1 00:00:34,522 --> 00:00:37,462 W. Curtis Preston: Hi, and welcome to Backup Central's Restore it All podcast. 2 00:00:37,462 --> 00:00:39,922 I'm your host w Curtis Preston, AKA Mr. 3 00:00:39,922 --> 00:00:44,512 Backup, and I have with me, my post vacation depression 4 00:00:44,512 --> 00:00:46,662 consultant, Prasanna Malaiyandi. 5 00:00:47,252 --> 00:00:48,762 How's it going, Prasanna? 6 00:00:49,087 --> 00:00:50,437 Prasanna Malaiyandi: I am good. 7 00:00:50,497 --> 00:00:52,417 Jealous of your vacation. 8 00:00:52,717 --> 00:00:57,907 Also really upset that you decided to come back from said vacation rather 9 00:00:57,907 --> 00:01:01,957 than just like being like, yeah, I'm just gonna stay remotely and extend 10 00:01:01,957 --> 00:01:06,217 my vacation by another week or two weeks or a year, whatever it is. 11 00:01:07,067 --> 00:01:10,182 W. Curtis Preston: I had to come back because a, I was going broke. 12 00:01:10,542 --> 00:01:16,602 I was spending like $250 every time I got on a scuba boat, it was very, the 13 00:01:16,602 --> 00:01:18,672 diving is really expensive over there. 14 00:01:18,672 --> 00:01:20,382 Partly cuz I had to rent a wet suit. 15 00:01:20,782 --> 00:01:23,932 I brought all my gear, but left my regulator behind like a moron. 16 00:01:23,932 --> 00:01:25,912 So I had to rent a regulator every time I dove. 17 00:01:26,482 --> 00:01:27,352 It was great diving. 18 00:01:27,352 --> 00:01:29,512 I was at the big island, so I was diving in Kona. 19 00:01:29,517 --> 00:01:32,992 I did a pelagic dive where you, you interact with like transparent 20 00:01:32,997 --> 00:01:34,732 and, and, and translucent. 21 00:01:34,732 --> 00:01:38,062 And what, what do you call the bioluminescent creatures by 22 00:01:38,062 --> 00:01:40,252 diving over 5,000 foot of ocean? 23 00:01:40,612 --> 00:01:43,042 Oh, that was, that was, that was way cool. 24 00:01:43,072 --> 00:01:46,827 Prasanna Malaiyandi: So, so I think that you need a new profession, 25 00:01:46,832 --> 00:01:48,147 Curtis, in addition to Mr. 26 00:01:48,147 --> 00:01:50,967 Backup, I think you need to be like in the water all the time. 27 00:01:50,967 --> 00:01:54,087 Maybe there's something about like backup in the ocean or 28 00:01:54,087 --> 00:01:55,737 like data centers in the ocean. 29 00:01:56,457 --> 00:01:58,137 W. Curtis Preston: I am so happy. 30 00:01:58,227 --> 00:02:02,877 Like, and it's been so long since I've dove, like, because I, I, 31 00:02:03,087 --> 00:02:07,977 my, my gear on my last dive to, to Hawaii was my last dive and my gear 32 00:02:08,067 --> 00:02:12,717 broke and, um, you know, it's, it's expensive to replace that stuff. 33 00:02:12,717 --> 00:02:13,347 And so. 34 00:02:14,197 --> 00:02:18,847 Uh, so yeah, it was, I, I forgot like how happy I am when I'm in the water. 35 00:02:18,847 --> 00:02:23,017 So I, yeah, so that was, that was really good, but it, but it was stupid expensive. 36 00:02:23,017 --> 00:02:27,637 Like, I mean, I, I spent, you know, close to a grand going out scuba 37 00:02:27,637 --> 00:02:29,437 diving, but it was, but it was great, 38 00:02:29,477 --> 00:02:30,627 Prasanna Malaiyandi: was well worth it though, to you look 39 00:02:30,627 --> 00:02:32,877 at how happy relaxed you are. 40 00:02:32,877 --> 00:02:33,267 And, 41 00:02:33,667 --> 00:02:34,087 W. Curtis Preston: Yeah. 42 00:02:34,117 --> 00:02:34,267 And 43 00:02:34,347 --> 00:02:37,127 Prasanna Malaiyandi: and hopefully, after this podcast, you will still continue to 44 00:02:37,127 --> 00:02:39,437 be happy and relaxed, but we shall see, 45 00:02:40,292 --> 00:02:43,322 W. Curtis Preston: We'll see, we'll see right now I'm in the, oh crap. 46 00:02:43,682 --> 00:02:45,152 I'm back at work this morning. 47 00:02:45,157 --> 00:02:46,412 I had to do some training. 48 00:02:46,412 --> 00:02:50,102 Now I gotta do a podcast and you know, it's just, you know, 49 00:02:50,102 --> 00:02:51,902 welcome back to the real world. 50 00:02:52,322 --> 00:02:55,397 Um, Let's bring on our guest today. 51 00:02:55,457 --> 00:02:56,657 Uh, I'm excited. 52 00:02:56,657 --> 00:03:00,977 He is a cybersecurity advisor who helps with assessment remediation 53 00:03:00,977 --> 00:03:02,747 and management of cybersecurity. 54 00:03:03,107 --> 00:03:07,787 He currently leads an it services practice called Tech and Maine, and is also the 55 00:03:07,787 --> 00:03:10,247 host of Tech and Maine presents podcast. 56 00:03:10,637 --> 00:03:14,067 You can find both of them at techandmain.com. 57 00:03:14,537 --> 00:03:17,407 Welcome to the podcast, Shaun St Hill. 58 00:03:18,857 --> 00:03:19,337 Shaun St. Hill: Curtis. 59 00:03:19,412 --> 00:03:20,402 Thank you. 60 00:03:20,462 --> 00:03:25,442 It is an honor to be here, super excited and looking forward to our time together. 61 00:03:25,937 --> 00:03:29,027 W. Curtis Preston: And we're not gonna get any, uh, sympathy from you 62 00:03:29,597 --> 00:03:35,417 Shaun St. Hill: well, I was gonna say, and I didn't know how this would be 63 00:03:35,417 --> 00:03:37,247 taken, but let's just jump right in. 64 00:03:38,417 --> 00:03:42,947 You went to Hawaii, sir, you get zero sympathy. 65 00:03:43,142 --> 00:03:48,487 If you went to the bank and said, could I withdraw some sympathy for 66 00:03:48,492 --> 00:03:51,487 the trip that I took to Hawaii? 67 00:03:51,757 --> 00:03:55,477 They would say, sir, you need to walk right back out because you'll 68 00:03:55,477 --> 00:03:58,147 get, you can take out zero sympathy 69 00:03:58,517 --> 00:03:59,057 W. Curtis Preston: I get it. 70 00:03:59,057 --> 00:03:59,657 I get it. 71 00:03:59,662 --> 00:04:03,927 You know, I got, I had a great trip to Hawaii, my wife had a great time. 72 00:04:03,927 --> 00:04:06,807 She, she hung out with her best friend who lives in Hawaii. 73 00:04:07,347 --> 00:04:11,517 It was a great all around trip, but oh man, it was, so it was a little 74 00:04:11,517 --> 00:04:16,587 warm and, and I had to spend lots of money while doing awesome things. 75 00:04:17,327 --> 00:04:19,617 Shaun St. Hill: Sounds sounds very first world to me 76 00:04:19,617 --> 00:04:21,277 Prasanna Malaiyandi: I know seriously, 77 00:04:21,707 --> 00:04:22,247 Shaun St. Hill: world 78 00:04:22,547 --> 00:04:23,567 W. Curtis Preston: #firstwordproblems. 79 00:04:24,237 --> 00:04:24,867 Yeah. 80 00:04:25,207 --> 00:04:25,697 Yeah. 81 00:04:26,067 --> 00:04:29,807 Meanwhile, you know, The world is fall. 82 00:04:29,807 --> 00:04:33,647 I, I left for a week and you know, the queen died. 83 00:04:33,677 --> 00:04:34,937 Uber got attacked. 84 00:04:35,357 --> 00:04:38,087 Like what, what happened while I, 85 00:04:38,297 --> 00:04:40,427 Prasanna Malaiyandi: Well, I remember asking you, I was talking to you. 86 00:04:40,427 --> 00:04:41,597 What was it yesterday? 87 00:04:41,627 --> 00:04:41,807 Yeah. 88 00:04:41,807 --> 00:04:42,497 Yesterday, right? 89 00:04:42,497 --> 00:04:44,567 I was like, oh, Curtis, did you hear about this Uber thing? 90 00:04:44,867 --> 00:04:46,637 You're like I'm behind on everything. 91 00:04:46,637 --> 00:04:47,897 I don't know what, yeah. 92 00:04:48,167 --> 00:04:48,497 You're I. 93 00:04:48,632 --> 00:04:50,132 W. Curtis Preston: did a real vacation. 94 00:04:50,132 --> 00:04:52,622 Like I tried really hard not to look at my phone. 95 00:04:52,622 --> 00:04:55,172 Certainly didn't respond to any work emails. 