1 00:00:14,727 --> 00:00:16,137 you know, it's not every day. 2 00:00:16,167 --> 00:00:20,337 You get to talk to a former Green Beret and it's my pleasure to do that today. 3 00:00:20,877 --> 00:00:24,747 We're talking to Zach fuller, a founding partner of silent 4 00:00:24,777 --> 00:00:26,517 sector, a cybersecurity firm. 5 00:00:26,877 --> 00:00:30,537 About our favorite subject and yes, he does happen to be a farmer Green 6 00:00:30,537 --> 00:00:32,577 Beret I hope you enjoy the episode. 7 00:00:52,568 --> 00:00:55,568 W. Curtis Preston: Hi, and welcome to Backup Central's Restored All podcast. 8 00:00:55,573 --> 00:00:58,118 I'm your host, w Curtis Preston, a k a, Mr. 9 00:00:58,118 --> 00:01:03,188 Backup, and have with me a guy that is determined to cause me to spend 10 00:01:03,193 --> 00:01:06,488 every last dollar I have on stuff. 11 00:01:07,238 --> 00:01:09,878 Persona Malaiyandi, how's it going? 12 00:01:09,878 --> 00:01:10,458 Prasanna 13 00:01:10,839 --> 00:01:14,589 Prasanna Malaiyandi: the I, I'm a little offended by that. 14 00:01:14,594 --> 00:01:19,839 I don't know if I've, I don't know if it's every single dollar, but I would probably 15 00:01:19,844 --> 00:01:22,299 say it's at least 50 cents on the dollar. 16 00:01:25,463 --> 00:01:27,413 W. Curtis Preston: You keep sending me cool stuff. 17 00:01:27,413 --> 00:01:31,343 You're like, Hey, have you heard of this thing, this cool thing? 18 00:01:31,673 --> 00:01:33,923 Cuz you did, you did sort of convince me. 19 00:01:33,923 --> 00:01:33,953 I. 20 00:01:34,433 --> 00:01:39,353 Remember there was, uh, you know, I wanted to replace the front door lock, right? 21 00:01:39,503 --> 00:01:44,783 Well, I needed to, and, uh, because the, the key broke off in the, in the 22 00:01:44,783 --> 00:01:46,583 deadbolt, it wouldn't work anymore. 23 00:01:47,063 --> 00:01:50,153 And so my wife was like, you should get one of those smart lock things. 24 00:01:50,153 --> 00:01:54,293 So then I was looking at stuff that costs like, Like a hundred 25 00:01:54,293 --> 00:01:57,713 dollars and you're like, if you looked at this one, that costs $200. 26 00:01:57,713 --> 00:01:58,733 It's much better. 27 00:01:59,093 --> 00:02:03,353 And now you're, and now August, basically you talked me into the August 28 00:02:03,353 --> 00:02:05,813 lock, which by the way has been great. 29 00:02:05,903 --> 00:02:07,913 I bought the August lock for my front door. 30 00:02:08,843 --> 00:02:13,673 Um, and, and it's pretty cool to, you know, the, the coolest feature of 31 00:02:13,673 --> 00:02:19,288 the August lock is that if I have my smartphone with me, It unlocks, uh, 32 00:02:19,318 --> 00:02:21,178 as I'm walking up to the front door. 33 00:02:21,238 --> 00:02:21,628 Right? 34 00:02:21,658 --> 00:02:22,258 Uh, you that's 35 00:02:22,258 --> 00:02:22,378 an 36 00:02:22,534 --> 00:02:22,654 Prasanna Malaiyandi: I, 37 00:02:22,738 --> 00:02:23,308 W. Curtis Preston: feature. 38 00:02:23,754 --> 00:02:26,244 Prasanna Malaiyandi: I, I don't know if that's probably the best feature for you. 39 00:02:26,244 --> 00:02:30,294 I think the best feature for you is Locke, ensuring that the door is locked. 40 00:02:31,194 --> 00:02:31,464 Right? 41 00:02:31,464 --> 00:02:31,614 I 42 00:02:31,708 --> 00:02:34,228 W. Curtis Preston: are you saying, are you saying that I'm absent-minded 43 00:02:34,258 --> 00:02:37,978 and that, that, for me personally would be the best feature? 44 00:02:38,008 --> 00:02:38,278 No. 45 00:02:40,528 --> 00:02:40,798 Yeah. 46 00:02:40,798 --> 00:02:45,428 So just so you know, It's just funny that you sent, so what, so what 47 00:02:45,428 --> 00:02:48,368 happened is you sent me today this link of, Hey, did you know sell? 48 00:02:48,368 --> 00:02:50,408 They also sell a key, right? 49 00:02:50,408 --> 00:02:53,228 Because mine is the one, the one that I bought is the one that 50 00:02:53,228 --> 00:02:54,458 goes on the back of the door. 51 00:02:54,458 --> 00:02:58,268 So from the front of the door, it looks just like I have a normal, uh, deadbolt. 52 00:02:58,598 --> 00:03:03,128 Um, and that's the way I like that method versus, you know, it's the whole security 53 00:03:03,128 --> 00:03:05,498 by obscurity, it's something, right? 54 00:03:05,828 --> 00:03:09,428 Um, and so I don't have somebody driving past my house 55 00:03:09,433 --> 00:03:11,078 trying to hack my smart lock. 56 00:03:11,604 --> 00:03:12,414 Prasanna Malaiyandi: they listen to this podcast. 57 00:03:13,448 --> 00:03:16,418 W. Curtis Preston: Unless I listen to this podcast, all they all they 58 00:03:16,418 --> 00:03:19,178 know, they'll, they'll know all they need to do is steal my smartphone. 59 00:03:19,328 --> 00:03:23,378 Cuz I did turn on that, that feature, which I don't know, at least right 60 00:03:23,378 --> 00:03:27,698 now, I still really enjoy having the door say, hello Curtis, welcome home. 61 00:03:27,698 --> 00:03:32,828 And opening, uh, a So it's just funny that you sent me this, this thing, the, the 62 00:03:32,828 --> 00:03:38,438 keypad as you were sending me that I was in the process of ordering the August, 63 00:03:38,918 --> 00:03:43,043 uh, The lock for my two other doors. 64 00:03:43,433 --> 00:03:43,823 So 65 00:03:45,419 --> 00:03:45,909 Prasanna Malaiyandi: telling 66 00:03:46,013 --> 00:03:49,793 W. Curtis Preston: I, I, and you know it, you're right, is the feature, 67 00:03:49,793 --> 00:03:54,353 the feature that I enjoy the most and which is what causing me to buy 68 00:03:54,353 --> 00:04:00,683 it, is the fact that I, I turn on the feature that basically says after. 69 00:04:01,313 --> 00:04:04,673 A time period that you determine the longest of which is 30 minutes, is that 70 00:04:04,673 --> 00:04:10,823 it locks the door automatically and the backdoor again, if anyone's listening 71 00:04:10,823 --> 00:04:16,223 to this podcast, the backdoor has a, has a habit of seemingly coming unlocked 72 00:04:16,703 --> 00:04:21,653 and, uh, left unlocked for, and then I'll come down at some random time and 73 00:04:22,043 --> 00:04:23,723 notice that the back door's unlocked. 74 00:04:24,219 --> 00:04:26,229 Prasanna Malaiyandi: so, you should be careful though, Curtis, just 75 00:04:26,229 --> 00:04:29,769 given your tendency to sometimes leave your phone elsewhere. 76 00:04:30,159 --> 00:04:33,819 You probably wanna make sure you don't get locked out of the house. 77 00:04:33,824 --> 00:04:34,119 Right. 78 00:04:34,119 --> 00:04:36,579 Especially if all of 'em, like maybe your garage door, you 79 00:04:36,579 --> 00:04:38,019 may not want to have auto lock. 80 00:04:38,693 --> 00:04:41,513 W. Curtis Preston: We, we've discussed this, we've discussed this. 81 00:04:41,873 --> 00:04:46,613 Uh, let's just say, given who I am, there are backup systems in place. 82 00:04:47,183 --> 00:04:53,363 Um, and also we've gotten into the habit of locking the front door as 83 00:04:53,363 --> 00:04:56,213 we leave via our smartphone, right? 84 00:04:56,218 --> 00:04:58,643 So since I'm using the phone to. 85 00:04:59,394 --> 00:05:00,204 Prasanna Malaiyandi: You always have it with you. 86 00:05:00,488 --> 00:05:02,138 W. Curtis Preston: I, I, yeah, I always have it with me. 87 00:05:02,348 --> 00:05:08,588 And also if I can call anyone else who lives here, which there are three other 88 00:05:08,593 --> 00:05:12,998 people who live here, I could call them and I could say, can you unlock the, the, 89 00:05:13,164 --> 00:05:13,674 Prasanna Malaiyandi: The door. 90 00:05:14,094 --> 00:05:14,364 Yeah. 91 00:05:14,424 --> 00:05:15,414 Now, here's a question for her. 92 00:05:15,493 --> 00:05:16,148 W. Curtis Preston: is pretty cool. 93 00:05:16,209 --> 00:05:17,289 Prasanna Malaiyandi: Here's a question for you. 94 00:05:18,128 --> 00:05:18,458 W. Curtis Preston: Yeah. 95 00:05:18,789 --> 00:05:20,859 Prasanna Malaiyandi: Do you remember any of their numbers? 96 00:05:22,973 --> 00:05:23,663 W. Curtis Preston: Um, 97 00:05:24,309 --> 00:05:24,999 Prasanna Malaiyandi: Because, because 98 00:05:25,523 --> 00:05:27,713 W. Curtis Preston: my wife's number, I know my wife's number 99 00:05:27,713 --> 00:05:29,273 and I know my daughter's number. 100 00:05:29,273 --> 00:05:30,803 I do not know my son-in-law's 101 00:05:31,089 --> 00:05:31,479 Prasanna Malaiyandi: Okay. 102 00:05:31,479 --> 00:05:31,869 That's okay. 103 00:05:31,869 --> 00:05:33,579 At least you know two outta the three, so that's fine. 104 00:05:33,579 --> 00:05:36,399 Because I was just thinking like a lot of people, like with smartphones these days, 105 00:05:36,699 --> 00:05:38,349 they don't know people's numbers anymore. 106 00:05:38,349 --> 00:05:39,909 Or you just look it up and you're like, Hey, call 107 00:05:39,909 --> 00:05:40,449 so-and-so. 108 00:05:40,523 --> 00:05:44,033 W. Curtis Preston: was, if I was at a payphone, like 109 00:05:44,033 --> 00:05:45,443 what, what would that be like? 110 00:05:45,503 --> 00:05:47,573 Uh, is there a payphone anywhere? 111 00:05:47,829 --> 00:05:49,659 Prasanna Malaiyandi: Or you just walk over to your neighbors, right? 112 00:05:49,659 --> 00:05:51,189 You're like, Hey, can I borrow your phone? 113 00:05:52,193 --> 00:05:53,213 W. Curtis Preston: I don't talk to my neighbors. 114 00:05:54,819 --> 00:05:55,119 Prasanna Malaiyandi: Oh 115 00:05:55,133 --> 00:05:59,423 W. Curtis Preston: My ne the neighbor on that side would go, bleep, itty bleep. 116 00:05:59,663 --> 00:06:01,793 No, no, not 117 00:06:01,793 --> 00:06:02,663 gonna, yeah. 118 00:06:02,963 --> 00:06:03,263 Neighbor 119 00:06:03,319 --> 00:06:03,739 Prasanna Malaiyandi: I'm sorry 120 00:06:03,778 --> 00:06:04,343 W. Curtis Preston: They're new. 121 00:06:04,343 --> 00:06:04,913 I don't know. 122 00:06:04,973 --> 00:06:05,783 I don't know what they're, 123 00:06:06,339 --> 00:06:08,679 Prasanna Malaiyandi: so I'm sorry for getting you to spend extra money. 124 00:06:10,869 --> 00:06:11,439 But not really. 125 00:06:11,693 --> 00:06:12,143 W. Curtis Preston: Yeah. 126 00:06:12,563 --> 00:06:12,983 Yeah. 127 00:06:13,043 --> 00:06:15,503 Especially at a time right now. 128 00:06:15,593 --> 00:06:19,373 Uh, you know, well, we don't know when this episode goes live at a time 129 00:06:19,378 --> 00:06:24,353 right now, when I am currently, as we say, looking for opportunities, uh, 130 00:06:24,533 --> 00:06:26,693 so, you know, need to preserve cash. 131 00:06:26,693 --> 00:06:32,363 Cash is king right now, but, uh, anyway, um, let us get onto our guest 132 00:06:32,573 --> 00:06:32,843 who's 133 00:06:32,949 --> 00:06:34,599 Prasanna Malaiyandi: like, what are you guys talking about? 134 00:06:34,599 --> 00:06:36,459 Just blabbering on about smart logs. 135 00:06:36,464 --> 00:06:37,919 I thought this was like something else. 136 00:06:39,278 --> 00:06:40,118 W. Curtis Preston: Yeah, exactly. 137 00:06:40,538 --> 00:06:45,548 So we have, uh, I think, um, a very interesting guest today. 138 00:06:45,698 --> 00:06:50,228 He's actually a former member of the Special Forces Turn Cybersecurity Expert. 139 00:06:50,558 --> 00:06:56,278 He's a co-host of the Cyber Rans Podcast and founding partner of Silent Sector. 140 00:06:56,398 --> 00:06:59,578 I like that phrase, A company that builds cybersecurity. 141 00:07:00,008 --> 00:07:02,288 Programs for B2B companies. 142 00:07:02,558 --> 00:07:05,858 I'm pretty sure he's our first former Green Beret on the show. 143 00:07:06,098 --> 00:07:08,228 Welcome to the show, Zach Fuller. 144 00:07:08,999 --> 00:07:09,779 Zach Fuller: Thank you, Curtis. 145 00:07:09,779 --> 00:07:10,739 Pleasure to be here. 146 00:07:11,378 --> 00:07:13,208 W. Curtis Preston: Always nice to have a fellow veteran. 147 00:07:13,208 --> 00:07:14,798 I was, uh, I was not. 148 00:07:15,253 --> 00:07:16,453 In the Special Forces. 