00:00:00Tech Talk
00:10:00Email Security and Zero Click Vulnerability
00:16:39Connected Device Security Risks
00:25:30Insider Threats and Data Resilience
00:35:33Backup and Recovery Importance
درباره این اپیزود
How safe is your email? This week on Zero Gravity Live, we explore the hidden threats lurking in your inbox, starting with a zero-click vulnerability in Microsoft Outlook that can activate malicious code just by viewing an email. We dive into the critical importance of zero trust and data resilience, drawing parallels to past cybersecurity challenges and emphasizing the need for robust security practices in an ever-evolving digital landscape. You'll also hear our thoughts on why unique passwords are still one of your best defenses against these sophisticated attacks.
Next, we shift gears to discuss the most perilous connected devices of 2024. From unpatched hypervisors to vulnerable IP cameras and NAS devices, we explore how these technologies, while integral to modern operations, pose significant risks if left unsecured. We share a real-world example of an insider threat where a former IT employee wreaked havoc by wiping out 180 virtual servers, illustrating the devastating potential of both external and internal security breaches. Learn why zero trust, immutability, and resilience are non-negotiable in today's cybersecurity strategies.
Finally, we underscore the indispensable role of backups and recovery plans in safeguarding business continuity. Discover why simply having backups isn't enough without ensuring their recoverability through techniques like verification and the 3-2-1-1-0 rule. We'll discuss how a comprehensive strategy can protect your operations and reputation from all types of threats, including rogue administrators and ransomware. Stay tuned for our next episode, where we'll reveal the surprising dangers posed by emojis in your digital communications. Until then, stay weightless, stay frictionless, stay zero gravity.
Watch us live every Tuesday at 11 am EST
Need the best storage for Veeam? Check out Ootbi by Object First
انگلیسی
ایالات متحده آمریکا
یادداشت ها را نشان دهید 🔗
رونوشت 🔗
Speaker 1:
0:00
Welcome back to Zero Gravity Live, the Weightless Weekly Tech Podcast, bringing all the latest discussions right to you. Listen, we're sponsored by Object First OOPI the best storage for Veeam. And if you've watched this show before, you already know you're on YouTube. Ring the bell, give us a like, leave us a comment. If you're watching on LinkedIn, let us know where you're coming in from. If you're watching from YouTube, we also want to know. And if you're watching on LinkedIn and you're wondering, like where are all the extra pixels going, they're on YouTube. So you know, I always recommend watch on YouTube.
Speaker 2:
0:34
Get that 4k action. Are we? Are we in 4k Matt?
Speaker 1:
0:35
No we're not Okay. Well, the pixels? We care about the pixels here on the show. And if you're listening in audio form on podcast, we welcome you to and ask that you share with your friends and leave us a nice little review. I'm Anthony, joined by my fellow co-hosts, Matt and Sterling. How y'all doing today.
Speaker 3:
0:53
Doing good man.
Speaker 2:
0:54
Doing good, feeling great. Gorgeous day. Here we're into the summer season. It's doing awesome. How are you?
Speaker 1:
1:02
I'm doing fantabulous, but I'm going to be doing a lot better when I find out what's going on in y'all's office. So I know. Before the show, Matt, you whipped out your wallet and said it's something to talk about. I want to know what's the deal with your wallet.
Speaker 3:
1:16
Well, so full disclosure. I had another call that ran right up to our show today, so I didn't have an opportunity to go digging for something really cool and I feel like everything in my purview that's right out of shot here. I've already talked about you know I've got the pocket three rocking right here and some other things. But I tell you, you know, anthony, every time I go somewhere and I pull out my wallet, people will make a comment like that's the coolest thing ever. Where'd you get it? So this is called the the flip side. This has got nothing to do with technology. What a cool color. I think it's really cool because you know more people are starting to at least more guys are doing the front like pocket wallets versus the old costanza. You know you sit on a slant in your back pocket wallet and what's really cool about the damage to your back.
Speaker 3:
2:02
yeah, exactly, your vertebrae is getting out of kilter. But one of the things I love about it is it's got a quick access port for, let's say, your most commonly used card, and then it's got a locking mechanism and when it opens up you actually have a slot here, my trusty Costco card, but there's also probably about, I would say, four to five. You can get like right in this little holder area, then you've got you know cards here and this will also hold about four, but then wait, there's more.
Speaker 3:
2:33
flip it this way, oh look and you've got your id and you actually have a money clip where you can clip money right there, and when it's closed, everything is nice and tight and you also have an attachment right. So this attachment will replace this little card slot. So if you, let's say, you're going to a show and you want to put some business cards in there, you can just place your business cards under this little rubber strap and there you go. It's like the wallets.
Speaker 2:
3:01
Are you kidding me? You know it's. It's. It's so crazy, matt. I just saw something on the interwebs yesterday. It was a new style wallet where you hit a button and all of your credit cards come out, but they come out in sort of a cascaded thing to make them easy to use. And so this is pretty awesome, because the wallet has not been innovated for like ever, and I'm glad we're starting to see some like new innovations. I've always been one of those, the thin wallet guys, not the Costanzas like normally in the back, but now we have our health cards and then I live in a condo. It's the access key, it's the Costco, it's like all of these things continue to just build until you're sort of Costanzing.
Speaker 3:
3:45
Well, and you know too real quick on that topic, about the one that you know, put your cards out. So the Ridge wallet is super common, right? You know, I know Marquez from NK, uh, his review channel, nkdbhd or whatever it is. So he's now partnered with Ridge wallet. But my problem there is, there's just not enough real estate in that thing, to your point. Sterling Like this is still to me very thin. I mean, it's pretty much you know the the width of your thumb, let's say so it's still very flat. But I mean I can keep 12 cards in there, plus cash, plus my driver's license, and it's nice and closed to me. That's why I've never looked at any of those thinner ones, because to your, unless you only have two or three cards with your ID, that's about the only time those are useful. Yeah, yeah.
Speaker 2:
4:29
You're absolutely right. Is it bulletproof?
Speaker 1:
4:32
That thing is thick. Can it stop a bullet? It is absolutely not bulletproof but it is object-first orange. Oh well, I guess all of my qualms have been sated. Uh, you know, I'm pretty silly, you know, because I I go for the thin wallet and I don't even carry it in my pocket, I keep it in my man purse. So you know what? Why do I even do that? I don't know, but maybe I should get one of these because it seems way more convenient than what I'm rocking.
Speaker 3:
5:00
Uh, thank you for sharing what was that called, matt it's. It's called the Flipside Flipside. You can pick it up at your local Amazon. That's pretty slick. I do like that.
Speaker 1:
5:10
Really. I know you don't have something to share physically, but there is an image I've heard there's an image.
Speaker 2:
5:31
Yes, absolutely. What I have to share today is not something that's in my office, although, leave it up to me, it probably could be in my office soon. What I have to share today is really something along the motif of our entire team here now we talk about being zero gravity, weightless, frictionless. Well, there is a battery version of that. Well, wait, hold on, something's not. It's not showing up here. Uh-oh, I was just working. There was a. There's a battery view with a view of a battery that I was showing. That's actually called Zero gravity batteries.
Speaker 2:
5:48
All these batteries are lithium batteries made specifically for motorcycles. So these are actually pretty cool because you know they can shave off, let's say, in a motorcycle. An average motorcycle is 350 to 400 pounds. They can go 600, 800, but let's just call it on an average, the average battery is 10 pounds, and so you put in one of these bad boys into the bike and it literally drops it by nine pounds. So think about that, something that gives you more cold cranking amps, more power to start it up, it lasts much longer, it doesn't need to be plugged in, it can literally last, for I mean, I've seen them actually over a year sitting without going flat and you're saving all this weight.
Speaker 2:
6:30
So a lot of you out there might be thinking why don't I just put one of these bad boys in my car? Some people do. But let me tell you, if it's your daily driver, there are a couple of small downsides. If you live in an environment that gets really cold sometimes, these lithium batteries have a tough time really cranking in really cold weather. And also for your daily driver, to save 20, 30, 40 pounds, it sounds like a whole lot, but for the cost differential it's probably, for a car battery, hundreds, if not into the thousands, of dollars. And so you have to ask yourself, if you're not racing or if you're not tracking the vehicle, is it really worth the squeeze of dollars? And so you have to ask yourself, if you're not racing or if you're not tracking the vehicle, is it really worth the squeeze of uh for the juice? So that was what I had shared today. I'm not too sure why it's not pulling up, but it's an awesome battery. Uh, if you're looking for an easy way to shave some pounds.
