Speaker:
00:00:19
I'm very rarely shocked when we record these episodes.
Speaker:
00:00:23
But it happened in this episode.
Speaker:
00:00:25
Uh, I ask a really important question of our guests who is a storage and
Speaker:
00:00:30
backup and recovery security expert.
Speaker:
00:00:33
Uh, and I was shocked by his answer.
Speaker:
00:00:36
If you care at all about the security of your backup and recovery
Speaker:
00:00:40
system, this is the episode for you.
Speaker:
00:00:42
I hope you enjoy it.
W. Curtis Preston:
00:00:44
Hi, and welcome to Backup Central's Restore it All podcast.
W. Curtis Preston:
00:00:47
I'm your host, W Curtis Preston, aka Mr.
W. Curtis Preston:
00:00:50
Backup, and have with me a guy that I'm not sure fully filled me in.
W. Curtis Preston:
00:00:55
On everything that I was in for when I bought my Tesla Prasanna
W. Curtis Preston:
00:01:01
Malaiyandi how's it going?
W. Curtis Preston:
00:01:03
Prasanna?
Prasanna Malaiyandi:
00:01:04
Oh no.
Prasanna Malaiyandi:
00:01:04
What did I do this time?
W. Curtis Preston:
00:01:06
I don't know.
W. Curtis Preston:
00:01:07
As you know, I've been incredibly happy with my new car.
W. Curtis Preston:
00:01:10
Um, I, I, I've, I've put a thousand miles on it already.
W. Curtis Preston:
00:01:16
Um, Which is more than you probably put in your entire first year.
W. Curtis Preston:
00:01:20
But the, um, I think the, my one disappointment, and it is, it
W. Curtis Preston:
00:01:26
truly is a disappointment, is that Tesla doesn't have tech support.
W. Curtis Preston:
00:01:32
Right.
W. Curtis Preston:
00:01:32
Given that it's essentially like, you know, that they've sold me this really
W. Curtis Preston:
00:01:36
expensive computer on wheels and it has all these interfaces and there's
W. Curtis Preston:
00:01:43
all this conflicting information about.
W. Curtis Preston:
00:01:46
Things about the car based on when you bought it, which you
W. Curtis Preston:
00:01:51
know, which model you have.
W. Curtis Preston:
00:01:52
So I have the L F P battery, which is the newer battery, which, which apparently
W. Curtis Preston:
00:01:58
according to the manual, as opposed to be charged to a hundred percent.
W. Curtis Preston:
00:02:02
Um, and you know, I just have questions that I would like to
W. Curtis Preston:
00:02:07
hear answers directly from Tesla.
W. Curtis Preston:
00:02:11
There's no phone number or email address for me to contact
Prasanna Malaiyandi:
00:02:15
so have you gone into the app and gone to,
Prasanna Malaiyandi:
00:02:17
have you gone into the app, gone to support and said other issue?
W. Curtis Preston:
00:02:22
other that, because the only thing I've seen
W. Curtis Preston:
00:02:24
is, is schedule service call
Prasanna Malaiyandi:
00:02:27
Yeah.
Prasanna Malaiyandi:
00:02:28
Uh, yeah.
Prasanna Malaiyandi:
00:02:28
So if you do schedule service, I think you can also do other, and
Prasanna Malaiyandi:
00:02:34
then just enter your, your questions.
W. Curtis Preston:
00:02:38
So you're saying my greatest disappointment doesn't exist.
W. Curtis Preston:
00:02:41
Is that what you're telling me?
Prasanna Malaiyandi:
00:02:43
I,
W. Curtis Preston:
00:02:43
You're looking at the, you're looking at the
W. Curtis Preston:
00:02:44
app right now, aren't you?
Prasanna Malaiyandi:
00:02:46
I am looking at the app right now.
Prasanna Malaiyandi:
00:02:47
Yes, I am.
Prasanna Malaiyandi:
00:02:48
Um, I think it could work.
Prasanna Malaiyandi:
00:02:50
I, so I've never done this.
W. Curtis Preston:
00:02:53
Yeah.
W. Curtis Preston:
00:02:54
I mean, if I could just, if I could, yeah, if I could just have an email chat.
W. Curtis Preston:
00:02:57
Cuz a lot of 'em are just like, you know, You know, questions, right?
W. Curtis Preston:
00:03:02
Like, I'm, I'm like, I can't find this thing, right?
W. Curtis Preston:
00:03:05
I'm looking for the thing and I can't find the thing because there's
W. Curtis Preston:
00:03:08
37 menus and, um, you know, I need
Prasanna Malaiyandi:
00:03:12
You know there's a search now, right?
Prasanna Malaiyandi:
00:03:13
Yes.
W. Curtis Preston:
00:03:14
I, I know there's a search, but it doesn't
W. Curtis Preston:
00:03:16
always find, there's a search.
Prasanna Malaiyandi:
00:03:19
First world problems.
Prasanna Malaiyandi:
00:03:20
Curtis First World
W. Curtis Preston:
00:03:21
never ending, the, the, the never ending search for
W. Curtis Preston:
00:03:25
looking for what I'm trying to find.
W. Curtis Preston:
00:03:27
Um, yeah, I did find the most important app though.
W. Curtis Preston:
00:03:32
You know, I, we've discussed this already, the, the admission
W. Curtis Preston:
00:03:36
testing app, otherwise known
Prasanna Malaiyandi:
Speaker:
00:03:39
Otherwise known as Spart
W. Curtis Preston:
00:03:40
fart noise.
Prasanna Malaiyandi:
00:03:44
Oh,
W. Curtis Preston:
00:03:45
could, you could literally, you, you,
W. Curtis Preston:
00:03:46
you can configure it so that.
W. Curtis Preston:
00:03:48
Whenever you push a button on the steering wheel, it makes a random fart noise,
W. Curtis Preston:
00:03:51
uh, to other passengers in the car.
W. Curtis Preston:
00:03:54
By the way, my wife not a big fan, not a big fan of the fart
Prasanna Malaiyandi:
00:04:00
Curtis, are you like a little kid in a candy store?
W. Curtis Preston:
00:04:02
I am inside, inside, every grown man is a five-year-old boy,
W. Curtis Preston:
00:04:07
just, just begging to get out and, uh, I'm a five year old boy with a $40,000 car.
W. Curtis Preston:
00:04:13
That wants to, that wants to try every little part, right?
W. Curtis Preston:
00:04:16
The only difference between men and boys is the price of their toys, right?
W. Curtis Preston:
00:04:21
uh, yeah.
W. Curtis Preston:
00:04:22
So tomorrow it'll be, it'll be a week, uh, that I've had my, my lovely
W. Curtis Preston:
00:04:27
new car and, uh, yes, I've put a
Prasanna Malaiyandi:
Speaker:
00:04:30
And, and oh, we should.
Prasanna Malaiyandi:
Speaker:
00:04:32
We should, yeah.
Prasanna Malaiyandi:
Speaker:
00:04:33
We should also tell the listeners also about your, uh, experience
Prasanna Malaiyandi:
Speaker:
00:04:37
going through a car wash.
W. Curtis Preston:
00:04:43
I went to a car wash and you know, it's one of
W. Curtis Preston:
00:04:46
these things, things that you take for granted when you drive, uh, you
W. Curtis Preston:
00:04:50
know, what I now call an ice car?
W. Curtis Preston:
00:04:51
That's a internal combustion engine.
W. Curtis Preston:
00:04:54
A gas car is, you know, you just, it's super easy to put into neutral and,
W. Curtis Preston:
00:04:58
and, and Tesla's super easy to put into neutral if you know how to do it.
W. Curtis Preston:
00:05:03
And, uh, so I'm sitting there and I had rolled up to the, to the thing
W. Curtis Preston:
00:05:07
where the, you know, where the.
W. Curtis Preston:
00:05:08
The, the, I don't know, the conveyor belt's gonna grab my car.
W. Curtis Preston:
00:05:12
And then the guy's like, you know, he's pointing to the thing up there
W. Curtis Preston:
00:05:15
that says, you know, put it in neutral.
W. Curtis Preston:
00:05:17
And I'm like, oh yeah, I'm supposed to put it in neutral.
W. Curtis Preston:
00:05:20
I shut down the whole thing.
W. Curtis Preston:
00:05:21
I shut down the whole car wash because I had no idea how
W. Curtis Preston:
00:05:25
to put my car into neutral.
W. Curtis Preston:
00:05:26
And then I thought I had it into neutral.
W. Curtis Preston:
00:05:28
They turned it on again.
W. Curtis Preston:
00:05:29
Nope, shut it down again.
W. Curtis Preston:
00:05:31
Um, the, the only, the only nice thing I can say is thank
W. Curtis Preston:
00:05:35
God my wife was not in the car.
W. Curtis Preston:
00:05:36
She would've just been flipping out.
W. Curtis Preston:
00:05:38
Uh, but yeah, I, I did, luckily the manager was like, you know, rolled
W. Curtis Preston:
00:05:43
down the window and he's like, um, go to the menu and it's car wash mode.
W. Curtis Preston:
00:05:47
I'm like, sweet.
W. Curtis Preston:
00:05:49
Um,
Prasanna Malaiyandi:
00:05:50
not the first time that this has happened at that
W. Curtis Preston:
00:05:53
I am not the, I'm not the first idiot with a brand new
W. Curtis Preston:
00:05:55
Tesla to take it into a car wash and not know how to put it in neutral.
W. Curtis Preston:
00:06:00
Anyway, uh, so enough test Tesla talk for the day, gonna bring on our guest.
W. Curtis Preston:
00:06:06
He's been specializing in it, uh, for over 30 years and specializes
W. Curtis Preston:
00:06:10
in storage and backup and security as well as it architecture.
W. Curtis Preston:
00:06:14
He's now the CTO at Continuity Software.
W. Curtis Preston:
00:06:17
The industry's only cybersecurity solution for enterprise storage and backup systems.
W. Curtis Preston:
00:06:22
Welcome to the pod, Doran Pinhas.
Doron Pinhas:
00:06:27
Hi.
Doron Pinhas:
00:06:27
Good to be here.
W. Curtis Preston:
00:06:29
So you're, you're currently in Israel, right?
W. Curtis Preston:
00:06:31
Doran?
Doron Pinhas:
00:06:35
Yep, that's true.
W. Curtis Preston:
00:06:36
What, what, what, what?
W. Curtis Preston:
00:06:38
It's, it's still sunny.
W. Curtis Preston:
00:06:40
What, uh, what part are you in?
Doron Pinhas:
00:06:42
it's 7:00 PM over here.
Doron Pinhas:
00:06:44
Uh, just, you know, it's a very, very small country.
Doron Pinhas:
00:06:47
It's the, the size of New Jersey maybe.
Doron Pinhas:
00:06:49
So, uh, anywhere you put your finger, it's where I am.
Doron Pinhas:
00:06:52
So
W. Curtis Preston:
00:06:53
yeah.
Doron Pinhas:
00:06:53
in the area of Tel Aviv.
Doron Pinhas:
00:06:55
Yes.
Doron Pinhas:
00:06:55
So give or take, which is in the middle of the country.
W. Curtis Preston:
00:06:57
I've been to, I've been to Tel Aviv,
W. Curtis Preston:
00:06:59
uh, Jerusalem, and, uh, a lot.
W. Curtis Preston:
00:07:03
I went and did scuba diving there, uh, which was very, very nice.
W. Curtis Preston:
00:07:08
Um, scuba diving in the
Doron Pinhas:
00:07:10
a good start for a first visit.
W. Curtis Preston:
00:07:12
Yeah, absolutely, absolutely.
W. Curtis Preston:
00:07:14
I wanna do our usual disclaimer, uh, Prasanna and I work for different
W. Curtis Preston:
00:07:18
companies, and this is an independent podcast and is the opinions that you
W. Curtis Preston:
00:07:23
hear are ours and don't necessarily reflect the opinions of our employers.
W. Curtis Preston:
00:07:27
Also, if you, uh, like the show, please rate us, go to your favorite pod catcher
W. Curtis Preston:
00:07:32
and give us all the stars and comments.
W. Curtis Preston:
00:07:33
We'd love to hear comments from you, and also if you'd like to
W. Curtis Preston:
00:07:36
join the conversation or just send us, you know, Kudos or whatever.
W. Curtis Preston:
00:07:41
Uh, you can reach me at w Curtis Preston gmail or uh, uh, WC Preston on Twitter
W. Curtis Preston:
00:07:48
or linkedin.com/in/mr backup Um, so, you know, when I, when I saw your, you know,
W. Curtis Preston:
00:07:57
I went to the Continuity's website and the first thing that popped up, Was this, uh,
W. Curtis Preston:
00:08:03
paper that you've done recently, which it looks like you've been doing for a couple
W. Curtis Preston:
00:08:08
of years on, uh, that that basically is a study of, uh, what, why don't,
W. Curtis Preston:
00:08:14
why don't you tell, tell us about it?
W. Curtis Preston:
00:08:15
That this paper,
Doron Pinhas:
00:08:17
Oh, you mean the storage and backup?
Doron Pinhas:
00:08:19
Um, you know, state of the industry
W. Curtis Preston:
00:08:22
yes.
W. Curtis Preston:
00:08:22
Yes.
Doron Pinhas:
00:08:23
That's the one.
Doron Pinhas:
00:08:24
Yeah.
Doron Pinhas:
00:08:24
Okay.
Doron Pinhas:
00:08:25
So it's the tradition.
Doron Pinhas:
00:08:26
We started several years back.
Doron Pinhas:
00:08:28
Uh, we were fortunate enough to meet, you know, we are in the IT business as a
Doron Pinhas:
00:08:33
whole and, and generate, uh, management tools for, uh, large enterprises.
Doron Pinhas:
00:08:39
We can talk about that later if there's any interest.
Doron Pinhas:
00:08:41
Uh, and we were fortunate enough to get about with some of the
Doron Pinhas:
00:08:45
world's largest enterprises, and we started talking years back about
Doron Pinhas:
00:08:48
securing storage and backup systems.
Doron Pinhas:
00:08:51
Lo and behold, and uh, it's dawned on us eventually that there is
Doron Pinhas:
00:08:54
no standard research that tests the maturity level of the market.
Doron Pinhas:
00:08:59
As it were, so several years back we started, uh, running surveys.
Doron Pinhas:
00:09:03
We have a technology that then collect that can collect configuration,
Doron Pinhas:
00:09:07
data, off storage and backup devices, appliances, media servers and stuff like
W. Curtis Preston:
00:09:13
Mm.
Doron Pinhas:
00:09:14
and then review the configuration to see
Doron Pinhas:
00:09:16
if it's done well or not.
Doron Pinhas:
00:09:18
That's pretty easy.
Doron Pinhas:
00:09:19
So we collected data from, uh, everyone we talked with and many of
Doron Pinhas:
00:09:23
those organizations were gracious enough to allow us to anonymize
Doron Pinhas:
00:09:25
the data and generate reports.
Doron Pinhas:
00:09:28
So to cut a long story short, um, this year we scanned the around 10,000 storage
Doron Pinhas:
00:09:35
devices in around 250 large enterprises.
Doron Pinhas:
00:09:39
Most of them are relatively large.
Doron Pinhas:
00:09:41
Organizations with north of 10,000 people.
Doron Pinhas:
00:09:45
Some of them has half a million employees.
Doron Pinhas:
00:09:47
So it's a interesting demographics.
Doron Pinhas:
00:09:49
60% in the United States, almost 40% in the eu, and some in Asia Pacific.
Doron Pinhas:
00:09:56
Um, and we did find that, uh, the majority of environments.
Doron Pinhas:
00:10:02
Did have grave misconfigurations that relate to storage and backup systems,
W. Curtis Preston:
00:10:08
Shocked
Doron Pinhas:
00:10:09
means that, you know, we're not shocked, but now we have
Doron Pinhas:
00:10:12
the proof, the writing is on the wall.
Doron Pinhas:
00:10:14
We can't ignore it anymore.
Doron Pinhas:
00:10:15
We knew in this secret of our heart that things might go wrong, but
Doron Pinhas:
00:10:19
now we know they are not great.
Doron Pinhas:
00:10:22
And, you know, stored and backup means are awesome at so many things.
Doron Pinhas:
00:10:26
They know how to increase capacity and deal with ever shrinking backup
Doron Pinhas:
00:10:30
windows and you know, ingest new technologies and move from on-prem to
Doron Pinhas:
00:10:35
cloud storage and all that fun stuff.
Doron Pinhas:
00:10:37
But there are not necessarily security experts.
Doron Pinhas:
00:10:40
And it is important to become more knowledgeable about security
Doron Pinhas:
00:10:45
because the outcomes of two lacks security in restorative
Doron Pinhas:
00:10:49
backup system can be devastating.
Doron Pinhas:
00:10:52
You know, that's something I'd love to be able to talk about and then
Doron Pinhas:
00:10:54
maybe, uh, we can have some practical advice around how can you do better?
Doron Pinhas:
00:11:00
You know, once people get convinced, it is important.
Prasanna Malaiyandi:
00:11:03
Yeah, so just a quick question.
Prasanna Malaiyandi:
00:11:06
Um, When you were, uh, looking at these backup and storage systems,
Prasanna Malaiyandi:
00:11:11
what sort of things were you looking for when you're evaluating
Prasanna Malaiyandi:
00:11:14
figure out were they secure or not?
Doron Pinhas:
00:11:18
So there, there are several dimensions to establishing
Doron Pinhas:
00:11:22
where whether, uh, uh, storage and backup infrastructure are secure.
Doron Pinhas:
00:11:25
So all the way from the very mundane, for example, are those,
Doron Pinhas:
00:11:30
uh, pieces of equipment and software laying around patched.
Doron Pinhas:
00:11:34
So surprisingly enough, uh, you know when people look at backup software
Doron Pinhas:
00:11:39
like Veeam and Veritas and you know, forgive me for all the rest and
Doron Pinhas:
00:11:42
Rubrik and others, these are piece of commercial software vendors will discover
Doron Pinhas:
00:11:46
security vulnerabilities, whether the code they have created or third party
Doron Pinhas:
00:11:50
libraries they use, everyone does that.