96 00:04:55,622 --> 00:04:59,372 So I, I thought we'd take this opportunity since, you know, 97 00:04:59,372 --> 00:05:04,472 you're in that cybersecurity world to discuss the Uber attack. 98 00:05:04,562 --> 00:05:07,202 Um, and, and I'll, I'll mention that. 99 00:05:07,922 --> 00:05:14,582 Um, for five years now, uh, I, back when I was underemployed for a minute, I actually 100 00:05:14,582 --> 00:05:19,622 became an Uber driver, uh, five, six, actually, I guess it's six years now. 101 00:05:20,012 --> 00:05:24,812 And so, and, and I, I have stayed active, so I still, you know, 102 00:05:24,817 --> 00:05:27,662 occasionally drive for them when I want to get out of the house. 103 00:05:27,692 --> 00:05:28,112 Right. 104 00:05:28,562 --> 00:05:33,287 Um, . And so I am both an Uber passenger and an Uber driver. 105 00:05:33,827 --> 00:05:36,227 And then I hear that, you know, they got attacked. 106 00:05:36,227 --> 00:05:40,937 I, I guess the good news that we're hearing, uh, that you can either 107 00:05:40,937 --> 00:05:47,627 confirm or deny or, or whatever is that the no user accounts were affected. 108 00:05:47,627 --> 00:05:48,827 That's what I'm hearing. 109 00:05:48,827 --> 00:05:49,247 I don't know. 110 00:05:49,247 --> 00:05:50,597 What, what, what have you heard? 111 00:05:51,047 --> 00:05:53,237 Shaun St. Hill: Curtis I've I've heard the same thing. 112 00:05:53,717 --> 00:05:57,247 So this really, to me is very interesting. 113 00:05:57,692 --> 00:05:58,892 On a number of fronts. 114 00:05:59,492 --> 00:06:06,212 The first being back in, I want to say 2016, Uber had 115 00:06:07,292 --> 00:06:08,822 another cybersecurity incident. 116 00:06:09,272 --> 00:06:14,612 One that ended up costing the then CISO his job. 117 00:06:15,092 --> 00:06:19,502 And I believe there was some sort of lawsuit associated with that. 118 00:06:20,087 --> 00:06:20,357 W. Curtis Preston: Hmm. 119 00:06:20,822 --> 00:06:26,207 Shaun St. Hill: The other thing that always is interesting to me, When the 120 00:06:26,207 --> 00:06:32,117 company that had the security incident immediately comes out and says, oh, 121 00:06:32,117 --> 00:06:36,227 well, no, no customer information. 122 00:06:36,527 --> 00:06:40,457 Or, you know, P you know, PII was, was touched. 123 00:06:40,907 --> 00:06:41,327 W. Curtis Preston: yeah. 124 00:06:41,327 --> 00:06:42,407 And no code. 125 00:06:43,067 --> 00:06:45,547 No, you know, well, what did, what did they 126 00:06:45,887 --> 00:06:48,167 Prasanna Malaiyandi: well, I think I thought it's actually said, like 127 00:06:48,167 --> 00:06:52,397 they were, I was reading a earlier, very specific about like no sensitive 128 00:06:52,397 --> 00:06:57,947 personal data or some very specific term they were using to reference to 129 00:06:57,947 --> 00:07:00,677 like what they said was not accessed. 130 00:07:02,252 --> 00:07:05,822 Shaun St. Hill: A, and so that's that, like I said is always interesting 131 00:07:05,822 --> 00:07:10,892 to me because it sounds very much like someone that was coached 132 00:07:11,222 --> 00:07:13,292 by a public relations agency. 133 00:07:14,267 --> 00:07:16,397 W. Curtis Preston: Well, you know, that they're coached by a 134 00:07:16,702 --> 00:07:18,542 Shaun St. Hill: Oh, of course of of course. 135 00:07:18,572 --> 00:07:24,542 So, so, so the, so the thing is one, what really happened 136 00:07:25,832 --> 00:07:29,792 and two, how soon will we know. 137 00:07:30,302 --> 00:07:41,702 The, the person that this hacker that was, or has, um, self-identified 138 00:07:41,762 --> 00:07:43,592 as the person that got in. 139 00:07:44,282 --> 00:07:45,272 It's interesting. 140 00:07:45,782 --> 00:07:50,312 There's a company, uh, a game company. 141 00:07:50,312 --> 00:07:51,572 I think it's rocket games. 142 00:07:51,572 --> 00:07:54,302 Maybe they put out grand theft auto. 143 00:07:54,502 --> 00:07:55,062 W. Curtis Preston: right. 144 00:07:55,547 --> 00:07:59,507 Prasanna Malaiyandi: rockstar that just got GTA six grant theft, auto six, 145 00:07:59,927 --> 00:08:03,227 uh, Got released way ahead of time. 146 00:08:03,227 --> 00:08:06,347 They, I think they had hacked in, they had basically stolen the game 147 00:08:06,347 --> 00:08:09,287 that no one had knew was actually happening and leaked it on the web. 148 00:08:09,977 --> 00:08:10,607 Shaun St. Hill: So thank you. 149 00:08:10,607 --> 00:08:11,017 Prasanna. 150 00:08:11,177 --> 00:08:17,297 What's interesting is the same person has self identified as the hacker. 151 00:08:17,477 --> 00:08:18,107 So, 152 00:08:18,932 --> 00:08:21,662 W. Curtis Preston: And they're, they're connected to Lapsus$ by the way. 153 00:08:22,667 --> 00:08:24,647 Shaun St. Hill: ah, interesting. 154 00:08:25,037 --> 00:08:31,067 So, so, so here, so we here, we have this, these amazing 155 00:08:31,067 --> 00:08:33,197 connections and not amazing as. 156 00:08:34,367 --> 00:08:36,647 They're the right kind of connections, but it's just, it's 157 00:08:36,647 --> 00:08:39,227 it makes for an interesting story. 158 00:08:39,827 --> 00:08:46,427 The, the last thing is when you, when you think about a company, the size of 159 00:08:46,937 --> 00:08:54,647 Uber, going back to that 2016 security incident, you'd want to be sure that 160 00:08:54,647 --> 00:08:56,717 your name doesn't come up in the news. 161 00:08:57,767 --> 00:09:04,067 Also posted on one of the social media platforms, a screenshot 162 00:09:04,547 --> 00:09:08,927 of Uber's career portal. 163 00:09:09,197 --> 00:09:15,757 And so it looks like there's all of a sudden, you know, multiple openings for, 164 00:09:16,637 --> 00:09:24,647 you know, cybersecurity positions, which, which, again, Curtis it's like what. 165 00:09:26,237 --> 00:09:31,907 Do we not have the time and the money on the front end or on the back end? 166 00:09:31,937 --> 00:09:37,427 Like, you know, why does it always take an incident like this for you to 167 00:09:37,427 --> 00:09:45,047 be able to find budget and then open up these jobs and then spend millions 168 00:09:45,047 --> 00:09:50,897 of dollars to hire these amazing consultants to help you do what, 169 00:09:52,172 --> 00:09:56,302 according to what happened in 2016, you said you were doing or should have done. 170 00:09:56,927 --> 00:09:59,297 Prasanna Malaiyandi: So I think so I'll take a stab at that. 171 00:09:59,297 --> 00:10:02,177 And Curtis, I think we should throw out our disclaimer first. 172 00:10:02,237 --> 00:10:02,717 W. Curtis Preston: Yeah. 173 00:10:02,717 --> 00:10:02,987 Yeah. 174 00:10:03,407 --> 00:10:05,657 out our disclaimer, uh, Prasanna and I work for different 175 00:10:05,657 --> 00:10:07,817 companies, uh, he works for Zoom. 176 00:10:07,867 --> 00:10:08,957 I work for Druva. 177 00:10:09,107 --> 00:10:12,707 We're not representing either company and the opinions that you hear are ours. 178 00:10:12,877 --> 00:10:16,817 And also, uh, you know, if you'd like to rate us, we'd love to, 179 00:10:17,057 --> 00:10:19,797 you know, see your rating, just go to your favorite podcatcher. 180 00:10:20,107 --> 00:10:23,407 And, uh, you know, give us, give us all the stars and comments. 181 00:10:23,407 --> 00:10:24,307 We love comments. 182 00:10:24,307 --> 00:10:29,287 In fact, we're currently running a comment promotion, uh, that 183 00:10:29,292 --> 00:10:32,167 if we get I, I went and checked. 