Speaker 1:
7:16
I'm sure everyone listening to the podcast appreciated your verbal description of the item. So all the good Sterling Now. Now you know, my only issue with lithium ion is it just it seems like it's an imperfect technology. Yeah, right, like, yeah, you know battery. Well, actually, wait, there it is. Oh, there, it is there, it is okay. So now we can all see yeah, I mean, it looks like a battery.
Speaker 2:
7:37
Yeah, it does look like a battery it looks um, feels just like it's just super light.
Speaker 1:
7:41
Yeah, yeah yeah, you know, we went from like what was it? Salt, like salt acid, to lithium ion, and now they're saying again, like salt might be the next battery thing. Technology, yet again that we get into, because, you know, lithium ion explodes, it gets hot, it doesn't work in the cold, like you're saying, like it's just, it's imperfect. Yeah, but one day, man, I'm I'm super excited for the day that we don't really have to worry about batteries anymore because we figured out something better than storing power in these, these devices that just don't operate, given all the different circumstances.
Speaker 3:
8:16
Yeah, yeah certainly I've actually held one of those batteries and it's it's almost comically light, like for a battery it it doesn't seem possible that it works right but it actually works. Yeah, there's a reason why they call it anti-gravity for sure yeah, it literally feels like a toy, doesn't it?
Speaker 2:
8:33
yeah, like it doesn't feel like it should be that light. The packaging is strange. I pretty much have all of my motorcycles, even my former race bike, switched over to these anti-gravity batteries because for me I can feel the difference in side to side roll of the bike and the cold cranking apps never come in. Uh, uh, not handy.
Speaker 3:
8:51
So yeah, yeah no doubt Very nice.
Speaker 1:
8:54
Well cool. Thank you for sharing that. Gentlemen Always appreciate seeing what's going on in your office. I got nothing. I got nothing to show, so we'll just move right on. Um, speaking of moving on, I know we've got some interesting topics this week. Matt, you're up first. What do you got?
Speaker 3:
9:09
Yeah, so this was interesting. I actually saw Anton Gostev for those of you who know him one of the heads or the head of product management over at Veeam. He posted this on X the other day and I thought this was really eye-opening. So when we think about security vulnerabilities with applications and, prime example, when we think about phishing email attempts and things such as this, it seems like historically and maybe I have been living under a rock, but it seems like historically you always had to do some sort of action to activate the vulnerability, right. It's always like don't open that suspect email attachment. Well, we all know that, right. You open a exe file, you know what, godspeed, right, because you know that's going to have an issue.
Speaker 3:
10:00
But what I found really interesting about this is there was a very recent security vulnerability in Outlook coincidentally pretty much what everybody uses for their email client where you did not even have to open the email. So it's like you know, like, in other words, when you're going through your emails and you see your inbox and you first click on it just to view it. That's when the vulnerability was activated and I'm like whoa talk about like next level triggers, because for me that's something that I would never even thought was possible. You know, because you're not really doing anything, you're not clicking a link, you're not opening an attachment, you're literally just viewing the email but something in the code, and there was this security vulnerability. You can see the timeline there. See if I can zoom in a little bit. So April 3rd is when this was first reported, and it wasn't patched until June 11th. So talk about that gap of like. How about everybody just stay out of Outlook until we get this vulnerability patched? Like? That's next level, though, gents.
Speaker 1:
11:06
Zero click vulnerability, Like I feel. Like you know, we always talk about zero day, but I've not heard of a zero click before. That's scary, that's really so what's the impact of this? You might've said it and I missed it, but what happens if? You scroll past an email with one of these.
Speaker 3:
11:26
Yeah, well, it depends on what the attack is. I think this one wasn't necessarily specific to one type of malicious act. It was just a vulnerability in the program where code could be called to action if you just open the email. Just open the email. So again, this one was like more of a Microsoft like uh-oh, outlook is super vulnerable to anybody who might want to target this type of vector, so let's get it patched. And I just thought it was a little shocking. It took that long to patch, you know, for something so severe.
Speaker 2:
11:58
So this is if you open it right and what constitutes an open. I'm asking for all my reading pain. People out there.
Speaker 3:
12:04
This is my understanding right. And if you're in Outlook, at least on a desktop right, and you've got your inbox and you're just clicking from email to email where you get the reading pain on the right, that's opened. Yeah, and that's like disturbing because to me that's. I almost look at that as like I didn't do an action. I'm using Outlook like Outlook's supposed to be used, viewing inbound email, like I said earlier, opening an attachment. I mean, obviously those come with known risks, right, depending on what it is, but just to see the text and the body of the email, that's scary.
Speaker 1:
12:41
So, man, this is concerning because one Outlook, like you said, is the most used mail app on the planet by a large margin. Most big businesses are using 365 and Outlook. It's scary because it's zero click. You don't know, you have it, it's in your infrastructure. I think this perfectly highlights we talk about zero trust, data resilience and zero trust. A lot on this show Because it's in your infrastructure. I think this perfectly highlights. You know, we talk about zero trust, data resilience and zero trust. A lot on this show. You know because it's important.
Speaker 1:
13:12
But when we talk about segmentation and we talk about backup, storage and backup software, the reason we segment those things is because one should not ever influence the other. If there is a breach. Right, we want to separate as much as we can. How do you separate yourself from Outlook? Right? Like this is the thing that literally connects everything together. I mean, how much of your day is driven by email? I receive a file, I receive an attachment, that's how I'm going to go do my job. I have to go communicate with somebody. Like, yeah, we have Slack and the tools, but Outlook is the connective tissue that most organizations need to tie them together. You can't really segment yourself from this. You can't zero trust Outlook. So what do you do Like I don't have an answer, but this is concerning to me.
Speaker 3:
13:59
Yeah, and I just I hit the Microsoft site and technically, according to them, this wasn't exploited, it was just a known vulnerability. That could have been, but that's what they know, right? I mean, who knows? There could have been exploits that are yet to be reported from this window gap. That happened. So you're right, I don't know how you segment Outlook out of your lives, unless it's a different email client, but in the Microsoft world there is no secondary no secondary, it just I think it lends to the.
Speaker 1:
14:30
This is why you need to use different passwords and accounts for everything right, because even if it's just compromising your information, that's gathering things from you, you still need to ensure as much differentiation there as possible. And, uh, you know, don't put anything precious on your laptop, because in a moment you could scroll past an email. In a moment's notice it's all locked down and gone crazy talk.
Speaker 1:
14:52
Yeah, that is pretty crazy yeah, you brought like I'm johnny ray. I mean I'm still gonna be johnny rain cloud, but you rain today, matt dude I saw anton tweet that the other day and I'm like zero click.
Speaker 2:
15:08
That's a yikes.
Speaker 3:
15:10
Yeah, that's next level. I hadn't heard of that one yet.
Speaker 2:
15:13
I feel like in the past wasn't there a text message that was going around I don't know, maybe 18, 24 months ago maybe have my timing wrong where there was an exploit that was executed just by receiving this message? Yes was an exploit that was executed just by receiving this message. Yes, right, so this sort of this sort of zero interaction attack is something that sounds familiar to me, but obviously not something as big.
Speaker 1:
15:33
On the email it was it was called something power right, like uh, you would send them a text and it had like a combination of like arabic characters and you know emoji, like it was. But when you sent that text it could restart your phone and it was. It was an apple, uh vulnerability and in the message and the way that, like it was receiving the characters and executing on the back end, this is scary stuff it was sent to me and it scared the crap out of me.
Speaker 1:
16:00
Yeah, so we just gotta like we have to accept that every single device can be compromised and every single app inside the device can then compromise the device. It's well said. It's a messy world.
Speaker 2:
16:13
Zero trust is life. I mean, really there's no other way around it. Today we talk about a lot from on the backup portion of it, the segmentation of the permissions, but it's everywhere today, even in the physical world, you can't trust the person that's walking in behind you into a door. I could go on.