Doron Pinhas:
00:11:53
And they will write security bullet, public security
Doron Pinhas:
00:11:55
bulletins and issue patches.
Doron Pinhas:
00:11:57
So the question is, do you update your software?
Doron Pinhas:
00:11:59
Now when it comes to the software bit, That's a little easier because
Doron Pinhas:
00:12:03
the traditional vulnerability management engine you might
Doron Pinhas:
00:12:06
already have on on, on the floor.
Doron Pinhas:
00:12:09
We'll probably catch that.
Doron Pinhas:
00:12:11
Uh, but when you look at the stored and backup ecosystems, there are
Doron Pinhas:
00:12:14
all sorts of bizarre components there that are never scanned, right?
Doron Pinhas:
00:12:17
So we have, if you have a large shop, you have a sun fabric, and you have N
Doron Pinhas:
00:12:21
dmp and you have NetApp, and you have, uh, whatever storage, OSS and various
Doron Pinhas:
00:12:26
mix, no, HP and LMC and ibm, and.
Doron Pinhas:
00:12:29
Pure.
Doron Pinhas:
00:12:31
Um, these devices are never scanned by vulnerability managed engines.
Doron Pinhas:
00:12:35
And so, but it's pretty easy to determine if they are exposed or not.
Doron Pinhas:
00:12:39
So one of the trivial bits we've done is just retrieve the configuration baseline
Doron Pinhas:
00:12:44
of all the devices we have scanned.
Doron Pinhas:
00:12:46
Where there is are backup appliances and archiving appliances.
Doron Pinhas:
00:12:50
And shockingly you'll find that, uh, patches have been out there
Doron Pinhas:
00:12:54
for things like log four j.
Doron Pinhas:
00:12:56
That can impact the storage arrays.
Doron Pinhas:
00:12:58
Definitely can.
Doron Pinhas:
00:12:59
So, uh, but they haven't been patched.
Doron Pinhas:
00:13:02
And when you talk to professionals, say, oh, I didn't
Doron Pinhas:
00:13:04
know that I have that exposure.
Doron Pinhas:
00:13:06
I've run my scan with one of the big names, whatever, tenable Ines and Rapid
Doron Pinhas:
00:13:11
Seven and others, and they're all great companies, but they just don't scan.
Doron Pinhas:
00:13:14
The storage ecosystem to that level of detail, and people have
Doron Pinhas:
00:13:18
a blind spot and it's, it's bad.
Doron Pinhas:
00:13:20
So one thing is, that's mundane, right?
Doron Pinhas:
00:13:22
So, and, and around that category, I can count several other aspects.
Doron Pinhas:
00:13:26
Like, you know, you want to have your software patch, you want to have some
Doron Pinhas:
00:13:30
of the ridiculous stuff cleaned up.
Doron Pinhas:
00:13:32
Like, you know, you, you buy a backup appliance, it has a default
Doron Pinhas:
00:13:35
factory account like Root, root.
Doron Pinhas:
00:13:37
Did you close that account?
Doron Pinhas:
00:13:39
Oops.
Doron Pinhas:
00:13:40
So many organizations fail to do those.
Doron Pinhas:
00:13:42
Very simple, you know, it's not just the root root account.
Doron Pinhas:
00:13:45
There are service accounts.
Doron Pinhas:
00:13:47
There are default called home configurations that by and large, Are
Doron Pinhas:
00:13:52
not restricted to specific IP addresses.
Doron Pinhas:
00:13:54
And if I'm a hacker, I can spoof those.
Doron Pinhas:
00:13:57
So there are basic things you can do when you get a device, whether
Doron Pinhas:
00:13:59
that's a medial library or whatever, an archiving appliances or set up
Doron Pinhas:
00:14:04
a softer element that you can do to do the basics of hardening them.
Doron Pinhas:
00:14:10
So, so this is one area.
Doron Pinhas:
00:14:12
Another relates to a little bit more convoluted best practices.
Doron Pinhas:
00:14:16
You know, vendors will publish best practices for security, but by and
Doron Pinhas:
00:14:19
large it gurus tends to ignore them.
Doron Pinhas:
00:14:22
We want to go to the meet, how can we set up our first job?
Doron Pinhas:
00:14:26
But there are things, uh, that should be done.
Doron Pinhas:
00:14:30
Again, some of them are pretty mundane, right?
Doron Pinhas:
00:14:32
I'll give you just one example and you tell me if I'm going to, uh,
Prasanna Malaiyandi:
00:14:35
No,
Doron Pinhas:
00:14:36
uh, technical too quickly.
Doron Pinhas:
00:14:37
But, um, you know, time.
Doron Pinhas:
00:14:41
We all know about time it passes, right?
Doron Pinhas:
00:14:45
So, but when you set up a storage or a backup appliance, you
Doron Pinhas:
00:14:49
need to set up so it up with an authoritative time server, right?
Doron Pinhas:
00:14:53
Um, if I'm a hacker and I, uh, realize that it didn't harden the time
Doron Pinhas:
00:14:58
settings, I can spoof the time server and then I can issue all sorts of
Doron Pinhas:
00:15:03
attacks, like time's up attacks where, you know, I persuade your archiving
Doron Pinhas:
00:15:06
appliance that 12 years have passed.
Doron Pinhas:
00:15:09
Just in the span of a minute.
Doron Pinhas:
00:15:11
Of course, you can defeat that by setting up an authorized time server and using
Doron Pinhas:
00:15:17
authentication and stuff like that, but it's not set up out of the box.
Doron Pinhas:
00:15:21
Now if I'm not setting up my time correctly.
Doron Pinhas:
00:15:23
Of course, encryption keys can go stale and elapse, you know,
Doron Pinhas:
00:15:26
really bad stuff can happen.
Doron Pinhas:
00:15:28
So this is a trivial thing.
Doron Pinhas:
00:15:30
If you look at, uh, at reality from the security wearing the security hat or
Doron Pinhas:
00:15:34
security glasses, you'll realize that you have to harden some basic, uh, components
Doron Pinhas:
00:15:39
like time services and dns, and you have to close default accounts and set
Doron Pinhas:
00:15:43
up centrally managed authentication.
Doron Pinhas:
00:15:46
All of these are best practices.
Doron Pinhas:
00:15:47
Vendors will publish.
Doron Pinhas:
00:15:49
They will also tell you that, Hey, we are shipping this box
Doron Pinhas:
00:15:52
out of the gate with some initial security configurations like we.
Doron Pinhas:
00:15:57
Do allow you to decide if you want to configure SIFs one, two, whatever.
Doron Pinhas:
00:16:02
Uh, which Cipher Suites do you want to support?
Doron Pinhas:
00:16:05
Do you support in Fs version three and four and above?
Doron Pinhas:
00:16:09
Do you want to limit some of those?
Doron Pinhas:
00:16:10
So it's your job to decide, you know, we are selling you a Tesla.
Doron Pinhas:
00:16:14
You need to drive it out of the factory and you need to
Doron Pinhas:
00:16:16
do it as safely as you can.
Doron Pinhas:
00:16:18
You can of course drive it's hard, but you can try, you can
Doron Pinhas:
00:16:21
still force it into a tree.
Doron Pinhas:
00:16:23
So, The vendors will tell you, you may want to consider to
Doron Pinhas:
00:16:26
close some of the protocols.
Doron Pinhas:
00:16:28
If you're not using nfs, close it please.
Doron Pinhas:
00:16:30
If you're using nfs, maybe you want to disable NFS version three.
Doron Pinhas:
00:16:33
So we want to review some of those settings and follow
Doron Pinhas:
00:16:36
the vendor best practices.
Doron Pinhas:
00:16:38
So we start to see a picture emerging.
Doron Pinhas:
00:16:41
So we check for the basic vulnerabilities and the locking down of default
Doron Pinhas:
00:16:46
accounts, and then we go ahead and read the various vendor recommendations and
Doron Pinhas:
00:16:50
make them into a structured library of.
Doron Pinhas:
00:16:53
Things you should be looking into, and we just have a platform
Doron Pinhas:
00:16:56
that can automate those checks.
Doron Pinhas:
00:16:58
Now there, there are some other components to that.
Doron Pinhas:
00:17:00
For example, there are several standards that are today not legally binding,
Doron Pinhas:
00:17:05
but there are standards out there to regulate how stuff can be secured, right?
Doron Pinhas:
00:17:10
So we have the NIST framework.
Doron Pinhas:
00:17:12
We have the ISO framework.
Doron Pinhas:
00:17:14
Within NIST and iso.
Doron Pinhas:
00:17:15
There are families of, uh, uh, documents that regulate various aspects of security,
Doron Pinhas:
00:17:20
but specifically in recent years, there is more guidance for storage.
Doron Pinhas:
00:17:23
Right?
Doron Pinhas:
00:17:24
NIST has published, uh, the special publication 802 0 9, which
Doron Pinhas:
00:17:29
talks about storage and backup systems, security guidelines.
Doron Pinhas:
00:17:32
Right.
Doron Pinhas:
00:17:33
Just.
Doron Pinhas:
00:17:34
Spell it out differently, but you know, uh, and we were fortunate enough
Doron Pinhas:
00:17:38
to take part in shaping, uh, this particular piece ISO are publishing.
Doron Pinhas:
00:17:43
Um, there is a, a document called, uh, ISO 27 0 40, which, uh, outlines,
Doron Pinhas:
00:17:50
uh, guidelines for storage security.
Doron Pinhas:
00:17:52
So the current version is dated 2015.
Doron Pinhas:
00:17:56
Uh, it was great at the time.
Doron Pinhas:
00:17:58
It's not great anymore, but they are working on a new release.
Doron Pinhas:
00:18:00
Which is going to come out any week now, and we are fortunate enough
Doron Pinhas:
00:18:04
to see some of the drafts and even comment and it's awesome, right?
Doron Pinhas:
00:18:07
So we have guidance around what could serve as a framework for having better
Doron Pinhas:
00:18:13
security for storage and backup.
Doron Pinhas:
00:18:15
Um, so the last, maybe that's the last source.
Doron Pinhas:
00:18:18
We also, uh, review all of those guidelines and then we pick the
Doron Pinhas:
00:18:22
ones that are relevant to the average user and turn them into a
Doron Pinhas:
00:18:26
comprehensive automated checklist.
Doron Pinhas:
00:18:28
If you're curious, we have about whatever, three to 4,000 automated checks.
Doron Pinhas:
00:18:34
So when
Prasanna Malaiyandi:
00:18:34
gonna say, yeah.
Doron Pinhas:
00:18:35
go, go ahead and collect the configuration, you
Doron Pinhas:
00:18:38
know, we just need read only access.
Doron Pinhas:
00:18:40
That's how we work with, uh, the organizations.
Doron Pinhas:
00:18:42
We advise.
Doron Pinhas:
00:18:44
We ask them to let us, uh, have a readonly role.
Doron Pinhas:
00:18:47
We collect the data, we keep it in, it doesn't have to leave.
Doron Pinhas:
00:18:50
We run our tool and it's just create a dashboard and score cards saying This is
Doron Pinhas:
00:18:55
what you're doing well and here is where you, uh, can improve or might have failed.
Doron Pinhas:
00:19:00
And now, uh, uh, uh, many of those organizations are really gracious
Doron Pinhas:
00:19:03
allowing us to take the stats out.
Doron Pinhas:
00:19:06
So that's how we came across with a sample of around 10,000 components and component
Doron Pinhas:
00:19:12
could be a media server, archiving device, master server storage appliance.
Doron Pinhas:
00:19:18
And when, when you talk about backup, of course everyone realizes today
Doron Pinhas:
00:19:21
that the, when you want to recover something, you have multiple.
Doron Pinhas:
00:19:25
Layers of defense.
Doron Pinhas:
00:19:26
So the, the quickest recovery can be done from live on disk storage,
Doron Pinhas:
00:19:32
whether that's snapshots or replicas.
Doron Pinhas:
00:19:35
Uh uh, and then you have a progressing line now where you know the list quick
Doron Pinhas:
00:19:41
recoveries from offsite and you know, offline, maybe even offline tapes.
Doron Pinhas:
00:19:45
So we have a progression of, uh, mediums and when we want to protect backup, we
Doron Pinhas:
00:19:49
have to look at all those two components.
Doron Pinhas:
00:19:51
So we want to protect our.
Doron Pinhas:
00:19:53
A master server or media servers or archiving appliances, our online
Doron Pinhas:
00:19:57
storage, the snapshots, the replica engines, all of these have to be hardened
Doron Pinhas:
00:20:01
and there is a bit more than that.
Doron Pinhas:
00:20:02
Uh, so, uh,
Prasanna Malaiyandi:
Speaker:
00:20:05
that's very comprehensive.
Doron Pinhas:
00:20:07
Yeah.
Doron Pinhas:
00:20:07
Yeah.
Doron Pinhas:
00:20:07
So to, this was a very long-winded way of saying, yeah.
Doron Pinhas:
00:20:11
So these, these are some of the areas we gather together
Doron Pinhas:
00:20:14
to compile that list of checks.
Doron Pinhas:
00:20:15
And that's how we can come about with a.
Doron Pinhas:
00:20:18
Pretty comprehensive set of, uh, scores and in the report we, we try to make
Doron Pinhas:
00:20:24
it easy and friendly to the user.
Doron Pinhas:
00:20:26
We divided the findings into the top.
Doron Pinhas:
00:20:28
Five categories that were common in almost all environments.
Doron Pinhas:
00:20:33
We also, uh, dedicated the section to some of the less frequent issues
Doron Pinhas:
00:20:38
that are extremely lethal, as it were.
Doron Pinhas:
00:20:41
So, you know, not many people do that, but if you do, that can be devastating.
Doron Pinhas:
00:20:45
So you might want to watch out.
Doron Pinhas:
00:20:47
And I think what can be really actionable if, if I'm interested to see
Doron Pinhas:
00:20:52
that, just take that list of the top five or top six and ask yourself, I.
Doron Pinhas:
00:20:56
Am I free from those?
Doron Pinhas:
00:20:58
You probably will find that for some of those, even in your own organizations.
Doron Pinhas:
00:21:02
There is something here to take a closer look at, uh,
Doron Pinhas:
00:21:05
which I think can be valuable.
Doron Pinhas:
00:21:07
This is why our way of sharing, um, the generosity of the organization
Doron Pinhas:
00:21:13
work with, in, in, in freely sharing what they do well and what they don't.
Doron Pinhas:
00:21:18
So, you know, everyone can actually, uh, use that as a benchmark.
W. Curtis Preston:
00:21:23
I, I, I really like that Doran.
W. Curtis Preston:
00:21:24
Um, in fact, the, the, the, you know, we're recording this
W. Curtis Preston:
00:21:28
in the middle of June, the.
W. Curtis Preston:
00:21:30
The episode that went live this morning was, uh, an se that was sort
W. Curtis Preston:
00:21:36
of bemoaning the fact that companies don't share, um, security, especially
W. Curtis Preston:
00:21:44
when a security incident happens.
W. Curtis Preston:
00:21:47
They don't share with the rest of the world what happened, why it happened.
W. Curtis Preston:
00:21:51
Basically, you know, information that can help people.
W. Curtis Preston:
00:21:55
And I think in this case, this is really helpful, uh, in that.
W. Curtis Preston:
00:22:00
Uh, there's two things in here.
W. Curtis Preston:
00:22:01
One, one, you know, I, I, you know, early in the said, I sh I said, shocked.
W. Curtis Preston:
00:22:06
Shocked.
W. Curtis Preston:
00:22:06
I am, uh, I, I, you know, I'm not shocked, right?
W. Curtis Preston:
00:22:10
Because of the, the, um, you know, because, you know, I've been in the
W. Curtis Preston:
00:22:14
back space for a while and storage and backup due kind of get the back of the
W. Curtis Preston:
00:22:19
bus status for, for a lot of reasons.
W. Curtis Preston:
00:22:22
They just don't get the, many of the tools aren't looking at that.
W. Curtis Preston:
00:22:25
Many of the people aren't thinking about that.
W. Curtis Preston:
00:22:28
And the, but the reality is storage and backup.
W. Curtis Preston:
00:22:32
That's where it's at.
W. Curtis Preston:
00:22:33
That's where the data is, right?
W. Curtis Preston:
00:22:36
It, it's the, it is the thing that you're protecting.
W. Curtis Preston:
00:22:39
In fact, um, you know, in this episode that went live, um, uh,
W. Curtis Preston:
00:22:44
today we, you know, we were talking about, well, we're not really.
W. Curtis Preston:
00:22:47
I, I don't think of myself as a cybersecurity person.
W. Curtis Preston:
00:22:50
I think of myself as a backup and, and data person.
W. Curtis Preston:
00:22:52
And, and he made the point of saying, well, without data, there's
W. Curtis Preston:
00:22:55
no point in having cybersecurity.
W. Curtis Preston:
00:22:57
Right.
W. Curtis Preston:
00:22:57
Uh, which is, which is, which is really good.
W. Curtis Preston:
00:23:00
Right.
W. Curtis Preston:
00:23:00
Um, I, I am curious, w with this survey that you did, um, or study whatever,
W. Curtis Preston:
00:23:07
whatever you'd like to call it, what.
W. Curtis Preston:
00:23:10
When you went out there, can you speak at all to like the percentage
W. Curtis Preston:
00:23:16
that you would find, like if you, if you were at a hundred companies,
W. Curtis Preston:
00:23:20
how many of them had something that you would consider truly scary?
W. Curtis Preston:
00:23:25
Uh, a misconfiguration that was
Doron Pinhas:
00:23:28
Are you sitting tightly?
W. Curtis Preston:
00:23:31
Uh, I'm sitting tightly.
Doron Pinhas:
00:23:33
Yeah.