149 00:07:16,453 --> 00:07:23,383 I was in the um, uh, I was in the, the phrase we used to say was, 150 00:07:23,383 --> 00:07:26,383 there ain't no sense running around the bushes if there's no war. 151 00:07:26,563 --> 00:07:27,493 I was in the Navy. 152 00:07:27,703 --> 00:07:28,153 Right. 153 00:07:28,183 --> 00:07:32,893 Um, and um, cuz I was in the Navy, technically most of my 154 00:07:32,893 --> 00:07:34,423 time was during peace time. 155 00:07:34,843 --> 00:07:41,713 But I did, I was in, during the OG Modern War Operation Desert Storm, 156 00:07:42,133 --> 00:07:44,803 uh, we actually invaded Kuwait. 157 00:07:45,238 --> 00:07:53,848 On my birthday in whatever year that was, two, was that like 2090? 158 00:07:54,958 --> 00:07:55,648 Yeah, you're right. 159 00:07:55,648 --> 00:07:56,968 It was in the nineties, wasn't it? 160 00:07:57,178 --> 00:07:57,448 Yeah. 161 00:07:57,838 --> 00:07:58,018 Yeah. 162 00:07:58,023 --> 00:07:59,608 Nineties, like 91. 163 00:08:00,118 --> 00:08:06,418 Um, and I, I have, I, I, I absolutely credit where I am today with the, 164 00:08:06,418 --> 00:08:09,748 the years that I spent in the Navy, and I'm sure you do as well. 165 00:08:09,928 --> 00:08:14,128 Um, you know, looks like you were in about the same amount of time as I was. 166 00:08:14,954 --> 00:08:19,184 Zach Fuller: I spent five years in, I was 2004 to 2009. 167 00:08:19,774 --> 00:08:23,494 So it seem seems like a, a long time ago, but at the same time, 168 00:08:23,494 --> 00:08:25,954 it seems that time has flown by. 169 00:08:25,954 --> 00:08:31,024 I don't know where it went, but, um, but uh, yeah, here, here we are. 170 00:08:31,024 --> 00:08:34,894 And I wouldn't trade it for the world, but, uh, it's a rougher lifestyle 171 00:08:35,074 --> 00:08:37,204 than being, than doing what I do now. 172 00:08:37,204 --> 00:08:42,064 I'll tell you that my, I've soft keyboard hands now, um, and a, and a sore back. 173 00:08:43,378 --> 00:08:47,068 W. Curtis Preston: Yeah, I, I, um, I, you know, I, I went in the 174 00:08:47,068 --> 00:08:51,088 Navy, you know, for, for those that you know, for whatever. 175 00:08:51,088 --> 00:08:51,898 It's a podcast. 176 00:08:51,898 --> 00:08:54,058 You don't wanna listen to me, you're on the wrong podcast. 177 00:08:55,303 --> 00:09:00,643 Um, but back in the day, so I went in the Navy for a very specific reason. 178 00:09:01,123 --> 00:09:03,733 I was working real jobs, right? 179 00:09:03,733 --> 00:09:08,053 Like, like, you know, for, for companies with Paychex from the time I was 15. 180 00:09:08,623 --> 00:09:13,723 And when I, uh, like I worked part-time as a, as a phone salesman. 181 00:09:14,413 --> 00:09:18,973 Um, I was selling carpet cleaning and police benevolent association stuff. 182 00:09:18,973 --> 00:09:21,673 I sold cars, I worked at McDonald's. 183 00:09:22,298 --> 00:09:27,008 By the time I turned 21 in bootcamp, I had had 19 jobs. 184 00:09:27,699 --> 00:09:27,919 Zach Fuller: Wow. 185 00:09:28,358 --> 00:09:28,838 W. Curtis Preston: Right. 186 00:09:28,898 --> 00:09:35,048 And, and I, I went into the Navy, uh, specifically with the goal of having a job 187 00:09:35,048 --> 00:09:39,518 that I couldn't quit because I had, I know this is gonna come as a great surprise. 188 00:09:39,518 --> 00:09:45,518 I had an issue with authority and, um, I was like, yeah, yeah. 189 00:09:45,908 --> 00:09:49,418 And I, you know, so I went in the Navy to have a job that I couldn't quit. 190 00:09:49,873 --> 00:09:52,633 And I remember, I, I still remember the moment. 191 00:09:52,963 --> 00:09:57,103 My first, you know, we'll call it f you moment, right? 192 00:09:57,133 --> 00:10:01,993 The moment where typically when I was a civilian, I would've said, f 193 00:10:01,993 --> 00:10:05,233 you and I would've walked out, and that would've, and then I would've, 194 00:10:05,238 --> 00:10:06,913 would've gotten another job, right? 195 00:10:07,333 --> 00:10:12,703 And that was the moment that, uh, an E nine, so that's a senior chief, an E nine. 196 00:10:14,158 --> 00:10:17,518 In my mind, an E nine asked me to move this thing. 197 00:10:17,518 --> 00:10:20,998 You know, it was something simpler, like move this chair from there to there. 198 00:10:21,268 --> 00:10:25,498 And I said something along the lines of, at the time I didn't think I was arguing. 199 00:10:25,498 --> 00:10:28,468 I didn't think I was dis disobeying an order I. 200 00:10:28,548 --> 00:10:31,878 I just was like, well, I think it makes more sense for the 201 00:10:31,878 --> 00:10:33,528 chair to be over there, whatever. 202 00:10:33,528 --> 00:10:34,458 Whatever it was. 203 00:10:34,458 --> 00:10:34,878 Right? 204 00:10:35,448 --> 00:10:39,258 And and he immediately just went to to 11, right? 205 00:10:39,588 --> 00:10:44,178 And he just was like, let me explain to you the E nine E four relationship. 206 00:10:44,208 --> 00:10:49,518 I say, you do thinking is beyond your bleeping pay grade. 207 00:10:49,518 --> 00:10:49,938 Right? 208 00:10:50,358 --> 00:10:52,608 And I remember thinking at that exact moment. 209 00:10:52,843 --> 00:10:56,263 Okay, Curtis, this is, this is what you, this is that moment that you, 210 00:10:56,743 --> 00:10:58,213 this is what you signed up for. 211 00:10:58,603 --> 00:11:01,183 And I did not say those magic words. 212 00:11:01,183 --> 00:11:02,923 I did not get booted outta the Navy. 213 00:11:02,953 --> 00:11:04,483 And uh, and here I am. 214 00:11:04,513 --> 00:11:05,143 How about you? 215 00:11:06,164 --> 00:11:08,204 Zach Fuller: Um, well, I, I definitely have. 216 00:11:08,584 --> 00:11:12,934 Have been tuned up by higher enlisted before, so you're not alone there. 217 00:11:13,234 --> 00:11:15,514 Um, that's, uh, that, yeah. 218 00:11:15,514 --> 00:11:18,334 Saying that to an E nine s, never, never a good idea. 219 00:11:18,664 --> 00:11:22,864 It's basically whatever they say you do, if jump off that cliff, better jump 220 00:11:22,864 --> 00:11:26,524 off that cliff, cuz the ramifications are gonna be less than if you don't. 221 00:11:26,529 --> 00:11:28,744 But um, yeah. 222 00:11:28,744 --> 00:11:30,584 That being said, I mean, I was, I. 223 00:11:30,889 --> 00:11:34,489 I was just felt drawn to the, the military. 224 00:11:34,519 --> 00:11:38,299 Um, and nine 11 happened when I was in high school. 225 00:11:38,299 --> 00:11:42,049 And I, you know, and then I went on to, on to college and was at University of 226 00:11:42,049 --> 00:11:45,229 Colorado and I was kind of, I kind of felt I was doing fine in school, but 227 00:11:45,234 --> 00:11:49,159 I didn't feel that challenge that I was looking for at that point in life. 228 00:11:49,164 --> 00:11:56,869 And I had, I just felt this calling to go join the military and then, and then, um, 229 00:11:56,869 --> 00:12:02,459 in the, The, there was an opportunity if you could go through all the assessment 230 00:12:02,459 --> 00:12:07,109 and selection process and all that, you could go from civilian to becoming a Green 231 00:12:07,109 --> 00:12:14,519 Beret, um, rather than prior, they, you had to be in the army for a handful of 232 00:12:14,519 --> 00:12:16,469 years and like an infantry or something. 233 00:12:16,469 --> 00:12:21,404 So, Having that opportunity, passing all the tests, going through selection, 234 00:12:21,404 --> 00:12:24,794 getting selected, going through the, um, qualification course for about 235 00:12:24,794 --> 00:12:28,964 two years, um, was just a, that was the challenge I was looking for, 236 00:12:28,964 --> 00:12:33,584 you know, and that, that was a game changer for me and just was the. 237 00:12:34,849 --> 00:12:39,289 You know, brought, brought me to that next notch of maturity that I really 238 00:12:39,294 --> 00:12:41,509 needed at that, that point in life. 239 00:12:41,509 --> 00:12:44,209 And, and so I, I wouldn't trade it for the world. 240 00:12:44,209 --> 00:12:47,569 You know, I got to work with guys that, you know, small team of guys that are 241 00:12:47,574 --> 00:12:49,189 the best in the world at what they do. 242 00:12:49,189 --> 00:12:52,159 They there's, and there's no place else they would've rather been, you 243 00:12:52,164 --> 00:12:54,379 know, so it's kind of funny because. 244 00:12:54,944 --> 00:12:56,804 It was just an incredible environment to work in. 245 00:12:56,804 --> 00:12:57,974 Incredible people. 246 00:12:58,184 --> 00:13:01,634 We went out, we did our operations overseas, global war on terror, 247 00:13:01,964 --> 00:13:04,844 um, and did some amazing things. 248 00:13:05,564 --> 00:13:10,754 Now, when my enlistment came to an end being naive, 20 249 00:13:10,814 --> 00:13:12,104 something, mid, mid twenties. 250 00:13:12,669 --> 00:13:17,259 At the time, I thought that that's how the rest of the world operated. 251 00:13:17,559 --> 00:13:20,259 You know, where you, you could ask, you could tell somebody to do something, 252 00:13:20,259 --> 00:13:23,769 and it was basically already done, even if time hadn't caught up yet, 253 00:13:23,799 --> 00:13:27,279 there was no checking in to see if it had happened or anything like that. 254 00:13:27,579 --> 00:13:33,129 And so going from that environment into the business world was an eyeopener. 255 00:13:33,129 --> 00:13:37,719 And it, it, it took a lot of adjustment and expectations and, and how things 256 00:13:37,719 --> 00:13:40,319 work and operate, but, I love it. 257 00:13:40,319 --> 00:13:41,519 I wouldn't trade it for the world. 258 00:13:41,519 --> 00:13:45,509 I, we learned a lot during that time that I wouldn't have picked up anywhere else. 259 00:13:45,514 --> 00:13:50,819 And, and I try to, uh, share those, those, those concepts and those 260 00:13:50,819 --> 00:13:55,109 methodologies and ideas that we ran by in the unconventional warfare world 261 00:13:55,499 --> 00:13:59,519 and share those with business leaders, with technical, technical leaders 262 00:13:59,789 --> 00:14:03,209 and, and, um, people just getting started in their careers as well. 263 00:14:03,239 --> 00:14:04,979 Um, so lots. 264 00:14:04,979 --> 00:14:07,289 Yeah, I could, I could talk all day about that stuff. 265 00:14:07,289 --> 00:14:08,189 It's a fun. 266 00:14:08,864 --> 00:14:13,964 Um, group to be around because there's, they don't, they don't 267 00:14:13,964 --> 00:14:17,954 accept anything but the best, the very best performance all the time. 268 00:14:17,954 --> 00:14:19,934 But they also have fun doing it. 269 00:14:19,934 --> 00:14:22,124 And there's lots of jokes, there's lots of laughs. 270 00:14:22,129 --> 00:14:23,474 It's where they want to be. 271 00:14:23,474 --> 00:14:28,094 So, um, yeah, I, I just, um, got so much out of that. 272 00:14:28,094 --> 00:14:31,724 People as a veteran people will come up and say, thank you for your service. 273 00:14:31,724 --> 00:14:34,034 I say, well, thank you for your tax dollars, first of all, cuz 274 00:14:34,034 --> 00:14:35,444 I probably wasted a lot of them. 275 00:14:35,878 --> 00:14:36,958 W. Curtis Preston: thank you for the paycheck. 276 00:14:37,664 --> 00:14:38,084 Zach Fuller: Yeah. 277 00:14:38,084 --> 00:14:40,844 And, and also it's, you know, really it's the, the, the, the 278 00:14:40,844 --> 00:14:44,834 pleasure is mine to be able to, to do that in, in that environment. 279 00:14:44,894 --> 00:14:45,224 So, 280 00:14:45,644 --> 00:14:49,544 Prasanna Malaiyandi: So what made you go from that into cybersecurity? 281 00:14:49,904 --> 00:14:52,274 Like how, why choose this area? 282 00:14:53,174 --> 00:14:57,074 Zach Fuller: so I was always a, I was always kind of a, a, well, not kind of, 283 00:14:57,074 --> 00:15:02,069 it was definitely an a, you know, Tech nerd growing up, I spent lots of time 284 00:15:02,339 --> 00:15:04,529 on computers, grew up in tech, family. 