Speaker 1:
16:31
Yeah. I totally agree, rough stuff.
Speaker 3:
16:35
Thanks, Matt, for that.
Speaker 1:
16:37
Great way to start the day.
Speaker 3:
16:39
Don't check your email. Maybe this is a new reason to just keep your inbox empty.
Speaker 1:
16:45
Well, I mean, how are you going to empty it if you don't know what's in there? You got to scroll through it Don't look, no more email. We just came up with the best excuse to not do your job Tell your boss. I can't read your email because I don't want to put the company at risk.
Speaker 2:
17:02
Yeah, hey boss, I'm keeping you safe.
Speaker 1:
17:04
That's right. I feel protected, not reading my email, always thinking yeah, yes, yeah. Sterling, what do you have for us today?
Speaker 2:
17:13
I have to share a little something with you all, which is a report, the 2024 report of the riskiest connected devices. So you know you should check out this report. It's actually a pretty good read. So you know you should check out this report, it's actually a pretty good read, but you know the TLDR. Just to kind of skip through. What are the riskiest devices of 2024? Well, they're categorized like this IT devices, internet of Things, operational technology and Internet of Medical Things. So the IT devices they're listing as routers, access points, and this one I thought was really interesting, considering what we're talking about hypervisors, which of course allows the attackers to attack multiple VMs at a certain time, encrypting, moving, deleting, and so these devices were ranked number one on the attack vector of riskiest connected devices.
Speaker 2:
18:07
The internet of Things we're talking about the IP cameras, voip printers and, of course, nas. We talk a lot about the segmentation of data. This list is really pointing it out to us right here. Your VMs are not safe. They're attacking that right away. Nas was also on the list of Internet of Things for obvious reasons. It's where your data lies, right at the end of an IP address, right.
Speaker 2:
18:29
But also they're commonly found online, have significant vulnerabilities and often exploited by botnets. When we talk about the operational technology part, it's UPSs smart lighting UPS. They're involved in power monitoring and, of course, data center power management, and they're often left with the default credentials in place and the consequences of an attack there could include power loss. So that's three on the list and, of course, rising but new to the list is the Internet of Medical Things. They connect to things like health records, billing informations. The criticality of all the data is truly there. We're talking about imaging workstations, often left unpatched and exposed online. We're talking about picture archiving systems and even some ECGs that are used to actually get some of that deeper patient data from the patients themselves really are just left connected wide open. So those, those are the riskiest things for 2024.
Speaker 1:
19:31
Scary huh can you I don't know if you have more information on the hypervisors bit, but I'm curious and it's not because I'm gonna, you know, talk about this on my topic or anything, but I I'm just wondering what makes the hypervisor the most riskiest connected device it must be, because if they don't go into this, I'm going to take a stab at it and, matt, you can tell me what you think too.
Speaker 2:
19:51
You know how we as admins sometimes do. We rip from templates, we throw them up in the infrastructure. We didn't patch them. They're sitting out there. Oops, I left the NIC on. It's connected directly to the internet, not through a particular vlan. That actually creates a little bit of a dmz, I bet you. That is why they're talking about that, but they specifically called it out. If you check out this article, it is specifically called out as one of the riskier things, right below forward-facing routers yeah, yeah, no, we'll.
Speaker 1:
20:22
We'll talk more about that in a minute.
Speaker 3:
20:23
But, matt, I'm curious here what you think well, you had me at dark reading sterling I I mean Right at the top of the page. I'm like, oh, this is going to be great, yeah. No, I think the hypervisor to your point. You know it's connected to literally the rest of the virtual infrastructure. So if somebody were to find a vulnerability or a hole, you know, maybe their distributed virtual switching weren't locked down right, maybe there was a port left open, you know, maybe somebody didn't block 3389 and RDP is just wide open to the outside world. I mean, there's a lot of potential vulnerabilities that people could overlook and could miss. And if somebody gained access to the hypervisor, well, I mean all the VMs, the data stores, I mean they could blow everything away Technically, they could delete the VMs without even needing to get into the VM, right?
Speaker 3:
21:11
So it's like a lot of potential risk, especially to businesses, leaving stuff like that connected, Whereas I kind of jokingly go back to the connected toothbrush what's anybody going to do if they hack your toothbrush bro? To do if they hack your toothbrush bro. So it's like I guess there's different levels of risk based on connectivity, right, and I definitely think from a business perspective, the hypervisor, I mean, that is the business. If they run virtualization and if you can do anything, they own it.
Speaker 1:
21:44
I mean, my big problem with all of this is we can't just walk away from these technologies, right? Outlook hypervisors, medical devices, internet of things. Like, we're way too ingrained in this technology to simply say, well, it's too risky, it's too insecure, it's too under-reliant, let's pack it up. Move on to something. There is nothing else, right, there's nothing else that we can use. The challenge truly seems to be that you can't secure it, so you accept that it will always be vulnerable. But then what? Like, there has to be a means to an end in all of this. And how we say OK, yeah, everything sucks, but here's the here's how we get through it. Right, like, there has to be an uptick. I'm struggling to see it these days.
Speaker 2:
22:34
Well, what oh go ahead Matt.
Speaker 3:
22:36
I was going to say. You know, this is something similar came up with. You know the VMware changes that are going on in the industry today. Everybody's like, well, they'll just jump to Kubernetes or they'll jump to containers. I'm like, well, not so fast. Like to your point. Like there's a spot for containers, there's a spot for virtualization. They are not the same in any stretch of the imagination. So it's like there's tech that's always going to be around.
Speaker 1:
23:01
To your point, anthony, it always has to be, unless we want to go back to the non-virtualized server you know, one server does this, one server does that?
Speaker 3:
23:10
Hey, hardware companies would love it, but you know, I just don't think that's the answer either. So I think, to your point, there's bound to be a way that, as you know, bad actors and as malicious attacks increase, we also have to, you know, increase and elevate the tech and the sophistication of the good guys, yeah, to make sure everything is just that much more secure.
Speaker 2:
23:32
I kind of feel like the answer is sort of somewhere in between. We're starting to see a little bit of a twist and I think some of our industry right now I mean, if you even look at to your point the ideas of VMs and then using kind of an infrastructure consideration and thought and so solutions maybe the many big solutions really kind of contain both. We saw this huge pivot to the cloud five, six years ago. Everybody starts throwing their data into the cloud.
Speaker 2:
24:06
Object storage blew up all of the facets of those pieces that people like, but then again here came all of the new threat vectors that were pointing other things out the true zero trust process, not being able to bring data back in a true and efficient way, and so things and solutions that actually augment that. We know people aren't going to stop using the cloud, but when it comes time and you're at the zero second to try to rebuild your infrastructure, you probably want some of that storage on premises to be able to bring it back quickly, and so it's kind of hard to sit here to be like on premises. Storage is the future, but at the same time, when we start to look at some of these new things that are coming out, the new threat factors, the way we use technology. I feel like we're just going to see a bigger segmentation when we start to see what tools are used where.
Speaker 1:
24:54
Completely agree, and it's funny, both topics. We've kind of discussed segmentation and the importance thereof, and it's not just at the hardware layer right Like, we can segment at the software layer, the service layer, the operating system layer, and the person layer right Like the people layer, we can implement segmentation as well. Person layer, right Like the people layer, we can implement segmentation as well, and I think we'll get more into that in a second. But this is super man like. I feel like we're just, you know, batting for three for three on the Johnny Rain clouds today. Here we go. So what I wanted to talk about is a former IT employee gets 2.5 years for wiping 180 virtual servers. This individual, who worked for a company, was fired and after he was fired, executed a script that he'd been working on for apparently months which might explain why he got fired to do damages estimated at 678. Is that a million? There's an extra zero on there. I don't really know how the extra zero works.
Speaker 1:
26:01
There is an extra zero 6,780,000 is the number I'm guessing. They had been working on the script for a while, just in case they ever were removed from the company, and when they found out they were fired. They executed the script and it went and just purged 180 virtual servers. Now there is a funny moment in this tale. It's one little ray of hope. The investigator mentions that the individual developed the wiper script via Google searches on how to delete virtual servers, so the man was exposed from his internet history. That's how they were able to figure out that he was the one who committed the crime.