Doron Pinhas:
00:23:33
Well, you know, pretty much all of them.
W. Curtis Preston:
00:23:36
I knew you were
Doron Pinhas:
00:23:37
the average, right, so, so the average device on average, A
Doron Pinhas:
00:23:45
device, and again, we define a device as either truly physical device, like a
Doron Pinhas:
00:23:49
sand fabric switch, or a storage array or back backup appliance or archiving
Doron Pinhas:
00:23:54
appliance or stuff like that through a media server, which is a, you know, hosted
Doron Pinhas:
00:23:58
a piece of software and a master server.
Doron Pinhas:
00:24:01
Each one is a device, so the average device will have 14.
Doron Pinhas:
00:24:06
Risks out of which three are critical or major, meaning that if I'm a hacker,
Doron Pinhas:
00:24:10
I, I can get in and take your data out.
Doron Pinhas:
00:24:12
So it's, that's not to say that 100% of the organizations were, uh, in a poor
Doron Pinhas:
00:24:18
situation, you know, maybe two or 3%.
Doron Pinhas:
00:24:21
Did actually better than others, but by and large, I think the state of the
Doron Pinhas:
00:24:29
industry is not great yet to be mild.
Doron Pinhas:
00:24:32
And if you want to be more brutal, it's dismal.
Prasanna Malaiyandi:
00:24:35
Do you feel though that some of this is because storage and
Prasanna Malaiyandi:
00:24:39
backup, it's kind of like a web, right?
Prasanna Malaiyandi:
00:24:41
A very complex tangled web that no one really knows how everything
Prasanna Malaiyandi:
00:24:45
is all connected together, which leads to some of these issues?
Prasanna Malaiyandi:
00:24:49
Or do you think it's some other situation why companies are doing poorly?
Doron Pinhas:
00:24:56
Yeah, I'd love to debug that notion by the way that it's a
Doron Pinhas:
00:24:59
web, which is too complex for the human intellect to grasp, right?
Doron Pinhas:
00:25:02
You didn't say that exactly.
Doron Pinhas:
00:25:04
Like I'm, uh, but, but, uh, no.
Doron Pinhas:
00:25:06
So there, there is a way to put structure on top, you know, roll up
Doron Pinhas:
00:25:10
your sleeves and you can apply a clear methodology to, to be much better.
Doron Pinhas:
00:25:15
It's actually.
Doron Pinhas:
00:25:17
Not very difficult.
Doron Pinhas:
00:25:18
We, you know, if time allows, we can talk a little bit about what
Doron Pinhas:
00:25:20
you can do to be much more secure.
Doron Pinhas:
00:25:23
So, uh, I and I object to making it something really intangible
Doron Pinhas:
00:25:27
that's, you know, incomprehensible.
Doron Pinhas:
00:25:29
It's just a little bit of work.
Doron Pinhas:
00:25:31
We have all the foundation.
Doron Pinhas:
00:25:32
So what, but what are your, to
Prasanna Malaiyandi:
Speaker:
00:25:33
oh, sorry, sorry, sorry.
Prasanna Malaiyandi:
Speaker:
00:25:34
Uh, my question though wasn't necessarily about security guidelines being complex,
Prasanna Malaiyandi:
Speaker:
00:25:39
it was more the infrastructure that are deployed in customers environments
Prasanna Malaiyandi:
Speaker:
00:25:43
such that maybe when you're backing up, you don't know necessarily how all
Prasanna Malaiyandi:
Speaker:
00:25:46
the devices are connected together.
Prasanna Malaiyandi:
Speaker:
00:25:49
Right.
Prasanna Malaiyandi:
Speaker:
00:25:49
Or the different IT groups or things like that.
Doron Pinhas:
00:25:52
Yeah.
Doron Pinhas:
00:25:52
So you, you do have a point.
Doron Pinhas:
00:25:55
And I'll give an example, but it's still no reason not to, uh, you know,
Doron Pinhas:
00:26:02
uh, get a good handle of things, right?
Doron Pinhas:
00:26:04
So it can be complex, right?
Doron Pinhas:
00:26:05
So let's first prove your point, right?
Doron Pinhas:
00:26:08
Um, and I, again, I'm thinking like a hacker, right?
Doron Pinhas:
00:26:11
I want to attack your, uh, favorite backup software.
Doron Pinhas:
00:26:14
Mm.
Doron Pinhas:
00:26:15
And there are many ways I can go about it if it's not patched.
Doron Pinhas:
00:26:19
We mentioned some I can use, uh, default accounts maybe didn't really separate.
Doron Pinhas:
00:26:23
There was a principle of separation of, uh, authorities.
Doron Pinhas:
00:26:26
You don't want to have an admin account that can actually
Doron Pinhas:
00:26:29
manage, uh, the backup server.
Doron Pinhas:
00:26:31
You have to separate those entities into separate planes.
Doron Pinhas:
00:26:35
Some will argue that the, uh, backup admin should be part of active directory.
Doron Pinhas:
00:26:40
There are merits to that line of thought.
Doron Pinhas:
00:26:42
Um, you know, but it has to be strictly separated because the
Doron Pinhas:
00:26:46
first thing a hacker will do once they, they, they first get in.
Doron Pinhas:
00:26:49
Now they do a little bit of a, uh, uh, reconnaissance eventually, you
Doron Pinhas:
00:26:53
should assume they'll get admin level, uh, credentials, domain
Doron Pinhas:
00:26:57
admin level cred that will happen.
Doron Pinhas:
00:27:00
So when they do that, they should not be able to attack the backup software.
Doron Pinhas:
00:27:03
So now we can do that.
Doron Pinhas:
00:27:04
But let's say you did a really good job.
Doron Pinhas:
00:27:06
I'm at a loss now you talked about convoluted uh, dependencies.
Doron Pinhas:
00:27:11
Well, you know, in many cases, probably people have something like VMware.
Doron Pinhas:
00:27:15
VMware has a trust relationship with the backup software because when
Doron Pinhas:
00:27:19
we want to take consistent backups, every piece of software does that.
Doron Pinhas:
00:27:22
We use APIs for the Visser infrastructure to tell us when it's ready.
Doron Pinhas:
00:27:27
To, uh, back up consistently, whatever a vm.
Doron Pinhas:
00:27:31
Or a volume or whatever to do federated consistency.
Doron Pinhas:
00:27:34
Uh, in some cases we want to even delegate the infrastructure, the ability to tell
Doron Pinhas:
00:27:39
the backup software when to start a job, what would be the content of the job.
Doron Pinhas:
00:27:43
So we have some sort of a federated trust relationship Most.
Doron Pinhas:
00:27:47
Organizations we talk with don't really do that, uh, granularly.
Doron Pinhas:
00:27:52
So you, you, you have to think zero trust.
Doron Pinhas:
00:27:53
So they don't do that.
Doron Pinhas:
00:27:54
And if I can attack the vSphere infrastructure, let's say, if that hasn't
Doron Pinhas:
00:27:58
been secure, I can maybe use that to stop the backup jobs to alter the backup jobs.
Doron Pinhas:
00:28:03
So think about it, you're using immutable backup.
Doron Pinhas:
00:28:06
I really want to destroy it because I want to encrypt your files and demand my
Doron Pinhas:
00:28:10
ransom, and I want you to have to pay.
Doron Pinhas:
00:28:12
But you have immutable backups.
Doron Pinhas:
00:28:14
Ah, I can't really delete that.
Doron Pinhas:
00:28:16
Of course, there are ways to actually delete that.
Doron Pinhas:
00:28:18
If you didn't set it up, if you didn't set up immutability correctly, you didn't
Doron Pinhas:
00:28:21
enable retention log and stuff like that.
Doron Pinhas:
00:28:24
And I can maybe tamper with your system, but let's say you've done a good job.
Doron Pinhas:
00:28:28
Um, so I want to actually, my last research, which is very effective,
Doron Pinhas:
00:28:32
is to poison your backups.
Doron Pinhas:
00:28:34
How do I do that?
Doron Pinhas:
00:28:35
I break into vSphere.
Doron Pinhas:
00:28:37
I.
Doron Pinhas:
00:28:38
I find that it has the ability to alter the backup job, so I alter the content.
Doron Pinhas:
00:28:42
I'm starting to back up.
Doron Pinhas:
00:28:44
Instead of actual production VMs, I'm backing up jump my
Doron Pinhas:
00:28:48
temp directory, my swap file.
Doron Pinhas:
00:28:51
I just wanna make sure it's the same amount of data go that goes nightly.
Doron Pinhas:
00:28:55
So, Now I wait for two or three months.
Doron Pinhas:
00:28:59
So the backup jobs continue to run.
Doron Pinhas:
00:29:01
The backup admins, is that the job?
Doron Pinhas:
00:29:03
If you're not alert enough to find that the content has been changed, it's
Doron Pinhas:
00:29:05
successful, and after 90 days or whatever I deem necessary, I lock your files.
Doron Pinhas:
00:29:12
Um, now you go to the backup environment and say, oh, fine,
Doron Pinhas:
00:29:16
I have 90 days full of backup.
Doron Pinhas:
00:29:17
But none of them, it's all crap.
Doron Pinhas:
00:29:19
So the only valid backup you have if youre a bank is 90 days old.
Doron Pinhas:
00:29:22
Imagine you're calling your bank to say, where are my funds?
Doron Pinhas:
00:29:25
And they're saying, Hmm,
Prasanna Malaiyandi:
00:29:26
Sorry.
Doron Pinhas:
00:29:27
do you have a paper receipt?
Doron Pinhas:
00:29:29
Sorry, we don't know.
Doron Pinhas:
00:29:31
Um, so that can be bad, right?
Doron Pinhas:
00:29:34
So I can.
Doron Pinhas:
00:29:34
To your point, they are convoluted.
Doron Pinhas:
00:29:36
Trust, relationship, API gateways and services.
Doron Pinhas:
00:29:40
To name a few examples, we scan an environment and we find, you
Doron Pinhas:
00:29:44
know, you can find the management APIs of management consoles.
Doron Pinhas:
00:29:47
You just scan for the REST API and through IP address and you find,
Doron Pinhas:
00:29:51
you find, they say we have one management console and you find three.
Doron Pinhas:
00:29:54
One of them is, is in the lab.
Doron Pinhas:
00:29:57
Where they used to do testing two years ago, they never shut down that instance.
Doron Pinhas:
00:30:01
And it's not protected.
Doron Pinhas:
00:30:02
And it's, there is no time server, there is no cookie session cookie timeout,
Doron Pinhas:
00:30:07
and it still can control production.
Doron Pinhas:
00:30:09
So we want, so there are, it is convoluted, so I totally agree.
Doron Pinhas:
00:30:14
The only thing I, um, I would suggest is that you can become good at fi thinking
Doron Pinhas:
00:30:20
like a criminal, uh, or expecting what a, don't think like a criminal, but expect,
Doron Pinhas:
00:30:25
you know, be able to expect what I do.
Doron Pinhas:
00:30:28
And if you are at a loss, you can refer to some of the guidelines I've provided.
Doron Pinhas:
00:30:32
Go and go ahead and read the NIST Guide.
Doron Pinhas:
00:30:34
Go ahead and read.
Doron Pinhas:
00:30:34
The coming is a guide.
Doron Pinhas:
00:30:36
Snia has a lot of good re amazing resources around storage,
Doron Pinhas:
00:30:39
security, and you'll find you can.
Doron Pinhas:
00:30:41
Pretty easily compile a checklist of the i questions you should ask.
Doron Pinhas:
00:30:45
And these are relatively straightforward questions.
Doron Pinhas:
00:30:48
Where are my, where, where is, you know, one of the big areas is the control plane.
Doron Pinhas:
00:30:52
How do I control all that stuff?
Doron Pinhas:
00:30:53
Like we have API gateways, we have management consoles, we
Doron Pinhas:
00:30:56
have, uh, URLs, the, I lock it down, it boils down to a list of.
Doron Pinhas:
00:31:01
Finite amount of questions.
Doron Pinhas:
00:31:03
So you have to roll up your sleeve and do that.
Doron Pinhas:
00:31:06
Um, and, and as just, I don't want to talk much.
Doron Pinhas:
00:31:09
It's not an advertisement to our company.
Doron Pinhas:
00:31:11
We have tools that allow you to automate some of that stuff, so that
Doron Pinhas:
00:31:14
might prove useful, but, As always in life, you don't have to use our tools.
Doron Pinhas:
00:31:19
If you know what you're doing, you can do a good job with
Doron Pinhas:
00:31:22
manual tools, it's still okay.
Doron Pinhas:
00:31:24
Um, you know, woodworking, myself, you know, there are a lot of things
Doron Pinhas:
00:31:28
you can do with manual tools.
Doron Pinhas:
00:31:30
Power tools can save you some effort and increase predictability, but you know,
Doron Pinhas:
00:31:35
it can, you do a fine job manually.
Doron Pinhas:
00:31:37
So that's, that's,
Doron Pinhas:
00:31:38
still fine.
Doron Pinhas:
00:31:39
So, to her question, it's complex, but it's possible to, to actually
Doron Pinhas:
00:31:43
build a framework to add it your environment in, in a more, uh,
Doron Pinhas:
00:31:47
Comprehensive way and, and, and, and reduce the attack surface noticeably.
W. Curtis Preston:
00:31:51
The, cuz I, you know, you were saying, you know, you don't
W. Curtis Preston:
00:31:55
necessarily want to plug your company, but at the same time that, that's where I
W. Curtis Preston:
00:31:59
wanted to go next because I, I'm curious.
W. Curtis Preston:
00:32:01
So you, you're able to do this, um, you know, this, uh, automated check
W. Curtis Preston:
00:32:07
to check all of these settings.
W. Curtis Preston:
00:32:10
I, is that the service that your company provides or what, what else do
W. Curtis Preston:
00:32:13
you, you know, where, where do you go
Doron Pinhas:
00:32:15
yeah, so ultimately one of those days, you know, we
Doron Pinhas:
00:32:19
hope that organizations that want to automate a framework to check.
Doron Pinhas:
00:32:24
On a daily basis or an ongoing basis or after exchange that
Doron Pinhas:
00:32:27
they're always locked down.
Doron Pinhas:
00:32:29
They might be looking into something like what Continuity provides, which is an.
Doron Pinhas:
00:32:34
Engine that automates all of those checks that gets automated.
Doron Pinhas:
00:32:37
It's like an antivirus if you want it, or like a vulnerability management tools.
Doron Pinhas:
00:32:41
It gets automatic updates where all the vendor best practices, the latest
Doron Pinhas:
00:32:44
CVEs, the latest recommendations from framework like NIST and niso
Doron Pinhas:
00:32:49
and PCI and HIPAA are implemented.
Doron Pinhas:
00:32:51
And you, you can get automated compliance reports and if you've done something
Doron Pinhas:
00:32:55
wrong, you'll know what went wrong.
Doron Pinhas:
00:32:58
What is this syntax I need to use to fix the problem?
Doron Pinhas:
00:33:01
And you can start over.
Doron Pinhas:
00:33:01
So you, you know, we provide those tools to automate a frequent
Doron Pinhas:
00:33:06
mode of validation, right?
Doron Pinhas:
00:33:07
So that's something, uh, that can be helpful and we advocate that.
Doron Pinhas:
00:33:13
Uh, so, so that's how we make our living.
Doron Pinhas:
00:33:16
But we are also working with organizations to do one-off assessments.
Doron Pinhas:
00:33:21
Uh, no strings attached.
Doron Pinhas:
00:33:23
If you want to understand how material you are.
Doron Pinhas:
00:33:25
You know, we can definitely talk and first of all, share with you.
Doron Pinhas:
00:33:28
We'll happily do that because we learn so much from the, those interactions.
Doron Pinhas:
00:33:33
And we want to give some of that back, right?
Doron Pinhas:
00:33:35
So, uh, if you want to just run a one-time scan, you can approach us.
Doron Pinhas:
00:33:39
You can even approach your, uh, trusted, uh, security consultant and
Doron Pinhas:
00:33:43
ask them if they can do a scan for you.
Doron Pinhas:
00:33:46
Um, there are not too many options.
Doron Pinhas:
00:33:48
We are, we know, pretty unique, but they can use our software.
Doron Pinhas:
00:33:52
A lot of, uh, um, uh, there are many consultant firms out there that
Doron Pinhas:
00:33:56
have access to our technology and can use it to run a scan for you.
Doron Pinhas:
00:33:59
And even if that's a one time scan, you will understand.
Doron Pinhas:
00:34:02
What you're doing well, where you have issues, what are the
Doron Pinhas:
00:34:06
priorities of those issues?
Doron Pinhas:
00:34:08
What does it mean to your business in terms of, you know, not adhering
Doron Pinhas:
00:34:12
to industry standards and regulations If you are in a regulated segment,
Doron Pinhas:
00:34:16
uh, sometimes that's enough.
Doron Pinhas:
00:34:17
That's just, that's a starting point that can, uh, get you going
Doron Pinhas:
00:34:21
because now you have a better clarity instead of understanding that,
Doron Pinhas:
00:34:24
you know, I'm probably not good.
Doron Pinhas:
00:34:26
You'll know exactly what works well for you and where do you have issues.
Doron Pinhas:
00:34:30
So that's, In a sense, this is what our, uh, product does, and we make a living
Doron Pinhas:
00:34:36
out of selling it to those organizations.
Doron Pinhas:
00:34:38
Choose to be standardized 24 7 and be accountable.
Doron Pinhas:
00:34:42
We hope, uh,
W. Curtis Preston:
00:34:44
For what it's worth, uh, you know, I'm a fan of that, right?
W. Curtis Preston:
00:34:47
I'm a fan of automation.
W. Curtis Preston:
00:34:48
I'm a fan of, uh, you know, I mean, I, I like the fact that you
W. Curtis Preston:
00:34:52
have the check first off period.
W. Curtis Preston:
00:34:54
Right?
