If they can expire your backups right, um, then they take the backup 166 00:08:01,553 --> 00:08:06,353 infrastructure out of the equation, uh, from a ransomware perspective, 167 00:08:06,353 --> 00:08:11,093 and thus increasing the chance that you would, uh, then pay the ransom. 168 00:08:11,153 --> 00:08:12,593 Is, is the number one reason. 169 00:08:12,593 --> 00:08:13,673 Do you remember the second reason? 170 00:08:13,673 --> 00:08:14,813 I know we've talked about it a few, a 171 00:08:15,668 --> 00:08:19,508 think, uh, if I recall from prior podcasts, it was the fact that. 172 00:08:20,333 --> 00:08:22,013 All like what is backup? 173 00:08:22,043 --> 00:08:25,583 It is taking all of your production environment and protecting 174 00:08:25,583 --> 00:08:28,523 it somewhere else, right into the backup infrastructure. 175 00:08:28,523 --> 00:08:29,363 What does that mean? 176 00:08:30,203 --> 00:08:31,853 of your data is in one place, 177 00:08:32,573 --> 00:08:37,043 don't need to go compromise a hundred different production applications. 178 00:08:37,343 --> 00:08:40,403 If you can compromise the backup infrastructure, you have access 179 00:08:40,403 --> 00:08:43,673 to all the data stored in those a hundred production applications. 180 00:08:44,603 --> 00:08:46,793 Yeah, and I, I should have pulled up. 181 00:08:46,823 --> 00:08:50,753 Um, I know that I, I don't have a stat, but I know that a 182 00:08:50,753 --> 00:08:53,903 significant percentage of, um. 183 00:08:54,913 --> 00:08:59,503 Of of modern ransomware attacks include exfiltration, right? 184 00:08:59,533 --> 00:09:04,843 Because if they're able to exfiltrate your data, it then once again increases 185 00:09:04,843 --> 00:09:08,508 the chance that you'll pay the ransom because you're thinking, I. 186 00:09:09,113 --> 00:09:15,413 They have, not only have they prevented my access from important data, they 187 00:09:15,413 --> 00:09:20,273 have my 11 herbs and spices, and they're gonna release it to the 188 00:09:20,303 --> 00:09:23,123 public, uh, if I don't pay the ransom. 189 00:09:23,153 --> 00:09:27,053 Or either they've got, you know, IP that they're going to release 190 00:09:27,323 --> 00:09:29,933 or they've got damning evidence. 191 00:09:29,933 --> 00:09:30,988 Do you remember the Sony hack? 192 00:09:31,568 --> 00:09:31,788 Yep. 193 00:09:32,013 --> 00:09:34,143 Where they were talking about artists And 194 00:09:36,303 --> 00:09:36,993 not go over well. 195 00:09:37,493 --> 00:09:37,823 yeah. 196 00:09:37,823 --> 00:09:41,933 And that one, uh, was very damaging to Sony at the time. 197 00:09:41,933 --> 00:09:42,233 Right. 198 00:09:42,653 --> 00:09:46,373 To their relationship with their, uh, with their talent and all of that. 199 00:09:46,673 --> 00:09:51,913 Um, and that was a successful meaning, like they didn't pay 200 00:09:51,913 --> 00:09:55,483 the ransom and so they ended up actually, uh, releasing the data. 201 00:09:55,483 --> 00:09:55,543 Yeah. 202 00:09:55,603 --> 00:09:55,693 Yeah. 203 00:09:56,503 --> 00:09:57,553 Just two things to add. 204 00:09:57,553 --> 00:10:01,873 So I know in past episodes when we talk about sort of encrypting 205 00:10:01,873 --> 00:10:05,773 data plus exfiltrating and then threatening you, again, we've 206 00:10:05,983 --> 00:10:07,393 referred to that as double extortion. 207 00:10:07,393 --> 00:10:08,293 We didn't make up that term. 208 00:10:08,293 --> 00:10:08,473 That's. 209 00:10:08,513 --> 00:10:09,143 Kind of what 210 00:10:09,773 --> 00:10:10,583 referring to. 211 00:10:10,973 --> 00:10:14,633 Uh, the other thing, you also mentioned IP in terms of like 212 00:10:14,633 --> 00:10:16,043 company's data being stolen. 213 00:10:16,283 --> 00:10:18,863 In that case, you're not talking about IP addresses, you're talking 214 00:10:18,863 --> 00:10:20,003 about intellectual property, 215 00:10:20,173 --> 00:10:22,093 Thank you very much for clarifying. 