Speaker 3:
26:34
Now go ahead. Matt, I have to ask is this Inateck? I feel like I've seen this movie before. It is Office Space and that's the rounding zero, that extra zero that was in your notebook.
Speaker 1:
26:53
Yes, exactly man. Life imitates art. Right, that's what happens over and over again. You know, it's not all fun and games. This individual is going to jail for I believe it is a minimum of two years. Yeah, so it's two years, eight months in prison. So it's no light sentence. But the reason I brought this up and I didn't I, you know, this is the joy of this show is I didn't know what topics y'all were going to bring. I thought I was going to Johnny Rainclot it, but here I am just fitting right in. You know, we talked about Outlook. Everyone uses Outlook. We talked about the riskiest connected devices, hypervisors, right there. And then bam, this human being goes and proves every point correct, literally works for the company, does his job, gets fired, goes and commits a major crime. How do you stop it? What can you do? And I think we can just talk about that for a few minutes.
Speaker 3:
27:46
Yeah, so this is like the whole reason why, you know, a lot of times, when we have an opportunity to talk about zero trust, we talk about immutability, we talk about ransomware, but people forget people are a threat also. Like and you know, when we talk about, immutability is not enough, that's very true. Ransomware is just one such cyber threat that is just really hot in today's world, but there's always going to be bad people, always going to be people that you know set out to inflict harm, whether bodily or cyber, just like in this case. Right, and it's like that's the point of why, when we talk about, like this whole zero access to root and everything is pre provision with our box, a little plug here, it's like you literally take that out also, you know, as a potential threat and I feel like in today's world it's just getting overshadowed with ransomware. Like a ransomware is just this you're talking about Johnny rain cloud like ransomware is the cloud.
Speaker 3:
28:47
And like people forget that. You know, john over there in the corner just wrote a script to delete the whole data store, you know. So it's like what do you do at this point? Well, production's always going to delete the whole data store, you know. So it's like what?
Speaker 1:
28:56
do you do at this?
Speaker 1:
28:57
point Well production's always going to be the point of attack, right, like we. You know, we even talk about this in some of our own material. Like 93% of attacks now go after the backup. It's because they know that if they go after production it's it's likely the backup's going to be the point of recovery. So they go for both. Now, right it's. I got to attack backups. I got to attack live production. This individual went after live production.
Speaker 1:
29:20
The article doesn't mention whether they restored from backup or not. I'm assuming. I'm hoping they had backups and they were able to get something back. But yeah, that's why we do that and, furthermore, that's why we use zero trust data resilience to segment that right. You, you have your OOPB locally and then you might be using someone like Backblaze off in the cloud. That way, if he takes a hammer to your OOPB, he destroys your servers locally. You still have that third place, right, like it's the 3-2-1 rule, or 3-2-1-1-0. If you want to be extra cautious, which I recommend, there is no perfect plan for recovery, and that's what we see over and over again is, no matter what you're planning on, something will go worse than expected. So just take every precaution you can when assuming the worst.
Speaker 2:
30:07
I think you're spot on. I think you're spot on and you know it's really interesting. When we kind of think about this, I actually feel like for once, that isn't actually a Johnny Rain Cloud story, because guess what? This guy did some malicious activity and he got caught, and I think that really needs to be the message that really goes out there. That same technology that we talk about from our perspective who's watching you? What information is your teeth, your toothbrush given? What connected devices are way too connected or way risky? You know that also does turn on the bad guys as well, and we have seen some bad guys be brought down because of traces that they've left.
Speaker 2:
30:47
And so yeah, it's good to see, in this case, search history of how do I delete servers. God, I can't even. I don't even know where to go with that, but it's nice to know that there was a reason he was fired, you know I mean I hate to see the rest of his search history.
Speaker 2:
31:02
I can only imagine, but. But this is exactly the point that that I hope that we'll continue to have tools and frameworks. You know, we have the, the zero, uh, the zero, trust, the segmentation of backup framework, but there are other tools that are going to be coming out that will help us use and implement these frameworks that I really feel are going to help us battle these bad guys, because boy do we need it yep, and you know it.
Speaker 1:
31:26
It's the point I made earlier. Like you can segment your software, you can segment your operating systems, you can segment your hardware, you got to segment your people too. Yeah, I don't think this person should have had all the keys to the kingdom. There needs to be segmentation of roles and responsibilities as well. Part of the original zero trust model created by CISA and NIST was that you, you know, have verification steps every part of your way when you go through systems of verification and that identity access. This person should not have been able to just go run a script that deletes everything. Delete needs to be a two-person operation at a minimum, right Like we need to verify these activities. So there's ways that we can improve these processes through education, through software, through security practices, and it all goes to say that we're going to keep talking about it week after week, because, until it stops, I think we have to continue to do so.
Speaker 1:
32:17
But it is good to see a criminal gets caught.
Speaker 3:
32:19
Yeah, yeah. So, sterling, you might remember this shameless plug for Veeam If they had been running Veeam 1, there's actually a report that would show infrastructure changes by user where they could have easily just ran the report, search history or not and saw the username that deleted all 180 VMs.
Speaker 3:
32:39
So there's definitely some checks and balances to have in place. And to your point, anthony, I think that more than ever is why it's important that we have that whole zero trust data resilience methodology in our company and especially with our product. It's like look you know, yes, there are good admins, but there there are bad admins. How about we just don't give you access altogether regardless? That way we don't have to decide if you're good or bad. You just can't come to our box and delete anything.
Speaker 1:
33:05
You know, once it's been marked immutable, and I think that's the way it ought to be all right, you know I've told this story before, but my first week on the job in my previous place I was fresh out of college Someone literally destroyed the database of the entire customer database for one of our projects because they were told to by someone else and they were pointed to the wrong ESX host. So you know, accidents happen too right. Happen too right. Like, should someone so new, you know another intern be exposed to something so devastating on their? You know, I think he was there four months. I was there for a week and you know he was like. He came in my office told me what happened. I was like, oh my gosh, what's going to happen to you? He's fine, he was told to do it. So, like again, it's just really look at what you got, understand it, make sure that you assume the worst and then you can prepare for the best kind of recovery.
Speaker 3:
34:02
Yep Agreed.
Speaker 1:
34:06
What an episode, folks. I feel like we've talked about it a lot, so let me just go ahead and pull up the code one more time. So if you've not read our Zero Trust and Secure Backup for Enterprises white paper, give that QR link a scan. Highly recommend it. If you're listening, you can just go to any search engine and type in Zero Trust Data Resilience. You can find the Veeam research paper, you can find our white paper. You can follow Sterling's finger and scan that thing. There's so many ways you can read this and I do advise you read it.
Speaker 1:
34:36
It's not marketing fluff. It's meant to be purely educational and it is the best way to ensure you have a recovery point at all costs. It's not going to sell you a product. It's instead going to educate you on a practice and that's what we're here to do is to help educate you around this practice. We will be meeting with the author of the Zero Trust Data Resilience later this month on our webinar series. If you're interested in that, we'll be posting about that soon on LinkedIn. Make sure you register and sign up for that. It will be a great opportunity to take any questions you might have directly to the source. That's Jason Garbus. We'll be talking with him soon and it's going to be a great show, so I highly recommend you check that out too.
Speaker 2:
35:23
Matt Sterling, any closing thoughts from y'all, I think from go ahead, sterling. I was just going to say, just watch your devices, you know. Look and see. We saw this list. We went through everything. It's time to just check and have a plan before anything happens.
Speaker 3:
35:33
Matt, yeah, I think for me me, you know, selfish plug to what we do backups are everything.
Speaker 3:
35:40
You know, and it's one of the little sayings I used to always coin, it you know, when I was doing um, engineering at beam is, backups are one thing, but recoveries are everything. So it's it's not just about having the backup right, but it's making sure the backup is recoverable. Now, whether or not that's doing verification, testing with like sure backup where the 32110 comes in, or just making sure the backups can't be compromised, you know those two things have to be paramount in today's world to make sure that if you do have a bad actor, like the admin that just blew away 180 VMs, you have a backup plan that you don't have to second guess. You just know, hey, they're immutable, we got them. You know they're on the UBI 192 node, we can just go recover right, yeah, they're fired and they're going to prison, but our business is still going to. You know, stay afloat and we're not going to have that reputation hit of downtime and, you know, losing customers and database corruption and all this other stuff, right? So I think that's absolutely critical. Let's not forget about the people.