285 00:15:04,529 --> 00:15:09,989 Both my parents worked in Silicon Valley and, and, um, so I was on computers 286 00:15:09,989 --> 00:15:13,829 since I was as young as I could remember, you know, starting with the Apple 287 00:15:13,829 --> 00:15:16,679 two E and, uh, going up from there. 288 00:15:17,279 --> 00:15:21,209 But I got started getting kicked outta computer classes for hacking 289 00:15:21,209 --> 00:15:24,239 the networks and locking the teachers outta their own systems and stuff. 290 00:15:24,239 --> 00:15:26,609 And in, uh, that was in middle school. 291 00:15:26,669 --> 00:15:27,149 Um, so 292 00:15:27,343 --> 00:15:28,543 W. Curtis Preston: Thank you for your service. 293 00:15:28,934 --> 00:15:29,324 Zach Fuller: Oh yeah. 294 00:15:30,074 --> 00:15:34,274 So, um, I, I had fun, you know, breaking stuff and putting it back together, 295 00:15:34,274 --> 00:15:37,934 and I think that's the root of a lot of people in cybersecurity now. 296 00:15:37,934 --> 00:15:39,284 Um, I took a different path though. 297 00:15:39,284 --> 00:15:45,344 I realized that, uh, when it, when it came down to really, as I realized that, 298 00:15:45,494 --> 00:15:48,554 and, uh, later on in middle school and high school, I realized girls weren't 299 00:15:48,554 --> 00:15:50,474 super interested in my tech skills. 300 00:15:50,774 --> 00:15:55,754 So now, now it's a cooler thing, you know, but now, but back then, you, you 301 00:15:55,759 --> 00:16:00,414 know, They weren't very interested in that stuff, but, um, I actually took 302 00:16:00,444 --> 00:16:03,714 a path of more the entrepreneurial realm and so started building 303 00:16:03,714 --> 00:16:07,314 websites for companies when that was a cutting edge thing to have a website. 304 00:16:07,314 --> 00:16:11,694 I started outsourcing work to Russia that I didn't know how to do at the 305 00:16:11,694 --> 00:16:13,434 time before outsourcing was really. 306 00:16:13,859 --> 00:16:14,759 A known thing. 307 00:16:14,759 --> 00:16:18,629 I found developers that could do work that I didn't know how to do for much cheaper 308 00:16:18,629 --> 00:16:20,429 than it could be done here in the us. 309 00:16:20,429 --> 00:16:24,809 And so, um, did that and, and really took an interest in the entrepreneurial side, 310 00:16:24,809 --> 00:16:27,269 the business, um, development and so on. 311 00:16:27,929 --> 00:16:31,979 And so I did, did different ventures, um, throughout my career. 312 00:16:31,979 --> 00:16:35,969 E even in a college and exterior painting company door. 313 00:16:35,969 --> 00:16:38,429 I've done everything from door to door sales to. 314 00:16:38,999 --> 00:16:42,569 Implement Salesforce for, or, you know, mid-market companies. 315 00:16:42,569 --> 00:16:47,039 So, um, had a lot of, lot of crossover between that tech and then 316 00:16:47,039 --> 00:16:48,479 that business development world. 317 00:16:48,989 --> 00:16:53,969 Um, after the Army I went into, uh, the real estate private equity world. 318 00:16:53,974 --> 00:16:55,439 Well, real estate investment world. 319 00:16:56,199 --> 00:17:00,039 Because it was 2009 and everybody said how terrible real estate 320 00:17:00,039 --> 00:17:01,149 was and stay away from it. 321 00:17:01,149 --> 00:17:06,009 So being the hardheaded person that I tend to be, sometimes that's exactly where 322 00:17:06,009 --> 00:17:07,509 I went, is where I was told not to go. 323 00:17:07,509 --> 00:17:08,889 So, um, that was fun. 324 00:17:08,889 --> 00:17:12,939 Learned a lot, um, helped a private equity company build and grow and, and, 325 00:17:12,944 --> 00:17:14,979 and just build a tremendous organization. 326 00:17:15,449 --> 00:17:19,389 But, but, um, I realized that what I got to do in the Army, I. 327 00:17:19,389 --> 00:17:23,254 Was, I, I got to protect great people in our nation from kind of 328 00:17:23,254 --> 00:17:27,034 behind the scenes doing things that people never really hear about. 329 00:17:27,034 --> 00:17:29,854 I mean, some of the stuff made the news, but it, it, who was behind 330 00:17:29,859 --> 00:17:31,804 it never, never came out, right? 331 00:17:31,804 --> 00:17:36,064 And so I thought that was a really awesome thing and I, I 332 00:17:36,064 --> 00:17:37,324 really felt called to be able to. 333 00:17:37,574 --> 00:17:39,674 Protect our nation again in some way. 334 00:17:39,884 --> 00:17:43,514 Um, I wasn't necessarily gonna do it by slinging lead and high explosives. 335 00:17:43,514 --> 00:17:46,394 Again, that, that was, you know, my, my prior life. 336 00:17:46,694 --> 00:17:50,474 Um, but I recognize there's a need in the cybersecurity realm. 337 00:17:50,774 --> 00:17:55,094 Um, when we started Silent Sector in 2016, we're starting to see our 338 00:17:55,094 --> 00:17:59,324 uptick in, um, breaches on the news, and it was becoming more and more. 339 00:17:59,719 --> 00:18:02,929 Uh, these, these activities of cyber criminals were becoming 340 00:18:02,929 --> 00:18:06,409 more prevalent and the, the public was becoming more aware of 'em. 341 00:18:06,859 --> 00:18:09,679 So I said, well, you know, there's probably something that needs to be done 342 00:18:09,679 --> 00:18:11,209 here, something that we can do different. 343 00:18:11,809 --> 00:18:14,849 And, um, that's, that's really, I. 344 00:18:14,849 --> 00:18:21,689 How I entered into this industry, um, you, you know, and, and have two incredible 345 00:18:21,869 --> 00:18:26,999 partners that both have 25 years as, um, you know, both in, in technical 346 00:18:26,999 --> 00:18:29,669 and leadership roles in cybersecurity. 347 00:18:29,669 --> 00:18:33,749 So, um, the three of us came together, brought different skillsets, and we 348 00:18:33,749 --> 00:18:34,919 said, Hey, let's build this thing. 349 00:18:34,919 --> 00:18:36,119 Let's do something different. 350 00:18:36,389 --> 00:18:38,819 And that's what we've been doing and it's been, it's been great. 351 00:18:40,463 --> 00:18:40,703 W. Curtis Preston: Yeah. 352 00:18:40,703 --> 00:18:41,333 That's pretty cool. 353 00:18:41,353 --> 00:18:42,263 I, I like that. 354 00:18:43,013 --> 00:18:45,953 You know, I, I liked hearing, I. 355 00:18:45,953 --> 00:18:48,718 Sort of applying the stuff that you learned in the military. 356 00:18:49,588 --> 00:18:54,058 I, I think there's things that I learned in the military that have stuck with me, 357 00:18:54,238 --> 00:18:57,508 but for me it was longer ago than you. 358 00:18:57,508 --> 00:19:00,718 So I think I learned things and then forgot that that's where I learned them 359 00:19:01,168 --> 00:19:09,418 one, one of, one of the thing that, um, When I think back on things is one 360 00:19:09,418 --> 00:19:14,908 thing that I learned in, at least in my military or my part in the military, was 361 00:19:14,908 --> 00:19:18,688 the value of well tested documentation. 362 00:19:19,138 --> 00:19:22,648 Um, because, which, which I'm thinking do, which not a, was not 363 00:19:22,648 --> 00:19:24,658 a situation in your, in your field. 364 00:19:24,658 --> 00:19:26,248 But, uh, I mean, you've 365 00:19:26,248 --> 00:19:26,428 got 366 00:19:26,609 --> 00:19:27,289 Zach Fuller: be surprised. 367 00:19:27,628 --> 00:19:28,048 W. Curtis Preston: I'm sure. 368 00:19:28,168 --> 00:19:28,558 Okay. 369 00:19:29,403 --> 00:19:32,403 Uh, yeah, probably explosives are probably very well documented. 370 00:19:32,743 --> 00:19:38,293 We had this, um, uh, this system for doing preventative maintenance on the equipment. 371 00:19:38,298 --> 00:19:40,003 I was in, electronics, I was in. 372 00:19:40,403 --> 00:19:44,633 Um, uh, I operated and maintained the video system for the flight deck of an 373 00:19:44,633 --> 00:19:48,533 aircraft carrier and then also the, the lighting system that allowed the planes 374 00:19:48,533 --> 00:19:50,303 to land in the same spot every time. 375 00:19:51,443 --> 00:19:56,723 And, uh, we had a system for, um, doing preventative maintenance 376 00:19:56,723 --> 00:19:59,063 on these, uh, on these systems. 377 00:19:59,063 --> 00:20:04,553 And they had those procedures had to be vetted and vetted and vetted and 378 00:20:04,558 --> 00:20:07,463 tested, and then put onto a card. 379 00:20:07,863 --> 00:20:13,743 Those procedures you, you lived and died by, you had this card and you followed it. 380 00:20:14,043 --> 00:20:18,723 Even if you were trained in that piece of equipment, you followed that card. 381 00:20:19,213 --> 00:20:19,333 I. 382 00:20:19,333 --> 00:20:24,503 Step by step by step, and, and that's the way when I think about like cyber 383 00:20:24,503 --> 00:20:29,483 recovery, disaster recovery, that's the way the procedure should be. 384 00:20:29,513 --> 00:20:34,823 It should be fully tested and vetted to the point that you should be able, 385 00:20:34,823 --> 00:20:37,323 you should be able to hand it to a. 386 00:20:38,338 --> 00:20:44,068 Um, a, a technically proficient person who isn't familiar with the process and they 387 00:20:44,068 --> 00:20:48,788 should be able to execute the plan, um, what, what, what do you think about that? 388 00:20:49,314 --> 00:20:50,484 Zach Fuller: yeah, absolutely. 389 00:20:50,484 --> 00:20:53,904 Well, I was, I was, I was kind of laughing over here when you're saying 390 00:20:53,904 --> 00:20:57,534 the system, cuz I was thinking, well, in the army they're saying is if 391 00:20:57,534 --> 00:20:59,604 it ain't broke, fix it until it is. 392 00:20:59,874 --> 00:21:04,159 And so, so that, that's their version but no, um, seriously, 393 00:21:04,159 --> 00:21:05,479 it, no, that's exactly it. 394 00:21:05,509 --> 00:21:08,359 Um, I, I think of it in terms of airborne operations, right? 395 00:21:08,359 --> 00:21:09,859 And jumping out of airplanes. 396 00:21:09,889 --> 00:21:14,299 Um, the riggers have a tremendous job in getting the shoots packed the 397 00:21:14,304 --> 00:21:17,089 same exact way every single time. 398 00:21:17,094 --> 00:21:19,249 And it is me meticulously done. 399 00:21:19,459 --> 00:21:21,169 There's no room for variants. 400 00:21:21,169 --> 00:21:22,669 There's not any, any there. 401 00:21:22,819 --> 00:21:26,389 So I think regardless of all joking aside, regardless of where you. 402 00:21:26,519 --> 00:21:29,309 You are in the military and those listening with military backgrounds, 403 00:21:29,309 --> 00:21:33,029 I think that's a tremendous asset to bring into your security program, 404 00:21:33,029 --> 00:21:36,359 especially when you're talking about incident response, disaster recovery. 405 00:21:36,719 --> 00:21:42,689 We, we find a lot of organizations in the mid-market and emerging size company 406 00:21:42,689 --> 00:21:46,229 space will have, and I'm sure this is true in, you know, large enterprise 407 00:21:46,229 --> 00:21:51,809 in a lot of cases too, but there's a lot of times the I R D R plans are. 408 00:21:52,219 --> 00:21:57,859 Uh, very loosely put together, if at all, oftentimes off a template that 409 00:21:57,859 --> 00:21:59,989 has been downloaded from somewhere. 410 00:22:00,049 --> 00:22:03,439 Um, and they're not necessarily kept up and maintained. 411 00:22:03,439 --> 00:22:08,299 So one best practice is that, um, if you can, I mean, I, 412 00:22:08,299 --> 00:22:10,339 I'd say everybody can do this. 413 00:22:10,339 --> 00:22:15,169 It's whether they'll make time or not, but do tabletop exercises once a quarter, dust 414 00:22:15,169 --> 00:22:17,659 off that I R D R plan and work through it. 415 00:22:17,959 --> 00:22:19,249 Um, even if you're not doing. 416 00:22:20,309 --> 00:22:23,699 A, a actual full blown exercise. 