W. Curtis Preston:
00:34:54
I'm a fan of that.
W. Curtis Preston:
00:34:56
The idea, and, and, and those are good, right?
W. Curtis Preston:
00:34:58
Those, those one time checks are good.
W. Curtis Preston:
00:35:00
It's good to have a consultant look at your stuff once in a while to make
W. Curtis Preston:
00:35:03
sure that you're doing the right stuff.
W. Curtis Preston:
00:35:04
But there's nothing like just having something continually checking because,
W. Curtis Preston:
00:35:10
you know, um, there are always new CVEs, there are always new vulnerabilities
W. Curtis Preston:
00:35:17
and things that you need to patch.
W. Curtis Preston:
00:35:19
I think patching is the thing that most people get behind on the most, right?
W. Curtis Preston:
00:35:26
There's that one time configuration of making sure we separate this and that
W. Curtis Preston:
00:35:29
and we're using MFA and we're using.
W. Curtis Preston:
00:35:31
Um, you know, the, the proper, uh, usernames and passwords and not
W. Curtis Preston:
00:35:36
using root root, you know, you, that should hopefully be a one-time thing.
W. Curtis Preston:
00:35:40
I think it's the, the patch management, uh, and other things,
W. Curtis Preston:
00:35:45
maybe recommendations change over time.
W. Curtis Preston:
00:35:47
Uh, that, that's the one where it's like, it, it would be nice to have something
W. Curtis Preston:
00:35:53
that just tells me, Hey, a new CBE came out, you know, and, and, uh, you know,
W. Curtis Preston:
00:35:59
the vendor has patched it already.
W. Curtis Preston:
00:36:01
You need to go, you know, you need to go patch it right
W. Curtis Preston:
00:36:04
away or else you're at risk.
Prasanna Malaiyandi:
00:36:06
Yeah.
Prasanna Malaiyandi:
00:36:07
I think
Doron Pinhas:
00:36:07
So you, you'll get that.
Doron Pinhas:
00:36:09
Yeah, go ahead,
W. Curtis Preston:
00:36:10
Yeah.
Prasanna Malaiyandi:
00:36:10
I think the other thing, Curtis too, and I
Prasanna Malaiyandi:
00:36:12
know we've talked about this in previous podcasts, is like people's
Prasanna Malaiyandi:
00:36:15
environment is never static, right?
Prasanna Malaiyandi:
00:36:17
You're always getting new devices in some group or another, right?
Prasanna Malaiyandi:
00:36:20
New applications being spun up, right?
Prasanna Malaiyandi:
00:36:22
New deployments, new servers, and so having that ongoing check where it's
Prasanna Malaiyandi:
00:36:27
like, Hey, we can now make it more efficient for you to bring online these
Prasanna Malaiyandi:
00:36:31
applications rather than going through sort of the entire security audit
Prasanna Malaiyandi:
00:36:35
and everything else that you might.
Prasanna Malaiyandi:
00:36:36
Have to do, which might elongate the time you need by weeks.
Prasanna Malaiyandi:
00:36:40
Right.
Prasanna Malaiyandi:
00:36:40
The other thing also I was thinking is there's also, from what I've read, and
Prasanna Malaiyandi:
00:36:44
I don't know, Darron, if your product supports, I'm guessing it supports
Prasanna Malaiyandi:
00:36:47
public clouds as well as endpoints.
Doron Pinhas:
00:36:50
Yep.
Prasanna Malaiyandi:
00:36:51
Okay.
Prasanna Malaiyandi:
00:36:51
Right.
Prasanna Malaiyandi:
00:36:52
So as people are looking to go to the cloud, right, sometimes they're also
Prasanna Malaiyandi:
00:36:55
looking at multi-cloud strategies.
Prasanna Malaiyandi:
00:36:57
Right where maybe they're an expert at AWS and they're trying to figure
Prasanna Malaiyandi:
00:37:00
out, can I use Azure GCP for certain workloads or because of regionality
Prasanna Malaiyandi:
00:37:05
or services being available and, but they're not the experts.
Prasanna Malaiyandi:
00:37:08
And so to get up to speed and learn, okay, what is the mapping and what are the
Prasanna Malaiyandi:
00:37:11
best practices in AW or in GCP or Azure takes time and they're not the experts.
Prasanna Malaiyandi:
00:37:16
They don't have the resources.
Prasanna Malaiyandi:
00:37:17
And having a tool like this that can automate.
Prasanna Malaiyandi:
00:37:19
And say like, Hey, here are your best practices.
Prasanna Malaiyandi:
00:37:22
Are you doing things in the right way or not?
Prasanna Malaiyandi:
00:37:24
And giving you that guidance and be like, yep, this is how you should be doing
Prasanna Malaiyandi:
00:37:27
things, I think can go a long way as well.
Doron Pinhas:
00:37:30
Yeah, I totally agree, and I just want to add that over the
Doron Pinhas:
00:37:33
course of running a business, right, I've been in this position for 17 years.
Doron Pinhas:
00:37:37
I'm proud of that.
Doron Pinhas:
00:37:39
You know, people stay at an organization for years and over the span of years.
Doron Pinhas:
00:37:43
You know, if you take a look at the, if you're running a, an IT shop
Doron Pinhas:
00:37:47
and you take a look at how you have run your business five years ago.
Doron Pinhas:
00:37:49
Four years ago, three, two years ago.
Doron Pinhas:
00:37:52
You'll see that there are sometimes, there are tectonic
Doron Pinhas:
00:37:55
changes over those spans, right?
Doron Pinhas:
00:37:57
We change one of our major vendors.
Doron Pinhas:
00:37:59
We move from one backup vendor to another.
Doron Pinhas:
00:38:01
We change from tapes to discs.
Doron Pinhas:
00:38:03
We start adding cloud.
Doron Pinhas:
00:38:06
Tertiary copies now, each one of those, and, and if you look three, four years
Doron Pinhas:
00:38:11
back, you'll see tectonic changes.
Doron Pinhas:
00:38:12
But each one of those steps, they happen on a monthly basis.
Doron Pinhas:
00:38:15
You know, we throw away our own library and bring in a new vtl and,
Doron Pinhas:
00:38:20
you know, something like, and, and.
Doron Pinhas:
00:38:21
And we have like five of those.
Doron Pinhas:
00:38:22
So you know, they live like four or five years.
Doron Pinhas:
00:38:25
So, you know, every year we change one and we have tapes and we have
Doron Pinhas:
00:38:27
discs, and we've, every new release, we have different frameworks, we have
Doron Pinhas:
00:38:31
new releases, management consoles.
Doron Pinhas:
00:38:33
Every four or five years the architecture changes.
Doron Pinhas:
00:38:35
So whenever something like that happens, for me, it's new.
Doron Pinhas:
00:38:39
But if you are relying on an industry backed whatever, uh, library of
Doron Pinhas:
00:38:44
checks that, you know, should cover everything, and we learn a
Doron Pinhas:
00:38:47
lot from our, uh, user community.
Doron Pinhas:
00:38:50
They'll tell us, oh, we started looking into this.
Doron Pinhas:
00:38:53
Are you familiar with it?
Doron Pinhas:
00:38:55
Say, Hmm, interesting.
Doron Pinhas:
00:38:56
Let's take a look.
Doron Pinhas:
00:38:57
Let's take a look together.
Doron Pinhas:
00:38:58
What did you find?
Doron Pinhas:
00:38:58
Some of them are, so there is a sort of a community feedback here and uh,
Doron Pinhas:
00:39:04
maybe it's new for your organization, but it's probably not new for others.
Doron Pinhas:
00:39:08
And there is definitely an opportunity to have a much better starting point.
Doron Pinhas:
00:39:13
So, you know, I'm deploying.
Doron Pinhas:
00:39:15
Uh, a cloud target backup, you know, and I wanna make sure that I pass
Doron Pinhas:
00:39:20
all of the checks so I run a quick scan when it's not yet production,
Doron Pinhas:
00:39:24
and I find what I'm doing well.
Doron Pinhas:
00:39:25
And if there is room for improvement, usually there is.
Doron Pinhas:
00:39:28
So, you know, an ounce of prevention is worth, uh, a pound of KiOR, right?
Doron Pinhas:
00:39:32
So think about your, uh, immune system.
Doron Pinhas:
00:39:35
Let's say it would've run once a year for a day, and then it would stop shut
Doron Pinhas:
00:39:40
down for a day the rest of the year.
Doron Pinhas:
00:39:41
That's not great.
Doron Pinhas:
00:39:43
It's better than nothing, but so that's so, so to, to Curtis's point.
Doron Pinhas:
00:39:47
Yeah.
Doron Pinhas:
00:39:47
One time scan is awesome.
Doron Pinhas:
00:39:49
It's important to know if something is wrong, but you know you have to
Doron Pinhas:
00:39:53
be, or it's better to be continual.
Prasanna Malaiyandi:
00:39:58
Yeah.
W. Curtis Preston:
Speaker:
00:39:59
Yeah, I like that a lot.
W. Curtis Preston:
Speaker:
00:40:00
Um, so the, you know, I'd, I'd like to wrap up, but what I, what I am curious
W. Curtis Preston:
Speaker:
00:40:07
about early on, you alluded to, I mean, we've kind of discussed some of the
W. Curtis Preston:
Speaker:
00:40:13
things that you recommend that people do.
W. Curtis Preston:
Speaker:
00:40:15
Besides obviously running the continual scan.
W. Curtis Preston:
Speaker:
00:40:19
Um, are there some other things that you recommend people do to secure
W. Curtis Preston:
Speaker:
00:40:23
their storage and backup environment?
Doron Pinhas:
00:40:24
Yeah, sure.
Doron Pinhas:
00:40:25
So I think.
Doron Pinhas:
00:40:27
The first thing to do is to get to know a little bit more about I, I would even read
Doron Pinhas:
00:40:33
a little bit about the business threats.
Doron Pinhas:
00:40:36
What can possibly go wrong, right?
Doron Pinhas:
00:40:38
So maybe, uh, I'm not sure we'll have time to go there today.
Doron Pinhas:
00:40:41
Why is it important?
Doron Pinhas:
00:40:42
Really get a good grasp.
Doron Pinhas:
00:40:44
Uh, it's not a difficult read.
Doron Pinhas:
00:40:46
If you go to the Snea site, you go and, uh, take a look at the NIST or IZO guide.
Doron Pinhas:
00:40:51
You'll have a framework for, in the NIST guide, there are about
Doron Pinhas:
00:40:53
30 different areas you should be looking into, get familiar with.
Doron Pinhas:
00:40:57
What are the components you need to consider to build.
Doron Pinhas:
00:41:00
Secure framework, choose.
Doron Pinhas:
00:41:03
So, you know, so the first step is, you know, get a little bit more
Doron Pinhas:
00:41:06
knowledge about storage security.
Doron Pinhas:
00:41:08
Five years ago, it was not accessible to datas.
Doron Pinhas:
00:41:11
There are plenty of resources in our site, you know, it's
Doron Pinhas:
00:41:14
www.continuitysoftware.com resources.
Doron Pinhas:
00:41:17
You'll find a library of research and guidelines and advice and
Doron Pinhas:
00:41:21
useful links to other sites.
Doron Pinhas:
00:41:23
So there is plenty of material out there to get educated.
Doron Pinhas:
00:41:26
The second thing I would encourage to do is to define, at least at
Doron Pinhas:
00:41:30
a high level, a set of security standards you'd expect to have.
Doron Pinhas:
00:41:36
And you can draw, uh, um, uh, intuition or, or, or guidelines from the set
Doron Pinhas:
00:41:44
documents, either or NIST or other frameworks, build a set of baselines
Doron Pinhas:
00:41:48
like, so I want to lock down devices, I want to have password complexities.
Doron Pinhas:
00:41:52
I want to whatever, set up session cookies or session timeouts.
Doron Pinhas:
00:41:57
I want to, you know, these are my baselines.
W. Curtis Preston:
00:42:00
Mm-hmm.
Doron Pinhas:
00:42:00
Define those baselines and then, you know, find a way to
Doron Pinhas:
00:42:04
periodically review your settings.
Doron Pinhas:
00:42:06
You know, it's, um, it takes a little, uh, doing, but all the
Doron Pinhas:
00:42:11
building blocks are out there.
Doron Pinhas:
00:42:13
If you want to use automation, then we would be very happy
Doron Pinhas:
00:42:16
to help you achieve that.
Doron Pinhas:
00:42:19
You can even script that yourself, right?
Doron Pinhas:
00:42:20
So it's not everyone has to buy a power saw, right?
Doron Pinhas:
00:42:25
You can rent it.
Doron Pinhas:
00:42:27
Right?
Doron Pinhas:
00:42:27
So, but you know, Close the knowledge gap, understand what is there to check.
Doron Pinhas:
00:42:33
It's a finalist.
Doron Pinhas:
00:42:34
There are 13 different areas.
Doron Pinhas:
00:42:36
There are different ways to look at it.
Doron Pinhas:
00:42:37
It's structured.
Doron Pinhas:
00:42:39
Pick and choose the, the things that are important to your business
Doron Pinhas:
00:42:43
and find a way to put repetition into validating that you're clean.
Doron Pinhas:
00:42:46
This way whenever you roll out something new and it always happens,
Doron Pinhas:
00:42:50
you have a, at least a point where you can, you know, validate your design.
Doron Pinhas:
00:42:53
So these are three things that you can easily do.
Doron Pinhas:
00:42:55
Um, and again, our sites has a lot of nice videos that simulate
Doron Pinhas:
00:43:00
how, you know, how hackers thinks.
Doron Pinhas:
00:43:02
What they can do in a specific scenario.
Doron Pinhas:
00:43:05
Uh, when you start thinking like that, uh, it can be even interesting
Doron Pinhas:
00:43:10
is to to think a little bit like a hacker and, and build better designs.
Doron Pinhas:
00:43:14
If you want to make your house burglar proof, you should just take
Doron Pinhas:
00:43:17
a look outside and think critical and say, I can get in through here.
Doron Pinhas:
00:43:22
What about the basement door?
Doron Pinhas:
00:43:24
What about my Tesla keys?
Doron Pinhas:
00:43:26
And so on.
Doron Pinhas:
00:43:27
So, uh, I can hide in the Tesla.
Doron Pinhas:
00:43:32
Uh, yeah, back seat and wait for you to open the garage doors.
W. Curtis Preston:
00:43:38
Yeah, I,
Doron Pinhas:
00:43:39
that, that's my advice.
Doron Pinhas:
00:43:40
It's pretty straightforward, so.
W. Curtis Preston:
00:43:42
yeah, I like the, um, I, I think, uh, we'll put some
W. Curtis Preston:
00:43:47
links in the show notes, uh, to the, to the things that you talked about.
W. Curtis Preston:
00:43:52
I like that idea a lot.
W. Curtis Preston:
00:43:53
Um, basically just make yourself more knowledgeable.
W. Curtis Preston:
00:43:56
Is, is the key.
W. Curtis Preston:
00:43:58
Cuz I, I do think that, you know, our folks tend to be backup centric,
W. Curtis Preston:
00:44:04
um, security, you know, they're learning security and a lot of backup
W. Curtis Preston:
00:44:09
folks are often junior folks, right?
W. Curtis Preston:
00:44:12
The, this is the job they were able to get.
W. Curtis Preston:
00:44:15
And mainly because nobody else wanted it, right?
W. Curtis Preston:
00:44:18
Um, yeah.
W. Curtis Preston:
00:44:19
I mean, that's how, that's how I got my first job in backup.
W. Curtis Preston:
00:44:23
And so yeah, this is definitely the part of that, the part of the world
W. Curtis Preston:
00:44:29
that you really need to go to, right?
W. Curtis Preston:
00:44:31
You really need to increase your cybersecurity knowledge.
W. Curtis Preston:
00:44:34
If you don't have that, if you were listening to this episode and these,
W. Curtis Preston:
00:44:38
uh, acronyms that, that, uh, we were, you know, rattling off like nist, if
W. Curtis Preston:
00:44:42
those are foreign to you, Definitely follow the links in the show guides
W. Curtis Preston:
00:44:46
to, um, to, to learn more about that.
W. Curtis Preston:
00:44:48
Well, uh, Doran, I want to thank you for, for coming on the show
Doron Pinhas:
00:44:53
Perfect.
Doron Pinhas:
00:44:53
It was my pleasure.
Doron Pinhas:
00:44:55
Thank you for having me.
W. Curtis Preston:
00:44:57
and Prasanna.
W. Curtis Preston:
00:44:57
You, uh, continue to get all the blame for my Tesla, but,
W. Curtis Preston:
00:45:01
uh, I'm glad you're here anyway.
Prasanna Malaiyandi:
00:45:04
Yeah.
Prasanna Malaiyandi:
00:45:04
Thanks Curtis and nice to meet you Doran, and thanks for
Prasanna Malaiyandi:
00:45:07
answering all the questions.
Prasanna Malaiyandi:
00:45:08
I think it's a very compelling, uh, solution, right.
Prasanna Malaiyandi:
00:45:13
And solves a very specific problem that I think there's, like you mentioned, right?
Prasanna Malaiyandi:
00:45:18
There's a huge blind spot to this.
Prasanna Malaiyandi:
00:45:20
So I think it's very valuable.
Prasanna Malaiyandi:
00:45:22
And Curtis, I hope one day that you will thank me that, that you bought your Tesla.
Prasanna Malaiyandi:
00:45:26
So I'll just, uh, I'm not gonna hold my breath for that day, but.
W. Curtis Preston:
00:45:30
There's this, there's this other person in my
W. Curtis Preston:
00:45:32
house that is still blaming you, but, uh, we'll, we'll, we'll see.
W. Curtis Preston:
00:45:36
Maybe, maybe one day.
W. Curtis Preston:
00:45:38
Uh, well, anyway, I, I want to thank our listeners.
W. Curtis Preston:
00:45:41
You know, you, you are why we do this, and remember to subscribe
00:00:19
I'm very rarely shocked when we record these episodes.