184 00:10:32,197 --> 00:10:35,887 It's gotta be 25 comments by the I'm. 185 00:10:35,887 --> 00:10:36,517 I'm gonna push it. 186 00:10:37,067 --> 00:10:37,877 I'm gonna push it out. 187 00:10:38,297 --> 00:10:40,037 I'm gonna push it out to the end of October. 188 00:10:40,577 --> 00:10:46,427 Uh, if we get 25 comments total, by the end of October, I will continue to grow 189 00:10:46,427 --> 00:10:50,297 this beard and I'll do my best to look like Santa Claus by come Christmas time. 190 00:10:50,717 --> 00:10:54,197 So, um, and if you'd like to join the conversation, please reach 191 00:10:54,197 --> 00:10:59,157 out to me @wcpreston on Twitter or wcurtispreston at Gmail and Prasanna. 192 00:10:59,177 --> 00:11:01,667 You're probably gonna mention that maybe you work a little 193 00:11:01,667 --> 00:11:04,187 bit in the, in the privacy area, 194 00:11:05,042 --> 00:11:05,312 Prasanna Malaiyandi: Yeah. 195 00:11:05,972 --> 00:11:07,682 Well, that's one of the things I wanna talk about. 196 00:11:07,682 --> 00:11:09,632 And even before I got into privacy, right? 197 00:11:10,412 --> 00:11:15,152 I think the challenge is security is seen as a risk reduction 198 00:11:16,022 --> 00:11:18,362 function of an organization, right. 199 00:11:18,362 --> 00:11:21,542 It's to protect the organization now, uh, I'm not saying this 200 00:11:21,542 --> 00:11:22,712 is how it is everywhere. 201 00:11:23,042 --> 00:11:23,432 Right. 202 00:11:23,432 --> 00:11:25,982 But in some places that's kind of how it's seen. 203 00:11:26,252 --> 00:11:29,822 And so one of the challenges becomes you have this tension between 204 00:11:29,822 --> 00:11:32,312 security, privacy compliance, right? 205 00:11:32,522 --> 00:11:34,262 All of these sort of risk reducing. 206 00:11:34,312 --> 00:11:38,992 Organizations which wanna keep the business protected versus sort of 207 00:11:38,992 --> 00:11:42,502 your revenue driving parts of the business, which are like, we gotta ship 208 00:11:42,502 --> 00:11:44,512 something, we gotta ship something, we gotta get it out the door. 209 00:11:44,512 --> 00:11:44,872 Right. 210 00:11:45,082 --> 00:11:46,252 We gotta get more money. 211 00:11:46,762 --> 00:11:50,692 And so there's this tension because the revenue side wants to go fast. 212 00:11:50,697 --> 00:11:51,152 Right? 213 00:11:51,262 --> 00:11:53,542 Wants to innovate, wants to get things out there quickly. 214 00:11:53,542 --> 00:11:55,042 And the security side. 215 00:11:55,607 --> 00:11:59,837 Doesn't always have, like you said, the budget, the number of people, right. 216 00:11:59,837 --> 00:12:04,457 To be able to look over all of the things that the revenue side is doing to make 217 00:12:04,457 --> 00:12:05,867 sure it's being done the right way. 218 00:12:06,437 --> 00:12:09,797 And so you kind of have to pick and choose what you focus on. 219 00:12:10,097 --> 00:12:12,767 And sometimes it's accepting the risk, right? 220 00:12:12,767 --> 00:12:13,757 It's like saying, Hey. 221 00:12:14,222 --> 00:12:18,332 I can only cover 30 or 40 or 70% take whatever number you wanna take 222 00:12:18,332 --> 00:12:20,402 of the products going out the door. 223 00:12:20,402 --> 00:12:23,972 And that's what I'm gonna be focused on and making sure that at least 224 00:12:23,972 --> 00:12:27,242 those are good enough and there are no major vulnerabilities. 225 00:12:27,242 --> 00:12:31,462 Now it could be done better where you get security, privacy compliance. 226 00:12:32,132 --> 00:12:34,112 Earlier on in the process. 227 00:12:34,112 --> 00:12:37,922 So it's sort of privacy by design security by design, right, where 228 00:12:37,922 --> 00:12:40,832 they're working hand in hand as product is being developed. 229 00:12:41,192 --> 00:12:43,172 So you make sure that security is baked in, right? 230 00:12:43,172 --> 00:12:46,142 All of these other processes are baked in rather than having to 231 00:12:46,142 --> 00:12:49,082 worry about it at the end, but it's always that tension, right? 232 00:12:49,082 --> 00:12:52,262 People will always wanna spend more on R and D and not necessarily more 233 00:12:52,262 --> 00:12:56,222 on security and privacy in other compliance parts of the business. 234 00:12:56,882 --> 00:12:59,802 W. Curtis Preston: by the way, and, and this is not in any way, a defense of Uber. 235 00:13:00,167 --> 00:13:06,227 The problem for Uber is that they have I'm, I'm just gonna say dozens, but I 236 00:13:06,227 --> 00:13:10,937 think it might be well over a hundred different versions of the same product 237 00:13:11,237 --> 00:13:13,787 for those of you that aren't Uber drivers. 238 00:13:14,462 --> 00:13:17,552 They run different features and different functionality. 239 00:13:17,552 --> 00:13:19,982 And they're constantly AB testing. 240 00:13:20,462 --> 00:13:22,082 What if we did this for drivers? 241 00:13:22,082 --> 00:13:24,062 What if we did this for passengers? 242 00:13:24,272 --> 00:13:28,472 And they're like, let's do it for everybody in San Diego for two weeks. 243 00:13:28,802 --> 00:13:29,162 Right? 244 00:13:29,162 --> 00:13:33,452 So they're, it's not just one product that they're releasing out across the world. 245 00:13:33,752 --> 00:13:37,262 They're constantly tweaking the algorithm. 246 00:13:37,507 --> 00:13:43,392 And so, so they've got that push, like you were saying to spend a lot of money on R 247 00:13:43,392 --> 00:13:48,102 and D and perhaps a little bit less on, on the things that you're talking about. 248 00:13:48,312 --> 00:13:51,792 I, I just wanted to mention, by the way, um, Shaun, the. 249 00:13:52,477 --> 00:13:58,417 The I, I, I pulled up the breach, the, the old breach, uh, and it was actually 2014. 250 00:13:58,747 --> 00:14:04,567 The reason why you're thinking 2016 is they didn't tell us about it until 2015. 251 00:14:05,047 --> 00:14:07,057 Uh, and that's, and so that's why. 252 00:14:07,327 --> 00:14:14,267 And then, and then they talked to the, the FTC in 2016, um, Yeah. 253 00:14:14,267 --> 00:14:17,987 And so, so the, basically this is referred to as the data breach 254 00:14:17,987 --> 00:14:23,777 and coverup timeline, which goes all the way until 2020, right? 255 00:14:24,017 --> 00:14:24,287 Yeah. 256 00:14:24,287 --> 00:14:28,367 So there were, there was a lot because it, it, because basically 257 00:14:28,367 --> 00:14:31,247 they tried to cover it up. 258 00:14:31,247 --> 00:14:36,227 So I will say at least Uber has learned that lesson. 259 00:14:37,162 --> 00:14:37,582 The, 260 00:14:37,897 --> 00:14:38,407 Shaun St. Hill: good for them. 261 00:14:38,422 --> 00:14:41,272 W. Curtis Preston: it looks like they've learned that lesson they've come out 262 00:14:41,452 --> 00:14:44,512 right away as far as that's what we think. 263 00:14:45,652 --> 00:14:47,812 Of course they may not have been given a choice because 264 00:14:47,812 --> 00:14:49,462 this person did it publicly. 265 00:14:50,092 --> 00:14:51,592 Uh, anyway, sorry. 266 00:14:51,597 --> 00:14:51,652 I, 267 00:14:51,707 --> 00:14:54,317 Prasanna Malaiyandi: Now the, the one other thing I wanted to bring up too 268 00:14:54,317 --> 00:14:59,717 is I think, I know I was talking about product security, but if we look at the 269 00:14:59,777 --> 00:15:04,157 Uber side of things and what happened, it was more of an operation security, 270 00:15:04,862 --> 00:15:05,352 W. Curtis Preston: Yeah. 271 00:15:05,447 --> 00:15:06,107 Prasanna Malaiyandi: breach, right? 