216 00:10:22,093 --> 00:10:22,453 Yeah. 217 00:10:22,483 --> 00:10:22,633 Yeah. 218 00:10:22,633 --> 00:10:24,403 We're talking about intellectual property, right? 219 00:10:24,403 --> 00:10:28,213 So your 11 herbs and spices is the one I I I like to use a lot. 220 00:10:28,253 --> 00:10:29,843 those who are not US based, 221 00:10:30,763 --> 00:10:31,033 dude. 222 00:10:31,033 --> 00:10:32,413 KFC's everywhere. 223 00:10:32,503 --> 00:10:36,283 I have been in many countries and I see KFC everywhere. 224 00:10:36,283 --> 00:10:41,413 We have exported that horrible, like, I love it. 225 00:10:41,413 --> 00:10:42,433 I love the restaurant. 226 00:10:42,433 --> 00:10:42,673 Right? 227 00:10:42,673 --> 00:10:43,423 I love KMC. 228 00:10:43,633 --> 00:10:47,773 It's been, it's been like a, a year since I've had it, but, um, I think 229 00:10:47,773 --> 00:10:51,913 raising canes I think has taken over my, my, uh, need for fried chicken. 230 00:10:52,393 --> 00:10:57,253 But, um, yeah, we, we, we've exported that quite a bit, but yeah, so the 11 231 00:10:57,253 --> 00:11:01,063 herbs and spices was the phrase that was always up in the, in the advertisements. 232 00:11:01,063 --> 00:11:04,063 And so they've got your company intellectual property, whatever it is, 233 00:11:04,063 --> 00:11:08,653 it makes your company, your company, and they're threatening to release it 234 00:11:09,103 --> 00:11:14,953 or, uh, they're, they've got damning uh, information on, um, you know. 235 00:11:15,778 --> 00:11:20,338 Either your executives or perhaps just, uh, the behavior of your 236 00:11:20,338 --> 00:11:25,498 company and in and in a modern, in our modern world, the threat there is 237 00:11:25,498 --> 00:11:27,538 the threat of being canceled, right? 238 00:11:27,958 --> 00:11:31,498 Right now, like I can think of what's that? 239 00:11:32,068 --> 00:11:32,638 What, 240 00:11:33,568 --> 00:11:34,048 which. 241 00:11:34,048 --> 00:11:37,078 you're the one who told me the uh, Campbell Soup. 242 00:11:38,038 --> 00:11:38,758 Oh yeah. 243 00:11:38,758 --> 00:11:38,968 Yeah. 244 00:11:38,968 --> 00:11:39,988 That's just crazy, right? 245 00:11:39,988 --> 00:11:44,548 The this, this crazy thing that a Campbell suit, allegedly, a Campbell soup 246 00:11:44,548 --> 00:11:49,228 executive, he was supposedly the head of cybersecurity or something, and emails 247 00:11:49,228 --> 00:11:50,993 from him leaked out that he was saying. 248 00:11:51,623 --> 00:11:54,803 Very unflattering things, both about his own product, uh, 249 00:11:54,803 --> 00:11:56,093 or their, their own product. 250 00:11:56,093 --> 00:12:01,073 And, uh, also being highly racist about his, uh, his interest, 251 00:12:01,073 --> 00:12:02,963 interestingly enough, Indian coworkers. 252 00:12:03,503 --> 00:12:08,103 Um, basically anything, anything that is negative about your company or the 253 00:12:08,103 --> 00:12:10,563 executives of your company in the current. 254 00:12:11,543 --> 00:12:15,413 Shoot, first ask questions later world that we live in. 255 00:12:15,563 --> 00:12:19,943 Um, you don't want that kind of stuff to get out because you don't know the degree 256 00:12:19,943 --> 00:12:24,353 to which that that is going to be, um, you know, negatively impact your company. 257 00:12:24,353 --> 00:12:24,623 Right? 258 00:12:24,743 --> 00:12:27,503 So go back to the question at hand. 259 00:12:28,223 --> 00:12:32,273 The worry is that either or the, the desire on the part of the 260 00:12:32,273 --> 00:12:35,543 threat actor is to either take out the backup infrastructure so 261 00:12:35,543 --> 00:12:37,283 that you have to pay the ransom. 262 00:12:37,598 --> 00:12:42,068 Or use the backup infrastructure to exfiltrate data. 263 00:12:42,488 --> 00:12:43,118 Um, 264 00:12:43,198 --> 00:12:43,793 also a third one. 265 00:12:44,438 --> 00:12:45,158 what's the third one? 266 00:12:45,713 --> 00:12:48,833 If a company is using SaaS and decides not to back up their 267 00:12:48,833 --> 00:12:49,943 data, they don't have to worry. 