417 00:22:23,699 --> 00:22:29,129 Just a, a tabletop will tell you a lot about where things are and we'll, we'll 418 00:22:29,129 --> 00:22:34,589 bring up a lot of, um, considerations and, and not enough companies do that. 419 00:22:34,589 --> 00:22:39,389 A lot of times it's, yeah, we, you know, we built out our plan and it, we 420 00:22:39,389 --> 00:22:41,429 haven't looked at it in three years, so. 421 00:22:41,653 --> 00:22:45,473 W. Curtis Preston: You know, right out of the military, I went into a bank, I. 422 00:22:45,888 --> 00:22:47,628 That's where I got my start in it. 423 00:22:48,678 --> 00:22:52,878 And we were required by the occ, right? 424 00:22:52,878 --> 00:22:54,858 That's the office of controller of currency. 425 00:22:55,188 --> 00:22:59,268 We were required by the OCC to do a DR test twice a year. 426 00:22:59,928 --> 00:23:03,888 And so, you know that comment that you made when you got outta the 427 00:23:03,888 --> 00:23:05,508 military, you were surprised that. 428 00:23:06,023 --> 00:23:09,023 Um, that people, you know, that when people are told to do something, they 429 00:23:09,023 --> 00:23:10,703 don't just, they just don't do it. 430 00:23:10,703 --> 00:23:10,973 Right. 431 00:23:11,333 --> 00:23:17,903 Um, I was surprised when I left the bank to find out that everybody didn't do that. 432 00:23:17,963 --> 00:23:18,323 Right. 433 00:23:18,353 --> 00:23:24,473 Uh, so to me, this idea of a having a well-documented, uh, dr plan that you 434 00:23:24,473 --> 00:23:29,813 then test it, uh, at, at least once a year, uh, you know, we did it every six 435 00:23:29,813 --> 00:23:36,728 months and, um, That the, the way we did it was we would take the plan and 436 00:23:36,728 --> 00:23:39,098 we would hand it to someone else, right? 437 00:23:39,368 --> 00:23:41,408 Zach, you seem like you know what you're doing. 438 00:23:41,468 --> 00:23:42,368 You're the new guy. 439 00:23:42,428 --> 00:23:44,048 Here's the documentation. 440 00:23:44,198 --> 00:23:48,458 Follow it while I stand in the background and figure out what I missed. 441 00:23:49,448 --> 00:23:49,838 Right? 442 00:23:50,048 --> 00:23:54,158 That, that's, that's the real way to do a test and I am, I am. 443 00:23:55,513 --> 00:23:56,203 I, I don't know. 444 00:23:56,203 --> 00:23:57,733 I'm continually surprised. 445 00:23:57,733 --> 00:23:58,723 I know persona, or 446 00:23:59,344 --> 00:23:59,794 Prasanna Malaiyandi: No, I'm. 447 00:24:00,163 --> 00:24:03,553 W. Curtis Preston: surprised that the people that don't do the basics, let alone 448 00:24:03,559 --> 00:24:03,859 Prasanna Malaiyandi: Yeah. 449 00:24:04,099 --> 00:24:07,129 Well, yeah, and y no, and I agree with that. 450 00:24:07,129 --> 00:24:10,249 And as I was actually gonna ask Zach, I'm like, for customers 451 00:24:10,249 --> 00:24:14,359 you've been talking to, how many of them actually have a IR or DR. 452 00:24:14,364 --> 00:24:15,409 Plan documented? 453 00:24:15,409 --> 00:24:18,709 Forget about actually testing it or verifying it, but even actually 454 00:24:18,714 --> 00:24:23,239 having a plan that seems feasible for recovering their environment. 455 00:24:24,199 --> 00:24:27,229 Zach Fuller: Yeah, it's, it's more, more rare than it should be. 456 00:24:27,234 --> 00:24:27,979 We, we work. 457 00:24:27,979 --> 00:24:31,694 Because we work with a lot of mid-market and, and smaller organizations. 458 00:24:31,694 --> 00:24:35,084 These aren't startups and stuff, but these are, you know, established companies. 459 00:24:35,084 --> 00:24:38,024 They're in compliance regulated industries, healthcare, 460 00:24:38,024 --> 00:24:41,174 financial services, uh, defense contractors, all that. 461 00:24:41,444 --> 00:24:46,214 And, and the ones that tend to be a little more on top of it are the ones that are, 462 00:24:46,244 --> 00:24:48,224 uh, that their hands are forced, right? 463 00:24:48,224 --> 00:24:52,874 They have an audit, um, on a annual basis or every three years even. 464 00:24:53,204 --> 00:24:56,054 And, and so they, they kind of have to do something about it. 465 00:24:56,354 --> 00:24:57,194 Um, so. 466 00:24:57,729 --> 00:25:01,929 It's, it's, it's much more prevalent than it should be to 467 00:25:01,929 --> 00:25:04,179 not have any type of, of DR plan. 468 00:25:04,179 --> 00:25:08,379 I mean, even, even just lack of independent backup solutions. 469 00:25:08,379 --> 00:25:10,869 You know, companies, Hey, we're, well, we're in aws. 470 00:25:10,899 --> 00:25:12,219 Okay, well, where, where else? 471 00:25:13,089 --> 00:25:13,299 No. 472 00:25:13,304 --> 00:25:15,819 Well, you know, aws, Amazon's 473 00:25:15,859 --> 00:25:16,519 Prasanna Malaiyandi: don't need anything 474 00:25:16,969 --> 00:25:19,039 Zach Fuller: It's like, no, that's not how it works. 475 00:25:19,039 --> 00:25:23,599 So, um, so yeah, it's, it's not, um, as prevalent as it should be. 476 00:25:23,599 --> 00:25:26,839 The other thing too is the, the quality and then making assumptions 477 00:25:26,839 --> 00:25:28,639 that people actually know what to do. 478 00:25:28,639 --> 00:25:32,029 So I like Curtis, your, your methodology, hand it to somebody else. 479 00:25:32,419 --> 00:25:35,809 What we do is we've created a gamified approach that actually 480 00:25:35,809 --> 00:25:37,129 involves dice and everything. 481 00:25:37,129 --> 00:25:41,089 So think of like a Dungeons and Dragons type type situation. 482 00:25:41,684 --> 00:25:43,994 We're rolling dice, and then we're figuring out, well, 483 00:25:43,994 --> 00:25:45,704 what's the scenario that's next? 484 00:25:45,704 --> 00:25:50,624 Is the next scenario is, hey, John is, um, head of it and is the one that 485 00:25:50,624 --> 00:25:54,074 usually runs all this for us, but he's out in the mountains for a week and we 486 00:25:54,074 --> 00:25:56,414 can't get ahold of him, so who's next? 487 00:25:56,414 --> 00:25:58,214 And then, and then on down the line. 488 00:25:58,504 --> 00:26:01,864 And then another thing that can be done is oftentimes these 489 00:26:01,864 --> 00:26:06,874 exercises are in, uh, group format, whether it be remote or actually 490 00:26:06,879 --> 00:26:08,314 sitting around a conference table. 491 00:26:08,764 --> 00:26:11,644 Well, instead of that, maybe we kick it off. 492 00:26:11,704 --> 00:26:14,704 We let everybody know, Hey, this is going to happen at some point this week. 493 00:26:14,974 --> 00:26:16,474 Be expecting a phone call. 494 00:26:16,744 --> 00:26:19,984 So they know this is part of the exercise, but we actually 495 00:26:19,984 --> 00:26:21,814 kick it off in a live chain. 496 00:26:21,814 --> 00:26:24,094 Like it actually would go down in real life. 497 00:26:24,094 --> 00:26:27,394 Hey, somebody you know is getting, um, bug pulled, you know, pulled 498 00:26:27,394 --> 00:26:30,994 outta their meeting or whatever, and we're going through this sequence of 499 00:26:30,994 --> 00:26:34,174 events in order to follow their plan. 500 00:26:34,174 --> 00:26:37,084 So, um, a lot of ways you could go about it, but I think just. 501 00:26:37,684 --> 00:26:40,384 Making the time to do it is, is something that should be on the 502 00:26:40,384 --> 00:26:44,944 calendar, um, minimum once a year, but we, you know, two to four is ideal. 503 00:26:45,184 --> 00:26:45,474 Prasanna Malaiyandi: Yeah. 504 00:26:45,648 --> 00:26:46,038 W. Curtis Preston: Yeah. 505 00:26:46,298 --> 00:26:50,478 I, I think I like that idea of, of gamifying it, right? 506 00:26:50,478 --> 00:26:55,518 I, I, I just see, I mean, just in general, the idea of gamifying it, I like that, 507 00:26:55,728 --> 00:26:58,758 uh, you know, I like, I've got this idea, you know, you got this dice, you're 508 00:26:58,763 --> 00:27:00,218 like, and what, and what do we win? 509 00:27:00,648 --> 00:27:03,318 You get a zero a day exploit, let's go. 510 00:27:03,558 --> 00:27:03,948 Right. 511 00:27:03,948 --> 00:27:04,518 I like it. 512 00:27:04,518 --> 00:27:05,148 I like it. 513 00:27:05,538 --> 00:27:09,288 Um, yeah, I, I, I think maybe I. 514 00:27:10,203 --> 00:27:14,253 Because when I think back to those, uh, those DR tests that we did, and 515 00:27:14,253 --> 00:27:19,173 this is way before anyone said the word ransomware, um, although as I've 516 00:27:19,173 --> 00:27:23,163 been studying up, uh, on ransomware, it turns out ransomware has actually 517 00:27:23,163 --> 00:27:25,413 been around longer than I thought. 518 00:27:25,683 --> 00:27:30,243 I first started hearing about it in 2014, but it's actually goes all the way back 519 00:27:30,243 --> 00:27:32,043 to, believe it or not, the eighties. 520 00:27:32,043 --> 00:27:34,593 There was a ransomware case in the eighties, but it 521 00:27:34,593 --> 00:27:36,183 wasn't really a, a, a thing. 522 00:27:36,243 --> 00:27:41,038 Uh, and I, I think it's been, um, It's been Bitcoin and things like that, that 523 00:27:41,038 --> 00:27:44,368 have really, I think, enabled it right in the, in the, in the recent era. 524 00:27:44,878 --> 00:27:49,108 So when I think back to those days, I remember those being 525 00:27:49,113 --> 00:27:51,598 high stress events, right? 526 00:27:51,868 --> 00:27:54,238 We only did it once every six months. 527 00:27:54,418 --> 00:27:56,578 We wanted it to be successful. 528 00:27:56,698 --> 00:27:59,908 Successful was defined as the recovery worked. 529 00:28:00,238 --> 00:28:03,118 And Curtis didn't have to get involved, right? 530 00:28:03,118 --> 00:28:05,098 So y you know, I handed it to Zack. 531 00:28:05,098 --> 00:28:09,568 Zack followed the procedures and the recovery was a hundred percent successful 532 00:28:09,628 --> 00:28:11,098 and I didn't have to do anything. 533 00:28:11,338 --> 00:28:15,508 We were never successful by that, by that standard, but we 534 00:28:15,508 --> 00:28:17,068 learned a lot along the way. 535 00:28:17,073 --> 00:28:20,548 And so the point was that it was an incredibly stressful situation. 536 00:28:20,938 --> 00:28:26,158 So I think this idea of gamifying it and doing it more often and having it, 537 00:28:26,188 --> 00:28:28,408 you know, just something that we do. 538 00:28:29,133 --> 00:28:38,013 As a way of both, um, creating the esprit core as well as, um, increasing 539 00:28:38,013 --> 00:28:40,233 knowledge and doing it more often. 540 00:28:40,773 --> 00:28:45,603 Um, that's actually a, I think, a fascinating idea, um, versus 541 00:28:46,113 --> 00:28:47,493 what, what we used to do. 542 00:28:48,033 --> 00:28:49,713 Um, what do you think persona. 543 00:28:50,189 --> 00:28:52,619 Prasanna Malaiyandi: Yeah, no, I think doing things more often, like 544 00:28:52,624 --> 00:28:55,739 practice makes perfect, you know, and you can't predict each and every 545 00:28:55,739 --> 00:28:57,179 single one of these events, right? 546 00:28:57,449 --> 00:28:59,969 Like you were saying, Zach, you rolled the dice and it might be this scenario 547 00:28:59,969 --> 00:29:03,809 or that scenario, but at least you're going through and getting used to the. 548 00:29:04,034 --> 00:29:06,854 Process and what things look like and dealing with that. 549 00:29:06,854 --> 00:29:09,434 Because when it really happened, it's gonna be a very high 550 00:29:09,434 --> 00:29:11,624 stress environment, right? 551 00:29:11,624 --> 00:29:14,954 But if you know how people are gonna react, how they behave, you've 552 00:29:14,954 --> 00:29:17,894 gone through these exercises, it builds up the confidence that you 553 00:29:17,894 --> 00:29:19,604 can handle whatever comes your way. 554 00:29:20,473 --> 00:29:22,993 W. Curtis Preston: So I just realized I haven't thrown out our disclaimer, 555 00:29:23,083 --> 00:29:27,643 uh, persona and I work for different companies and, uh, we're not representing 556 00:29:27,643 --> 00:29:29,263 either of them on this podcast. 557 00:29:29,263 --> 00:29:32,653 This is an independent podcast and the opinions that you hear 558 00:29:32,653 --> 00:29:34,573 are ours, not necessarily theirs. 