272 00:15:06,107 --> 00:15:11,807 It was, uh, contractor who basically got fooled into sharing their 273 00:15:11,807 --> 00:15:13,967 multifactor authentication codes, right. 274 00:15:13,967 --> 00:15:18,647 With the hacker, which then allowed that hacker access into Uber's environment. 275 00:15:19,022 --> 00:15:22,742 Now the fact that the, uh, the hacker was able to laterally 276 00:15:22,742 --> 00:15:24,062 move within the environment. 277 00:15:24,482 --> 00:15:24,872 Right. 278 00:15:25,292 --> 00:15:26,162 Isn't great. 279 00:15:26,792 --> 00:15:27,062 right. 280 00:15:27,062 --> 00:15:31,112 That they were able to access the AWS infrastructure and hacker one systems 281 00:15:31,112 --> 00:15:33,452 and their VMware infrastructure. 282 00:15:33,452 --> 00:15:33,662 Right. 283 00:15:33,662 --> 00:15:37,772 That things weren't isolated and alerts weren't going off right. 284 00:15:38,372 --> 00:15:38,972 Is worrisome. 285 00:15:38,972 --> 00:15:42,602 But I, I think it's less about the product side, right. 286 00:15:42,602 --> 00:15:44,612 And more about the operation side 287 00:15:44,717 --> 00:15:46,817 W. Curtis Preston: What do you think about the contractor aspect, John? 288 00:15:48,352 --> 00:15:54,322 Shaun St. Hill: So this honestly is something that you would think 289 00:15:54,622 --> 00:15:59,242 companies have a better handle on. 290 00:15:59,482 --> 00:16:07,492 And that is who has access to the kitchen, so to speak, who 291 00:16:07,492 --> 00:16:10,307 has the keys to the kingdom. 292 00:16:11,057 --> 00:16:18,377 You, you hear so much about zero trust and the need to make sure that whoever 293 00:16:19,757 --> 00:16:25,397 has access to the source code or to, you know, some other part of the environment, 294 00:16:25,757 --> 00:16:31,487 you know, they, they need to verify going in and then as soon as they come out, 295 00:16:31,587 --> 00:16:36,297 you make sure that, you know, they're not able to go back in, you know, pry the door 296 00:16:36,297 --> 00:16:44,577 open, so to speak and for a company, the size of Uber's for that to be the case, 297 00:16:45,417 --> 00:16:50,727 I think there, there needs to be, there needs to be some comeuppance for that. 298 00:16:52,482 --> 00:16:53,202 W. Curtis Preston: That's a good word. 299 00:16:53,232 --> 00:16:54,012 I like that word. 300 00:16:54,492 --> 00:16:57,042 Um, now you, there was something on the pre-call. 301 00:16:57,042 --> 00:17:01,542 You, you talked about you, the companies are very quick to throw 302 00:17:01,542 --> 00:17:03,192 the contractor under the bus. 303 00:17:03,717 --> 00:17:04,407 Shaun St. Hill: Yes. 304 00:17:04,977 --> 00:17:10,647 So before we actually started recording, we were talking about colonial pipeline 305 00:17:10,877 --> 00:17:13,017 and a number of other organizations. 306 00:17:13,497 --> 00:17:15,357 And again, this isn't 307 00:17:15,522 --> 00:17:16,542 W. Curtis Preston: target was one of them. 308 00:17:16,647 --> 00:17:17,097 Shaun St. Hill: target. 309 00:17:17,097 --> 00:17:17,397 Right? 310 00:17:17,517 --> 00:17:17,968 So these are. 311 00:17:19,287 --> 00:17:21,807 Stories and information that's out in the public domain. 312 00:17:21,807 --> 00:17:25,977 We're not throwing shade at any one particular company we're just 313 00:17:26,157 --> 00:17:28,137 stating what's already out there. 314 00:17:28,437 --> 00:17:34,047 And so these companies during their security incidents made sure to tell 315 00:17:34,047 --> 00:17:41,577 you that, oh, it was the intern or, oh, it was the HVAC contractor as a, 316 00:17:41,967 --> 00:17:49,302 as a person who now has to go through signing up for whatever credit monitoring 317 00:17:49,572 --> 00:17:56,862 you're throwing out to me that doesn't give me the warm and fuzzies, nor does 318 00:17:56,862 --> 00:18:00,582 it as a shareholder or an investor. 319 00:18:00,822 --> 00:18:06,432 Give me the warm and fuzzies to know that the money that we've 320 00:18:06,642 --> 00:18:11,202 given either through stock purchase or through, you know, a round of 321 00:18:11,207 --> 00:18:14,292 funding that that money was used for. 322 00:18:15,882 --> 00:18:25,422 Offsite leadership retreats or something other than securing and locking down the 323 00:18:25,422 --> 00:18:30,252 important things, customer data, whether that customer's internal or external. 324 00:18:31,032 --> 00:18:39,282 So, so for me, there's, there is this need to own the situation. 325 00:18:40,302 --> 00:18:44,682 Like my, like my daughter and her teenage friends will say, I own that. 326 00:18:44,842 --> 00:18:47,362 There needs to be that aspect of it. 327 00:18:47,722 --> 00:18:50,212 And then again, the, the, the comeuppance, so to 328 00:18:50,212 --> 00:18:52,402 W. Curtis Preston: Prasanna mentioned about lateral movement? 329 00:18:52,942 --> 00:18:59,872 We don't know what type of contractor this was, but I hope it was like an it 330 00:19:00,052 --> 00:19:07,432 admin contractor, because if he wasn't an it, she wasn't an it admin contractor. 331 00:19:07,612 --> 00:19:11,362 The fact that they were able to modify the open DNS configuration 332 00:19:11,392 --> 00:19:14,392 that by the way, if, if one of the things that happened was. 333 00:19:15,262 --> 00:19:18,498 They modified the open DNS configuration so that if anybody went 334 00:19:18,498 --> 00:19:22,128 to any webpage, what they got was a pornographic image and message. 335 00:19:22,668 --> 00:19:23,058 Right. 336 00:19:23,478 --> 00:19:32,268 Um, so, so either this was an admin level contractor, or they had a 337 00:19:32,268 --> 00:19:35,678 serious, least privileged problem, 338 00:19:35,773 --> 00:19:39,373 Prasanna Malaiyandi: well, I think what happened though, was I believe that 339 00:19:39,373 --> 00:19:44,443 the hacker got in, he then found he, or she then found a share, which contained 340 00:19:44,443 --> 00:19:47,803 passwords for other parts of the system. 341 00:19:48,568 --> 00:19:49,258 W. Curtis Preston: I can't. 342 00:19:49,318 --> 00:19:55,078 I just can't even with this, I can't, you know, the last one, the last 343 00:19:55,078 --> 00:19:57,508 was an open S three bucket, right. 344 00:19:57,568 --> 00:20:03,208 You telling me inside your company is a share with admin passwords. 345 00:20:04,388 --> 00:20:08,878 Prasanna Malaiyandi: I don't know what type of passwords they were, but I think I 346 00:20:08,878 --> 00:20:16,638 did read in an account in one of the blog posts, that there was a, uh, a share that 347 00:20:16,643 --> 00:20:18,598 the attacker used that had the passcodes. 348 00:20:18,598 --> 00:20:20,758 W. Curtis Preston: can't Shaun, stop me. 349 00:20:22,048 --> 00:20:23,698 Just an editor's note here. 350 00:20:23,788 --> 00:20:29,278 I researched what persona was talking about and what it appears happened was 351 00:20:29,283 --> 00:20:34,948 that there was a PowerShell script with admin credentials hard coded in it. 352 00:20:35,938 --> 00:20:40,183 So after they got the mFA hack. 353 00:20:40,213 --> 00:20:44,863 They then scanned the internal network and they found this PowerShell script, 354 00:20:45,223 --> 00:20:50,873 which was unprotected from those that did not have admin credentials, and 355 00:20:50,878 --> 00:20:56,393 that's what they used to escalate their privileges to, which I just want to go. 356 00:20:57,023 --> 00:20:59,813 Ugh, I I'm back to, I just can't. 357 00:20:59,993 --> 00:21:03,623 I, I, I just don't understand how that happened. 