268 00:12:53,453 --> 00:12:54,903 Hopefully you're not that company, 269 00:12:55,328 --> 00:12:56,648 Hopefully you're not that company. 270 00:12:56,648 --> 00:12:56,858 Yeah. 271 00:12:57,338 --> 00:13:00,488 Um, yeah, I, I was just thinking about. 272 00:13:01,793 --> 00:13:05,153 Yeah, I mean, if you're, if you have a, if you have a SaaS infrastructure 273 00:13:05,483 --> 00:13:08,963 and you, you don't have a third party backup of that, and then the, the 274 00:13:08,963 --> 00:13:14,033 threat actor attacks that infrastructure then, uh, you know, like for example, 275 00:13:14,033 --> 00:13:19,223 the Rackspace incident where they were a SaaS provider of, uh, hosted 276 00:13:19,253 --> 00:13:24,113 exchange and then, uh, the entire thing got attacked by ransomware and they 277 00:13:24,113 --> 00:13:26,843 basically had to give up and move on. 278 00:13:26,843 --> 00:13:28,133 They basically moved the entire. 279 00:13:28,748 --> 00:13:32,588 Uh, infrastructure over to Microsoft 365. 280 00:13:32,828 --> 00:13:33,188 Right. 281 00:13:34,028 --> 00:13:34,688 because yeah. 282 00:13:35,213 --> 00:13:40,463 and I would say if we go back in history, right, not even that far back. 283 00:13:40,943 --> 00:13:42,863 Ransomware, actors ignored backups. 284 00:13:43,448 --> 00:13:43,898 Right. 285 00:13:43,943 --> 00:13:46,853 didn't care about their backup infrastructure, but because of all 286 00:13:46,853 --> 00:13:49,733 these things, people getting smarter, people not paying the ransomware 'cause 287 00:13:49,733 --> 00:13:51,113 they could recover their environment. 288 00:13:51,563 --> 00:13:54,263 Backup actors are like, Hey, let me go after that. 289 00:13:55,613 --> 00:13:55,973 Yeah. 290 00:13:55,973 --> 00:14:00,623 And so, uh, you know, and this is just because not, maybe not 291 00:14:00,623 --> 00:14:05,063 everybody, maybe everybody doesn't believe what we're saying, right? 292 00:14:05,063 --> 00:14:06,863 And so I thought it would be interesting. 293 00:14:06,998 --> 00:14:07,973 to this podcast. 294 00:14:07,978 --> 00:14:08,278 Come on. 295 00:14:09,908 --> 00:14:10,238 Yeah. 296 00:14:10,238 --> 00:14:13,118 Well, I like some of the people who listen to this podcast, think I'm an idiot. 297 00:14:13,118 --> 00:14:13,388 Right. 298 00:14:13,388 --> 00:14:18,548 So, um, you know, my wife, uh, being one of them anyway, no, she 299 00:14:18,548 --> 00:14:20,168 just uses it to, to go to sleep. 300 00:14:20,828 --> 00:14:24,938 The, um, the, there's a couple of different reports here that I thought 301 00:14:24,938 --> 00:14:30,368 were, uh, really telling the, the biggest of which was this, um, ransomware 302 00:14:30,368 --> 00:14:34,418 trends report from 2024, which was, um. 303 00:14:35,468 --> 00:14:40,358 Cited in in vio, it's 25 Disaster Recovery Statistics. 304 00:14:40,508 --> 00:14:46,088 And they were saying that 96% of modern ransomware attacks attempt 305 00:14:46,088 --> 00:14:47,888 to infect the backup repositories. 306 00:14:48,818 --> 00:14:52,088 Um, 96% is basically everything. 307 00:14:52,583 --> 00:14:52,883 Yeah. 308 00:14:53,273 --> 00:14:55,553 It's like what are those other 4% doing? 309 00:14:56,318 --> 00:14:59,108 Yeah, it's like the, it's like the one out of, what is it? 310 00:14:59,108 --> 00:15:02,288 The, the four out of five recommend sugarless gum for their patients. 311 00:15:02,288 --> 00:15:02,948 Chew, chew gum. 312 00:15:02,948 --> 00:15:06,158 What's with the one guy, like, he doesn't like you. 313 00:15:06,158 --> 00:15:08,948 You don't think they should chew sugarless gum anyway? 314 00:15:09,368 --> 00:15:11,453 so do you remember Dwayne 315 00:15:12,128 --> 00:15:12,638 Of course. 