559 00:29:34,933 --> 00:29:38,533 And, uh, be sure to rate us, uh, by going to your favorite pod catcher. 560 00:29:38,533 --> 00:29:41,563 Scroll down to the stars and give us all the, all the stars. 561 00:29:42,173 --> 00:29:44,663 You know, unless you hate us, then don't bother rating us. 562 00:29:45,173 --> 00:29:47,213 If, if you hate us, don't rate us. 563 00:29:47,273 --> 00:29:47,753 I like that. 564 00:29:47,753 --> 00:29:48,773 I've never said that before. 565 00:29:49,103 --> 00:29:53,153 Um, you know, it helps other people find the, the episode and, and share it 566 00:29:53,153 --> 00:29:56,933 with your friends, um, assuming that you have friends that care about their data. 567 00:29:57,353 --> 00:30:01,253 And, uh, also, uh, if you'd like to be part of the conversation, 568 00:30:01,433 --> 00:30:02,393 just reach out to me. 569 00:30:02,393 --> 00:30:03,383 I'm easy to find. 570 00:30:03,383 --> 00:30:05,123 I'm at WC Preston on Twitter. 571 00:30:05,488 --> 00:30:07,318 W Curtis Preston gmail. 572 00:30:07,618 --> 00:30:13,018 Uh, and you can also find me at linkedin.com/in/mr backup. 573 00:30:13,528 --> 00:30:15,688 And, uh, you know, we'll get you on the show. 574 00:30:15,808 --> 00:30:19,378 We love talking to other people that care about data. 575 00:30:19,968 --> 00:30:23,968 So, so, uh, Zach, let's talk about some of the things that have been 576 00:30:23,973 --> 00:30:26,578 happening, uh, in the news lately. 577 00:30:26,578 --> 00:30:30,748 And I'm gonna start with this, um, the Veeam story, and 578 00:30:30,748 --> 00:30:32,428 this one frustrates me a lot. 579 00:30:32,428 --> 00:30:34,168 And by the way, I'm just gonna right up front. 580 00:30:34,408 --> 00:30:37,408 Say, I am not upset with Veeam. 581 00:30:37,468 --> 00:30:37,678 Right? 582 00:30:37,678 --> 00:30:39,658 This is not an issue with Veeam. 583 00:30:40,138 --> 00:30:45,868 Um, because there was a vulnerability announced in March, which as of 584 00:30:45,868 --> 00:30:51,988 this recording is two months ago, they patched the vulnerability days. 585 00:30:52,108 --> 00:30:56,878 Uh, I don't know exact the exact number of days, but it was very shortly after the 586 00:30:56,878 --> 00:31:03,898 announcement, uh, of the vulnerability, and then you would think that. 587 00:31:04,258 --> 00:31:08,308 Every Veeam customer would then immediately apply the patch. 588 00:31:08,728 --> 00:31:13,408 But I'm pretty sure you saw this same news article that came out a couple of days 589 00:31:13,408 --> 00:31:17,968 ago, and it was, I forgot which federal agency, but it was some federal agency 590 00:31:17,968 --> 00:31:23,188 basically saying, Hey, uh, we've been looking out there and this Veeam exploit 591 00:31:23,188 --> 00:31:28,618 that happened two months ago is still in the wild, meaning that there are still 592 00:31:28,618 --> 00:31:30,718 attacks that are happening because of it. 593 00:31:31,153 --> 00:31:34,603 There are still, there was some company or some entity, I don't 594 00:31:34,603 --> 00:31:38,323 remember if it was an agency or some like threat hunter out there. 595 00:31:38,653 --> 00:31:43,933 They went out and just scanned for vulnerable Veeam servers and the 596 00:31:43,933 --> 00:31:50,713 number was in the, like the five digits and that just, I don't know what to 597 00:31:50,923 --> 00:31:55,063 think about that, Zach, cuz because, you know, I mean, tell, tell me. 598 00:31:55,123 --> 00:31:56,893 Well, first off, tell me if you agree with me. 599 00:31:57,103 --> 00:31:59,953 Like if you do nothing else, right? 600 00:31:59,953 --> 00:32:03,523 Good passwords, MFA pass or, and patch management. 601 00:32:03,883 --> 00:32:07,063 Like if you, if you do nothing else from a cybersecurity perspective, 602 00:32:07,303 --> 00:32:10,093 those three will go a long way. 603 00:32:10,153 --> 00:32:10,633 Right? 604 00:32:11,143 --> 00:32:13,993 Um, but, but here we have. 605 00:32:15,178 --> 00:32:19,348 Like this is, this is, you know, the backup system is, I like to 606 00:32:19,348 --> 00:32:21,448 say it, it's, it's Helms deep. 607 00:32:21,448 --> 00:32:24,118 I don't know if you get the Lord of the Reference, reference or Lord, 608 00:32:24,148 --> 00:32:25,378 Lord of the Rings reference there. 609 00:32:25,378 --> 00:32:29,398 But, um, you know, it's, it's the final line of defense 610 00:32:30,238 --> 00:32:33,358 and you're not patching it. 611 00:32:33,358 --> 00:32:36,478 I, I, how, how do you deal with that out there? 612 00:32:38,444 --> 00:32:43,154 Zach Fuller: yeah, so that's, and that's not patching with, you know, the, the 613 00:32:43,154 --> 00:32:46,964 Veeam, uh, the Veeam vulnerability aside. 614 00:32:47,144 --> 00:32:49,664 That's, I mean, that's prevalent throughout. 615 00:32:50,039 --> 00:32:50,969 Everything right. 616 00:32:51,149 --> 00:32:56,309 The CVE comes out and, and, um, there's, there's a known vulnerability. 617 00:32:56,639 --> 00:33:01,049 The vendors are generally very good about patching 'em quickly 618 00:33:01,289 --> 00:33:04,619 and getting notice out to their customers and everything else. 619 00:33:04,619 --> 00:33:06,779 So, and so that's, 620 00:33:06,838 --> 00:33:09,598 W. Curtis Preston: want, uh, Zach, you wanna define, uh, CVE for those 621 00:33:09,598 --> 00:33:10,858 that aren't familiar with the term? 622 00:33:11,144 --> 00:33:14,864 Zach Fuller: C CVEs, your, your, essentially your vulnerability database. 623 00:33:14,864 --> 00:33:19,544 So every vulnerability that's identified by researchers out there has a number 624 00:33:19,549 --> 00:33:22,394 associated with it and the year and such. 625 00:33:22,394 --> 00:33:27,524 And so you can basically pull up a, a, a list, um, and look at all the. 626 00:33:27,849 --> 00:33:31,239 You know, vulnerabilities for a certain, uh, type of environment 627 00:33:31,239 --> 00:33:33,459 or, um, scanners run off of these. 628 00:33:33,459 --> 00:33:37,329 So if you're running a vulnerability scanner, it'll match up a known 629 00:33:37,334 --> 00:33:42,009 vulnerability with a potentially exploitable, um, uh, device. 630 00:33:42,159 --> 00:33:44,859 Now, it doesn't mean that device is actually exploitable. 631 00:33:44,859 --> 00:33:49,089 There are false positives, there are deeper layers of control and so on. 632 00:33:49,329 --> 00:33:56,019 But, um, it's a, it's a methodology of marking a, um, a vulnerability. 633 00:33:56,219 --> 00:33:59,339 With a, a specific number so you can go back and, and look it up. 634 00:33:59,339 --> 00:33:59,639 Right. 635 00:33:59,639 --> 00:34:01,109 And, and identify what's there. 636 00:34:01,424 --> 00:34:01,634 W. Curtis Preston: Yeah. 637 00:34:01,639 --> 00:34:02,414 I think it's critical. 638 00:34:02,414 --> 00:34:04,244 Vulnerabilities and exploits, I think. 639 00:34:04,249 --> 00:34:05,744 But it, it, yeah. 640 00:34:05,744 --> 00:34:08,384 This database where, and it's like CVE dash. 641 00:34:08,879 --> 00:34:10,409 0 9, 7, 5. 642 00:34:10,829 --> 00:34:14,849 Um, and, and that tells you like in case the Veeam vulnerability, 643 00:34:14,999 --> 00:34:19,349 there is a CVE number, uh, so that everybody knows the same, so that 644 00:34:19,349 --> 00:34:20,909 we're all, we're all on the same page, 645 00:34:21,165 --> 00:34:22,155 Zach Fuller: Yeah, exactly. 646 00:34:22,155 --> 00:34:25,215 And then, and then your scanning tools will mark it. 647 00:34:25,220 --> 00:34:29,985 You know, you generally like one through five rating or one through 10, and, um, 648 00:34:29,985 --> 00:34:34,425 so you'll have a different severity level, um, depending on what it is and so on. 649 00:34:34,425 --> 00:34:35,415 Now, again, that doesn't. 650 00:34:35,865 --> 00:34:38,385 Tell you the true exploitable nature of that. 651 00:34:38,385 --> 00:34:42,045 But, um, it's, it gives you an idea of where to look when something's wrong. 652 00:34:42,045 --> 00:34:45,255 So one of the things companies need to be doing is continuous 653 00:34:45,255 --> 00:34:46,305 vulnerability scanning. 654 00:34:46,305 --> 00:34:50,745 So the whole vulner, oh, we scan once a quarter for PCI compliance. 655 00:34:50,985 --> 00:34:52,965 That just doesn't, doesn't cut it. 656 00:34:53,205 --> 00:34:58,035 They should be running continuous scans because it's simple to do. 657 00:34:58,035 --> 00:35:02,445 The tools are out there, especially externally, I mean internally too, 658 00:35:02,625 --> 00:35:05,115 ideally, but, um, at, at a minimum. 659 00:35:05,775 --> 00:35:07,365 Do continuous external scanning. 660 00:35:07,365 --> 00:35:11,235 So these vulnerabilities are popping up, um, and you're seeing them, and 661 00:35:11,235 --> 00:35:15,315 that way you're not trying to keep up with the articles and such that are 662 00:35:15,315 --> 00:35:19,515 coming out or the, the notifications from the vendors, those scanning tools 663 00:35:19,515 --> 00:35:22,695 that you're paying for whatever, whether it's Qualys or Nessus, rapid seven, 664 00:35:22,695 --> 00:35:25,035 whatever, whatever tool you're using. 665 00:35:25,250 --> 00:35:28,250 There's a bunch of 'em out there, but they're, they're constantly 666 00:35:28,250 --> 00:35:31,820 loading their databases with these new vulnerability signatures. 667 00:35:32,330 --> 00:35:35,600 And so if you're running this continuously, you're, you're. 668 00:35:35,865 --> 00:35:40,905 You have a third party, um, provider of the scanner platform that's, that's 669 00:35:40,905 --> 00:35:44,445 loading these signatures in, so they're on the ball cuz that's their business. 670 00:35:44,445 --> 00:35:46,995 They're, you know, very, very quick with this stuff. 671 00:35:47,205 --> 00:35:51,525 So you should be getting red flags and getting, getting notifications when 672 00:35:51,525 --> 00:35:53,415 a new vulnerability is identified. 673 00:35:53,415 --> 00:35:58,040 So the problem is, Mo a lot of organizations in the mid-market 674 00:35:58,040 --> 00:36:02,420 and emerging space are, it's been often a year more since they've done 675 00:36:02,420 --> 00:36:04,310 a vulnerability scan if, if ever. 676 00:36:04,640 --> 00:36:10,250 Um, and so it's, it, they, a lot of the, you know, it like MSPs and things, they're 677 00:36:10,250 --> 00:36:14,900 focused more on the day-to-day operational things and running, running tools like 678 00:36:14,900 --> 00:36:17,330 antivirus, managing firewalls and such. 679 00:36:17,330 --> 00:36:22,190 But this, this proactive activity of vulnerability scans v vulnerability scans, 680 00:36:22,190 --> 00:36:23,420 the first thing that's gonna tell you. 681 00:36:23,785 --> 00:36:27,205 Um, you know, whether it's Veeam or anything else, if you have something 682 00:36:27,205 --> 00:36:28,705 to look at, look deeper into. 683 00:36:28,975 --> 00:36:32,455 So, and then you get into the patch management whole discussion 684 00:36:32,460 --> 00:36:35,455 and that's a thorn in the side for lots of organizations. 685 00:36:35,455 --> 00:36:40,735 But, um, you can't look to go, you know, jump on a patch out of your 686 00:36:40,735 --> 00:36:44,365 normal schedule if you don't even know that that vulnerability is there. 687 00:36:44,455 --> 00:36:44,845 So, 688 00:36:45,090 --> 00:36:46,740 Prasanna Malaiyandi: So two questions for you, Zach. 689 00:36:46,740 --> 00:36:47,910 I think that all makes sense. 690 00:36:47,940 --> 00:36:51,180 Uh, the first is, What is the category like if someone wanted to 691 00:36:51,180 --> 00:36:54,720 look up a category for what these vulnerability scanning tools are 692 00:36:54,720 --> 00:36:56,010 called, what would they go search for? 693 00:36:56,010 --> 00:36:58,290 I know you gave a couple of vendors, but what's that 694 00:36:58,290 --> 00:36:59,610 general category of tool called? 