Speaker 3:
36:44
There's more threats out there than just ransomware.
Speaker 1:
36:48
Well said, couldn't. Couldn't add anything more to that if I wanted to, so instead I'll end it with this. Next week, we're going to be talking about how emojis will destroy you, and if that doesn't sound interesting, I can't help you. You're on the wrong show. So make sure to tune in next week and learn all about this new, just existential threat of emojis. And until then, stay weightless, stay frictionless, stay zero gravity.
Speaker 3:
37:18
Thank you.
0:00
Welcome back to Zero Gravity Live, the Weightless Weekly Tech Podcast, bringing all the latest discussions right to you. Listen, we're sponsored by Object First OOPI the best storage for Veeam. And if you've watched this show before, you already know you're on YouTube. Ring the bell, give us a like, leave us a comment. If you're watching on LinkedIn, let us know where you're coming in from. If you're watching from YouTube, we also want to know. And if you're watching on LinkedIn and you're wondering, like where are all the extra pixels going, they're on YouTube. So you know, I always recommend watch on YouTube.
Speaker 2:
0:34
Get that 4k action. Are we? Are we in 4k Matt?
Speaker 1:
0:35
No we're not Okay. Well, the pixels? We care about the pixels here on the show. And if you're listening in audio form on podcast, we welcome you to and ask that you share with your friends and leave us a nice little review. I'm Anthony, joined by my fellow co-hosts, Matt and Sterling. How y'all doing today.
Speaker 3:
0:53
Doing good man.
Speaker 2:
0:54
Doing good, feeling great. Gorgeous day. Here we're into the summer season. It's doing awesome. How are you?
Speaker 1:
1:02
I'm doing fantabulous, but I'm going to be doing a lot better when I find out what's going on in y'all's office. So I know. Before the show, Matt, you whipped out your wallet and said it's something to talk about. I want to know what's the deal with your wallet.
Speaker 3:
1:16
Well, so full disclosure. I had another call that ran right up to our show today, so I didn't have an opportunity to go digging for something really cool and I feel like everything in my purview that's right out of shot here. I've already talked about you know I've got the pocket three rocking right here and some other things. But I tell you, you know, anthony, every time I go somewhere and I pull out my wallet, people will make a comment like that's the coolest thing ever. Where'd you get it? So this is called the the flip side. This has got nothing to do with technology. What a cool color. I think it's really cool because you know more people are starting to at least more guys are doing the front like pocket wallets versus the old costanza. You know you sit on a slant in your back pocket wallet and what's really cool about the damage to your back.
Speaker 3:
2:02
yeah, exactly, your vertebrae is getting out of kilter. But one of the things I love about it is it's got a quick access port for, let's say, your most commonly used card, and then it's got a locking mechanism and when it opens up you actually have a slot here, my trusty Costco card, but there's also probably about, I would say, four to five. You can get like right in this little holder area, then you've got you know cards here and this will also hold about four, but then wait, there's more.
Speaker 3:
2:33
flip it this way, oh look and you've got your id and you actually have a money clip where you can clip money right there, and when it's closed, everything is nice and tight and you also have an attachment right. So this attachment will replace this little card slot. So if you, let's say, you're going to a show and you want to put some business cards in there, you can just place your business cards under this little rubber strap and there you go. It's like the wallets.
Speaker 2:
3:01
Are you kidding me? You know it's. It's. It's so crazy, matt. I just saw something on the interwebs yesterday. It was a new style wallet where you hit a button and all of your credit cards come out, but they come out in sort of a cascaded thing to make them easy to use. And so this is pretty awesome, because the wallet has not been innovated for like ever, and I'm glad we're starting to see some like new innovations. I've always been one of those, the thin wallet guys, not the Costanzas like normally in the back, but now we have our health cards and then I live in a condo. It's the access key, it's the Costco, it's like all of these things continue to just build until you're sort of Costanzing.
Speaker 3:
3:45
Well, and you know too real quick on that topic, about the one that you know, put your cards out. So the Ridge wallet is super common, right? You know, I know Marquez from NK, uh, his review channel, nkdbhd or whatever it is. So he's now partnered with Ridge wallet. But my problem there is, there's just not enough real estate in that thing, to your point. Sterling Like this is still to me very thin. I mean, it's pretty much you know the the width of your thumb, let's say so it's still very flat. But I mean I can keep 12 cards in there, plus cash, plus my driver's license, and it's nice and closed to me. That's why I've never looked at any of those thinner ones, because to your, unless you only have two or three cards with your ID, that's about the only time those are useful. Yeah, yeah.
Speaker 2:
4:29
You're absolutely right. Is it bulletproof?
Speaker 1:
4:32
That thing is thick. Can it stop a bullet? It is absolutely not bulletproof but it is object-first orange. Oh well, I guess all of my qualms have been sated. Uh, you know, I'm pretty silly, you know, because I I go for the thin wallet and I don't even carry it in my pocket, I keep it in my man purse. So you know what? Why do I even do that? I don't know, but maybe I should get one of these because it seems way more convenient than what I'm rocking.
Speaker 3:
5:00
Uh, thank you for sharing what was that called, matt it's. It's called the Flipside Flipside. You can pick it up at your local Amazon. That's pretty slick. I do like that.
Speaker 1:
5:10
Really. I know you don't have something to share physically, but there is an image I've heard there's an image.
Speaker 2:
5:31
Yes, absolutely. What I have to share today is not something that's in my office, although, leave it up to me, it probably could be in my office soon. What I have to share today is really something along the motif of our entire team here now we talk about being zero gravity, weightless, frictionless. Well, there is a battery version of that. Well, wait, hold on, something's not. It's not showing up here. Uh-oh, I was just working. There was a. There's a battery view with a view of a battery that I was showing. That's actually called Zero gravity batteries.
Speaker 2:
5:48
All these batteries are lithium batteries made specifically for motorcycles. So these are actually pretty cool because you know they can shave off, let's say, in a motorcycle. An average motorcycle is 350 to 400 pounds. They can go 600, 800, but let's just call it on an average, the average battery is 10 pounds, and so you put in one of these bad boys into the bike and it literally drops it by nine pounds. So think about that, something that gives you more cold cranking amps, more power to start it up, it lasts much longer, it doesn't need to be plugged in, it can literally last, for I mean, I've seen them actually over a year sitting without going flat and you're saving all this weight.
Speaker 2:
6:30
So a lot of you out there might be thinking why don't I just put one of these bad boys in my car? Some people do. But let me tell you, if it's your daily driver, there are a couple of small downsides. If you live in an environment that gets really cold sometimes, these lithium batteries have a tough time really cranking in really cold weather. And also for your daily driver, to save 20, 30, 40 pounds, it sounds like a whole lot, but for the cost differential it's probably, for a car battery, hundreds, if not into the thousands, of dollars. And so you have to ask yourself, if you're not racing or if you're not tracking the vehicle, is it really worth the squeeze of dollars? And so you have to ask yourself, if you're not racing or if you're not tracking the vehicle, is it really worth the squeeze of uh for the juice? So that was what I had shared today. I'm not too sure why it's not pulling up, but it's an awesome battery. Uh, if you're looking for an easy way to shave some pounds.
Speaker 1:
7:16
I'm sure everyone listening to the podcast appreciated your verbal description of the item. So all the good Sterling Now. Now you know, my only issue with lithium ion is it just it seems like it's an imperfect technology. Yeah, right, like, yeah, you know battery. Well, actually, wait, there it is. Oh, there, it is there, it is okay. So now we can all see yeah, I mean, it looks like a battery.
Speaker 2:
7:37
Yeah, it does look like a battery it looks um, feels just like it's just super light.
Speaker 1:
7:41
Yeah, yeah yeah, you know, we went from like what was it? Salt, like salt acid, to lithium ion, and now they're saying again, like salt might be the next battery thing. Technology, yet again that we get into, because, you know, lithium ion explodes, it gets hot, it doesn't work in the cold, like you're saying, like it's just, it's imperfect. Yeah, but one day, man, I'm I'm super excited for the day that we don't really have to worry about batteries anymore because we figured out something better than storing power in these, these devices that just don't operate, given all the different circumstances.