316 00:15:13,493 --> 00:15:16,313 and he was like, because he was a red teamer 317 00:15:16,688 --> 00:15:17,108 Yep. 318 00:15:17,768 --> 00:15:19,028 What is a red team or Prasanna? 319 00:15:19,553 --> 00:15:24,383 It is someone that a company hires to attack their infrastructure and 320 00:15:24,383 --> 00:15:26,663 pretend like they're a hacker, so then they can figure out what the 321 00:15:26,663 --> 00:15:30,083 flaws are and what the vulnerabilities are that they should probably fix. 322 00:15:30,398 --> 00:15:32,588 As depicted in the amazing movie sneakers. 323 00:15:33,053 --> 00:15:33,593 Yes. 324 00:15:34,193 --> 00:15:39,233 And so he actually mentioned, he's like, I love going after backup infrastructure 325 00:15:39,233 --> 00:15:40,793 because that has everything I, I 326 00:15:41,393 --> 00:15:44,573 remember him saying that, and that's like stuck with me all this time. 327 00:15:45,038 --> 00:15:45,338 yeah. 328 00:15:45,338 --> 00:15:48,188 And, and, and some of it is not as obvious as you might think. 329 00:15:48,188 --> 00:15:48,798 So we talked about. 330 00:15:50,348 --> 00:15:57,068 Uh, we talked about that the, the backup system is this honeypot from 331 00:15:57,068 --> 00:15:58,988 which you can get basically everything. 332 00:15:59,738 --> 00:16:02,438 He also looked at it from a different standpoint. 333 00:16:02,438 --> 00:16:05,918 He also looked at service accounts, for example, service accounts that 334 00:16:05,918 --> 00:16:11,018 are often unmonitored, that often don't have the, none of the limits. 335 00:16:11,168 --> 00:16:16,028 Uh, for typical accounts are applied to these service accounts because, 336 00:16:16,208 --> 00:16:20,048 well, it's the backup service account and so of course, uh, it's gonna 337 00:16:20,048 --> 00:16:21,668 be transferring ridiculous tons of. 338 00:16:21,818 --> 00:16:26,708 So if they can get access to that service account, they can then, uh, gain direct 339 00:16:26,708 --> 00:16:30,548 access to that host and, and transfer the data just like the backup system. 340 00:16:31,238 --> 00:16:34,358 Which is interesting when you think about it because on the podcast we 341 00:16:34,358 --> 00:16:38,258 talk about, least privilege access. 342 00:16:38,918 --> 00:16:41,678 And if you think about backup, it's the exact opposite. 343 00:16:41,828 --> 00:16:42,698 Yeah, it is. 344 00:16:42,758 --> 00:16:43,748 It is it really? 345 00:16:43,748 --> 00:16:43,928 Yeah. 346 00:16:43,928 --> 00:16:50,018 Because backup, in order to do its job, um, it has to basically be all powerful. 347 00:16:50,018 --> 00:16:55,358 It has to have access to every file, every database, everything on the system. 348 00:16:55,658 --> 00:16:57,368 Which is why, by the way, right. 349 00:16:57,428 --> 00:17:03,038 iPhone backup is so challenging because, um, the, because of the way that, that the 350 00:17:03,038 --> 00:17:05,528 security is done, uh, within the iPhone. 351 00:17:05,588 --> 00:17:05,978 Right. 352 00:17:06,458 --> 00:17:06,758 Yep. 353 00:17:07,298 --> 00:17:08,258 so you can't. 354 00:17:08,558 --> 00:17:15,968 For example, backup third party apps in the iPhone from a, from a third party 355 00:17:15,968 --> 00:17:19,868 app, because one third party app can't see another third party app's data. 356 00:17:20,078 --> 00:17:24,998 And so if, if that problem existed in regular IT infrastructure, 357 00:17:24,998 --> 00:17:25,988 this would be a problem. 358 00:17:26,378 --> 00:17:28,868 And so you do have these service accounts that are essentially all 359 00:17:28,868 --> 00:17:31,358 powerful, that are typically unmonitored. 360 00:17:31,358 --> 00:17:34,178 And, and if they are monitored, they're all the, the alerts 361 00:17:34,178 --> 00:17:35,258 and everything are turned off. 362 00:17:36,428 --> 00:17:38,768 Um, what, what are you laughing about now? 363 00:17:38,948 --> 00:17:42,758 it's, it's, it's, I was going back to that story. 