358 00:21:03,895 --> 00:21:09,895 Shaun St. Hill: There seems to be this common theme of slackness no pun intended. 359 00:21:11,200 --> 00:21:13,060 Slack was thank you. 360 00:21:13,600 --> 00:21:17,830 You know, slack being one of the tools that was named, um, and 361 00:21:17,830 --> 00:21:20,260 abused in this particular incident. 362 00:21:20,560 --> 00:21:25,060 But there, there, there seems to be this indifference and this, 363 00:21:26,080 --> 00:21:30,550 oh, no one will ever find out no one will ever be able to access. 364 00:21:30,710 --> 00:21:31,270 Right. 365 00:21:31,420 --> 00:21:37,960 It's it's that, it's that virtual sticky note under the keyboard, if you will. 366 00:21:38,830 --> 00:21:42,800 No, no one will ever think to look under the keyboard, to see all of 367 00:21:42,800 --> 00:21:43,940 the passwords that I've written. 368 00:21:44,615 --> 00:21:46,235 W. Curtis Preston: So how, how about this? 369 00:21:46,295 --> 00:21:49,625 Let's talk about what we, what we can learn. 370 00:21:49,625 --> 00:21:53,465 What, so here, the, the thing that we're sort of dancing around is this 371 00:21:53,465 --> 00:21:55,355 concept of least privilege, right? 372 00:21:55,465 --> 00:22:01,105 I'm thinking about there was a GDPR breach in Europe. 373 00:22:01,135 --> 00:22:03,085 I'm thinking Spain. 374 00:22:03,085 --> 00:22:04,555 I can't remember exactly. 375 00:22:04,560 --> 00:22:07,255 And it was a hospital we've talked about it on the podcast. 376 00:22:07,255 --> 00:22:08,215 This was a couple years ago. 377 00:22:08,215 --> 00:22:09,145 It a hospital. 378 00:22:09,535 --> 00:22:15,115 And when the, the breach, what the breach was, was it was an investigation. 379 00:22:15,445 --> 00:22:17,365 And the investigation showed that. 380 00:22:18,400 --> 00:22:21,550 They didn't understand the concept or they just, they just didn't care 381 00:22:21,550 --> 00:22:23,020 about the concept of Lee's privilege. 382 00:22:23,260 --> 00:22:27,670 They gave doctor level access to every single employee in 383 00:22:27,670 --> 00:22:29,620 the, in the, uh, hospital. 384 00:22:30,190 --> 00:22:32,470 That, that was, that was the easiest thing to do. 385 00:22:32,475 --> 00:22:36,100 So it didn't matter if you were the janitor or if you were a surgeon, 386 00:22:36,370 --> 00:22:40,660 you had access to everything, including medical records and such. 387 00:22:41,725 --> 00:22:46,975 The, the big thing I would say is to, to make sure like use Okta, right. 388 00:22:47,005 --> 00:22:51,295 Okta isn't evil and, and it's not, I'm not picking Okta, but it's just, 389 00:22:51,300 --> 00:22:54,415 it's the one that's off the top of my head, use something like Okta, 390 00:22:54,595 --> 00:22:59,035 but then don't just give everybody access to everything, give them access 391 00:22:59,040 --> 00:23:01,045 to the things they need access to. 392 00:23:01,505 --> 00:23:05,855 Another editor's note here, because we ultimately found out after the 393 00:23:05,855 --> 00:23:11,735 recording, that the big breach here was that there was a PowerShell 394 00:23:11,735 --> 00:23:13,445 script with admin credentials. 395 00:23:13,775 --> 00:23:17,555 The other big thing that we can learn here is don't do 396 00:23:17,560 --> 00:23:19,965 that number, number one, right? 397 00:23:20,135 --> 00:23:24,605 Don't put admin level , credentials in a script. 398 00:23:25,595 --> 00:23:29,345 We had to do that 20 years ago maybe, or. 399 00:23:29,750 --> 00:23:32,870 You know, I, I, I don't, I don't know if that's that shouldn't 400 00:23:32,870 --> 00:23:34,880 ever have to be the case. 401 00:23:34,880 --> 00:23:39,200 There are other ways to get credentials or to require that the 402 00:23:39,200 --> 00:23:41,240 script be run as an administrator. 403 00:23:41,245 --> 00:23:43,400 There are ways around that issue. 404 00:23:44,180 --> 00:23:44,870 And if. 405 00:23:45,575 --> 00:23:47,225 You can't get around that issue. 406 00:23:47,225 --> 00:23:51,125 And again, I don't, I'm not a PowerShell expert. 407 00:23:51,125 --> 00:23:55,565 I'm not a Windows expert by any means, but if you can't get around that 408 00:23:55,565 --> 00:24:00,095 issue, then make sure that any script like that is stored in a way that 409 00:24:00,095 --> 00:24:04,655 only people that already have admin credentials can get access to it. 410 00:24:05,165 --> 00:24:07,595 But again, I don't think you should have to write a script like that. 411 00:24:07,801 --> 00:24:13,321 The other thing I would add to that is internal pen tests, right? 412 00:24:13,771 --> 00:24:19,381 Why is it only the hacker that was able to scan around to see if there were scripts 413 00:24:19,381 --> 00:24:24,061 that, that an ordinary person is able to access that have admin credentials? 414 00:24:24,061 --> 00:24:25,471 Why didn't they do that? 415 00:24:25,471 --> 00:24:26,731 You should be doing that. 416 00:24:27,031 --> 00:24:27,541 So. 417 00:24:28,276 --> 00:24:30,856 Again, if you don't have that internal access, there are 418 00:24:30,856 --> 00:24:33,166 services, there are SaaS services. 419 00:24:33,166 --> 00:24:37,426 There are consultants, there are all sorts of people that you can hire or 420 00:24:37,426 --> 00:24:42,286 pay for a service to do penetration testing, both externally and internally. 421 00:24:42,459 --> 00:24:46,509 so that you can find out these vulnerabilities before they bite 422 00:24:46,569 --> 00:24:48,699 you the way that Uber got bit. 423 00:24:49,893 --> 00:24:55,253 Shaun St. Hill: So the, the thing that comes to mind for me, Curtis, if you don't 424 00:24:55,258 --> 00:25:04,253 have the people internally that care and, or have the skill set necessary to help 425 00:25:04,258 --> 00:25:07,283 put those controls in place, then please. 426 00:25:07,283 --> 00:25:14,903 For the love of God, reach out to a managed security service provider who 427 00:25:14,903 --> 00:25:19,973 is literally frothing at the mouth to be able to add you as a logo. 428 00:25:20,513 --> 00:25:20,873 W. Curtis Preston: Right. 429 00:25:20,983 --> 00:25:25,763 Shaun St. Hill: and then take that responsibility that could or 430 00:25:25,823 --> 00:25:31,163 should be assigned to a full-time employee, allow them to come in 431 00:25:31,493 --> 00:25:33,893 and take that excuse away from you. 432 00:25:34,583 --> 00:25:35,483 W. Curtis Preston: Yeah, absolutely. 433 00:25:35,488 --> 00:25:36,538 Cybersecurity. 434 00:25:36,898 --> 00:25:38,728 Has a different problem than data protection. 435 00:25:38,728 --> 00:25:40,918 So data, the problem with data protection backup. 436 00:25:41,128 --> 00:25:43,138 So nobody wants to do it right. 437 00:25:43,138 --> 00:25:48,148 Nobody, nobody wants to do that job that, that, you know, I've been in this 438 00:25:48,568 --> 00:25:50,458 business coming up on three decades. 439 00:25:50,608 --> 00:25:52,738 That part has never changed. 440 00:25:52,743 --> 00:25:53,008 Right? 441 00:25:53,908 --> 00:26:00,448 Cyber security, at least people wanna sign up, but there is a global skill shortage. 