Speaker:
00:00:23
But it happened in this episode.
Speaker:
00:00:25
Uh, I ask a really important question of our guests who is a storage and
Speaker:
00:00:30
backup and recovery security expert.
Speaker:
00:00:33
Uh, and I was shocked by his answer.
Speaker:
00:00:36
If you care at all about the security of your backup and recovery
Speaker:
00:00:40
system, this is the episode for you.
Speaker:
00:00:42
I hope you enjoy it.
W. Curtis Preston:
00:00:44
Hi, and welcome to Backup Central's Restore it All podcast.
W. Curtis Preston:
00:00:47
I'm your host, W Curtis Preston, aka Mr.
W. Curtis Preston:
00:00:50
Backup, and have with me a guy that I'm not sure fully filled me in.
W. Curtis Preston:
00:00:55
On everything that I was in for when I bought my Tesla Prasanna
W. Curtis Preston:
00:01:01
Malaiyandi how's it going?
W. Curtis Preston:
00:01:03
Prasanna?
Prasanna Malaiyandi:
00:01:04
Oh no.
Prasanna Malaiyandi:
00:01:04
What did I do this time?
W. Curtis Preston:
00:01:06
I don't know.
W. Curtis Preston:
00:01:07
As you know, I've been incredibly happy with my new car.
W. Curtis Preston:
00:01:10
Um, I, I, I've, I've put a thousand miles on it already.
W. Curtis Preston:
00:01:16
Um, Which is more than you probably put in your entire first year.
W. Curtis Preston:
00:01:20
But the, um, I think the, my one disappointment, and it is, it
W. Curtis Preston:
00:01:26
truly is a disappointment, is that Tesla doesn't have tech support.
W. Curtis Preston:
00:01:32
Right.
W. Curtis Preston:
00:01:32
Given that it's essentially like, you know, that they've sold me this really
W. Curtis Preston:
00:01:36
expensive computer on wheels and it has all these interfaces and there's
W. Curtis Preston:
00:01:43
all this conflicting information about.
W. Curtis Preston:
00:01:46
Things about the car based on when you bought it, which you
W. Curtis Preston:
00:01:51
know, which model you have.
W. Curtis Preston:
00:01:52
So I have the L F P battery, which is the newer battery, which, which apparently
W. Curtis Preston:
00:01:58
according to the manual, as opposed to be charged to a hundred percent.
W. Curtis Preston:
00:02:02
Um, and you know, I just have questions that I would like to
W. Curtis Preston:
00:02:07
hear answers directly from Tesla.
W. Curtis Preston:
00:02:11
There's no phone number or email address for me to contact
Prasanna Malaiyandi:
00:02:15
so have you gone into the app and gone to,
Prasanna Malaiyandi:
00:02:17
have you gone into the app, gone to support and said other issue?
W. Curtis Preston:
00:02:22
other that, because the only thing I've seen
W. Curtis Preston:
00:02:24
is, is schedule service call
Prasanna Malaiyandi:
00:02:27
Yeah.
Prasanna Malaiyandi:
00:02:28
Uh, yeah.
Prasanna Malaiyandi:
00:02:28
So if you do schedule service, I think you can also do other, and
Prasanna Malaiyandi:
00:02:34
then just enter your, your questions.
W. Curtis Preston:
00:02:38
So you're saying my greatest disappointment doesn't exist.
W. Curtis Preston:
00:02:41
Is that what you're telling me?
Prasanna Malaiyandi:
00:02:43
I,
W. Curtis Preston:
00:02:43
You're looking at the, you're looking at the
W. Curtis Preston:
00:02:44
app right now, aren't you?
Prasanna Malaiyandi:
00:02:46
I am looking at the app right now.
Prasanna Malaiyandi:
00:02:47
Yes, I am.
Prasanna Malaiyandi:
00:02:48
Um, I think it could work.
Prasanna Malaiyandi:
00:02:50
I, so I've never done this.
W. Curtis Preston:
00:02:53
Yeah.
W. Curtis Preston:
00:02:54
I mean, if I could just, if I could, yeah, if I could just have an email chat.
W. Curtis Preston:
00:02:57
Cuz a lot of 'em are just like, you know, You know, questions, right?
W. Curtis Preston:
00:03:02
Like, I'm, I'm like, I can't find this thing, right?
W. Curtis Preston:
00:03:05
I'm looking for the thing and I can't find the thing because there's
W. Curtis Preston:
00:03:08
37 menus and, um, you know, I need
Prasanna Malaiyandi:
00:03:12
You know there's a search now, right?
Prasanna Malaiyandi:
00:03:13
Yes.
W. Curtis Preston:
00:03:14
I, I know there's a search, but it doesn't
W. Curtis Preston:
00:03:16
always find, there's a search.
Prasanna Malaiyandi:
00:03:19
First world problems.
Prasanna Malaiyandi:
00:03:20
Curtis First World
W. Curtis Preston:
00:03:21
never ending, the, the, the never ending search for
W. Curtis Preston:
00:03:25
looking for what I'm trying to find.
W. Curtis Preston:
00:03:27
Um, yeah, I did find the most important app though.
W. Curtis Preston:
00:03:32
You know, I, we've discussed this already, the, the admission
W. Curtis Preston:
00:03:36
testing app, otherwise known
Prasanna Malaiyandi:
Speaker:
00:03:39
Otherwise known as Spart
W. Curtis Preston:
00:03:40
fart noise.
Prasanna Malaiyandi:
00:03:44
Oh,
W. Curtis Preston:
00:03:45
could, you could literally, you, you,
W. Curtis Preston:
00:03:46
you can configure it so that.
W. Curtis Preston:
00:03:48
Whenever you push a button on the steering wheel, it makes a random fart noise,
W. Curtis Preston:
00:03:51
uh, to other passengers in the car.
W. Curtis Preston:
00:03:54
By the way, my wife not a big fan, not a big fan of the fart
Prasanna Malaiyandi:
00:04:00
Curtis, are you like a little kid in a candy store?
W. Curtis Preston:
00:04:02
I am inside, inside, every grown man is a five-year-old boy,
W. Curtis Preston:
00:04:07
just, just begging to get out and, uh, I'm a five year old boy with a $40,000 car.
W. Curtis Preston:
00:04:13
That wants to, that wants to try every little part, right?
W. Curtis Preston:
00:04:16
The only difference between men and boys is the price of their toys, right?
W. Curtis Preston:
00:04:21
uh, yeah.
W. Curtis Preston:
00:04:22
So tomorrow it'll be, it'll be a week, uh, that I've had my, my lovely
W. Curtis Preston:
00:04:27
new car and, uh, yes, I've put a
Prasanna Malaiyandi:
Speaker:
00:04:30
And, and oh, we should.
Prasanna Malaiyandi:
Speaker:
00:04:32
We should, yeah.
Prasanna Malaiyandi:
Speaker:
00:04:33
We should also tell the listeners also about your, uh, experience
Prasanna Malaiyandi:
Speaker:
00:04:37
going through a car wash.
W. Curtis Preston:
00:04:43
I went to a car wash and you know, it's one of
W. Curtis Preston:
00:04:46
these things, things that you take for granted when you drive, uh, you
W. Curtis Preston:
00:04:50
know, what I now call an ice car?
W. Curtis Preston:
00:04:51
That's a internal combustion engine.
W. Curtis Preston:
00:04:54
A gas car is, you know, you just, it's super easy to put into neutral and,
W. Curtis Preston:
00:04:58
and, and Tesla's super easy to put into neutral if you know how to do it.
W. Curtis Preston:
00:05:03
And, uh, so I'm sitting there and I had rolled up to the, to the thing
W. Curtis Preston:
00:05:07
where the, you know, where the.
W. Curtis Preston:
00:05:08
The, the, I don't know, the conveyor belt's gonna grab my car.
W. Curtis Preston:
00:05:12
And then the guy's like, you know, he's pointing to the thing up there
W. Curtis Preston:
00:05:15
that says, you know, put it in neutral.
W. Curtis Preston:
00:05:17
And I'm like, oh yeah, I'm supposed to put it in neutral.
W. Curtis Preston:
00:05:20
I shut down the whole thing.
W. Curtis Preston:
00:05:21
I shut down the whole car wash because I had no idea how
W. Curtis Preston:
00:05:25
to put my car into neutral.
W. Curtis Preston:
00:05:26
And then I thought I had it into neutral.
W. Curtis Preston:
00:05:28
They turned it on again.
W. Curtis Preston:
00:05:29
Nope, shut it down again.
W. Curtis Preston:
00:05:31
Um, the, the only, the only nice thing I can say is thank
W. Curtis Preston:
00:05:35
God my wife was not in the car.
W. Curtis Preston:
00:05:36
She would've just been flipping out.
W. Curtis Preston:
00:05:38
Uh, but yeah, I, I did, luckily the manager was like, you know, rolled
W. Curtis Preston:
00:05:43
down the window and he's like, um, go to the menu and it's car wash mode.
W. Curtis Preston:
00:05:47
I'm like, sweet.
W. Curtis Preston:
00:05:49
Um,
Prasanna Malaiyandi:
00:05:50
not the first time that this has happened at that
W. Curtis Preston:
00:05:53
I am not the, I'm not the first idiot with a brand new
W. Curtis Preston:
00:05:55
Tesla to take it into a car wash and not know how to put it in neutral.
W. Curtis Preston:
00:06:00
Anyway, uh, so enough test Tesla talk for the day, gonna bring on our guest.
W. Curtis Preston:
00:06:06
He's been specializing in it, uh, for over 30 years and specializes
W. Curtis Preston:
00:06:10
in storage and backup and security as well as it architecture.
W. Curtis Preston:
00:06:14
He's now the CTO at Continuity Software.
W. Curtis Preston:
00:06:17
The industry's only cybersecurity solution for enterprise storage and backup systems.
W. Curtis Preston:
00:06:22
Welcome to the pod, Doran Pinhas.
Doron Pinhas:
00:06:27
Hi.
Doron Pinhas:
00:06:27
Good to be here.
W. Curtis Preston:
00:06:29
So you're, you're currently in Israel, right?
W. Curtis Preston:
00:06:31
Doran?
Doron Pinhas:
00:06:35
Yep, that's true.
W. Curtis Preston:
00:06:36
What, what, what, what?
W. Curtis Preston:
00:06:38
It's, it's still sunny.
W. Curtis Preston:
00:06:40
What, uh, what part are you in?
Doron Pinhas:
00:06:42
it's 7:00 PM over here.
Doron Pinhas:
00:06:44
Uh, just, you know, it's a very, very small country.
Doron Pinhas:
00:06:47
It's the, the size of New Jersey maybe.
Doron Pinhas:
00:06:49
So, uh, anywhere you put your finger, it's where I am.
Doron Pinhas:
00:06:52
So
W. Curtis Preston:
00:06:53
yeah.
Doron Pinhas:
00:06:53
in the area of Tel Aviv.
Doron Pinhas:
00:06:55
Yes.
Doron Pinhas:
00:06:55
So give or take, which is in the middle of the country.
W. Curtis Preston:
00:06:57
I've been to, I've been to Tel Aviv,
W. Curtis Preston:
00:06:59
uh, Jerusalem, and, uh, a lot.
W. Curtis Preston:
00:07:03
I went and did scuba diving there, uh, which was very, very nice.
W. Curtis Preston:
00:07:08
Um, scuba diving in the
Doron Pinhas:
00:07:10
a good start for a first visit.
W. Curtis Preston:
00:07:12
Yeah, absolutely, absolutely.
W. Curtis Preston:
00:07:14
I wanna do our usual disclaimer, uh, Prasanna and I work for different
W. Curtis Preston:
00:07:18
companies, and this is an independent podcast and is the opinions that you
W. Curtis Preston:
00:07:23
hear are ours and don't necessarily reflect the opinions of our employers.
W. Curtis Preston:
00:07:27
Also, if you, uh, like the show, please rate us, go to your favorite pod catcher
W. Curtis Preston:
00:07:32
and give us all the stars and comments.
W. Curtis Preston:
00:07:33
We'd love to hear comments from you, and also if you'd like to
W. Curtis Preston:
00:07:36
join the conversation or just send us, you know, Kudos or whatever.
W. Curtis Preston:
00:07:41
Uh, you can reach me at w Curtis Preston gmail or uh, uh, WC Preston on Twitter
W. Curtis Preston:
00:07:48
or linkedin.com/in/mr backup Um, so, you know, when I, when I saw your, you know,
W. Curtis Preston:
00:07:57
I went to the Continuity's website and the first thing that popped up, Was this, uh,
W. Curtis Preston:
00:08:03
paper that you've done recently, which it looks like you've been doing for a couple
W. Curtis Preston:
00:08:08
of years on, uh, that that basically is a study of, uh, what, why don't,
W. Curtis Preston:
00:08:14
why don't you tell, tell us about it?
W. Curtis Preston:
00:08:15
That this paper,
Doron Pinhas:
00:08:17
Oh, you mean the storage and backup?
Doron Pinhas:
00:08:19
Um, you know, state of the industry
W. Curtis Preston:
00:08:22
yes.
W. Curtis Preston:
00:08:22
Yes.
Doron Pinhas:
00:08:23
That's the one.
Doron Pinhas:
00:08:24
Yeah.
Doron Pinhas:
00:08:24
Okay.
Doron Pinhas:
00:08:25
So it's the tradition.
Doron Pinhas:
00:08:26
We started several years back.
Doron Pinhas:
00:08:28
Uh, we were fortunate enough to meet, you know, we are in the IT business as a
Doron Pinhas:
00:08:33
whole and, and generate, uh, management tools for, uh, large enterprises.
Doron Pinhas:
00:08:39
We can talk about that later if there's any interest.
Doron Pinhas:
00:08:41
Uh, and we were fortunate enough to get about with some of the
Doron Pinhas:
00:08:45
world's largest enterprises, and we started talking years back about
Doron Pinhas:
00:08:48
securing storage and backup systems.
Doron Pinhas:
00:08:51
Lo and behold, and uh, it's dawned on us eventually that there is
Doron Pinhas:
00:08:54
no standard research that tests the maturity level of the market.
Doron Pinhas:
00:08:59
As it were, so several years back we started, uh, running surveys.
Doron Pinhas:
00:09:03
We have a technology that then collect that can collect configuration,
Doron Pinhas:
00:09:07
data, off storage and backup devices, appliances, media servers and stuff like
W. Curtis Preston:
00:09:13
Mm.
Doron Pinhas:
00:09:14
and then review the configuration to see
Doron Pinhas:
00:09:16
if it's done well or not.
Doron Pinhas:
00:09:18
That's pretty easy.
Doron Pinhas:
00:09:19
So we collected data from, uh, everyone we talked with and many of
Doron Pinhas:
00:09:23
those organizations were gracious enough to allow us to anonymize
Doron Pinhas:
00:09:25
the data and generate reports.
Doron Pinhas:
00:09:28
So to cut a long story short, um, this year we scanned the around 10,000 storage
Doron Pinhas:
00:09:35
devices in around 250 large enterprises.
Doron Pinhas:
00:09:39
Most of them are relatively large.
Doron Pinhas:
00:09:41
Organizations with north of 10,000 people.
Doron Pinhas:
00:09:45
Some of them has half a million employees.
Doron Pinhas:
00:09:47
So it's a interesting demographics.
Doron Pinhas:
00:09:49
60% in the United States, almost 40% in the eu, and some in Asia Pacific.
Doron Pinhas:
00:09:56
Um, and we did find that, uh, the majority of environments.
Doron Pinhas:
00:10:02
Did have grave misconfigurations that relate to storage and backup systems,
W. Curtis Preston:
00:10:08
Shocked
Doron Pinhas:
00:10:09
means that, you know, we're not shocked, but now we have
Doron Pinhas:
00:10:12
the proof, the writing is on the wall.
Doron Pinhas:
00:10:14
We can't ignore it anymore.
Doron Pinhas:
00:10:15
We knew in this secret of our heart that things might go wrong, but
Doron Pinhas:
00:10:19
now we know they are not great.
Doron Pinhas:
00:10:22
And, you know, stored and backup means are awesome at so many things.
Doron Pinhas:
00:10:26
They know how to increase capacity and deal with ever shrinking backup
Doron Pinhas:
00:10:30
windows and you know, ingest new technologies and move from on-prem to
Doron Pinhas:
00:10:35
cloud storage and all that fun stuff.
Doron Pinhas:
00:10:37
But there are not necessarily security experts.
Doron Pinhas:
00:10:40
And it is important to become more knowledgeable about security
Doron Pinhas:
00:10:45
because the outcomes of two lacks security in restorative
Doron Pinhas:
00:10:49
backup system can be devastating.
Doron Pinhas:
00:10:52
You know, that's something I'd love to be able to talk about and then
Doron Pinhas:
00:10:54
maybe, uh, we can have some practical advice around how can you do better?
Doron Pinhas:
00:11:00
You know, once people get convinced, it is important.
Prasanna Malaiyandi:
00:11:03
Yeah, so just a quick question.
Prasanna Malaiyandi:
00:11:06
Um, When you were, uh, looking at these backup and storage systems,
Prasanna Malaiyandi:
00:11:11
what sort of things were you looking for when you're evaluating
Prasanna Malaiyandi:
00:11:14
figure out were they secure or not?
Doron Pinhas:
00:11:18
So there, there are several dimensions to establishing
Doron Pinhas:
00:11:22
where whether, uh, uh, storage and backup infrastructure are secure.
Doron Pinhas:
00:11:25
So all the way from the very mundane, for example, are those,
Doron Pinhas:
00:11:30
uh, pieces of equipment and software laying around patched.
Doron Pinhas:
00:11:34
So surprisingly enough, uh, you know when people look at backup software
Doron Pinhas:
00:11:39
like Veeam and Veritas and you know, forgive me for all the rest and
Doron Pinhas:
00:11:42
Rubrik and others, these are piece of commercial software vendors will discover
Doron Pinhas:
00:11:46
security vulnerabilities, whether the code they have created or third party
Doron Pinhas:
00:11:50
libraries they use, everyone does that.