695 00:37:00,195 --> 00:37:03,135 Zach Fuller: Yeah, I, I just look up network vulnerability scanners. 696 00:37:03,165 --> 00:37:06,975 Um, you can, yeah, there's, there's, um, there's a hand. 697 00:37:07,005 --> 00:37:10,935 The big names really are, are Qualys, um, Nessus. 698 00:37:10,940 --> 00:37:12,525 You got, um, tenable. 699 00:37:12,795 --> 00:37:15,645 There's a couple others, but you, but they're all gonna 700 00:37:15,645 --> 00:37:17,325 accomplish really similar things. 701 00:37:17,325 --> 00:37:19,215 It just depends on your, your budget and 702 00:37:19,455 --> 00:37:22,355 Prasanna Malaiyandi: And, and then the other question I had also is, especially 703 00:37:22,355 --> 00:37:26,315 since you've been talking a lot about sort of small and medium businesses, 704 00:37:26,765 --> 00:37:31,025 do you find though that these tools are practical for these organizations, 705 00:37:31,055 --> 00:37:36,305 either from a budget cost perspective or even from a skillset perspective? 706 00:37:36,305 --> 00:37:39,245 Because some of these organizations are very strapped when it comes 707 00:37:39,245 --> 00:37:41,435 to IT personnel especially. 708 00:37:41,465 --> 00:37:44,855 And in addition to that, you're looking at someone who's like cybersecurity 709 00:37:44,860 --> 00:37:49,910 focused and so, Is this something that they can easily pick up and start to use? 710 00:37:49,910 --> 00:37:53,150 Or is this such a burden for the organization that they're like, Hey, 711 00:37:53,360 --> 00:37:54,950 we have 50 other things to deal with. 712 00:37:54,955 --> 00:37:56,060 I can't worry about this. 713 00:37:57,065 --> 00:38:01,025 Zach Fuller: Yeah, they can easily hire a third party provider, uh, 714 00:38:01,025 --> 00:38:03,155 to, to run continuous scanning. 715 00:38:03,365 --> 00:38:04,295 We're talking. 716 00:38:04,700 --> 00:38:08,480 Couple hundred bucks a month, depending on the size of their, their environment. 717 00:38:08,540 --> 00:38:11,870 Um, it can larger, it, it is of course, the more time it takes 718 00:38:11,870 --> 00:38:13,010 to actually look at those skins. 719 00:38:13,015 --> 00:38:16,340 So you wanna, you can, you can always hire a third party and it's, it's 720 00:38:16,550 --> 00:38:20,330 pretty simple, pretty inexpensive, um, for a lot of companies. 721 00:38:20,905 --> 00:38:23,005 Some of the tools can be pretty costly. 722 00:38:23,005 --> 00:38:25,855 So for a lot of the companies, it's much more cost effective. 723 00:38:26,125 --> 00:38:30,355 If you have, you know, five or 10 external ips, you might as well just 724 00:38:30,415 --> 00:38:32,995 have a service provider do that for you. 725 00:38:33,415 --> 00:38:38,335 And then, um, hopefully that service provider also has an actual human 726 00:38:38,575 --> 00:38:40,585 looking at the scan results, right? 727 00:38:40,585 --> 00:38:43,435 So not just kicking you a scan report, but even if they kick you 728 00:38:43,435 --> 00:38:46,525 a scan report, um, you, you can. 729 00:38:46,955 --> 00:38:50,495 Teach somebody pretty quickly how to look through those. 730 00:38:50,495 --> 00:38:55,655 And most of 'em are just Excel exports, so you can just sort 'em however you'd like. 731 00:38:55,925 --> 00:38:59,735 Uh, if there's specific ips, things that you wanna focus on, or say you 732 00:38:59,740 --> 00:39:04,325 wanna only look at severity four and five, then we, you could, you could 733 00:39:04,325 --> 00:39:06,905 do that, um, really simply with Excel. 734 00:39:06,905 --> 00:39:09,935 So it's not, um, it doesn't get too technical. 735 00:39:09,935 --> 00:39:13,475 And I think the time it takes, even if you're looking at those. 736 00:39:13,850 --> 00:39:14,660 Yourself. 737 00:39:14,690 --> 00:39:19,130 Um, it's, it's well worth it compared to the 738 00:39:19,790 --> 00:39:21,050 Prasanna Malaiyandi: Cost of not doing it. 739 00:39:21,050 --> 00:39:21,890 Yeah, exactly. 740 00:39:21,920 --> 00:39:23,000 Zach Fuller: Yeah, absolutely. 741 00:39:23,374 --> 00:39:26,164 W. Curtis Preston: and where do those, because I know I've also seen 742 00:39:26,284 --> 00:39:31,654 a number of um, uh, sort of automated. 743 00:39:31,984 --> 00:39:34,564 PIN test, pin testing as a service. 744 00:39:34,954 --> 00:39:37,774 So this is like vulnerability scanning as a service. 745 00:39:37,774 --> 00:39:39,574 What about PIN testing as a service? 746 00:39:40,250 --> 00:39:44,090 Zach Fuller: So, yeah, there's the, the pen testing market's been interesting. 747 00:39:44,090 --> 00:39:46,850 It's been, be, become a bit commoditized. 748 00:39:46,880 --> 00:39:49,130 Um, and so it's hard for consumers. 749 00:39:49,670 --> 00:39:52,730 That are not in this business every day to kind of decipher what's, what. 750 00:39:53,030 --> 00:39:55,880 Mostly what we've seen out of automated pen testing is it's 751 00:39:55,880 --> 00:39:57,500 good for certain scenarios. 752 00:39:57,650 --> 00:40:00,200 There are some companies that all they wanna do is check a block and 753 00:40:00,205 --> 00:40:01,970 they say, we got a pen test done. 754 00:40:02,510 --> 00:40:04,640 Um, and, and it can be good for. 755 00:40:04,665 --> 00:40:09,915 Ongoing, um, continuous automated pen testing where you actually do, maybe you 756 00:40:09,915 --> 00:40:15,705 do a, a, a human driven pen test twice a year or, or once a quarter or something 757 00:40:15,710 --> 00:40:19,725 like that, or on every major release of your software, whatever the case may be. 758 00:40:19,730 --> 00:40:22,605 But then you have automation going in in the meantime. 759 00:40:22,815 --> 00:40:23,925 That can be a good use for it. 760 00:40:24,520 --> 00:40:29,380 The problem that we see is that, um, we'll have, we'll have, you know, potential 761 00:40:29,380 --> 00:40:32,380 clients come to us and say, Hey, we just got this, we got this pen test. 762 00:40:32,385 --> 00:40:33,520 We don't really know what to do. 763 00:40:34,180 --> 00:40:36,370 A lot of times there's a lot of fluff in there. 764 00:40:36,370 --> 00:40:40,780 The, the idea of saving money from an automated, a approach, we haven't 765 00:40:40,780 --> 00:40:44,565 really seen that be effective because, The companies that, that don't have 766 00:40:44,565 --> 00:40:50,175 the, the resources to, to decipher this stuff, they, they take this huge data 767 00:40:50,175 --> 00:40:54,885 dump from the automated tools and they go start trying to ta trying to tackle 768 00:40:54,885 --> 00:40:57,015 every vulnerability that's identified. 769 00:40:57,405 --> 00:40:59,715 So a good pen tester will show you. 770 00:41:00,240 --> 00:41:06,060 Really the, the areas that are truly exploitable in your environment, right? 771 00:41:06,060 --> 00:41:10,290 Just because a web application, you know, a tool says, Hey, there's 772 00:41:10,440 --> 00:41:12,540 potential for a sequel injection here. 773 00:41:12,780 --> 00:41:14,610 Doesn't mean you need to rebuild the app. 774 00:41:14,610 --> 00:41:18,900 It's okay maybe that, maybe there's a form field that lets arbitrary characters 775 00:41:18,900 --> 00:41:20,640 go through, but that doesn't mean. 776 00:41:21,215 --> 00:41:24,395 That the database is gonna spit out a bunch of information 777 00:41:24,395 --> 00:41:25,565 based, you know, based on attack. 778 00:41:25,565 --> 00:41:28,025 There are various layers of protection between them. 779 00:41:28,505 --> 00:41:31,835 So it, so as long as a company has, you know, a defense in 780 00:41:31,835 --> 00:41:35,765 depth approach, um, a lot of the automation stuff is, is limited. 781 00:41:36,065 --> 00:41:38,915 Um, I, again, I think it's, I think it's evolving. 782 00:41:38,945 --> 00:41:42,155 I think they're, it's getting better, but we have a ways to go. 783 00:41:42,155 --> 00:41:42,925 There are also. 784 00:41:43,355 --> 00:41:48,275 Uh, issues within environments that take, um, kind of human logic to identify 785 00:41:48,275 --> 00:41:51,125 still that, uh, tools won't pick up. 786 00:41:51,695 --> 00:41:57,605 So, for instance, we had a client, uh, who, who came to us for a pen test. 787 00:41:57,605 --> 00:42:02,135 They had a, uh, web application that when every, every time a user would sign up as 788 00:42:02,135 --> 00:42:04,985 financially based organization and they. 789 00:42:05,475 --> 00:42:08,745 They, every time a user would sign up, their data would go off to 790 00:42:08,745 --> 00:42:13,125 a third party that would charge 'em 10 cents, uh, a submission to 791 00:42:13,125 --> 00:42:14,985 validate that this is indeed a fact. 792 00:42:15,045 --> 00:42:20,235 Indeed a real person, and the financial information is valid and so on. 793 00:42:20,565 --> 00:42:22,725 So, third party service, 10 cents a shot. 794 00:42:23,175 --> 00:42:26,145 Well, the scanners and tools and stuff didn't. 795 00:42:26,465 --> 00:42:27,395 Pick up anything. 796 00:42:27,395 --> 00:42:32,195 There's nothing wrong with that per se, but our team found that, oh, hey, we can 797 00:42:32,195 --> 00:42:37,715 write a quick Python script here that can inject 5 million, uh, new users into this 798 00:42:37,715 --> 00:42:41,105 platform within a matter of hours or less. 799 00:42:41,315 --> 00:42:41,555 Right? 800 00:42:41,555 --> 00:42:44,585 And so at 10 cents a piece that can start to get costly. 801 00:42:44,915 --> 00:42:48,875 So we did proof of concept, you know, run 10 users through kind of thing, um, 802 00:42:48,995 --> 00:42:49,775 Prasanna Malaiyandi: Only 10. 803 00:42:50,295 --> 00:42:50,565 Zach Fuller: Right. 804 00:42:50,925 --> 00:42:51,105 Yeah. 805 00:42:51,105 --> 00:42:52,485 But here, you know, here's what could happen. 806 00:42:52,485 --> 00:42:57,105 So we need to stop, you know, so, so that kind of stuff sometimes, um, won't be, 807 00:42:57,735 --> 00:43:01,965 won't be flagged and we just need to look at, we need to look at it objectively. 808 00:43:02,055 --> 00:43:05,265 Um, you know, from the, from the business logic perspective. 809 00:43:06,304 --> 00:43:11,134 W. Curtis Preston: So earlier I was mentioning, um, that my top three 810 00:43:11,134 --> 00:43:17,794 are a good password system, um, and, uh, MFA and patch management. 811 00:43:18,344 --> 00:43:19,549 So, Past that. 812 00:43:19,579 --> 00:43:23,299 What, what, what would you, you know, cuz we talked about like, these are 813 00:43:23,299 --> 00:43:25,699 the things you need to do first, right? 814 00:43:25,699 --> 00:43:29,599 If, if, if you're concerned about the security of your environment, that 815 00:43:29,629 --> 00:43:33,769 these are the things you need to do first, what would you do after that? 816 00:43:33,905 --> 00:43:34,205 Zach Fuller: Mm. 817 00:43:34,895 --> 00:43:41,465 Well, most breaches occur because of well-meaning, but unaware individuals. 818 00:43:41,975 --> 00:43:45,725 So this, and this is a tough one cuz if I, if I could give a condensed 819 00:43:45,725 --> 00:43:48,425 list of top 10, that would be ideal. 820 00:43:48,635 --> 00:43:52,985 But the, the reality is there's a lot that goes into policy and, and process 821 00:43:52,985 --> 00:43:55,175 around how we use our computing devices. 822 00:43:55,775 --> 00:43:57,425 So thinking through that. 823 00:43:58,145 --> 00:44:03,605 A lot of times it's, um, the, uh, old user accounts aren't deprovisioned, right? 824 00:44:03,605 --> 00:44:06,785 Somebody leaves the company and HR isn't communicating with it, 825 00:44:07,535 --> 00:44:10,715 and, and then those accounts get compromised and nobody knows about it. 826 00:44:10,895 --> 00:44:11,705 So it's stuff like that. 827 00:44:11,705 --> 00:44:16,895 So I, I'd say, um, if, if this is a big category, but your policies and 828 00:44:16,895 --> 00:44:22,060 procedures and standards, documentation for the organization, Is, is so critical 829 00:44:22,060 --> 00:44:24,970 because that's going to encompass a lot. 830 00:44:25,360 --> 00:44:28,510 Um, I If you're referring more to technical controls 831 00:44:28,515 --> 00:44:30,700 specifically, then absolutely. 