442 00:26:00,838 --> 00:26:04,288 And you may not have anyone at your company that, that 443 00:26:04,288 --> 00:26:05,308 knows what they're doing. 444 00:26:05,398 --> 00:26:05,848 Right. 445 00:26:06,328 --> 00:26:12,328 And so I, I wholeheartedly concur with you to, to use an MSP, to use, you 446 00:26:12,333 --> 00:26:14,398 know, you know, consulting companies. 447 00:26:14,478 --> 00:26:17,448 The episode that we published today was with Horangi, which, which 448 00:26:17,448 --> 00:26:22,638 automates cloud security and, um, you know, and specifically for the 449 00:26:22,638 --> 00:26:26,328 Asian market, but they're broadening into the, into the rest of the world. 450 00:26:26,958 --> 00:26:29,898 Uh, and Horangi is apparently the Korean word for tiger. 451 00:26:30,018 --> 00:26:31,248 So there you go. 452 00:26:32,598 --> 00:26:34,728 Prasanna Malaiyandi: or the other thing is if you are running in the 453 00:26:34,728 --> 00:26:39,528 cloud as a SaaS service or whatever else, reach out to the cloud company, 454 00:26:39,528 --> 00:26:42,888 because they have well architected reviews, they have best practices. 455 00:26:42,888 --> 00:26:45,018 They have tools already, right. 456 00:26:45,018 --> 00:26:47,628 To sort of help you cover the basics to make sure you're not 457 00:26:47,628 --> 00:26:52,518 doing something obviously wrong, like making a public S3 bucket. 458 00:26:55,653 --> 00:26:56,223 W. Curtis Preston: Yeah. 459 00:26:56,463 --> 00:27:02,043 Can you think of any other big lessons from this particular, um, hack Shaun? 460 00:27:03,618 --> 00:27:10,968 Shaun St. Hill: The other big lesson is make sure that what is 461 00:27:10,968 --> 00:27:15,618 done internally is, is checked. 462 00:27:16,578 --> 00:27:16,908 Right? 463 00:27:16,998 --> 00:27:17,568 So. 464 00:27:18,898 --> 00:27:25,798 sure that if someone does have responsibility for a particular tool 465 00:27:25,978 --> 00:27:28,978 or particular part of the environment, make sure that there's someone 466 00:27:28,978 --> 00:27:32,368 that, that follows up if you will. 467 00:27:33,268 --> 00:27:39,538 And I forget the exact saying, but what, what gets inspected? 468 00:27:41,358 --> 00:27:43,228 Uh, it, it slipped my mind. 469 00:27:43,408 --> 00:27:47,248 It's, it's the one where if you, if you wanna make sure that it's 470 00:27:47,248 --> 00:27:48,508 done, it has to be inspected. 471 00:27:48,973 --> 00:27:49,363 W. Curtis Preston: right. 472 00:27:49,828 --> 00:27:52,708 Shaun St. Hill: So that, that would, that would be my thing, you 473 00:27:52,708 --> 00:27:58,648 know, make sure that there is some follow through and some, you know, 474 00:27:58,708 --> 00:28:03,178 coming behind the person or behind, you know, the tool to make sure. 475 00:28:04,918 --> 00:28:08,998 What is to be protected or, you know, what is to be passed 476 00:28:09,028 --> 00:28:11,848 has a, has in fact taken place. 477 00:28:12,508 --> 00:28:12,898 W. Curtis Preston: Right. 478 00:28:12,958 --> 00:28:17,128 And I will also say one lesson I would say is that, you know, we, we talk about 479 00:28:17,158 --> 00:28:19,298 MFA a lot and I'm a huge fan of MFA. 480 00:28:19,323 --> 00:28:21,868 And if you don't have, if you don't have MFA, then What 481 00:28:23,218 --> 00:28:26,518 What at this point, but it's not infallible. 482 00:28:26,958 --> 00:28:28,878 Prasanna Malaiyandi: in fact that's what happened here again, 483 00:28:29,058 --> 00:28:29,388 right? 484 00:28:29,388 --> 00:28:30,468 Just like, yep. 485 00:28:31,098 --> 00:28:32,088 Just like with Okta. 486 00:28:32,088 --> 00:28:32,808 That's what happened. 487 00:28:32,808 --> 00:28:34,998 So just be careful, 488 00:28:36,238 --> 00:28:36,568 W. Curtis Preston: Yeah. 489 00:28:36,568 --> 00:28:42,538 I mean, I don't understand this concept of, I, I get 57 MFA requests and so 490 00:28:42,538 --> 00:28:44,278 I just approve it to make it stop. 491 00:28:44,458 --> 00:28:45,958 I don't understand that person. 492 00:28:46,258 --> 00:28:48,328 Like I would be calling it going. 493 00:28:48,478 --> 00:28:49,198 What the hell 494 00:28:49,363 --> 00:28:52,303 Prasanna Malaiyandi: so what happened in the case of Uber though, is that 495 00:28:52,303 --> 00:28:59,773 the person, uh, pretended to be Uber it and pinged them on WhatsApp and 496 00:28:59,773 --> 00:29:01,513 said, oh, by the way, I'm, Uber's it. 497 00:29:02,203 --> 00:29:03,853 Please accept the MFA. 498 00:29:03,858 --> 00:29:04,203 Right. 499 00:29:04,513 --> 00:29:06,013 And so they kept doing that. 500 00:29:06,013 --> 00:29:07,393 If you wanted the MFA to stop. 501 00:29:08,128 --> 00:29:08,233 . Yep. 502 00:29:09,283 --> 00:29:11,233 And so then eventually the person's like, okay. 503 00:29:11,233 --> 00:29:13,243 And then they just said, yep, good to go. 504 00:29:14,233 --> 00:29:14,713 W. Curtis Preston: Okay. 505 00:29:14,713 --> 00:29:16,513 I'm I'm done talking about this. 506 00:29:16,513 --> 00:29:18,793 I want to go onto your second subject, Shaun. 507 00:29:19,053 --> 00:29:23,593 You, you, you, it's still in the same area, you in our pre-call you 508 00:29:23,593 --> 00:29:31,933 had talked about, um, you know, K through 12 funding and specifically 509 00:29:31,933 --> 00:29:34,603 funding for, uh, this kind of thing. 510 00:29:34,633 --> 00:29:36,203 Why don't you, why don't you talk about that. 511 00:29:36,553 --> 00:29:36,953 Shaun St. Hill: Sure. 512 00:29:36,953 --> 00:29:44,488 Mid-September of 2022, LA unified school district had a massive security incident. 513 00:29:45,178 --> 00:29:51,988 LA unified school district is the second largest school district in the nation. 514 00:29:52,528 --> 00:30:01,228 And so along with the security incident, came a request from some high ranking 515 00:30:01,228 --> 00:30:05,218 government officials in California, along with the leadership from the school. 516 00:30:06,343 --> 00:30:15,163 Asking the FCC to immediately consider allowing eRate to be used eRate funds. 517 00:30:15,193 --> 00:30:16,393 So just 518 00:30:16,513 --> 00:30:18,463 for a quick, yeah. 519 00:30:18,463 --> 00:30:24,193 So for, uh, for those that may not be familiar, eRate is a government program 520 00:30:24,703 --> 00:30:31,633 where each year school districts across the country can basically petition the 521 00:30:31,633 --> 00:30:34,963 government for services like internet. 522 00:30:35,953 --> 00:30:37,033 Access points. 523 00:30:37,183 --> 00:30:40,993 So things that will help from a technology standpoint within the district. 524 00:30:41,383 --> 00:30:46,723 And so interestingly enough, cybersecurity is not one of those technology services 525 00:30:46,993 --> 00:30:49,663 that they can get government funding for. 526 00:30:50,293 --> 00:30:56,503 And so they're asking the government to issue some sort of waiver that would 527 00:30:56,503 --> 00:30:58,933 allow for that to take place immediately. 528 00:30:59,773 --> 00:31:03,523 And as I was mentioning before we talked, or before we started 529 00:31:03,523 --> 00:31:07,423 the podcast, The cares act. 530 00:31:07,483 --> 00:31:13,453 And then the follow up, which was the American rescue plan, allocated billions 531 00:31:13,453 --> 00:31:18,703 of dollars to school districts for them to use, to spend on technology. 