Doron Pinhas:
00:11:53
And they will write security bullet, public security
Doron Pinhas:
00:11:55
bulletins and issue patches.
Doron Pinhas:
00:11:57
So the question is, do you update your software?
Doron Pinhas:
00:11:59
Now when it comes to the software bit, That's a little easier because
Doron Pinhas:
00:12:03
the traditional vulnerability management engine you might
Doron Pinhas:
00:12:06
already have on on, on the floor.
Doron Pinhas:
00:12:09
We'll probably catch that.
Doron Pinhas:
00:12:11
Uh, but when you look at the stored and backup ecosystems, there are
Doron Pinhas:
00:12:14
all sorts of bizarre components there that are never scanned, right?
Doron Pinhas:
00:12:17
So we have, if you have a large shop, you have a sun fabric, and you have N
Doron Pinhas:
00:12:21
dmp and you have NetApp, and you have, uh, whatever storage, OSS and various
Doron Pinhas:
00:12:26
mix, no, HP and LMC and ibm, and.
Doron Pinhas:
00:12:29
Pure.
Doron Pinhas:
00:12:31
Um, these devices are never scanned by vulnerability managed engines.
Doron Pinhas:
00:12:35
And so, but it's pretty easy to determine if they are exposed or not.
Doron Pinhas:
00:12:39
So one of the trivial bits we've done is just retrieve the configuration baseline
Doron Pinhas:
00:12:44
of all the devices we have scanned.
Doron Pinhas:
00:12:46
Where there is are backup appliances and archiving appliances.
Doron Pinhas:
00:12:50
And shockingly you'll find that, uh, patches have been out there
Doron Pinhas:
00:12:54
for things like log four j.
Doron Pinhas:
00:12:56
That can impact the storage arrays.
Doron Pinhas:
00:12:58
Definitely can.
Doron Pinhas:
00:12:59
So, uh, but they haven't been patched.
Doron Pinhas:
00:13:02
And when you talk to professionals, say, oh, I didn't
Doron Pinhas:
00:13:04
know that I have that exposure.
Doron Pinhas:
00:13:06
I've run my scan with one of the big names, whatever, tenable Ines and Rapid
Doron Pinhas:
00:13:11
Seven and others, and they're all great companies, but they just don't scan.
Doron Pinhas:
00:13:14
The storage ecosystem to that level of detail, and people have
Doron Pinhas:
00:13:18
a blind spot and it's, it's bad.
Doron Pinhas:
00:13:20
So one thing is, that's mundane, right?
Doron Pinhas:
00:13:22
So, and, and around that category, I can count several other aspects.
Doron Pinhas:
00:13:26
Like, you know, you want to have your software patch, you want to have some
Doron Pinhas:
00:13:30
of the ridiculous stuff cleaned up.
Doron Pinhas:
00:13:32
Like, you know, you, you buy a backup appliance, it has a default
Doron Pinhas:
00:13:35
factory account like Root, root.
Doron Pinhas:
00:13:37
Did you close that account?
Doron Pinhas:
00:13:39
Oops.
Doron Pinhas:
00:13:40
So many organizations fail to do those.
Doron Pinhas:
00:13:42
Very simple, you know, it's not just the root root account.
Doron Pinhas:
00:13:45
There are service accounts.
Doron Pinhas:
00:13:47
There are default called home configurations that by and large, Are
Doron Pinhas:
00:13:52
not restricted to specific IP addresses.
Doron Pinhas:
00:13:54
And if I'm a hacker, I can spoof those.
Doron Pinhas:
00:13:57
So there are basic things you can do when you get a device, whether
Doron Pinhas:
00:13:59
that's a medial library or whatever, an archiving appliances or set up
Doron Pinhas:
00:14:04
a softer element that you can do to do the basics of hardening them.
Doron Pinhas:
00:14:10
So, so this is one area.
Doron Pinhas:
00:14:12
Another relates to a little bit more convoluted best practices.
Doron Pinhas:
00:14:16
You know, vendors will publish best practices for security, but by and
Doron Pinhas:
00:14:19
large it gurus tends to ignore them.
Doron Pinhas:
00:14:22
We want to go to the meet, how can we set up our first job?
Doron Pinhas:
00:14:26
But there are things, uh, that should be done.
Doron Pinhas:
00:14:30
Again, some of them are pretty mundane, right?
Doron Pinhas:
00:14:32
I'll give you just one example and you tell me if I'm going to, uh,
Prasanna Malaiyandi:
00:14:35
No,
Doron Pinhas:
00:14:36
uh, technical too quickly.
Doron Pinhas:
00:14:37
But, um, you know, time.
Doron Pinhas:
00:14:41
We all know about time it passes, right?
Doron Pinhas:
00:14:45
So, but when you set up a storage or a backup appliance, you
Doron Pinhas:
00:14:49
need to set up so it up with an authoritative time server, right?
Doron Pinhas:
00:14:53
Um, if I'm a hacker and I, uh, realize that it didn't harden the time
Doron Pinhas:
00:14:58
settings, I can spoof the time server and then I can issue all sorts of
Doron Pinhas:
00:15:03
attacks, like time's up attacks where, you know, I persuade your archiving
Doron Pinhas:
00:15:06
appliance that 12 years have passed.
Doron Pinhas:
00:15:09
Just in the span of a minute.
Doron Pinhas:
00:15:11
Of course, you can defeat that by setting up an authorized time server and using
Doron Pinhas:
00:15:17
authentication and stuff like that, but it's not set up out of the box.
Doron Pinhas:
00:15:21
Now if I'm not setting up my time correctly.
Doron Pinhas:
00:15:23
Of course, encryption keys can go stale and elapse, you know,
Doron Pinhas:
00:15:26
really bad stuff can happen.
Doron Pinhas:
00:15:28
So this is a trivial thing.
Doron Pinhas:
00:15:30
If you look at, uh, at reality from the security wearing the security hat or
Doron Pinhas:
00:15:34
security glasses, you'll realize that you have to harden some basic, uh, components
Doron Pinhas:
00:15:39
like time services and dns, and you have to close default accounts and set
Doron Pinhas:
00:15:43
up centrally managed authentication.
Doron Pinhas:
00:15:46
All of these are best practices.
Doron Pinhas:
00:15:47
Vendors will publish.
Doron Pinhas:
00:15:49
They will also tell you that, Hey, we are shipping this box
Doron Pinhas:
00:15:52
out of the gate with some initial security configurations like we.
Doron Pinhas:
00:15:57
Do allow you to decide if you want to configure SIFs one, two, whatever.
Doron Pinhas:
00:16:02
Uh, which Cipher Suites do you want to support?
Doron Pinhas:
00:16:05
Do you support in Fs version three and four and above?
Doron Pinhas:
00:16:09
Do you want to limit some of those?
Doron Pinhas:
00:16:10
So it's your job to decide, you know, we are selling you a Tesla.
Doron Pinhas:
00:16:14
You need to drive it out of the factory and you need to
Doron Pinhas:
00:16:16
do it as safely as you can.
Doron Pinhas:
00:16:18
You can of course drive it's hard, but you can try, you can
Doron Pinhas:
00:16:21
still force it into a tree.
Doron Pinhas:
00:16:23
So, The vendors will tell you, you may want to consider to
Doron Pinhas:
00:16:26
close some of the protocols.
Doron Pinhas:
00:16:28
If you're not using nfs, close it please.
Doron Pinhas:
00:16:30
If you're using nfs, maybe you want to disable NFS version three.
Doron Pinhas:
00:16:33
So we want to review some of those settings and follow
Doron Pinhas:
00:16:36
the vendor best practices.
Doron Pinhas:
00:16:38
So we start to see a picture emerging.
Doron Pinhas:
00:16:41
So we check for the basic vulnerabilities and the locking down of default
Doron Pinhas:
00:16:46
accounts, and then we go ahead and read the various vendor recommendations and
Doron Pinhas:
00:16:50
make them into a structured library of.
Doron Pinhas:
00:16:53
Things you should be looking into, and we just have a platform
Doron Pinhas:
00:16:56
that can automate those checks.
Doron Pinhas:
00:16:58
Now there, there are some other components to that.
Doron Pinhas:
00:17:00
For example, there are several standards that are today not legally binding,
Doron Pinhas:
00:17:05
but there are standards out there to regulate how stuff can be secured, right?
Doron Pinhas:
00:17:10
So we have the NIST framework.
Doron Pinhas:
00:17:12
We have the ISO framework.
Doron Pinhas:
00:17:14
Within NIST and iso.
Doron Pinhas:
00:17:15
There are families of, uh, uh, documents that regulate various aspects of security,
Doron Pinhas:
00:17:20
but specifically in recent years, there is more guidance for storage.
Doron Pinhas:
00:17:23
Right?
Doron Pinhas:
00:17:24
NIST has published, uh, the special publication 802 0 9, which
Doron Pinhas:
00:17:29
talks about storage and backup systems, security guidelines.
Doron Pinhas:
00:17:32
Right.
Doron Pinhas:
00:17:33
Just.
Doron Pinhas:
00:17:34
Spell it out differently, but you know, uh, and we were fortunate enough
Doron Pinhas:
00:17:38
to take part in shaping, uh, this particular piece ISO are publishing.
Doron Pinhas:
00:17:43
Um, there is a, a document called, uh, ISO 27 0 40, which, uh, outlines,
Doron Pinhas:
00:17:50
uh, guidelines for storage security.
Doron Pinhas:
00:17:52
So the current version is dated 2015.
Doron Pinhas:
00:17:56
Uh, it was great at the time.
Doron Pinhas:
00:17:58
It's not great anymore, but they are working on a new release.
Doron Pinhas:
00:18:00
Which is going to come out any week now, and we are fortunate enough
Doron Pinhas:
00:18:04
to see some of the drafts and even comment and it's awesome, right?
Doron Pinhas:
00:18:07
So we have guidance around what could serve as a framework for having better
Doron Pinhas:
00:18:13
security for storage and backup.
Doron Pinhas:
00:18:15
Um, so the last, maybe that's the last source.
Doron Pinhas:
00:18:18
We also, uh, review all of those guidelines and then we pick the
Doron Pinhas:
00:18:22
ones that are relevant to the average user and turn them into a
Doron Pinhas:
00:18:26
comprehensive automated checklist.
Doron Pinhas:
00:18:28
If you're curious, we have about whatever, three to 4,000 automated checks.
Doron Pinhas:
00:18:34
So when
Prasanna Malaiyandi:
00:18:34
gonna say, yeah.
Doron Pinhas:
00:18:35
go, go ahead and collect the configuration, you
Doron Pinhas:
00:18:38
know, we just need read only access.
Doron Pinhas:
00:18:40
That's how we work with, uh, the organizations.
Doron Pinhas:
00:18:42
We advise.
Doron Pinhas:
00:18:44
We ask them to let us, uh, have a readonly role.
Doron Pinhas:
00:18:47
We collect the data, we keep it in, it doesn't have to leave.
Doron Pinhas:
00:18:50
We run our tool and it's just create a dashboard and score cards saying This is
Doron Pinhas:
00:18:55
what you're doing well and here is where you, uh, can improve or might have failed.
Doron Pinhas:
00:19:00
And now, uh, uh, uh, many of those organizations are really gracious
Doron Pinhas:
00:19:03
allowing us to take the stats out.
Doron Pinhas:
00:19:06
So that's how we came across with a sample of around 10,000 components and component
Doron Pinhas:
00:19:12
could be a media server, archiving device, master server storage appliance.
Doron Pinhas:
00:19:18
And when, when you talk about backup, of course everyone realizes today
Doron Pinhas:
00:19:21
that the, when you want to recover something, you have multiple.
Doron Pinhas:
00:19:25
Layers of defense.
Doron Pinhas:
00:19:26
So the, the quickest recovery can be done from live on disk storage,
Doron Pinhas:
00:19:32
whether that's snapshots or replicas.
Doron Pinhas:
00:19:35
Uh uh, and then you have a progressing line now where you know the list quick
Doron Pinhas:
00:19:41
recoveries from offsite and you know, offline, maybe even offline tapes.
Doron Pinhas:
00:19:45
So we have a progression of, uh, mediums and when we want to protect backup, we
Doron Pinhas:
00:19:49
have to look at all those two components.
Doron Pinhas:
00:19:51
So we want to protect our.
Doron Pinhas:
00:19:53
A master server or media servers or archiving appliances, our online
Doron Pinhas:
00:19:57
storage, the snapshots, the replica engines, all of these have to be hardened
Doron Pinhas:
00:20:01
and there is a bit more than that.
Doron Pinhas:
00:20:02
Uh, so, uh,
Prasanna Malaiyandi:
Speaker:
00:20:05
that's very comprehensive.
Doron Pinhas:
00:20:07
Yeah.
Doron Pinhas:
00:20:07
Yeah.
Doron Pinhas:
00:20:07
So to, this was a very long-winded way of saying, yeah.
Doron Pinhas:
00:20:11
So these, these are some of the areas we gather together
Doron Pinhas:
00:20:14
to compile that list of checks.
Doron Pinhas:
00:20:15
And that's how we can come about with a.
Doron Pinhas:
00:20:18
Pretty comprehensive set of, uh, scores and in the report we, we try to make
Doron Pinhas:
00:20:24
it easy and friendly to the user.
Doron Pinhas:
00:20:26
We divided the findings into the top.
Doron Pinhas:
00:20:28
Five categories that were common in almost all environments.
Doron Pinhas:
00:20:33
We also, uh, dedicated the section to some of the less frequent issues
Doron Pinhas:
00:20:38
that are extremely lethal, as it were.
Doron Pinhas:
00:20:41
So, you know, not many people do that, but if you do, that can be devastating.
Doron Pinhas:
00:20:45
So you might want to watch out.
Doron Pinhas:
00:20:47
And I think what can be really actionable if, if I'm interested to see
Doron Pinhas:
00:20:52
that, just take that list of the top five or top six and ask yourself, I.
Doron Pinhas:
00:20:56
Am I free from those?
Doron Pinhas:
00:20:58
You probably will find that for some of those, even in your own organizations.
Doron Pinhas:
00:21:02
There is something here to take a closer look at, uh,
Doron Pinhas:
00:21:05
which I think can be valuable.
Doron Pinhas:
00:21:07
This is why our way of sharing, um, the generosity of the organization
Doron Pinhas:
00:21:13
work with, in, in, in freely sharing what they do well and what they don't.
Doron Pinhas:
00:21:18
So, you know, everyone can actually, uh, use that as a benchmark.
W. Curtis Preston:
00:21:23
I, I, I really like that Doran.
W. Curtis Preston:
00:21:24
Um, in fact, the, the, the, you know, we're recording this
W. Curtis Preston:
00:21:28
in the middle of June, the.
W. Curtis Preston:
00:21:30
The episode that went live this morning was, uh, an se that was sort
W. Curtis Preston:
00:21:36
of bemoaning the fact that companies don't share, um, security, especially
W. Curtis Preston:
00:21:44
when a security incident happens.
W. Curtis Preston:
00:21:47
They don't share with the rest of the world what happened, why it happened.
W. Curtis Preston:
00:21:51
Basically, you know, information that can help people.
W. Curtis Preston:
00:21:55
And I think in this case, this is really helpful, uh, in that.
W. Curtis Preston:
00:22:00
Uh, there's two things in here.
W. Curtis Preston:
00:22:01
One, one, you know, I, I, you know, early in the said, I sh I said, shocked.
W. Curtis Preston:
00:22:06
Shocked.
W. Curtis Preston:
00:22:06
I am, uh, I, I, you know, I'm not shocked, right?
W. Curtis Preston:
00:22:10
Because of the, the, um, you know, because, you know, I've been in the
W. Curtis Preston:
00:22:14
back space for a while and storage and backup due kind of get the back of the
W. Curtis Preston:
00:22:19
bus status for, for a lot of reasons.
W. Curtis Preston:
00:22:22
They just don't get the, many of the tools aren't looking at that.
W. Curtis Preston:
00:22:25
Many of the people aren't thinking about that.
W. Curtis Preston:
00:22:28
And the, but the reality is storage and backup.
W. Curtis Preston:
00:22:32
That's where it's at.
W. Curtis Preston:
00:22:33
That's where the data is, right?
W. Curtis Preston:
00:22:36
It, it's the, it is the thing that you're protecting.
W. Curtis Preston:
00:22:39
In fact, um, you know, in this episode that went live, um, uh,
W. Curtis Preston:
00:22:44
today we, you know, we were talking about, well, we're not really.
W. Curtis Preston:
00:22:47
I, I don't think of myself as a cybersecurity person.
W. Curtis Preston:
00:22:50
I think of myself as a backup and, and data person.
W. Curtis Preston:
00:22:52
And, and he made the point of saying, well, without data, there's
W. Curtis Preston:
00:22:55
no point in having cybersecurity.
W. Curtis Preston:
00:22:57
Right.
W. Curtis Preston:
00:22:57
Uh, which is, which is, which is really good.
W. Curtis Preston:
00:23:00
Right.
W. Curtis Preston:
00:23:00
Um, I, I am curious, w with this survey that you did, um, or study whatever,
W. Curtis Preston:
00:23:07
whatever you'd like to call it, what.
W. Curtis Preston:
00:23:10
When you went out there, can you speak at all to like the percentage
W. Curtis Preston:
00:23:16
that you would find, like if you, if you were at a hundred companies,
W. Curtis Preston:
00:23:20
how many of them had something that you would consider truly scary?
W. Curtis Preston:
00:23:25
Uh, a misconfiguration that was
Doron Pinhas:
00:23:28
Are you sitting tightly?
W. Curtis Preston:
00:23:31
Uh, I'm sitting tightly.
Doron Pinhas:
00:23:33
Yeah.