Speaker 3:
8:16
Yeah, yeah certainly I've actually held one of those batteries and it's it's almost comically light, like for a battery it it doesn't seem possible that it works right but it actually works. Yeah, there's a reason why they call it anti-gravity for sure yeah, it literally feels like a toy, doesn't it?
Speaker 2:
8:33
yeah, like it doesn't feel like it should be that light. The packaging is strange. I pretty much have all of my motorcycles, even my former race bike, switched over to these anti-gravity batteries because for me I can feel the difference in side to side roll of the bike and the cold cranking apps never come in. Uh, uh, not handy.
Speaker 3:
8:51
So yeah, yeah no doubt Very nice.
Speaker 1:
8:54
Well cool. Thank you for sharing that. Gentlemen Always appreciate seeing what's going on in your office. I got nothing. I got nothing to show, so we'll just move right on. Um, speaking of moving on, I know we've got some interesting topics this week. Matt, you're up first. What do you got?
Speaker 3:
9:09
Yeah, so this was interesting. I actually saw Anton Gostev for those of you who know him one of the heads or the head of product management over at Veeam. He posted this on X the other day and I thought this was really eye-opening. So when we think about security vulnerabilities with applications and, prime example, when we think about phishing email attempts and things such as this, it seems like historically and maybe I have been living under a rock, but it seems like historically you always had to do some sort of action to activate the vulnerability, right. It's always like don't open that suspect email attachment. Well, we all know that, right. You open a exe file, you know what, godspeed, right, because you know that's going to have an issue.
Speaker 3:
10:00
But what I found really interesting about this is there was a very recent security vulnerability in Outlook coincidentally pretty much what everybody uses for their email client where you did not even have to open the email. So it's like you know, like, in other words, when you're going through your emails and you see your inbox and you first click on it just to view it. That's when the vulnerability was activated and I'm like whoa talk about like next level triggers, because for me that's something that I would never even thought was possible. You know, because you're not really doing anything, you're not clicking a link, you're not opening an attachment, you're literally just viewing the email but something in the code, and there was this security vulnerability. You can see the timeline there. See if I can zoom in a little bit. So April 3rd is when this was first reported, and it wasn't patched until June 11th. So talk about that gap of like. How about everybody just stay out of Outlook until we get this vulnerability patched? Like? That's next level, though, gents.
Speaker 1:
11:06
Zero click vulnerability, Like I feel. Like you know, we always talk about zero day, but I've not heard of a zero click before. That's scary, that's really so what's the impact of this? You might've said it and I missed it, but what happens if? You scroll past an email with one of these.
Speaker 3:
11:26
Yeah, well, it depends on what the attack is. I think this one wasn't necessarily specific to one type of malicious act. It was just a vulnerability in the program where code could be called to action if you just open the email. Just open the email. So again, this one was like more of a Microsoft like uh-oh, outlook is super vulnerable to anybody who might want to target this type of vector, so let's get it patched. And I just thought it was a little shocking. It took that long to patch, you know, for something so severe.
Speaker 2:
11:58
So this is if you open it right and what constitutes an open. I'm asking for all my reading pain. People out there.
Speaker 3:
12:04
This is my understanding right. And if you're in Outlook, at least on a desktop right, and you've got your inbox and you're just clicking from email to email where you get the reading pain on the right, that's opened. Yeah, and that's like disturbing because to me that's. I almost look at that as like I didn't do an action. I'm using Outlook like Outlook's supposed to be used, viewing inbound email, like I said earlier, opening an attachment. I mean, obviously those come with known risks, right, depending on what it is, but just to see the text and the body of the email, that's scary.
Speaker 1:
12:41
So, man, this is concerning because one Outlook, like you said, is the most used mail app on the planet by a large margin. Most big businesses are using 365 and Outlook. It's scary because it's zero click. You don't know, you have it, it's in your infrastructure. I think this perfectly highlights we talk about zero trust, data resilience and zero trust. A lot on this show Because it's in your infrastructure. I think this perfectly highlights. You know, we talk about zero trust, data resilience and zero trust. A lot on this show. You know because it's important.
Speaker 1:
13:12
But when we talk about segmentation and we talk about backup, storage and backup software, the reason we segment those things is because one should not ever influence the other. If there is a breach. Right, we want to separate as much as we can. How do you separate yourself from Outlook? Right? Like this is the thing that literally connects everything together. I mean, how much of your day is driven by email? I receive a file, I receive an attachment, that's how I'm going to go do my job. I have to go communicate with somebody. Like, yeah, we have Slack and the tools, but Outlook is the connective tissue that most organizations need to tie them together. You can't really segment yourself from this. You can't zero trust Outlook. So what do you do Like I don't have an answer, but this is concerning to me.
Speaker 3:
13:59
Yeah, and I just I hit the Microsoft site and technically, according to them, this wasn't exploited, it was just a known vulnerability. That could have been, but that's what they know, right? I mean, who knows? There could have been exploits that are yet to be reported from this window gap. That happened. So you're right, I don't know how you segment Outlook out of your lives, unless it's a different email client, but in the Microsoft world there is no secondary no secondary, it just I think it lends to the.
Speaker 1:
14:30
This is why you need to use different passwords and accounts for everything right, because even if it's just compromising your information, that's gathering things from you, you still need to ensure as much differentiation there as possible. And, uh, you know, don't put anything precious on your laptop, because in a moment you could scroll past an email. In a moment's notice it's all locked down and gone crazy talk.
Speaker 1:
14:52
Yeah, that is pretty crazy yeah, you brought like I'm johnny ray. I mean I'm still gonna be johnny rain cloud, but you rain today, matt dude I saw anton tweet that the other day and I'm like zero click.
Speaker 2:
15:08
That's a yikes.
Speaker 3:
15:10
Yeah, that's next level. I hadn't heard of that one yet.
Speaker 2:
15:13
I feel like in the past wasn't there a text message that was going around I don't know, maybe 18, 24 months ago maybe have my timing wrong where there was an exploit that was executed just by receiving this message? Yes was an exploit that was executed just by receiving this message. Yes, right, so this sort of this sort of zero interaction attack is something that sounds familiar to me, but obviously not something as big.
Speaker 1:
15:33
On the email it was it was called something power right, like uh, you would send them a text and it had like a combination of like arabic characters and you know emoji, like it was. But when you sent that text it could restart your phone and it was. It was an apple, uh vulnerability and in the message and the way that, like it was receiving the characters and executing on the back end, this is scary stuff it was sent to me and it scared the crap out of me.
Speaker 1:
16:00
Yeah, so we just gotta like we have to accept that every single device can be compromised and every single app inside the device can then compromise the device. It's well said. It's a messy world.
Speaker 2:
16:13
Zero trust is life. I mean, really there's no other way around it. Today we talk about a lot from on the backup portion of it, the segmentation of the permissions, but it's everywhere today, even in the physical world, you can't trust the person that's walking in behind you into a door. I could go on.
Speaker 1:
16:31
Yeah. I totally agree, rough stuff.
Speaker 3:
16:35
Thanks, Matt, for that.
Speaker 1:
16:37
Great way to start the day.
Speaker 3:
16:39
Don't check your email. Maybe this is a new reason to just keep your inbox empty.
Speaker 1:
16:45
Well, I mean, how are you going to empty it if you don't know what's in there? You got to scroll through it Don't look, no more email. We just came up with the best excuse to not do your job Tell your boss. I can't read your email because I don't want to put the company at risk.
Speaker 2:
17:02
Yeah, hey boss, I'm keeping you safe.
Speaker 1:
17:04
That's right. I feel protected, not reading my email, always thinking yeah, yes, yeah. Sterling, what do you have for us today?
Speaker 2:
17:13
I have to share a little something with you all, which is a report, the 2024 report of the riskiest connected devices. So you know you should check out this report. It's actually a pretty good read. So you know you should check out this report, it's actually a pretty good read, but you know the TLDR. Just to kind of skip through. What are the riskiest devices of 2024? Well, they're categorized like this IT devices, internet of Things, operational technology and Internet of Medical Things. So the IT devices they're listing as routers, access points, and this one I thought was really interesting, considering what we're talking about hypervisors, which of course allows the attackers to attack multiple VMs at a certain time, encrypting, moving, deleting, and so these devices were ranked number one on the attack vector of riskiest connected devices.