832 00:44:30,705 --> 00:44:32,380 You know, your backups and such. 833 00:44:32,410 --> 00:44:37,455 Um, I think that, that there's, um, Another. 834 00:44:37,485 --> 00:44:41,565 Well, and all the major frameworks call for this is the, one of the first 835 00:44:41,565 --> 00:44:45,375 things they're gonna say to do is inventory and control of your assets. 836 00:44:45,405 --> 00:44:47,835 Whether that's hard hardware and software, both. 837 00:44:48,195 --> 00:44:52,995 Um, a lot of organizations struggle with knowing exactly what 838 00:44:52,995 --> 00:44:54,435 they have in their environment. 839 00:44:54,885 --> 00:44:58,845 And so if a rogue device is coming in there, or it, and it could just be. 840 00:44:59,255 --> 00:45:01,985 You know, somebody's tired of working through the controls that 841 00:45:01,985 --> 00:45:03,275 are set up on their work computer. 842 00:45:03,275 --> 00:45:07,205 So they bring their laptop and plug it in, and, um, and now they're on the 843 00:45:07,205 --> 00:45:11,315 network and, and who knows what their kids were doing on social media with 844 00:45:11,315 --> 00:45:12,845 that, you know, a couple hours ago. 845 00:45:12,875 --> 00:45:15,935 So those types of things need to be thought through. 846 00:45:15,995 --> 00:45:21,575 Um, but I, I would say that, um, the, the, the human element, 847 00:45:21,935 --> 00:45:22,985 um, is the biggest thing. 848 00:45:22,985 --> 00:45:25,985 If, yeah, if I had to pick one piece, it'd be staff awareness training, 849 00:45:26,834 --> 00:45:28,744 W. Curtis Preston: Yeah, I, I, I think that's, I think I 850 00:45:28,744 --> 00:45:30,364 would completely agree with you. 851 00:45:30,424 --> 00:45:36,724 Um, I, you know, I, I am a, like if my choice is off, Are. 852 00:45:37,519 --> 00:45:41,659 Build really good defenses against mistakes versus train everybody 853 00:45:41,659 --> 00:45:43,069 which mistakes not to make. 854 00:45:43,069 --> 00:45:45,829 I'm gonna go with the first, not the second, but you. 855 00:45:45,829 --> 00:45:47,089 But you have to do it, right? 856 00:45:47,089 --> 00:45:49,099 You have to train the users. 857 00:45:49,099 --> 00:45:55,009 The problem with people, it's that, where do I start? 858 00:45:55,189 --> 00:45:55,489 Right? 859 00:45:55,494 --> 00:45:57,409 Well, first off, there's always new people. 860 00:45:57,469 --> 00:46:02,029 Second, we are incredibly, we're just, we're just flawed. 861 00:46:02,029 --> 00:46:06,169 So, so really if we could just get rid of all the people, um, you 862 00:46:06,169 --> 00:46:08,404 know, You're good to go. 863 00:46:08,734 --> 00:46:11,674 Um, I mean, we all know that AI doesn't make mistakes. 864 00:46:11,674 --> 00:46:15,004 So once we replace everyone on the planet with some sort of piece of 865 00:46:15,320 --> 00:46:15,470 Zach Fuller: Right. 866 00:46:16,174 --> 00:46:17,944 W. Curtis Preston: uh, there will be no more hacking. 867 00:46:18,335 --> 00:46:20,495 Prasanna Malaiyandi: This podcast brought to you by ai. 868 00:46:23,074 --> 00:46:27,034 W. Curtis Preston: Absolutely no, I, I remember that, I remember, uh, back 869 00:46:27,034 --> 00:46:33,394 again, that, that bank that I, that I, um, worked at, we were constantly, 870 00:46:33,394 --> 00:46:35,074 we constantly did user training. 871 00:46:35,074 --> 00:46:37,504 And one of the things that I remember that, that, that you were 872 00:46:37,504 --> 00:46:43,114 always told in the regular training that we went to was no one in 873 00:46:43,774 --> 00:46:45,514 the, you know, the IT department. 874 00:46:45,514 --> 00:46:49,384 No one will ever call you and ask you for your password ever. 875 00:46:49,924 --> 00:46:50,464 Right. 876 00:46:50,854 --> 00:46:56,194 And then the next day we would always call them and ask them for their password 877 00:46:56,554 --> 00:46:59,134 and like 20% of them would give it to us. 878 00:46:59,674 --> 00:47:00,364 It was like, 879 00:47:01,020 --> 00:47:01,740 Zach Fuller: Oh yeah, 880 00:47:02,074 --> 00:47:04,984 W. Curtis Preston: it was just like, oh, it's, it's, it's, 881 00:47:06,305 --> 00:47:10,145 Zach Fuller: We've been led in, we've been led into, uh, we do physical 882 00:47:10,145 --> 00:47:14,165 intrusion testing from time to time, from a data security perspective though. 883 00:47:14,165 --> 00:47:18,995 So we've been led into buildings, you know, tailgating and that sort of thing 884 00:47:18,995 --> 00:47:23,855 during business hours, just looking like supposed to be there kind of thing. 885 00:47:23,855 --> 00:47:26,975 And, and, you know, throw that thumb drive in a, in a. 886 00:47:27,170 --> 00:47:32,690 Computer, um, even led into, um, you know, network rooms and, and server rooms. 887 00:47:32,695 --> 00:47:35,300 I mean, it's, it's, um, pretty amazing. 888 00:47:35,300 --> 00:47:40,670 But yeah, the, the unaware is generally well-meaning, but, you know, 889 00:47:40,670 --> 00:47:42,650 unaware individual is, is always. 890 00:47:43,025 --> 00:47:44,255 Going to be the biggest risk. 891 00:47:44,255 --> 00:47:47,045 And that's, that's where we see most, most attacks come through. 892 00:47:47,375 --> 00:47:49,835 Um, especially those companies that are on. 893 00:47:50,165 --> 00:47:53,495 Um, and well, I want to put this out there because you're on cloud 894 00:47:53,495 --> 00:47:55,715 services that does not make you secure. 895 00:47:55,745 --> 00:47:56,165 Right? 896 00:47:56,465 --> 00:48:01,445 Um, so those, those companies that, those companies that, um, 897 00:48:02,075 --> 00:48:06,215 Think that, hey, we're on Google Workspace or we're on Office 365. 898 00:48:06,215 --> 00:48:09,185 So, you know, Google or Microsoft is taking care of our security. 899 00:48:09,575 --> 00:48:13,355 Um, that if we're, if we're, you know, talking about a list of things to do, 900 00:48:13,715 --> 00:48:18,485 um, another critical mistake is that a lot of these mid-market and smaller 901 00:48:18,485 --> 00:48:23,525 companies are on these environments and it's, it's crazy things like they 902 00:48:23,525 --> 00:48:28,325 set up the, you know, the person that started the company 15 years ago. 903 00:48:28,560 --> 00:48:33,090 Um, you know, ha has their, their normal email account is also the 904 00:48:33,090 --> 00:48:35,760 administrator to that company's account. 905 00:48:35,820 --> 00:48:39,060 And, um, that when once that gets breached, of course 906 00:48:39,060 --> 00:48:40,230 all kinds of things happen. 907 00:48:40,235 --> 00:48:46,350 We've seen cryptocurrency accounts stolen, um, uh, domain names hijacked, uh, from 908 00:48:46,350 --> 00:48:50,910 the registrars and moved to, um, moved to overseas registrars and ha getting a 909 00:48:50,910 --> 00:48:54,360 ransom to get it, you know, demanding a ransom to get it back, that kind of thing. 910 00:48:54,690 --> 00:48:58,970 Um, We, we've seen, you know, and from there pivoting to other cloud 911 00:48:58,970 --> 00:49:00,980 services like Dropbox and such. 912 00:49:01,280 --> 00:49:04,460 So that's more toward the very small company side. 913 00:49:04,490 --> 00:49:06,920 Um, u usually they're, they're more sophisticated in that, but 914 00:49:06,920 --> 00:49:08,570 I wanted to dispel that myth. 915 00:49:08,570 --> 00:49:11,330 I'd say that make sure that your cloud. 916 00:49:12,140 --> 00:49:16,790 Service environments, they, they can be set up to be very well secured. 917 00:49:17,000 --> 00:49:20,900 Most organizations are not leveraging the, the full potential 918 00:49:20,900 --> 00:49:25,070 of their security, and they're not provisioning accounts properly. 919 00:49:25,640 --> 00:49:30,710 So if we think about principle, uh, of least privilege, we want to give 920 00:49:30,710 --> 00:49:35,900 people only what they need to do their job day to day, and then have a. 921 00:49:36,170 --> 00:49:39,440 Methodology in place so they can escalate their access if they 922 00:49:39,440 --> 00:49:41,810 need it in unique circumstances. 923 00:49:42,110 --> 00:49:45,260 Um, but a lot of times companies are just giving everybody the 924 00:49:45,260 --> 00:49:46,580 kind of the keys to the kingdom. 925 00:49:47,000 --> 00:49:51,650 So once their account gets breached, now the attacker can get to a lot more, 926 00:49:51,980 --> 00:49:53,300 uh, than they could have otherwise. 927 00:49:53,300 --> 00:49:55,130 And the, the damage goes further that way. 928 00:49:55,430 --> 00:49:57,380 Prasanna Malaiyandi: Yeah, but it's so much easier, Zach, if you 929 00:49:57,380 --> 00:49:59,180 give access to everyone you know. 930 00:49:59,300 --> 00:49:59,570 Zach Fuller: Right? 931 00:50:00,110 --> 00:50:00,530 Yeah. 932 00:50:00,740 --> 00:50:01,040 Yep. 933 00:50:01,070 --> 00:50:05,240 Just, uh, open up your firewalls to any, any, just let all the traffic through. 934 00:50:05,824 --> 00:50:11,359 W. Curtis Preston: there was a famous GDPR case in, uh, Spain, I think it was 935 00:50:11,359 --> 00:50:14,209 maybe Portugal, and it was a hospital. 936 00:50:14,509 --> 00:50:20,539 And, um, the, it, it was one of the first big G D P R fines and 937 00:50:20,569 --> 00:50:24,889 what they had done in the hospital was to make administration easy. 938 00:50:25,039 --> 00:50:26,629 They made everybody a doctor. 939 00:50:28,124 --> 00:50:33,884 So everybody that worked at the hospital had doctor level access so they could 940 00:50:33,884 --> 00:50:36,734 see any record of any patient any time. 941 00:50:37,244 --> 00:50:41,474 Uh, and they were like, basically the gdpr, you know, the commission basically 942 00:50:41,474 --> 00:50:44,084 said you clearly didn't even try. 943 00:50:44,234 --> 00:50:44,594 Right? 944 00:50:45,134 --> 00:50:46,004 You clearly. 945 00:50:46,749 --> 00:50:49,569 You, you never even heard of the concept of lease privilege. 946 00:50:49,899 --> 00:50:54,039 Uh, we, you know, we find you guilty and, and, and find them. 947 00:50:54,189 --> 00:50:56,709 I dunno, it's a couple hundred million dollars or something. 948 00:50:57,039 --> 00:51:01,329 Uh, persona, can you think of, um, a another, so Zach was 949 00:51:01,334 --> 00:51:03,759 saying that, uh, make sure to. 950 00:51:04,159 --> 00:51:07,789 Uh, make sure that your cloud services are secured or properly 951 00:51:07,789 --> 00:51:09,049 configured for security. 952 00:51:09,515 --> 00:51:10,565 Prasanna Malaiyandi: Make sure to back it up. 953 00:51:10,669 --> 00:51:11,299 W. Curtis Preston: add to that? 954 00:51:11,389 --> 00:51:11,749 Yeah, 955 00:51:11,765 --> 00:51:14,195 Prasanna Malaiyandi: Make sure to back it up exactly because like Microsoft 956 00:51:14,195 --> 00:51:16,655 365 or Google workspaces, right? 957 00:51:16,955 --> 00:51:21,545 They don't care about restoring and recovering your environment 958 00:51:21,545 --> 00:51:22,685 to a well-known point. 959 00:51:22,685 --> 00:51:26,885 All they care about is making sure their service is up to date, keeping recovery 960 00:51:26,890 --> 00:51:31,145 copies to make sure that, but they don't have those copies for your benefit, 961 00:51:31,924 --> 00:51:34,984 W. Curtis Preston: Yeah, this Zack, the, the, the thing of, you know, and 962 00:51:34,984 --> 00:51:39,004 I think in the security world, we're like, uh, you know, MFA is like, man, 963 00:51:39,004 --> 00:51:41,854 if you don't have MFA at this point, I, I don't even know what to tell you. 964 00:51:41,884 --> 00:51:42,334 Right. 965 00:51:42,694 --> 00:51:46,444 Uh, in, in the backup world, this is one of those things where it's 966 00:51:46,449 --> 00:51:49,754 like, I, I, I don't know what to tell you if you think that Microsoft 967 00:51:49,754 --> 00:51:51,794 is backing up your data, right? 