364 00:17:42,788 --> 00:17:43,208 Sorry. 365 00:17:43,418 --> 00:17:45,968 Maybe we don't have time for another story, but the story you would 366 00:17:45,968 --> 00:17:48,908 always tell about how you worked at a company where they went the 367 00:17:48,908 --> 00:17:51,818 opposite way and locked everything down and you could never do your job 368 00:17:52,238 --> 00:17:53,528 Yes, yes. 369 00:17:53,828 --> 00:17:56,018 to everything and they would not allow you access. 370 00:17:56,408 --> 00:18:01,628 That story is at the exact same time as my, uh, book story. 371 00:18:02,348 --> 00:18:08,198 Um, 'cause it was literally in, in 1999, we were preparing for Y 2K and 372 00:18:08,198 --> 00:18:11,948 that company, the, the cybersecurity people took their job seriously. 373 00:18:12,068 --> 00:18:16,868 And it's the most, it's the, it's the organization. 374 00:18:17,438 --> 00:18:22,418 That had the crunchiest internal infrastructure that I've ever seen before 375 00:18:22,418 --> 00:18:27,368 or since, uh, that it, that even once you were inside, it was not assumed that 376 00:18:27,368 --> 00:18:29,078 you could get from anywhere to anywhere. 377 00:18:29,078 --> 00:18:32,798 And here I was, this, this jerk that was good, trying to 378 00:18:32,798 --> 00:18:34,148 transfer data from everywhere. 379 00:18:34,148 --> 00:18:37,088 I was setting off all kinds of bells and whistles, and they, they kept 380 00:18:37,088 --> 00:18:38,468 telling 'em to, to shut it off. 381 00:18:39,098 --> 00:18:40,388 So here's an interesting thing. 382 00:18:40,468 --> 00:18:44,308 Here's another reason why we're having this conversation now, is you 383 00:18:44,308 --> 00:18:47,613 got the first statistic, 90, 96% of. 384 00:18:49,603 --> 00:18:52,933 Ransomware attacks include targeting the backup system. 385 00:18:53,713 --> 00:18:55,543 Couple that with the following data. 386 00:18:55,573 --> 00:19:00,443 So this is from a Kaseya, uh, study, , well, let me ask you a question. 387 00:19:00,443 --> 00:19:01,103 What do you think? 388 00:19:01,103 --> 00:19:05,423 So, you know, we've been p we've been preaching ransomware and 389 00:19:05,483 --> 00:19:06,443 we're not the only ones, right? 390 00:19:07,073 --> 00:19:08,873 This, this is like the biggest thing ever, right? 391 00:19:10,043 --> 00:19:11,513 For years, right? 392 00:19:11,633 --> 00:19:13,463 So what percentage do you think. 393 00:19:14,003 --> 00:19:17,663 Of, of, uh, the, the, the environments that they have. 394 00:19:17,933 --> 00:19:22,133 What percentage of youth of these environments do you think have any 395 00:19:22,133 --> 00:19:26,688 policies or controls to prevent malicious access to the back of infrastructure? 396 00:19:26,718 --> 00:19:27,928 What do you think that percentage is? 397 00:19:28,643 --> 00:19:29,423 Oh, 398 00:19:31,523 --> 00:19:33,653 so being. 399 00:19:34,358 --> 00:19:36,638 An optimist would. 400 00:19:38,828 --> 00:19:39,368 Right. 401 00:19:39,668 --> 00:19:45,983 I would hope for like 80%, but I know that is probably way too high. 402 00:19:46,718 --> 00:19:50,618 Yeah, that would be, that would be a correct, uh, assumption. 403 00:19:51,098 --> 00:19:55,358 The, the percentage that was in this study was 25%. 404 00:19:55,923 --> 00:19:56,143 Oof. 405 00:19:57,443 --> 00:19:57,663 Ugh. 406 00:19:57,728 --> 00:19:59,168 So we have, we have some work to do. 407 00:19:59,438 --> 00:19:59,618 Right. 408 00:20:00,653 --> 00:20:02,348 And so that's why we're starting here. 409 00:20:02,348 --> 00:20:06,938 It's like just number one, um, you know, what do you call it? 410 00:20:06,938 --> 00:20:07,388 Um. 411 00:20:07,778 --> 00:20:12,488 You, you need to, um, you, you need to do something about this, right? 412 00:20:12,488 --> 00:20:16,538 96% of the attacks and 25% of people are ready for those attacks. 