Speaker 2:
18:07
The internet of Things we're talking about the IP cameras, voip printers and, of course, nas. We talk a lot about the segmentation of data. This list is really pointing it out to us right here. Your VMs are not safe. They're attacking that right away. Nas was also on the list of Internet of Things for obvious reasons. It's where your data lies, right at the end of an IP address, right.
Speaker 2:
18:29
But also they're commonly found online, have significant vulnerabilities and often exploited by botnets. When we talk about the operational technology part, it's UPSs smart lighting UPS. They're involved in power monitoring and, of course, data center power management, and they're often left with the default credentials in place and the consequences of an attack there could include power loss. So that's three on the list and, of course, rising but new to the list is the Internet of Medical Things. They connect to things like health records, billing informations. The criticality of all the data is truly there. We're talking about imaging workstations, often left unpatched and exposed online. We're talking about picture archiving systems and even some ECGs that are used to actually get some of that deeper patient data from the patients themselves really are just left connected wide open. So those, those are the riskiest things for 2024.
Speaker 1:
19:31
Scary huh can you I don't know if you have more information on the hypervisors bit, but I'm curious and it's not because I'm gonna, you know, talk about this on my topic or anything, but I I'm just wondering what makes the hypervisor the most riskiest connected device it must be, because if they don't go into this, I'm going to take a stab at it and, matt, you can tell me what you think too.
Speaker 2:
19:51
You know how we as admins sometimes do. We rip from templates, we throw them up in the infrastructure. We didn't patch them. They're sitting out there. Oops, I left the NIC on. It's connected directly to the internet, not through a particular vlan. That actually creates a little bit of a dmz, I bet you. That is why they're talking about that, but they specifically called it out. If you check out this article, it is specifically called out as one of the riskier things, right below forward-facing routers yeah, yeah, no, we'll.
Speaker 1:
20:22
We'll talk more about that in a minute.
Speaker 3:
20:23
But, matt, I'm curious here what you think well, you had me at dark reading sterling I I mean Right at the top of the page. I'm like, oh, this is going to be great, yeah. No, I think the hypervisor to your point. You know it's connected to literally the rest of the virtual infrastructure. So if somebody were to find a vulnerability or a hole, you know, maybe their distributed virtual switching weren't locked down right, maybe there was a port left open, you know, maybe somebody didn't block 3389 and RDP is just wide open to the outside world. I mean, there's a lot of potential vulnerabilities that people could overlook and could miss. And if somebody gained access to the hypervisor, well, I mean all the VMs, the data stores, I mean they could blow everything away Technically, they could delete the VMs without even needing to get into the VM, right?
Speaker 3:
21:11
So it's like a lot of potential risk, especially to businesses, leaving stuff like that connected, Whereas I kind of jokingly go back to the connected toothbrush what's anybody going to do if they hack your toothbrush bro? To do if they hack your toothbrush bro. So it's like I guess there's different levels of risk based on connectivity, right, and I definitely think from a business perspective, the hypervisor, I mean, that is the business. If they run virtualization and if you can do anything, they own it.
Speaker 1:
21:44
I mean, my big problem with all of this is we can't just walk away from these technologies, right? Outlook hypervisors, medical devices, internet of things. Like, we're way too ingrained in this technology to simply say, well, it's too risky, it's too insecure, it's too under-reliant, let's pack it up. Move on to something. There is nothing else, right, there's nothing else that we can use. The challenge truly seems to be that you can't secure it, so you accept that it will always be vulnerable. But then what? Like, there has to be a means to an end in all of this. And how we say OK, yeah, everything sucks, but here's the here's how we get through it. Right, like, there has to be an uptick. I'm struggling to see it these days.
Speaker 2:
22:34
Well, what oh go ahead Matt.
Speaker 3:
22:36
I was going to say. You know, this is something similar came up with. You know the VMware changes that are going on in the industry today. Everybody's like, well, they'll just jump to Kubernetes or they'll jump to containers. I'm like, well, not so fast. Like to your point. Like there's a spot for containers, there's a spot for virtualization. They are not the same in any stretch of the imagination. So it's like there's tech that's always going to be around.
Speaker 1:
23:01
To your point, anthony, it always has to be, unless we want to go back to the non-virtualized server you know, one server does this, one server does that?
Speaker 3:
23:10
Hey, hardware companies would love it, but you know, I just don't think that's the answer either. So I think, to your point, there's bound to be a way that, as you know, bad actors and as malicious attacks increase, we also have to, you know, increase and elevate the tech and the sophistication of the good guys, yeah, to make sure everything is just that much more secure.
Speaker 2:
23:32
I kind of feel like the answer is sort of somewhere in between. We're starting to see a little bit of a twist and I think some of our industry right now I mean, if you even look at to your point the ideas of VMs and then using kind of an infrastructure consideration and thought and so solutions maybe the many big solutions really kind of contain both. We saw this huge pivot to the cloud five, six years ago. Everybody starts throwing their data into the cloud.
Speaker 2:
24:06
Object storage blew up all of the facets of those pieces that people like, but then again here came all of the new threat vectors that were pointing other things out the true zero trust process, not being able to bring data back in a true and efficient way, and so things and solutions that actually augment that. We know people aren't going to stop using the cloud, but when it comes time and you're at the zero second to try to rebuild your infrastructure, you probably want some of that storage on premises to be able to bring it back quickly, and so it's kind of hard to sit here to be like on premises. Storage is the future, but at the same time, when we start to look at some of these new things that are coming out, the new threat factors, the way we use technology. I feel like we're just going to see a bigger segmentation when we start to see what tools are used where.
Speaker 1:
24:54
Completely agree, and it's funny, both topics. We've kind of discussed segmentation and the importance thereof, and it's not just at the hardware layer right Like, we can segment at the software layer, the service layer, the operating system layer, and the person layer right Like the people layer, we can implement segmentation as well. Person layer, right Like the people layer, we can implement segmentation as well, and I think we'll get more into that in a second. But this is super man like. I feel like we're just, you know, batting for three for three on the Johnny Rain clouds today. Here we go. So what I wanted to talk about is a former IT employee gets 2.5 years for wiping 180 virtual servers. This individual, who worked for a company, was fired and after he was fired, executed a script that he'd been working on for apparently months which might explain why he got fired to do damages estimated at 678. Is that a million? There's an extra zero on there. I don't really know how the extra zero works.
Speaker 1:
26:01
There is an extra zero 6,780,000 is the number I'm guessing. They had been working on the script for a while, just in case they ever were removed from the company, and when they found out they were fired. They executed the script and it went and just purged 180 virtual servers. Now there is a funny moment in this tale. It's one little ray of hope. The investigator mentions that the individual developed the wiper script via Google searches on how to delete virtual servers, so the man was exposed from his internet history. That's how they were able to figure out that he was the one who committed the crime.
Speaker 3:
26:34
Now go ahead. Matt, I have to ask is this Inateck? I feel like I've seen this movie before. It is Office Space and that's the rounding zero, that extra zero that was in your notebook.
Speaker 1:
26:53
Yes, exactly man. Life imitates art. Right, that's what happens over and over again. You know, it's not all fun and games. This individual is going to jail for I believe it is a minimum of two years. Yeah, so it's two years, eight months in prison. So it's no light sentence. But the reason I brought this up and I didn't I, you know, this is the joy of this show is I didn't know what topics y'all were going to bring. I thought I was going to Johnny Rainclot it, but here I am just fitting right in. You know, we talked about Outlook. Everyone uses Outlook. We talked about the riskiest connected devices, hypervisors, right there. And then bam, this human being goes and proves every point correct, literally works for the company, does his job, gets fired, goes and commits a major crime. How do you stop it? What can you do? And I think we can just talk about that for a few minutes.