Doron Pinhas:
00:23:33
Well, you know, pretty much all of them.
W. Curtis Preston:
00:23:36
I knew you were
Doron Pinhas:
00:23:37
the average, right, so, so the average device on average, A
Doron Pinhas:
00:23:45
device, and again, we define a device as either truly physical device, like a
Doron Pinhas:
00:23:49
sand fabric switch, or a storage array or back backup appliance or archiving
Doron Pinhas:
00:23:54
appliance or stuff like that through a media server, which is a, you know, hosted
Doron Pinhas:
00:23:58
a piece of software and a master server.
Doron Pinhas:
00:24:01
Each one is a device, so the average device will have 14.
Doron Pinhas:
00:24:06
Risks out of which three are critical or major, meaning that if I'm a hacker,
Doron Pinhas:
00:24:10
I, I can get in and take your data out.
Doron Pinhas:
00:24:12
So it's, that's not to say that 100% of the organizations were, uh, in a poor
Doron Pinhas:
00:24:18
situation, you know, maybe two or 3%.
Doron Pinhas:
00:24:21
Did actually better than others, but by and large, I think the state of the
Doron Pinhas:
00:24:29
industry is not great yet to be mild.
Doron Pinhas:
00:24:32
And if you want to be more brutal, it's dismal.
Prasanna Malaiyandi:
00:24:35
Do you feel though that some of this is because storage and
Prasanna Malaiyandi:
00:24:39
backup, it's kind of like a web, right?
Prasanna Malaiyandi:
00:24:41
A very complex tangled web that no one really knows how everything
Prasanna Malaiyandi:
00:24:45
is all connected together, which leads to some of these issues?
Prasanna Malaiyandi:
00:24:49
Or do you think it's some other situation why companies are doing poorly?
Doron Pinhas:
00:24:56
Yeah, I'd love to debug that notion by the way that it's a
Doron Pinhas:
00:24:59
web, which is too complex for the human intellect to grasp, right?
Doron Pinhas:
00:25:02
You didn't say that exactly.
Doron Pinhas:
00:25:04
Like I'm, uh, but, but, uh, no.
Doron Pinhas:
00:25:06
So there, there is a way to put structure on top, you know, roll up
Doron Pinhas:
00:25:10
your sleeves and you can apply a clear methodology to, to be much better.
Doron Pinhas:
00:25:15
It's actually.
Doron Pinhas:
00:25:17
Not very difficult.
Doron Pinhas:
00:25:18
We, you know, if time allows, we can talk a little bit about what
Doron Pinhas:
00:25:20
you can do to be much more secure.
Doron Pinhas:
00:25:23
So, uh, I and I object to making it something really intangible
Doron Pinhas:
00:25:27
that's, you know, incomprehensible.
Doron Pinhas:
00:25:29
It's just a little bit of work.
Doron Pinhas:
00:25:31
We have all the foundation.
Doron Pinhas:
00:25:32
So what, but what are your, to
Prasanna Malaiyandi:
Speaker:
00:25:33
oh, sorry, sorry, sorry.
Prasanna Malaiyandi:
Speaker:
00:25:34
Uh, my question though wasn't necessarily about security guidelines being complex,
Prasanna Malaiyandi:
Speaker:
00:25:39
it was more the infrastructure that are deployed in customers environments
Prasanna Malaiyandi:
Speaker:
00:25:43
such that maybe when you're backing up, you don't know necessarily how all
Prasanna Malaiyandi:
Speaker:
00:25:46
the devices are connected together.
Prasanna Malaiyandi:
Speaker:
00:25:49
Right.
Prasanna Malaiyandi:
Speaker:
00:25:49
Or the different IT groups or things like that.
Doron Pinhas:
00:25:52
Yeah.
Doron Pinhas:
00:25:52
So you, you do have a point.
Doron Pinhas:
00:25:55
And I'll give an example, but it's still no reason not to, uh, you know,
Doron Pinhas:
00:26:02
uh, get a good handle of things, right?
Doron Pinhas:
00:26:04
So it can be complex, right?
Doron Pinhas:
00:26:05
So let's first prove your point, right?
Doron Pinhas:
00:26:08
Um, and I, again, I'm thinking like a hacker, right?
Doron Pinhas:
00:26:11
I want to attack your, uh, favorite backup software.
Doron Pinhas:
00:26:14
Mm.
Doron Pinhas:
00:26:15
And there are many ways I can go about it if it's not patched.
Doron Pinhas:
00:26:19
We mentioned some I can use, uh, default accounts maybe didn't really separate.
Doron Pinhas:
00:26:23
There was a principle of separation of, uh, authorities.
Doron Pinhas:
00:26:26
You don't want to have an admin account that can actually
Doron Pinhas:
00:26:29
manage, uh, the backup server.
Doron Pinhas:
00:26:31
You have to separate those entities into separate planes.
Doron Pinhas:
00:26:35
Some will argue that the, uh, backup admin should be part of active directory.
Doron Pinhas:
00:26:40
There are merits to that line of thought.
Doron Pinhas:
00:26:42
Um, you know, but it has to be strictly separated because the
Doron Pinhas:
00:26:46
first thing a hacker will do once they, they, they first get in.
Doron Pinhas:
00:26:49
Now they do a little bit of a, uh, uh, reconnaissance eventually, you
Doron Pinhas:
00:26:53
should assume they'll get admin level, uh, credentials, domain
Doron Pinhas:
00:26:57
admin level cred that will happen.
Doron Pinhas:
00:27:00
So when they do that, they should not be able to attack the backup software.
Doron Pinhas:
00:27:03
So now we can do that.
Doron Pinhas:
00:27:04
But let's say you did a really good job.
Doron Pinhas:
00:27:06
I'm at a loss now you talked about convoluted uh, dependencies.
Doron Pinhas:
00:27:11
Well, you know, in many cases, probably people have something like VMware.
Doron Pinhas:
00:27:15
VMware has a trust relationship with the backup software because when
Doron Pinhas:
00:27:19
we want to take consistent backups, every piece of software does that.
Doron Pinhas:
00:27:22
We use APIs for the Visser infrastructure to tell us when it's ready.
Doron Pinhas:
00:27:27
To, uh, back up consistently, whatever a vm.
Doron Pinhas:
00:27:31
Or a volume or whatever to do federated consistency.
Doron Pinhas:
00:27:34
Uh, in some cases we want to even delegate the infrastructure, the ability to tell
Doron Pinhas:
00:27:39
the backup software when to start a job, what would be the content of the job.
Doron Pinhas:
00:27:43
So we have some sort of a federated trust relationship Most.
Doron Pinhas:
00:27:47
Organizations we talk with don't really do that, uh, granularly.
Doron Pinhas:
00:27:52
So you, you, you have to think zero trust.
Doron Pinhas:
00:27:53
So they don't do that.
Doron Pinhas:
00:27:54
And if I can attack the vSphere infrastructure, let's say, if that hasn't
Doron Pinhas:
00:27:58
been secure, I can maybe use that to stop the backup jobs to alter the backup jobs.
Doron Pinhas:
00:28:03
So think about it, you're using immutable backup.
Doron Pinhas:
00:28:06
I really want to destroy it because I want to encrypt your files and demand my
Doron Pinhas:
00:28:10
ransom, and I want you to have to pay.
Doron Pinhas:
00:28:12
But you have immutable backups.
Doron Pinhas:
00:28:14
Ah, I can't really delete that.
Doron Pinhas:
00:28:16
Of course, there are ways to actually delete that.
Doron Pinhas:
00:28:18
If you didn't set it up, if you didn't set up immutability correctly, you didn't
Doron Pinhas:
00:28:21
enable retention log and stuff like that.
Doron Pinhas:
00:28:24
And I can maybe tamper with your system, but let's say you've done a good job.
Doron Pinhas:
00:28:28
Um, so I want to actually, my last research, which is very effective,
Doron Pinhas:
00:28:32
is to poison your backups.
Doron Pinhas:
00:28:34
How do I do that?
Doron Pinhas:
00:28:35
I break into vSphere.
Doron Pinhas:
00:28:37
I.
Doron Pinhas:
00:28:38
I find that it has the ability to alter the backup job, so I alter the content.
Doron Pinhas:
00:28:42
I'm starting to back up.
Doron Pinhas:
00:28:44
Instead of actual production VMs, I'm backing up jump my
Doron Pinhas:
00:28:48
temp directory, my swap file.
Doron Pinhas:
00:28:51
I just wanna make sure it's the same amount of data go that goes nightly.
Doron Pinhas:
00:28:55
So, Now I wait for two or three months.
Doron Pinhas:
00:28:59
So the backup jobs continue to run.
Doron Pinhas:
00:29:01
The backup admins, is that the job?
Doron Pinhas:
00:29:03
If you're not alert enough to find that the content has been changed, it's
Doron Pinhas:
00:29:05
successful, and after 90 days or whatever I deem necessary, I lock your files.
Doron Pinhas:
00:29:12
Um, now you go to the backup environment and say, oh, fine,
Doron Pinhas:
00:29:16
I have 90 days full of backup.
Doron Pinhas:
00:29:17
But none of them, it's all crap.
Doron Pinhas:
00:29:19
So the only valid backup you have if youre a bank is 90 days old.
Doron Pinhas:
00:29:22
Imagine you're calling your bank to say, where are my funds?
Doron Pinhas:
00:29:25
And they're saying, Hmm,
Prasanna Malaiyandi:
00:29:26
Sorry.
Doron Pinhas:
00:29:27
do you have a paper receipt?
Doron Pinhas:
00:29:29
Sorry, we don't know.
Doron Pinhas:
00:29:31
Um, so that can be bad, right?
Doron Pinhas:
00:29:34
So I can.
Doron Pinhas:
00:29:34
To your point, they are convoluted.
Doron Pinhas:
00:29:36
Trust, relationship, API gateways and services.
Doron Pinhas:
00:29:40
To name a few examples, we scan an environment and we find, you
Doron Pinhas:
00:29:44
know, you can find the management APIs of management consoles.
Doron Pinhas:
00:29:47
You just scan for the REST API and through IP address and you find,
Doron Pinhas:
00:29:51
you find, they say we have one management console and you find three.
Doron Pinhas:
00:29:54
One of them is, is in the lab.
Doron Pinhas:
00:29:57
Where they used to do testing two years ago, they never shut down that instance.
Doron Pinhas:
00:30:01
And it's not protected.
Doron Pinhas:
00:30:02
And it's, there is no time server, there is no cookie session cookie timeout,
Doron Pinhas:
00:30:07
and it still can control production.
Doron Pinhas:
00:30:09
So we want, so there are, it is convoluted, so I totally agree.
Doron Pinhas:
00:30:14
The only thing I, um, I would suggest is that you can become good at fi thinking
Doron Pinhas:
00:30:20
like a criminal, uh, or expecting what a, don't think like a criminal, but expect,
Doron Pinhas:
00:30:25
you know, be able to expect what I do.
Doron Pinhas:
00:30:28
And if you are at a loss, you can refer to some of the guidelines I've provided.
Doron Pinhas:
00:30:32
Go and go ahead and read the NIST Guide.
Doron Pinhas:
00:30:34
Go ahead and read.
Doron Pinhas:
00:30:34
The coming is a guide.
Doron Pinhas:
00:30:36
Snia has a lot of good re amazing resources around storage,
Doron Pinhas:
00:30:39
security, and you'll find you can.
Doron Pinhas:
00:30:41
Pretty easily compile a checklist of the i questions you should ask.
Doron Pinhas:
00:30:45
And these are relatively straightforward questions.
Doron Pinhas:
00:30:48
Where are my, where, where is, you know, one of the big areas is the control plane.
Doron Pinhas:
00:30:52
How do I control all that stuff?
Doron Pinhas:
00:30:53
Like we have API gateways, we have management consoles, we
Doron Pinhas:
00:30:56
have, uh, URLs, the, I lock it down, it boils down to a list of.
Doron Pinhas:
00:31:01
Finite amount of questions.
Doron Pinhas:
00:31:03
So you have to roll up your sleeve and do that.
Doron Pinhas:
00:31:06
Um, and, and as just, I don't want to talk much.
Doron Pinhas:
00:31:09
It's not an advertisement to our company.
Doron Pinhas:
00:31:11
We have tools that allow you to automate some of that stuff, so that
Doron Pinhas:
00:31:14
might prove useful, but, As always in life, you don't have to use our tools.
Doron Pinhas:
00:31:19
If you know what you're doing, you can do a good job with
Doron Pinhas:
00:31:22
manual tools, it's still okay.
Doron Pinhas:
00:31:24
Um, you know, woodworking, myself, you know, there are a lot of things
Doron Pinhas:
00:31:28
you can do with manual tools.
Doron Pinhas:
00:31:30
Power tools can save you some effort and increase predictability, but you know,
Doron Pinhas:
00:31:35
it can, you do a fine job manually.
Doron Pinhas:
00:31:37
So that's, that's,
Doron Pinhas:
00:31:38
still fine.
Doron Pinhas:
00:31:39
So, to her question, it's complex, but it's possible to, to actually
Doron Pinhas:
00:31:43
build a framework to add it your environment in, in a more, uh,
Doron Pinhas:
00:31:47
Comprehensive way and, and, and, and reduce the attack surface noticeably.
W. Curtis Preston:
00:31:51
The, cuz I, you know, you were saying, you know, you don't
W. Curtis Preston:
00:31:55
necessarily want to plug your company, but at the same time that, that's where I
W. Curtis Preston:
00:31:59
wanted to go next because I, I'm curious.
W. Curtis Preston:
00:32:01
So you, you're able to do this, um, you know, this, uh, automated check
W. Curtis Preston:
00:32:07
to check all of these settings.
W. Curtis Preston:
00:32:10
I, is that the service that your company provides or what, what else do
W. Curtis Preston:
00:32:13
you, you know, where, where do you go
Doron Pinhas:
00:32:15
yeah, so ultimately one of those days, you know, we
Doron Pinhas:
00:32:19
hope that organizations that want to automate a framework to check.
Doron Pinhas:
00:32:24
On a daily basis or an ongoing basis or after exchange that
Doron Pinhas:
00:32:27
they're always locked down.
Doron Pinhas:
00:32:29
They might be looking into something like what Continuity provides, which is an.
Doron Pinhas:
00:32:34
Engine that automates all of those checks that gets automated.
Doron Pinhas:
00:32:37
It's like an antivirus if you want it, or like a vulnerability management tools.
Doron Pinhas:
00:32:41
It gets automatic updates where all the vendor best practices, the latest
Doron Pinhas:
00:32:44
CVEs, the latest recommendations from framework like NIST and niso
Doron Pinhas:
00:32:49
and PCI and HIPAA are implemented.
Doron Pinhas:
00:32:51
And you, you can get automated compliance reports and if you've done something
Doron Pinhas:
00:32:55
wrong, you'll know what went wrong.
Doron Pinhas:
00:32:58
What is this syntax I need to use to fix the problem?
Doron Pinhas:
00:33:01
And you can start over.
Doron Pinhas:
00:33:01
So you, you know, we provide those tools to automate a frequent
Doron Pinhas:
00:33:06
mode of validation, right?
Doron Pinhas:
00:33:07
So that's something, uh, that can be helpful and we advocate that.
Doron Pinhas:
00:33:13
Uh, so, so that's how we make our living.
Doron Pinhas:
00:33:16
But we are also working with organizations to do one-off assessments.
Doron Pinhas:
00:33:21
Uh, no strings attached.
Doron Pinhas:
00:33:23
If you want to understand how material you are.
Doron Pinhas:
00:33:25
You know, we can definitely talk and first of all, share with you.
Doron Pinhas:
00:33:28
We'll happily do that because we learn so much from the, those interactions.
Doron Pinhas:
00:33:33
And we want to give some of that back, right?
Doron Pinhas:
00:33:35
So, uh, if you want to just run a one-time scan, you can approach us.
Doron Pinhas:
00:33:39
You can even approach your, uh, trusted, uh, security consultant and
Doron Pinhas:
00:33:43
ask them if they can do a scan for you.
Doron Pinhas:
00:33:46
Um, there are not too many options.
Doron Pinhas:
00:33:48
We are, we know, pretty unique, but they can use our software.
Doron Pinhas:
00:33:52
A lot of, uh, um, uh, there are many consultant firms out there that
Doron Pinhas:
00:33:56
have access to our technology and can use it to run a scan for you.
Doron Pinhas:
00:33:59
And even if that's a one time scan, you will understand.
Doron Pinhas:
00:34:02
What you're doing well, where you have issues, what are the
Doron Pinhas:
00:34:06
priorities of those issues?
Doron Pinhas:
00:34:08
What does it mean to your business in terms of, you know, not adhering
Doron Pinhas:
00:34:12
to industry standards and regulations If you are in a regulated segment,
Doron Pinhas:
00:34:16
uh, sometimes that's enough.
Doron Pinhas:
00:34:17
That's just, that's a starting point that can, uh, get you going
Doron Pinhas:
00:34:21
because now you have a better clarity instead of understanding that,
Doron Pinhas:
00:34:24
you know, I'm probably not good.
Doron Pinhas:
00:34:26
You'll know exactly what works well for you and where do you have issues.
Doron Pinhas:
00:34:30
So that's, In a sense, this is what our, uh, product does, and we make a living
Doron Pinhas:
00:34:36
out of selling it to those organizations.
Doron Pinhas:
00:34:38
Choose to be standardized 24 7 and be accountable.
Doron Pinhas:
00:34:42
We hope, uh,
W. Curtis Preston:
00:34:44
For what it's worth, uh, you know, I'm a fan of that, right?
W. Curtis Preston:
00:34:47
I'm a fan of automation.
W. Curtis Preston:
00:34:48
I'm a fan of, uh, you know, I mean, I, I like the fact that you
W. Curtis Preston:
00:34:52
have the check first off period.
W. Curtis Preston:
00:34:54
Right?