413 00:20:17,138 --> 00:20:18,818 This, this is a problem, right? 414 00:20:19,148 --> 00:20:22,508 Um, and, uh, which is why, here's a third statistic. 415 00:20:22,808 --> 00:20:26,558 This said, uh, this is from, uh, another, from the Nvidia OIT study. 416 00:20:26,913 --> 00:20:31,383 Less than 7% of companies recover within a day from ransomware. 417 00:20:31,443 --> 00:20:31,713 Right. 418 00:20:31,713 --> 00:20:33,663 Over a third, take more than a month. 419 00:20:33,993 --> 00:20:35,583 That makes perfect sense to me. 420 00:20:35,763 --> 00:20:36,153 Right? 421 00:20:36,153 --> 00:20:42,333 Because as we covered a lot in the book, the hardest part of the ransomware 422 00:20:42,993 --> 00:20:47,673 recovery is not the restore part, it's the what the hell happened part. 423 00:20:48,183 --> 00:20:48,573 Right. 424 00:20:48,933 --> 00:20:51,183 Um, and if you. 425 00:20:52,623 --> 00:20:55,173 Have something happen to your backup infrastructure, then, you 426 00:20:55,173 --> 00:20:56,943 know, it's just everything's out. 427 00:20:56,943 --> 00:20:57,963 Everything's out the window. 428 00:20:58,588 --> 00:21:04,743 And, and that, and it's interesting everything we've talked about, 429 00:21:04,743 --> 00:21:07,683 I know we've had Mike on the podcast, Mike Saylor, who's 430 00:21:07,683 --> 00:21:09,093 your co-author for this book. 431 00:21:09,843 --> 00:21:10,293 Um, 432 00:21:11,073 --> 00:21:12,333 talk about how. 433 00:21:13,503 --> 00:21:17,583 Difficult it is to do the forensics and or time consuming, right? 434 00:21:17,583 --> 00:21:20,613 It's not like you're going to just say, oh, everything's good. 435 00:21:20,613 --> 00:21:24,123 I'm just gonna blow away everything and recover my data and start going again, 436 00:21:24,388 --> 00:21:24,568 So. 437 00:21:24,568 --> 00:21:27,988 Is it just unrealistic to even have a one day stat? 438 00:21:27,993 --> 00:21:29,488 Why does that even make sense? 439 00:21:30,388 --> 00:21:34,948 No, I, I think that's a perfectly, uh, reasonable question. 440 00:21:34,973 --> 00:21:38,578 I, I actually, I thought of, I was thinking about that as I was, 441 00:21:38,608 --> 00:21:40,528 um, as I was reading it, right? 442 00:21:41,278 --> 00:21:46,978 Because I, I don't think it is, um, unless you have like the smallest of attacks 443 00:21:47,608 --> 00:21:50,908 or you really spend a lot of money for. 444 00:21:52,138 --> 00:21:59,158 Um, XDR tools and, um, you know, uh, SEIM and SOAR tools and you're, and 445 00:21:59,158 --> 00:22:01,978 you, and you catch it at that moment. 446 00:22:01,978 --> 00:22:06,928 You catch it at the initial infection and, and it sets off all the triggers and 447 00:22:06,928 --> 00:22:09,568 then you, you quarantine it at that one. 448 00:22:10,783 --> 00:22:14,323 Computer that got, um, attacked then. 449 00:22:14,323 --> 00:22:14,863 Sure. 450 00:22:15,073 --> 00:22:15,463 Right. 451 00:22:15,463 --> 00:22:17,203 If you're able to, to figure that out. 452 00:22:17,323 --> 00:22:20,623 But you still, you know what, even in that situation, you have to 453 00:22:20,623 --> 00:22:22,903 still go around and look everywhere. 454 00:22:22,903 --> 00:22:25,963 You, you can figure out, you can quarantine that server or that 455 00:22:25,963 --> 00:22:31,093 laptop and say, all right, we know what they put on that laptop. 456 00:22:31,093 --> 00:22:34,963 Let's go look everywhere else to see if that thing is everywhere else. 457 00:22:35,023 --> 00:22:35,143 Yeah. 458 00:22:35,473 --> 00:22:36,583 And, um. 459 00:22:36,583 --> 00:22:40,003 else they might have dropped elsewhere in your environment, which 460 00:22:40,813 --> 00:22:41,443 signature. 461 00:22:41,728 --> 00:22:42,178 right. 462 00:22:42,568 --> 00:22:46,708 And you, you know, and so it's, you can't assume that you, you caught 463 00:22:46,708 --> 00:22:51,448 it and therefore, oh, well we caught it early, and so we're good. 464 00:22:52,468 --> 00:22:53,908 You don't know what you didn't catch. 