532 00:31:18,793 --> 00:31:25,153 And one of those technology expenditures could be in the area of cybersecurity. 533 00:31:25,423 --> 00:31:30,643 So what I was saying is not that school districts don't deserve or need. 534 00:31:31,573 --> 00:31:39,163 The money from E-Rate, but I would first ask what have you done with 535 00:31:39,673 --> 00:31:45,553 the funding from cares and from art to upgrade your cybersecurity? 536 00:31:45,668 --> 00:31:48,968 Prasanna Malaiyandi: And I wonder actually, if they were even thinking about 537 00:31:48,968 --> 00:31:52,568 cybersecurity, when they were looking at that funding that came in, right, maybe 538 00:31:52,568 --> 00:31:54,368 they were like, Hey, we need more laptops. 539 00:31:54,368 --> 00:31:57,008 We need to worry about remote education. 540 00:31:57,008 --> 00:31:59,618 We need to put all these other equipment in place. 541 00:31:59,623 --> 00:32:03,698 Maybe cybersecurity didn't even like, come to mind. 542 00:32:04,928 --> 00:32:05,988 Shaun St. Hill: And, and Prasanna. 543 00:32:06,038 --> 00:32:11,018 I think that is a wonderful that's. 544 00:32:11,068 --> 00:32:13,498 That is a, that is a reasonable assumption. 545 00:32:14,428 --> 00:32:24,418 However, if you dig into K12 and the number of security incidents, it's 546 00:32:24,698 --> 00:32:25,738 Prasanna Malaiyandi: it's on the rise. 547 00:32:25,958 --> 00:32:29,068 Shaun St. Hill: it's it's, it is, it is very much on the rise. 548 00:32:29,458 --> 00:32:34,018 And so me being the cybersecurity and data nerd that I am. 549 00:32:34,978 --> 00:32:40,828 There are websites and different tools available to show that this 550 00:32:40,828 --> 00:32:45,283 has been a thing before the pandemic. 551 00:32:46,033 --> 00:32:53,113 And so, again, your, your, your question or your, your concern is very reasonable. 552 00:32:53,773 --> 00:33:01,963 We, we needed to get laptops and People out in the community 553 00:33:01,963 --> 00:33:03,553 to help distribute that. 554 00:33:03,763 --> 00:33:08,503 We had to, you know, make sure that our teachers had what they needed. 555 00:33:08,743 --> 00:33:13,033 And so yes, there were very legitimate, immediate concerns 556 00:33:13,033 --> 00:33:14,413 that needed to be addressed. 557 00:33:14,727 --> 00:33:16,017 Prasanna Malaiyandi: no one focused on this at all. 558 00:33:16,397 --> 00:33:21,917 Shaun St. Hill: this, this, this is such a critical thing that. 559 00:33:22,907 --> 00:33:27,992 if, if this was 2008 or 2009, we could give you a pass 560 00:33:28,127 --> 00:33:28,337 Prasanna Malaiyandi: Yeah. 561 00:33:29,342 --> 00:33:31,472 Shaun St. Hill: and say, you know what? 562 00:33:31,932 --> 00:33:34,272 There's so much to this. 563 00:33:34,542 --> 00:33:43,242 It's, you know, not only do we not have the employee or the staff, we don't have 564 00:33:43,242 --> 00:33:48,132 the budget there again, 14, 15 years ago. 565 00:33:48,422 --> 00:33:49,532 Totally get. 566 00:33:49,977 --> 00:33:50,877 Prasanna Malaiyandi: Times have changed. 567 00:33:51,252 --> 00:33:56,532 Shaun St. Hill: Times times have changed so much so that these school districts 568 00:33:57,192 --> 00:34:00,642 are partnered with other providers. 569 00:34:00,822 --> 00:34:07,092 So think of illuminate is, is a big one that was in the news recently where 570 00:34:07,662 --> 00:34:13,392 these companies provide software to the school districts and every parent, 571 00:34:13,397 --> 00:34:17,202 every child in the school district, every administrator, every teacher uses. 572 00:34:17,847 --> 00:34:24,537 This software to help with a particular function, you know, um, within the school. 573 00:34:24,627 --> 00:34:30,327 And so it's, it's, it's not as though you aren't aware that 574 00:34:30,327 --> 00:34:32,607 these things are happening again. 575 00:34:32,607 --> 00:34:35,187 The, the very reasonable question that you asked. 576 00:34:35,187 --> 00:34:37,077 Well, we have all these other priorities. 577 00:34:37,077 --> 00:34:37,617 Yes. 578 00:34:37,917 --> 00:34:44,847 But you also have this awareness that you need to take care of. 579 00:34:46,367 --> 00:34:46,847 W. Curtis Preston: Right. 580 00:34:46,992 --> 00:34:49,592 Shaun St. Hill: Your your kids and their parents and your staff. 581 00:34:49,697 --> 00:34:51,647 Prasanna Malaiyandi: One of the things is I. 582 00:34:52,637 --> 00:34:56,207 If you think about the disruption that could happen at schools, right? 583 00:34:56,627 --> 00:34:58,727 It's not just, I think LA unified, right. 584 00:34:58,727 --> 00:35:00,317 They had a ransomware attack, right. 585 00:35:00,317 --> 00:35:02,417 That kind of took down their infrastructure. 586 00:35:02,417 --> 00:35:02,657 Right. 587 00:35:02,867 --> 00:35:05,597 And that's disruptive because just imagine, I, I can't 588 00:35:05,602 --> 00:35:06,617 remember the exact number. 589 00:35:06,617 --> 00:35:06,797 Right. 590 00:35:06,802 --> 00:35:10,577 But hundreds and thousands of kids no longer in school because they 591 00:35:10,577 --> 00:35:12,407 can't go, they can't get attendance. 592 00:35:12,732 --> 00:35:13,662 They can't check in. 593 00:35:13,662 --> 00:35:16,272 If they're doing remote learning, they can no longer access things. 594 00:35:16,272 --> 00:35:16,512 Right. 595 00:35:16,512 --> 00:35:18,402 That's so disruptive. 596 00:35:18,702 --> 00:35:21,822 The other side though, is I know a lot of time when we talk about ransomware, 597 00:35:21,822 --> 00:35:26,442 we also talk about exfiltration of data right now, kids' data, right? 598 00:35:26,442 --> 00:35:29,622 Imagine that you now have access to kids' records, you're stealing 599 00:35:29,622 --> 00:35:32,622 their social security numbers, or other pieces of information. 600 00:35:33,012 --> 00:35:33,372 Right? 601 00:35:34,062 --> 00:35:35,772 These are kids who don't have credit. 602 00:35:35,772 --> 00:35:39,462 Imagine now starting using that for identity theft and other purposes. 603 00:35:40,757 --> 00:35:44,687 It's a lot of sensitive, sensitive data that could potentially be 604 00:35:44,687 --> 00:35:47,087 exposed that you may not find about. 605 00:35:47,087 --> 00:35:48,667 Find out until the kid turns 18. 606 00:35:48,667 --> 00:35:48,987 Right? 607 00:35:50,882 --> 00:35:56,417 Shaun St. Hill: Prasanna there are 10 year olds right now who have 608 00:35:56,477 --> 00:35:59,717 Maseratis and Porsches in their name. 609 00:36:00,077 --> 00:36:08,117 They have homes in Hawaii, Connecticut that are in their name and they 610 00:36:08,122 --> 00:36:11,297 won't know it until many years. 611 00:36:11,297 --> 00:36:18,497 Hence, and it's because of what we're talking about now, the, the, 612 00:36:18,827 --> 00:36:25,247 the need to take cybersecurity seriously is, is way overdue. 613 00:36:26,402 --> 00:36:31,112 W. Curtis Preston: A thought did occur to me and I do wonder about at what point. 614 00:36:31,112 --> 00:36:35,612 So like I locked down my, my, um, credit reports, right? 615 00:36:35,617 --> 00:36:41,462 So, uh, so at least minimizing this risk personally, uh, on my side. 616 00:36:41,702 --> 00:36:43,232 And I'm wondering at what age. 617 00:36:44,087 --> 00:36:47,477 Would could, should you do that with a minor, 618 00:36:47,957 --> 00:36:48,377 right. 619 00:36:48,437 --> 00:36:48,767 Like, 620 00:36:49,437 --> 00:36:50,907 Prasanna Malaiyandi: when you're still in the hospital. 