968 00:51:51,854 --> 00:51:56,024 Um, and I, I don't care what your, your Tam said to you, your, 969 00:51:56,029 --> 00:51:57,344 your technical account manager. 970 00:51:57,404 --> 00:52:00,284 I don't care what you read on some blog somewhere. 971 00:52:00,764 --> 00:52:03,284 Please go grab your service agreement. 972 00:52:04,389 --> 00:52:07,239 And find the word backup and and recovery in there anywhere. 973 00:52:07,239 --> 00:52:08,679 Cuz it, cuz it isn't there. 974 00:52:08,919 --> 00:52:09,369 Right. 975 00:52:09,399 --> 00:52:12,849 Uh, and also look up, uh, Microsoft has what they call the shared 976 00:52:12,849 --> 00:52:15,879 responsibility model and persona. 977 00:52:16,329 --> 00:52:17,739 They're not the only ones with that are they? 978 00:52:17,744 --> 00:52:19,359 Or is that just, that's not just their term, 979 00:52:19,475 --> 00:52:20,045 Prasanna Malaiyandi: that's not just 980 00:52:20,379 --> 00:52:22,689 W. Curtis Preston: So basically they show that they're responsible 981 00:52:22,694 --> 00:52:24,879 for the infrastructure and the availability of the service. 982 00:52:24,879 --> 00:52:26,409 And they're like data. 983 00:52:26,764 --> 00:52:27,814 You right? 984 00:52:27,814 --> 00:52:29,494 100% the customer. 985 00:52:29,794 --> 00:52:32,464 And still I have people that go, I don't think I need to back 986 00:52:32,464 --> 00:52:34,444 up these important services. 987 00:52:34,624 --> 00:52:40,714 I think that's gonna be, um, uh, the next sort of frontier. 988 00:52:40,714 --> 00:52:44,974 It already is starting to be, they're starting to go after her services like 989 00:52:44,974 --> 00:52:47,254 365 from a ransomware perspective. 990 00:52:47,884 --> 00:52:51,274 And I think at some point, hopefully in the next. 991 00:52:51,649 --> 00:52:57,049 Few years, people will start realizing once enough companies lose everything, 992 00:52:57,589 --> 00:53:02,659 uh, or are forced to pay a ransom to get their, um, important communi, you 993 00:53:02,659 --> 00:53:07,429 know, company communications back from their SaaS provider, uh, once somebody 994 00:53:07,429 --> 00:53:11,349 loses, you know, everything they've ever put into Salesforce, right. 995 00:53:12,209 --> 00:53:15,859 Um, and, and they're, they're forced to pay a ransom to get it back. 996 00:53:15,979 --> 00:53:18,319 Um, maybe this will get better. 997 00:53:18,769 --> 00:53:19,219 Yeah. 998 00:53:19,534 --> 00:53:19,774 What? 999 00:53:19,774 --> 00:53:20,644 What do you think Zach? 1000 00:53:21,100 --> 00:53:22,930 Zach Fuller: yeah, well, yeah, absolutely. 1001 00:53:22,930 --> 00:53:26,080 I think, I think there's more and more enforcement of that as well. 1002 00:53:26,080 --> 00:53:27,610 So you look at just, um, getting. 1003 00:53:27,610 --> 00:53:31,750 In a cyber insurance policy these days, for example, they're, they're 1004 00:53:31,750 --> 00:53:35,170 putting you through the ringer, and that's one of the key factors that 1005 00:53:35,170 --> 00:53:36,370 you're gonna need to have, right. 1006 00:53:36,375 --> 00:53:40,690 Is, is a backup system that's separate from your production environment 1007 00:53:40,690 --> 00:53:42,700 where everybody's working now? 1008 00:53:42,760 --> 00:53:44,200 Uh, yeah. 1009 00:53:44,200 --> 00:53:45,550 I, I think we're gonna see that. 1010 00:53:45,550 --> 00:53:46,570 We're also gonna see. 1011 00:53:46,910 --> 00:53:50,510 Um, these different regulations that are coming at, it's a compliance requirement 1012 00:53:50,510 --> 00:53:54,470 of the week coming up at this point, but, um, yeah, they're, they are absolutely 1013 00:53:54,470 --> 00:53:58,670 enforcing more and more of these controls with that being one of them, because, 1014 00:53:58,850 --> 00:54:01,820 I mean, I think especially because of ransomware, that's what everybody I. 1015 00:54:02,075 --> 00:54:05,885 Thinks about, but I mean, there's just a, there's a common everyday 1016 00:54:05,885 --> 00:54:07,475 business use case for it. 1017 00:54:07,475 --> 00:54:09,755 You know, it could be the malicious employee that wipes a 1018 00:54:09,755 --> 00:54:11,195 bunch of stuff before they leave. 1019 00:54:11,200 --> 00:54:14,975 It could be somebody just unknowingly overwrites a bunch of files with 1020 00:54:14,975 --> 00:54:18,785 old data and, and just having quick access to get that back. 1021 00:54:18,965 --> 00:54:22,205 So it, it's not, it doesn't take a ransomware attack to 1022 00:54:22,205 --> 00:54:23,885 have a reason to have a backup. 1023 00:54:23,915 --> 00:54:27,815 It's, um, there, there are lots and lots of use cases, or we talked a little 1024 00:54:27,815 --> 00:54:30,125 bit about das Disaster recovery before. 1025 00:54:30,500 --> 00:54:33,320 Um, that, you know, there's obvious implications there. 1026 00:54:33,320 --> 00:54:37,100 So, um, I, I think, I think that's a big piece of it for sure. 1027 00:54:37,699 --> 00:54:38,659 W. Curtis Preston: Preach it, Zach. 1028 00:54:38,899 --> 00:54:43,489 Um, I could, I could think, uh, so I used to administer, um, a 1029 00:54:43,489 --> 00:54:48,819 pretty large Salesforce environment and I remember one time I. 1030 00:54:48,819 --> 00:54:52,779 Uh, where what I was trying to do was I was trying to format, so I'm pretty 1031 00:54:52,779 --> 00:54:54,279 good with like text manipulation. 1032 00:54:54,279 --> 00:54:56,409 Being an old Unix guy, I was pretty good at that. 1033 00:54:56,979 --> 00:55:01,209 And I downloaded, um, the entire database, which was like, I don't know, a couple 1034 00:55:01,209 --> 00:55:08,889 million records and I went and did my Unix magic on the, uh, phone field. 1035 00:55:09,699 --> 00:55:16,269 I was good at text manipulation, I was bad at Excel, and so I sorted, I. 1036 00:55:17,089 --> 00:55:21,169 The spreadsheet, but I didn't sort the whole spreadsheet. 1037 00:55:21,169 --> 00:55:25,819 I just sorted like the phone numbers and I, which meant that I just 1038 00:55:25,819 --> 00:55:27,289 scrambled all the phone numbers to. 1039 00:55:27,964 --> 00:55:34,444 So, and then I uploaded that, uh, and basically in, in, in a matter of a 1040 00:55:34,444 --> 00:55:40,294 few minutes, I managed to give every contact in our, uh, database, the 1041 00:55:40,294 --> 00:55:44,674 wrong phone number, some other random person's phone number, and luckily, 1042 00:55:45,044 --> 00:55:50,954 Uh, I had, uh, this was before I had tried, this is a couple of years ago, 1043 00:55:51,494 --> 00:55:57,074 I had tried unsuccessfully to find a decent backup service for Salesforce, 1044 00:55:57,164 --> 00:56:01,694 and so the only thing I could do was like a, you know, an export of that. 1045 00:56:02,419 --> 00:56:03,469 Um, table. 1046 00:56:03,469 --> 00:56:05,929 It was the, the, um, the leads table. 1047 00:56:06,289 --> 00:56:13,699 And so luckily I had, I had saved the download that I had made before I mucked 1048 00:56:13,699 --> 00:56:16,219 it all up and then I was able to fix it. 1049 00:56:16,224 --> 00:56:19,219 But that's the kind of thing, like you said, it doesn't take a ransomware case. 1050 00:56:19,369 --> 00:56:22,009 It could just be a, we'll call it a Curtis. 1051 00:56:22,339 --> 00:56:23,089 Um, 1052 00:56:24,800 --> 00:56:27,440 Zach Fuller: Well, we, we were talking about humans being the, 1053 00:56:27,440 --> 00:56:29,210 the, the weakest link, right? 1054 00:56:29,210 --> 00:56:30,770 It's, it's, it's all of us. 1055 00:56:30,770 --> 00:56:36,665 You know, it's, it's not, um, it, it's not just, Uh, it's not just people that 1056 00:56:36,665 --> 00:56:41,915 ha that are, you know, not technically inclined or, or, or anything like that. 1057 00:56:41,945 --> 00:56:43,865 It, it's anybody and everybody. 1058 00:56:43,870 --> 00:56:48,275 I mean, we, there's lots of cybersecurity professionals still fall for scams 1059 00:56:48,280 --> 00:56:49,685 and different things out there. 1060 00:56:49,925 --> 00:56:54,425 I mean, they've, you know, given out data on forums and things like that 1061 00:56:54,425 --> 00:56:57,995 on the dark web, you know, it's, it's just, it's crazy what goes on. 1062 00:56:57,995 --> 00:56:59,585 But yeah, you're not alone there. 1063 00:56:59,765 --> 00:57:00,005 Prasanna Malaiyandi: Yeah. 1064 00:57:00,185 --> 00:57:02,915 Or in the case of cur Curtis, instead of calling it the Curtis, maybe we'll 1065 00:57:02,915 --> 00:57:04,875 call it the overconfident person. 1066 00:57:08,599 --> 00:57:11,809 W. Curtis Preston: you know, it's funny, uh, it's funny, earlier when, when, when 1067 00:57:11,809 --> 00:57:16,729 Zach was talking about, um, you know, it's, it's the well-meaning person, 1068 00:57:17,179 --> 00:57:19,819 uh, that just makes a, a, a mistake. 1069 00:57:19,969 --> 00:57:22,789 I was gonna float the idea of calling that a persona. 1070 00:57:23,059 --> 00:57:27,079 And see, seeing if we can, you know how like, like nowadays we, we have the term 1071 00:57:27,079 --> 00:57:29,179 Karen, and that means a specific thing. 1072 00:57:29,659 --> 00:57:33,979 If we could, I just, it would be really cool if, like, the well-meaning person 1073 00:57:33,979 --> 00:57:37,159 that manages to screw up everything, if we could just call out a persona. 1074 00:57:37,415 --> 00:57:38,555 Zach Fuller: we'll call him Steve. 1075 00:57:39,215 --> 00:57:40,145 Call him Steve. 1076 00:57:40,925 --> 00:57:44,795 Is that a Sorry for their, if there's any, Steve's listening. 1077 00:57:45,199 --> 00:57:47,329 W. Curtis Preston: Yeah, there, there's one or two. 1078 00:57:47,359 --> 00:57:48,499 I know for a fact. 1079 00:57:48,949 --> 00:57:52,339 Um, well, Zach, it's been, it's been great having you on. 1080 00:57:52,429 --> 00:57:57,469 Um, and, um, I wanted to, uh, uh, you know, thanks for the insight 1081 00:57:58,205 --> 00:57:59,135 Zach Fuller: hey, my pleasure. 1082 00:57:59,135 --> 00:58:02,075 Great, great chatting with you both and, um, yeah, looking forward 1083 00:58:02,075 --> 00:58:03,695 to doing this again sometime. 1084 00:58:03,859 --> 00:58:05,959 W. Curtis Preston: and persona, uh, great as always. 1085 00:58:06,560 --> 00:58:09,320 Prasanna Malaiyandi: Thank you Curtis and Zach, it was nice to meet you by the way. 1086 00:58:09,350 --> 00:58:13,880 Uh, if people wanted to sort of get more insights into, or figure 1087 00:58:13,880 --> 00:58:16,280 out what they should do around cybersecurity, how do they get in 1088 00:58:16,280 --> 00:58:17,990 touch with you and your company? 1089 00:58:19,145 --> 00:58:20,645 Zach Fuller: Yeah, they can, they can check out. 1090 00:58:20,645 --> 00:58:24,155 Silent sector.com is our website. 1091 00:58:24,155 --> 00:58:28,145 And then we have our book, cyber Rans available on Amazon 1092 00:58:28,385 --> 00:58:30,425 and the Cyber Rans podcast. 1093 00:58:30,425 --> 00:58:34,805 Um, information across all those, uh, places and, um, you know, 1094 00:58:34,805 --> 00:58:38,315 feel free to reach out anytime and uh, on LinkedIn as well. 1095 00:58:39,379 --> 00:58:41,389 W. Curtis Preston: I'll put a link to, I'll put a link to my 1096 00:58:41,394 --> 00:58:44,899 episode in the, uh, cuz I know I was a guest there at one point. 1097 00:58:44,899 --> 00:58:49,129 I'll put a link to my episode in our, in our show notes cuz, cuz our 1098 00:58:49,134 --> 00:58:51,259 people, they just want to hear me talk. 1099 00:58:56,029 --> 00:58:56,389 All right. 1100 00:58:56,389 --> 00:58:59,929 Well, you know, speaking of people that just want to hear me talk, uh, 1101 00:58:59,929 --> 00:59:01,849 I want to thank you to our listeners. 1102 00:59:01,909 --> 00:59:05,449 Uh, you are why we do this, and remember to subscribe so 1103 00:59:05,449 --> 00:59:07,407 that you can restore it all.