465 00:22:53,938 --> 00:22:54,268 Right. 466 00:22:54,268 --> 00:22:57,688 And so, you know, you, you, it, it, it's just, it's just not easy. 467 00:22:58,018 --> 00:22:58,348 Right. 468 00:22:58,468 --> 00:23:00,568 And so going back to the topic at hand. 469 00:23:01,708 --> 00:23:07,198 The one thing I just want to make sure that we do is at least let's make the 470 00:23:07,198 --> 00:23:09,688 backup infrastructure impervious and 471 00:23:09,958 --> 00:23:11,098 how, how can we do that? 472 00:23:11,518 --> 00:23:16,648 And the, the real answer, the only answer in my opinion is actual immutability. 473 00:23:17,743 --> 00:23:18,163 Right. 474 00:23:18,763 --> 00:23:23,293 Um, and because you cannot, as long as the computer, if it's a 475 00:23:23,293 --> 00:23:28,153 computer and it's plugged into the network, it's hackable, right? 476 00:23:28,483 --> 00:23:30,643 You can reduce the risk, right? 477 00:23:30,643 --> 00:23:31,723 We, we can do two things. 478 00:23:31,723 --> 00:23:36,643 One is like guaranteed the other is like, let's not make it, let's not, 479 00:23:36,703 --> 00:23:40,663 let's not leave the keys in the ignition of the car sitting in, you know, 480 00:23:41,863 --> 00:23:43,183 in the worst neighborhood, right? 481 00:23:44,233 --> 00:23:44,773 Um. 482 00:23:45,523 --> 00:23:50,173 And so because we know it's a target and so we do things like separate 483 00:23:50,173 --> 00:23:51,583 the backup infrastructure, right? 484 00:23:51,583 --> 00:23:54,433 To use a different, uh, IAM system. 485 00:23:54,433 --> 00:23:58,103 That's identity access management use a different IAM system. 486 00:23:58,103 --> 00:24:02,573 So don't you don't have it just be part of the, uh, Intra ID domain. 487 00:24:02,873 --> 00:24:04,403 Don't have it be part of whatever. 488 00:24:04,403 --> 00:24:04,763 Whatever. 489 00:24:04,763 --> 00:24:05,483 Centralized. 490 00:24:05,798 --> 00:24:09,008 Password system that you have, don't make it be part of that. 491 00:24:09,038 --> 00:24:13,448 Make it various different, perhaps even a different kind of infrastructure, not 492 00:24:13,448 --> 00:24:20,408 just a different, uh, domain in intra, but perhaps don't even use that over there. 493 00:24:20,408 --> 00:24:20,618 Right? 494 00:24:20,618 --> 00:24:22,118 It's only like four systems. 495 00:24:22,118 --> 00:24:24,698 So do you really need active directory over there? 496 00:24:24,698 --> 00:24:24,788 Right. 497 00:24:25,978 --> 00:24:30,688 So consider perhaps a local password management system, uh, with a third 498 00:24:30,688 --> 00:24:32,368 party password management system. 499 00:24:32,818 --> 00:24:36,778 Um, you know, separate that backup infrastructure as much as possible. 500 00:24:37,018 --> 00:24:41,068 Obviously, turn on MFA or turn on, uh, PA keys. 501 00:24:41,338 --> 00:24:42,928 That's something that we talk a lot about. 502 00:24:43,438 --> 00:24:47,638 Um, but if your backups, if, if the actual data. 503 00:24:48,368 --> 00:24:54,038 Of the backups is sitting on truly immutable storage where that even 504 00:24:54,518 --> 00:25:01,628 you can't delete it if you wanted to, then at least you know you will 505 00:25:01,628 --> 00:25:03,698 have that data when you need it. 506 00:25:04,418 --> 00:25:06,878 Yes, I agree with everything you said. 507 00:25:07,838 --> 00:25:08,763 I sense a big but. 508 00:25:09,548 --> 00:25:16,268 No, I, but yes, I want to talk about in a separate podcast episode, 509 00:25:16,268 --> 00:25:17,948 because it is gonna be more detailed. 