621 00:36:51,377 --> 00:36:54,917 W. Curtis Preston: well, like when can you CA you know, can you, can you do this? 622 00:36:54,917 --> 00:36:57,257 Like, as soon as they have a social security number, I would think 623 00:36:57,257 --> 00:36:58,637 you would be able to do it, right? 624 00:36:58,787 --> 00:37:01,367 Shaun St. Hill: You can So it's, it would be, it would be 625 00:37:01,367 --> 00:37:04,097 incumbent on the parent to do that, 626 00:37:04,107 --> 00:37:04,597 W. Curtis Preston: Yeah. 627 00:37:05,117 --> 00:37:05,627 Shaun St. Hill: to go ahead 628 00:37:05,627 --> 00:37:05,717 and 629 00:37:05,717 --> 00:37:06,047 lock 630 00:37:06,092 --> 00:37:08,072 W. Curtis Preston: gonna talk, I'm gonna talk to my kids. 631 00:37:08,732 --> 00:37:12,662 I'm gonna keep my, keep my granddaughter from owning a Mo home in, well, maybe 632 00:37:12,662 --> 00:37:14,072 I'll let her have that home in Hawaii. 633 00:37:16,082 --> 00:37:17,612 Prasanna Malaiyandi: I think the challenge though, is like, we're 634 00:37:17,612 --> 00:37:20,642 talking about it now and you're you were aware of credit freezes, right? 635 00:37:20,647 --> 00:37:20,972 Curtis. 636 00:37:20,972 --> 00:37:26,612 But there are a lot of parents who aren't even aware of a lot of the tech or possib 637 00:37:26,617 --> 00:37:30,842 process and possibilities that they might be able to leverage like credit 638 00:37:30,992 --> 00:37:32,582 or freezing the credit of their child. 639 00:37:32,582 --> 00:37:32,852 Right. 640 00:37:32,852 --> 00:37:35,492 And so what do you do for those parents? 641 00:37:35,612 --> 00:37:35,822 Right? 642 00:37:35,822 --> 00:37:36,602 How do you. 643 00:37:37,517 --> 00:37:41,327 Inform them or let them be aware that, Hey, there are these other 644 00:37:41,327 --> 00:37:44,357 options that you should be thinking about to protect your kids. 645 00:37:44,972 --> 00:37:47,372 W. Curtis Preston: Well, I can only help the lucky few that are smart 646 00:37:47,372 --> 00:37:49,022 enough to listen to this podcast. 647 00:37:49,322 --> 00:37:51,842 So go do that, right. 648 00:37:51,847 --> 00:37:54,782 I, I think, and I've never, I never thought about it myself. 649 00:37:54,782 --> 00:37:58,262 I am well aware of the concept of freezes, but I never thought of 650 00:37:58,262 --> 00:38:00,002 freezing my granddaughter's credit. 651 00:38:00,002 --> 00:38:00,932 She doesn't need. 652 00:38:01,472 --> 00:38:04,112 You know, an open credit report right now. 653 00:38:04,532 --> 00:38:08,972 Um, what, you know, what's really weird, you know, it's a bit of a non-sequitur, 654 00:38:08,972 --> 00:38:13,772 but what's really weird is there are like, if you Google, should I, or how 655 00:38:13,772 --> 00:38:15,152 could, how do I freeze your credit? 656 00:38:15,362 --> 00:38:16,262 You will find. 657 00:38:16,772 --> 00:38:22,742 Um, blogs that tell you that don't do it because it's, uh, it makes getting 658 00:38:22,742 --> 00:38:24,512 credit cards, inconvenient and such. 659 00:38:24,722 --> 00:38:25,562 And I will agree. 660 00:38:25,712 --> 00:38:26,702 It absolutely did. 661 00:38:26,762 --> 00:38:31,472 When we got our first new car in a long time, uh, but you 662 00:38:31,472 --> 00:38:32,732 know, what else is inconvenient? 663 00:38:33,237 --> 00:38:34,897 Prasanna Malaiyandi: Having your identity stolen? 664 00:38:35,467 --> 00:38:36,962 W. Curtis Preston: Having your identity stolen? 665 00:38:37,442 --> 00:38:40,442 Um, yeah, it's just, you know, it's, it's like security, 666 00:38:40,562 --> 00:38:42,182 security is never convenient. 667 00:38:42,662 --> 00:38:43,112 Right. 668 00:38:43,202 --> 00:38:46,772 Um, you know, having to unlock my front door when I come to 669 00:38:46,777 --> 00:38:47,912 the house, not convenient. 670 00:38:48,062 --> 00:38:48,392 Right. 671 00:38:48,812 --> 00:38:52,502 But it minimizes the number of yahoos running through my house. 672 00:38:53,012 --> 00:38:56,342 Um, Shaun, we're about to wrap this up. 673 00:38:56,402 --> 00:39:00,052 Uh, any, any final thoughts regarding the school system. 674 00:39:01,402 --> 00:39:06,502 Shaun St. Hill: There are a number of things that I'd yet say about security 675 00:39:06,502 --> 00:39:12,702 and the, the school districts, the one that I will put out there is, again, the, 676 00:39:12,792 --> 00:39:19,422 the amount of funding that is available through the sources that we mentioned, you 677 00:39:19,422 --> 00:39:22,732 know, cares and the American rescue plan. 678 00:39:22,782 --> 00:39:30,672 But beyond that, there are local and state grants available for technology 679 00:39:30,702 --> 00:39:33,972 upgrades that include cybersecurity. 680 00:39:34,752 --> 00:39:35,772 What am I saying? 681 00:39:36,102 --> 00:39:39,222 There really isn't an excuse, right? 682 00:39:39,342 --> 00:39:43,602 Until you have turned over every stone and exhausted every 683 00:39:43,607 --> 00:39:47,052 possibility, you don't have an excuse. 684 00:39:47,332 --> 00:39:54,332 There is no reason that your school district should be easy pickings. 685 00:39:54,697 --> 00:40:00,877 For someone to come through and get tens of thousands of, you know, 686 00:40:01,177 --> 00:40:02,857 student records and parent records. 687 00:40:02,947 --> 00:40:04,337 There's, there's just no reason for it. 688 00:40:05,137 --> 00:40:06,757 W. Curtis Preston: Yeah, that sounds about right. 689 00:40:07,487 --> 00:40:12,107 , I would suggest anybody that, you know, wherever you live, reach 690 00:40:12,107 --> 00:40:14,367 out to your school district, find out what they're doing. 691 00:40:14,552 --> 00:40:16,022 Prasanna Malaiyandi: Ask how they're securing your data. 692 00:40:16,742 --> 00:40:18,992 W. Curtis Preston: Maybe they're completely clueless, right? 693 00:40:19,182 --> 00:40:20,322 Maybe you should volunteer. 694 00:40:20,322 --> 00:40:20,892 I don't know. 695 00:40:20,952 --> 00:40:24,922 I don't know what the answer is there, but starts with this is a represent. 696 00:40:25,422 --> 00:40:29,712 Our podcast is listened to in more places than there are representative governments. 697 00:40:29,892 --> 00:40:34,872 But if you have a representative government you gotta represent 698 00:40:35,007 --> 00:40:35,677 Shaun St. Hill: Exactly. 699 00:40:36,267 --> 00:40:36,867 W. Curtis Preston: Yeah. 700 00:40:36,987 --> 00:40:37,467 Yeah. 701 00:40:37,527 --> 00:40:38,067 All right. 702 00:40:38,067 --> 00:40:39,607 Well, uh, thanks Shaun. 703 00:40:39,657 --> 00:40:40,917 For, for coming on. 704 00:40:40,917 --> 00:40:41,577 It's been great 705 00:40:42,557 --> 00:40:43,812 Shaun St. Hill: Prasanna Curtis. 706 00:40:43,812 --> 00:40:45,582 Thanks for your time. 707 00:40:45,582 --> 00:40:48,042 Appreciate being on you guys are doing a great job. 708 00:40:49,167 --> 00:40:54,027 W. Curtis Preston: and, uh, Prasanna, thanks for not giving any care 709 00:40:54,057 --> 00:40:57,297 about my post vacation depression. 710 00:40:57,892 --> 00:41:02,022 Prasanna Malaiyandi: That that's the least I can do, Curtis, you know, it 711 00:41:02,022 --> 00:41:04,412 was nice talking to you too, Shaun. 712 00:41:05,052 --> 00:41:06,462 W. Curtis Preston: And thank you to our listeners. 713 00:41:06,762 --> 00:41:10,812 Remember to subscribe so that you can restore it all