Speaker 3:
27:46
Yeah, so this is like the whole reason why, you know, a lot of times, when we have an opportunity to talk about zero trust, we talk about immutability, we talk about ransomware, but people forget people are a threat also. Like and you know, when we talk about, immutability is not enough, that's very true. Ransomware is just one such cyber threat that is just really hot in today's world, but there's always going to be bad people, always going to be people that you know set out to inflict harm, whether bodily or cyber, just like in this case. Right, and it's like that's the point of why, when we talk about, like this whole zero access to root and everything is pre provision with our box, a little plug here, it's like you literally take that out also, you know, as a potential threat and I feel like in today's world it's just getting overshadowed with ransomware. Like a ransomware is just this you're talking about Johnny rain cloud like ransomware is the cloud.
Speaker 3:
28:47
And like people forget that. You know, john over there in the corner just wrote a script to delete the whole data store, you know. So it's like what do you do at this point? Well, production's always going to delete the whole data store, you know. So it's like what?
Speaker 1:
28:56
do you do at this?
Speaker 1:
28:57
point Well production's always going to be the point of attack, right, like we. You know, we even talk about this in some of our own material. Like 93% of attacks now go after the backup. It's because they know that if they go after production it's it's likely the backup's going to be the point of recovery. So they go for both. Now, right it's. I got to attack backups. I got to attack live production. This individual went after live production.
Speaker 1:
29:20
The article doesn't mention whether they restored from backup or not. I'm assuming. I'm hoping they had backups and they were able to get something back. But yeah, that's why we do that and, furthermore, that's why we use zero trust data resilience to segment that right. You, you have your OOPB locally and then you might be using someone like Backblaze off in the cloud. That way, if he takes a hammer to your OOPB, he destroys your servers locally. You still have that third place, right, like it's the 3-2-1 rule, or 3-2-1-1-0. If you want to be extra cautious, which I recommend, there is no perfect plan for recovery, and that's what we see over and over again is, no matter what you're planning on, something will go worse than expected. So just take every precaution you can when assuming the worst.
Speaker 2:
30:07
I think you're spot on. I think you're spot on and you know it's really interesting. When we kind of think about this, I actually feel like for once, that isn't actually a Johnny Rain Cloud story, because guess what? This guy did some malicious activity and he got caught, and I think that really needs to be the message that really goes out there. That same technology that we talk about from our perspective who's watching you? What information is your teeth, your toothbrush given? What connected devices are way too connected or way risky? You know that also does turn on the bad guys as well, and we have seen some bad guys be brought down because of traces that they've left.
Speaker 2:
30:47
And so yeah, it's good to see, in this case, search history of how do I delete servers. God, I can't even. I don't even know where to go with that, but it's nice to know that there was a reason he was fired, you know I mean I hate to see the rest of his search history.
Speaker 2:
31:02
I can only imagine, but. But this is exactly the point that that I hope that we'll continue to have tools and frameworks. You know, we have the, the zero, uh, the zero, trust, the segmentation of backup framework, but there are other tools that are going to be coming out that will help us use and implement these frameworks that I really feel are going to help us battle these bad guys, because boy do we need it yep, and you know it.
Speaker 1:
31:26
It's the point I made earlier. Like you can segment your software, you can segment your operating systems, you can segment your hardware, you got to segment your people too. Yeah, I don't think this person should have had all the keys to the kingdom. There needs to be segmentation of roles and responsibilities as well. Part of the original zero trust model created by CISA and NIST was that you, you know, have verification steps every part of your way when you go through systems of verification and that identity access. This person should not have been able to just go run a script that deletes everything. Delete needs to be a two-person operation at a minimum, right Like we need to verify these activities. So there's ways that we can improve these processes through education, through software, through security practices, and it all goes to say that we're going to keep talking about it week after week, because, until it stops, I think we have to continue to do so.
Speaker 1:
32:17
But it is good to see a criminal gets caught.
Speaker 3:
32:19
Yeah, yeah. So, sterling, you might remember this shameless plug for Veeam If they had been running Veeam 1, there's actually a report that would show infrastructure changes by user where they could have easily just ran the report, search history or not and saw the username that deleted all 180 VMs.
Speaker 3:
32:39
So there's definitely some checks and balances to have in place. And to your point, anthony, I think that more than ever is why it's important that we have that whole zero trust data resilience methodology in our company and especially with our product. It's like look you know, yes, there are good admins, but there there are bad admins. How about we just don't give you access altogether regardless? That way we don't have to decide if you're good or bad. You just can't come to our box and delete anything.
Speaker 1:
33:05
You know, once it's been marked immutable, and I think that's the way it ought to be all right, you know I've told this story before, but my first week on the job in my previous place I was fresh out of college Someone literally destroyed the database of the entire customer database for one of our projects because they were told to by someone else and they were pointed to the wrong ESX host. So you know, accidents happen too right. Happen too right. Like, should someone so new, you know another intern be exposed to something so devastating on their? You know, I think he was there four months. I was there for a week and you know he was like. He came in my office told me what happened. I was like, oh my gosh, what's going to happen to you? He's fine, he was told to do it. So, like again, it's just really look at what you got, understand it, make sure that you assume the worst and then you can prepare for the best kind of recovery.
Speaker 3:
34:02
Yep Agreed.
Speaker 1:
34:06
What an episode, folks. I feel like we've talked about it a lot, so let me just go ahead and pull up the code one more time. So if you've not read our Zero Trust and Secure Backup for Enterprises white paper, give that QR link a scan. Highly recommend it. If you're listening, you can just go to any search engine and type in Zero Trust Data Resilience. You can find the Veeam research paper, you can find our white paper. You can follow Sterling's finger and scan that thing. There's so many ways you can read this and I do advise you read it.
Speaker 1:
34:36
It's not marketing fluff. It's meant to be purely educational and it is the best way to ensure you have a recovery point at all costs. It's not going to sell you a product. It's instead going to educate you on a practice and that's what we're here to do is to help educate you around this practice. We will be meeting with the author of the Zero Trust Data Resilience later this month on our webinar series. If you're interested in that, we'll be posting about that soon on LinkedIn. Make sure you register and sign up for that. It will be a great opportunity to take any questions you might have directly to the source. That's Jason Garbus. We'll be talking with him soon and it's going to be a great show, so I highly recommend you check that out too.
Speaker 2:
35:23
Matt Sterling, any closing thoughts from y'all, I think from go ahead, sterling. I was just going to say, just watch your devices, you know. Look and see. We saw this list. We went through everything. It's time to just check and have a plan before anything happens.
Speaker 3:
35:33
Matt, yeah, I think for me me, you know, selfish plug to what we do backups are everything.
Speaker 3:
35:40
You know, and it's one of the little sayings I used to always coin, it you know, when I was doing um, engineering at beam is, backups are one thing, but recoveries are everything. So it's it's not just about having the backup right, but it's making sure the backup is recoverable. Now, whether or not that's doing verification, testing with like sure backup where the 32110 comes in, or just making sure the backups can't be compromised, you know those two things have to be paramount in today's world to make sure that if you do have a bad actor, like the admin that just blew away 180 VMs, you have a backup plan that you don't have to second guess. You just know, hey, they're immutable, we got them. You know they're on the UBI 192 node, we can just go recover right, yeah, they're fired and they're going to prison, but our business is still going to. You know, stay afloat and we're not going to have that reputation hit of downtime and, you know, losing customers and database corruption and all this other stuff, right? So I think that's absolutely critical. Let's not forget about the people.
Speaker 3:
36:44
There's more threats out there than just ransomware.
Speaker 1:
36:48
Well said, couldn't. Couldn't add anything more to that if I wanted to, so instead I'll end it with this. Next week, we're going to be talking about how emojis will destroy you, and if that doesn't sound interesting, I can't help you. You're on the wrong show. So make sure to tune in next week and learn all about this new, just existential threat of emojis. And until then, stay weightless, stay frictionless, stay zero gravity.
Speaker 3:
37:18
Thank you.
جستجوی اپیزودهای گذشته
اپیزودهای قبلی Zero Gravity Podcast را جستجو کن.
سلب مسئولیت: پادکست و آثار هنری تعبیه شده در این صفحه متعلق به Object First است که متعلق به صاحب آن است و به Listen Notes، Inc وابسته یا تایید نشده است.
ویرایش
از کمک شما برای بروز نگهداشتن پایگاهدادههای پادکست سپاسگزاریم