510 00:25:18,143 --> 00:25:18,563 Yeah. 511 00:25:18,953 --> 00:25:21,713 I want to talk about immutability 512 00:25:22,403 --> 00:25:24,173 and why it's difficult in backups 513 00:25:25,073 --> 00:25:25,583 Yeah, 514 00:25:25,613 --> 00:25:28,493 don't think it's as simple because otherwise everyone would turn the switch, 515 00:25:28,853 --> 00:25:33,413 and so I think we should cover it in an episode we talk about immutability, 516 00:25:33,593 --> 00:25:34,673 the different kinds and. 517 00:25:34,673 --> 00:25:35,813 to other technologies. 518 00:25:36,188 --> 00:25:36,578 Yeah. 519 00:25:36,698 --> 00:25:37,028 Yeah. 520 00:25:37,313 --> 00:25:40,208 I, I think it is simple as long as you choose the right product. 521 00:25:40,898 --> 00:25:43,118 Choosing the right product is the difficult part, right? 522 00:25:43,418 --> 00:25:46,628 Because there are many products that call themselves immutable that don't meet 523 00:25:46,628 --> 00:25:49,178 the definition that I just said, right? 524 00:25:50,258 --> 00:25:55,778 And, um, um, you know, I can think of a we'll cover that on a future episode. 525 00:25:55,928 --> 00:25:56,258 So, 526 00:25:57,068 --> 00:26:00,308 all right, so your backup systems are under attack, 96%. 527 00:26:00,308 --> 00:26:00,758 How many times? 528 00:26:00,758 --> 00:26:01,298 I gotta say that. 529 00:26:01,358 --> 00:26:03,278 96. You round that up, that's a hundred percent 530 00:26:03,308 --> 00:26:05,198 let's just hundred, nearly a hundred. 531 00:26:05,198 --> 00:26:05,318 I 532 00:26:05,513 --> 00:26:06,923 Yeah, nearly a hundred percent. 533 00:26:08,213 --> 00:26:12,683 Couple that with the other stats that we've seen in other, uh, studies of 534 00:26:12,683 --> 00:26:17,423 like the number of companies that will be attacked by ransomware, right? 535 00:26:17,423 --> 00:26:21,433 So you basically, , if you don't have a method and a process to block. 536 00:26:22,318 --> 00:26:28,048 The threat actors from your backup system, then, uh, basically you're, you know, 537 00:26:28,048 --> 00:26:29,273 you're just gonna hand over the keys. 538 00:26:29,868 --> 00:26:30,088 Yep, 539 00:26:31,323 --> 00:26:31,613 Yeah, 540 00:26:32,023 --> 00:26:32,833 I agree. 541 00:26:33,303 --> 00:26:33,593 yeah, 542 00:26:35,038 --> 00:26:35,398 It. 543 00:26:35,398 --> 00:26:37,318 It's one of those things too. 544 00:26:37,318 --> 00:26:40,198 I know everyone's like, oh, ransomware is never gonna attack me, which is 545 00:26:40,198 --> 00:26:42,928 probably what people were saying three years ago, but just look at the news 546 00:26:42,928 --> 00:26:44,788 and how many people get hit every day, 547 00:26:45,478 --> 00:26:46,138 other day. 548 00:26:46,528 --> 00:26:49,318 It's just keeps going up and up and up and up, and up, and up 549 00:26:49,873 --> 00:26:53,203 It's, it's why we took the approach we took in the book, right? 550 00:26:53,203 --> 00:26:55,003 It's not a matter of if, but when, 551 00:26:55,468 --> 00:26:55,768 Yep. 552 00:26:56,113 --> 00:27:01,513 you know, statistically speaking, this is, this is the most likely kind 553 00:27:01,513 --> 00:27:04,273 of thing that's gonna happen to your environment from a cyber perspective. 554 00:27:04,803 --> 00:27:05,103 Right. 555 00:27:05,733 --> 00:27:10,653 So, um, uh, that's why we took the, the, the tack that we took in the 556 00:27:10,653 --> 00:27:13,893 book, which is you're going to get ransomware, so let's make sure that 557 00:27:13,893 --> 00:27:15,363 you're gonna be able to respond to it. 558 00:27:15,798 --> 00:27:16,018 Yep. 559 00:27:16,833 --> 00:27:18,763 All right, well thanks for chatting Prasanna. 560 00:27:19,318 --> 00:27:22,873 No, I, I'm looking forward to our next episode on Immutability. 561 00:27:23,133 --> 00:27:23,493 Me too. 562 00:27:24,313 --> 00:27:28,063 And hopefully you folks are listening to it or looking forward to it. 563 00:27:28,603 --> 00:27:31,813 Hopefully you folks are looking forward to it too for some reason. 564 00:27:31,813 --> 00:27:35,263 That was tying my tongue, but uh, that is a wrap. 565 00:27:35,263 --> 00:27:35,293 I.