W. Curtis Preston:
00:34:54
I'm a fan of that.
W. Curtis Preston:
00:34:56
The idea, and, and, and those are good, right?
W. Curtis Preston:
00:34:58
Those, those one time checks are good.
W. Curtis Preston:
00:35:00
It's good to have a consultant look at your stuff once in a while to make
W. Curtis Preston:
00:35:03
sure that you're doing the right stuff.
W. Curtis Preston:
00:35:04
But there's nothing like just having something continually checking because,
W. Curtis Preston:
00:35:10
you know, um, there are always new CVEs, there are always new vulnerabilities
W. Curtis Preston:
00:35:17
and things that you need to patch.
W. Curtis Preston:
00:35:19
I think patching is the thing that most people get behind on the most, right?
W. Curtis Preston:
00:35:26
There's that one time configuration of making sure we separate this and that
W. Curtis Preston:
00:35:29
and we're using MFA and we're using.
W. Curtis Preston:
00:35:31
Um, you know, the, the proper, uh, usernames and passwords and not
W. Curtis Preston:
00:35:36
using root root, you know, you, that should hopefully be a one-time thing.
W. Curtis Preston:
00:35:40
I think it's the, the patch management, uh, and other things,
W. Curtis Preston:
00:35:45
maybe recommendations change over time.
W. Curtis Preston:
00:35:47
Uh, that, that's the one where it's like, it, it would be nice to have something
W. Curtis Preston:
00:35:53
that just tells me, Hey, a new CBE came out, you know, and, and, uh, you know,
W. Curtis Preston:
00:35:59
the vendor has patched it already.
W. Curtis Preston:
00:36:01
You need to go, you know, you need to go patch it right
W. Curtis Preston:
00:36:04
away or else you're at risk.
Prasanna Malaiyandi:
00:36:06
Yeah.
Prasanna Malaiyandi:
00:36:07
I think
Doron Pinhas:
00:36:07
So you, you'll get that.
Doron Pinhas:
00:36:09
Yeah, go ahead,
W. Curtis Preston:
00:36:10
Yeah.
Prasanna Malaiyandi:
00:36:10
I think the other thing, Curtis too, and I
Prasanna Malaiyandi:
00:36:12
know we've talked about this in previous podcasts, is like people's
Prasanna Malaiyandi:
00:36:15
environment is never static, right?
Prasanna Malaiyandi:
00:36:17
You're always getting new devices in some group or another, right?
Prasanna Malaiyandi:
00:36:20
New applications being spun up, right?
Prasanna Malaiyandi:
00:36:22
New deployments, new servers, and so having that ongoing check where it's
Prasanna Malaiyandi:
00:36:27
like, Hey, we can now make it more efficient for you to bring online these
Prasanna Malaiyandi:
00:36:31
applications rather than going through sort of the entire security audit
Prasanna Malaiyandi:
00:36:35
and everything else that you might.
Prasanna Malaiyandi:
00:36:36
Have to do, which might elongate the time you need by weeks.
Prasanna Malaiyandi:
00:36:40
Right.
Prasanna Malaiyandi:
00:36:40
The other thing also I was thinking is there's also, from what I've read, and
Prasanna Malaiyandi:
00:36:44
I don't know, Darron, if your product supports, I'm guessing it supports
Prasanna Malaiyandi:
00:36:47
public clouds as well as endpoints.
Doron Pinhas:
00:36:50
Yep.
Prasanna Malaiyandi:
00:36:51
Okay.
Prasanna Malaiyandi:
00:36:51
Right.
Prasanna Malaiyandi:
00:36:52
So as people are looking to go to the cloud, right, sometimes they're also
Prasanna Malaiyandi:
00:36:55
looking at multi-cloud strategies.
Prasanna Malaiyandi:
00:36:57
Right where maybe they're an expert at AWS and they're trying to figure
Prasanna Malaiyandi:
00:37:00
out, can I use Azure GCP for certain workloads or because of regionality
Prasanna Malaiyandi:
00:37:05
or services being available and, but they're not the experts.
Prasanna Malaiyandi:
00:37:08
And so to get up to speed and learn, okay, what is the mapping and what are the
Prasanna Malaiyandi:
00:37:11
best practices in AW or in GCP or Azure takes time and they're not the experts.
Prasanna Malaiyandi:
00:37:16
They don't have the resources.
Prasanna Malaiyandi:
00:37:17
And having a tool like this that can automate.
Prasanna Malaiyandi:
00:37:19
And say like, Hey, here are your best practices.
Prasanna Malaiyandi:
00:37:22
Are you doing things in the right way or not?
Prasanna Malaiyandi:
00:37:24
And giving you that guidance and be like, yep, this is how you should be doing
Prasanna Malaiyandi:
00:37:27
things, I think can go a long way as well.
Doron Pinhas:
00:37:30
Yeah, I totally agree, and I just want to add that over the
Doron Pinhas:
00:37:33
course of running a business, right, I've been in this position for 17 years.
Doron Pinhas:
00:37:37
I'm proud of that.
Doron Pinhas:
00:37:39
You know, people stay at an organization for years and over the span of years.
Doron Pinhas:
00:37:43
You know, if you take a look at the, if you're running a, an IT shop
Doron Pinhas:
00:37:47
and you take a look at how you have run your business five years ago.
Doron Pinhas:
00:37:49
Four years ago, three, two years ago.
Doron Pinhas:
00:37:52
You'll see that there are sometimes, there are tectonic
Doron Pinhas:
00:37:55
changes over those spans, right?
Doron Pinhas:
00:37:57
We change one of our major vendors.
Doron Pinhas:
00:37:59
We move from one backup vendor to another.
Doron Pinhas:
00:38:01
We change from tapes to discs.
Doron Pinhas:
00:38:03
We start adding cloud.
Doron Pinhas:
00:38:06
Tertiary copies now, each one of those, and, and if you look three, four years
Doron Pinhas:
00:38:11
back, you'll see tectonic changes.
Doron Pinhas:
00:38:12
But each one of those steps, they happen on a monthly basis.
Doron Pinhas:
00:38:15
You know, we throw away our own library and bring in a new vtl and,
Doron Pinhas:
00:38:20
you know, something like, and, and.
Doron Pinhas:
00:38:21
And we have like five of those.
Doron Pinhas:
00:38:22
So you know, they live like four or five years.
Doron Pinhas:
00:38:25
So, you know, every year we change one and we have tapes and we have
Doron Pinhas:
00:38:27
discs, and we've, every new release, we have different frameworks, we have
Doron Pinhas:
00:38:31
new releases, management consoles.
Doron Pinhas:
00:38:33
Every four or five years the architecture changes.
Doron Pinhas:
00:38:35
So whenever something like that happens, for me, it's new.
Doron Pinhas:
00:38:39
But if you are relying on an industry backed whatever, uh, library of
Doron Pinhas:
00:38:44
checks that, you know, should cover everything, and we learn a
Doron Pinhas:
00:38:47
lot from our, uh, user community.
Doron Pinhas:
00:38:50
They'll tell us, oh, we started looking into this.
Doron Pinhas:
00:38:53
Are you familiar with it?
Doron Pinhas:
00:38:55
Say, Hmm, interesting.
Doron Pinhas:
00:38:56
Let's take a look.
Doron Pinhas:
00:38:57
Let's take a look together.
Doron Pinhas:
00:38:58
What did you find?
Doron Pinhas:
00:38:58
Some of them are, so there is a sort of a community feedback here and uh,
Doron Pinhas:
00:39:04
maybe it's new for your organization, but it's probably not new for others.
Doron Pinhas:
00:39:08
And there is definitely an opportunity to have a much better starting point.
Doron Pinhas:
00:39:13
So, you know, I'm deploying.
Doron Pinhas:
00:39:15
Uh, a cloud target backup, you know, and I wanna make sure that I pass
Doron Pinhas:
00:39:20
all of the checks so I run a quick scan when it's not yet production,
Doron Pinhas:
00:39:24
and I find what I'm doing well.
Doron Pinhas:
00:39:25
And if there is room for improvement, usually there is.
Doron Pinhas:
00:39:28
So, you know, an ounce of prevention is worth, uh, a pound of KiOR, right?
Doron Pinhas:
00:39:32
So think about your, uh, immune system.
Doron Pinhas:
00:39:35
Let's say it would've run once a year for a day, and then it would stop shut
Doron Pinhas:
00:39:40
down for a day the rest of the year.
Doron Pinhas:
00:39:41
That's not great.
Doron Pinhas:
00:39:43
It's better than nothing, but so that's so, so to, to Curtis's point.
Doron Pinhas:
00:39:47
Yeah.
Doron Pinhas:
00:39:47
One time scan is awesome.
Doron Pinhas:
00:39:49
It's important to know if something is wrong, but you know you have to
Doron Pinhas:
00:39:53
be, or it's better to be continual.
Prasanna Malaiyandi:
00:39:58
Yeah.
W. Curtis Preston:
Speaker:
00:39:59
Yeah, I like that a lot.
W. Curtis Preston:
Speaker:
00:40:00
Um, so the, you know, I'd, I'd like to wrap up, but what I, what I am curious
W. Curtis Preston:
Speaker:
00:40:07
about early on, you alluded to, I mean, we've kind of discussed some of the
W. Curtis Preston:
Speaker:
00:40:13
things that you recommend that people do.
W. Curtis Preston:
Speaker:
00:40:15
Besides obviously running the continual scan.
W. Curtis Preston:
Speaker:
00:40:19
Um, are there some other things that you recommend people do to secure
W. Curtis Preston:
Speaker:
00:40:23
their storage and backup environment?
Doron Pinhas:
00:40:24
Yeah, sure.
Doron Pinhas:
00:40:25
So I think.
Doron Pinhas:
00:40:27
The first thing to do is to get to know a little bit more about I, I would even read
Doron Pinhas:
00:40:33
a little bit about the business threats.
Doron Pinhas:
00:40:36
What can possibly go wrong, right?
Doron Pinhas:
00:40:38
So maybe, uh, I'm not sure we'll have time to go there today.
Doron Pinhas:
00:40:41
Why is it important?
Doron Pinhas:
00:40:42
Really get a good grasp.
Doron Pinhas:
00:40:44
Uh, it's not a difficult read.
Doron Pinhas:
00:40:46
If you go to the Snea site, you go and, uh, take a look at the NIST or IZO guide.
Doron Pinhas:
00:40:51
You'll have a framework for, in the NIST guide, there are about
Doron Pinhas:
00:40:53
30 different areas you should be looking into, get familiar with.
Doron Pinhas:
00:40:57
What are the components you need to consider to build.
Doron Pinhas:
00:41:00
Secure framework, choose.
Doron Pinhas:
00:41:03
So, you know, so the first step is, you know, get a little bit more
Doron Pinhas:
00:41:06
knowledge about storage security.
Doron Pinhas:
00:41:08
Five years ago, it was not accessible to datas.
Doron Pinhas:
00:41:11
There are plenty of resources in our site, you know, it's
Doron Pinhas:
00:41:14
www.continuitysoftware.com resources.
Doron Pinhas:
00:41:17
You'll find a library of research and guidelines and advice and
Doron Pinhas:
00:41:21
useful links to other sites.
Doron Pinhas:
00:41:23
So there is plenty of material out there to get educated.
Doron Pinhas:
00:41:26
The second thing I would encourage to do is to define, at least at
Doron Pinhas:
00:41:30
a high level, a set of security standards you'd expect to have.
Doron Pinhas:
00:41:36
And you can draw, uh, um, uh, intuition or, or, or guidelines from the set
Doron Pinhas:
00:41:44
documents, either or NIST or other frameworks, build a set of baselines
Doron Pinhas:
00:41:48
like, so I want to lock down devices, I want to have password complexities.
Doron Pinhas:
00:41:52
I want to whatever, set up session cookies or session timeouts.
Doron Pinhas:
00:41:57
I want to, you know, these are my baselines.
W. Curtis Preston:
00:42:00
Mm-hmm.
Doron Pinhas:
00:42:00
Define those baselines and then, you know, find a way to
Doron Pinhas:
00:42:04
periodically review your settings.
Doron Pinhas:
00:42:06
You know, it's, um, it takes a little, uh, doing, but all the
Doron Pinhas:
00:42:11
building blocks are out there.
Doron Pinhas:
00:42:13
If you want to use automation, then we would be very happy
Doron Pinhas:
00:42:16
to help you achieve that.
Doron Pinhas:
00:42:19
You can even script that yourself, right?
Doron Pinhas:
00:42:20
So it's not everyone has to buy a power saw, right?
Doron Pinhas:
00:42:25
You can rent it.
Doron Pinhas:
00:42:27
Right?
Doron Pinhas:
00:42:27
So, but you know, Close the knowledge gap, understand what is there to check.
Doron Pinhas:
00:42:33
It's a finalist.
Doron Pinhas:
00:42:34
There are 13 different areas.
Doron Pinhas:
00:42:36
There are different ways to look at it.
Doron Pinhas:
00:42:37
It's structured.
Doron Pinhas:
00:42:39
Pick and choose the, the things that are important to your business
Doron Pinhas:
00:42:43
and find a way to put repetition into validating that you're clean.
Doron Pinhas:
00:42:46
This way whenever you roll out something new and it always happens,
Doron Pinhas:
00:42:50
you have a, at least a point where you can, you know, validate your design.
Doron Pinhas:
00:42:53
So these are three things that you can easily do.
Doron Pinhas:
00:42:55
Um, and again, our sites has a lot of nice videos that simulate
Doron Pinhas:
00:43:00
how, you know, how hackers thinks.
Doron Pinhas:
00:43:02
What they can do in a specific scenario.
Doron Pinhas:
00:43:05
Uh, when you start thinking like that, uh, it can be even interesting
Doron Pinhas:
00:43:10
is to to think a little bit like a hacker and, and build better designs.
Doron Pinhas:
00:43:14
If you want to make your house burglar proof, you should just take
Doron Pinhas:
00:43:17
a look outside and think critical and say, I can get in through here.
Doron Pinhas:
00:43:22
What about the basement door?
Doron Pinhas:
00:43:24
What about my Tesla keys?
Doron Pinhas:
00:43:26
And so on.
Doron Pinhas:
00:43:27
So, uh, I can hide in the Tesla.
Doron Pinhas:
00:43:32
Uh, yeah, back seat and wait for you to open the garage doors.
W. Curtis Preston:
00:43:38
Yeah, I,
Doron Pinhas:
00:43:39
that, that's my advice.
Doron Pinhas:
00:43:40
It's pretty straightforward, so.
W. Curtis Preston:
00:43:42
yeah, I like the, um, I, I think, uh, we'll put some
W. Curtis Preston:
00:43:47
links in the show notes, uh, to the, to the things that you talked about.
W. Curtis Preston:
00:43:52
I like that idea a lot.
W. Curtis Preston:
00:43:53
Um, basically just make yourself more knowledgeable.
W. Curtis Preston:
00:43:56
Is, is the key.
W. Curtis Preston:
00:43:58
Cuz I, I do think that, you know, our folks tend to be backup centric,
W. Curtis Preston:
00:44:04
um, security, you know, they're learning security and a lot of backup
W. Curtis Preston:
00:44:09
folks are often junior folks, right?
W. Curtis Preston:
00:44:12
The, this is the job they were able to get.
W. Curtis Preston:
00:44:15
And mainly because nobody else wanted it, right?
W. Curtis Preston:
00:44:18
Um, yeah.
W. Curtis Preston:
00:44:19
I mean, that's how, that's how I got my first job in backup.
W. Curtis Preston:
00:44:23
And so yeah, this is definitely the part of that, the part of the world
W. Curtis Preston:
00:44:29
that you really need to go to, right?
W. Curtis Preston:
00:44:31
You really need to increase your cybersecurity knowledge.
W. Curtis Preston:
00:44:34
If you don't have that, if you were listening to this episode and these,
W. Curtis Preston:
00:44:38
uh, acronyms that, that, uh, we were, you know, rattling off like nist, if
W. Curtis Preston:
00:44:42
those are foreign to you, Definitely follow the links in the show guides
W. Curtis Preston:
00:44:46
to, um, to, to learn more about that.
W. Curtis Preston:
00:44:48
Well, uh, Doran, I want to thank you for, for coming on the show
Doron Pinhas:
00:44:53
Perfect.
Doron Pinhas:
00:44:53
It was my pleasure.
Doron Pinhas:
00:44:55
Thank you for having me.
W. Curtis Preston:
00:44:57
and Prasanna.
W. Curtis Preston:
00:44:57
You, uh, continue to get all the blame for my Tesla, but,
W. Curtis Preston:
00:45:01
uh, I'm glad you're here anyway.
Prasanna Malaiyandi:
00:45:04
Yeah.
Prasanna Malaiyandi:
00:45:04
Thanks Curtis and nice to meet you Doran, and thanks for
Prasanna Malaiyandi:
00:45:07
answering all the questions.
Prasanna Malaiyandi:
00:45:08
I think it's a very compelling, uh, solution, right.
Prasanna Malaiyandi:
00:45:13
And solves a very specific problem that I think there's, like you mentioned, right?
Prasanna Malaiyandi:
00:45:18
There's a huge blind spot to this.
Prasanna Malaiyandi:
00:45:20
So I think it's very valuable.
Prasanna Malaiyandi:
00:45:22
And Curtis, I hope one day that you will thank me that, that you bought your Tesla.
Prasanna Malaiyandi:
00:45:26
So I'll just, uh, I'm not gonna hold my breath for that day, but.
W. Curtis Preston:
00:45:30
There's this, there's this other person in my
W. Curtis Preston:
00:45:32
house that is still blaming you, but, uh, we'll, we'll, we'll see.
W. Curtis Preston:
00:45:36
Maybe, maybe one day.
W. Curtis Preston:
00:45:38
Uh, well, anyway, I, I want to thank our listeners.
W. Curtis Preston:
00:45:41
You know, you, you are why we do this, and remember to subscribe
