Prasanna Malaiyandi:
00:00:00
What's a TLD for our listeners?
curtis:
00:00:02
Oh, top level domain.
curtis:
00:00:04
That's like.com or dot ransomware.
curtis:
00:00:13
Hi and welcome to Backup Central's Restore it All podcast.
curtis:
00:00:16
I'm your host, W.
curtis:
00:00:16
Curtis Preston, AKA Mr.
curtis:
00:00:18
Backup.
curtis:
00:00:19
And I have with me, my delayed shipment consultant, Prasanna Malaiyandi.
curtis:
00:00:23
How's it going , Prasanna?
Prasanna Malaiyandi:
00:00:25
I'm good.
Prasanna Malaiyandi:
00:00:25
Curtis, wait, what's delayed.
curtis:
00:00:29
my, my, my flooring shipment, you know,
curtis:
00:00:31
and I, I turn to you for.
Prasanna Malaiyandi:
00:00:33
what I thought you received one.
curtis:
00:00:38
I did I did, but . I ordered a big shipment of flooring, and then
curtis:
00:00:42
I ordered a much smaller shipment and I did that in two shipments because
curtis:
00:00:46
I couldn't order all of it at once.
curtis:
00:00:47
And then I had to order like another 10% and the second shipment I received the
curtis:
00:00:51
second shipment like three weeks ago, I still haven't received the first shipment.
curtis:
00:00:55
And, um, I just turned to you for, for, you know, emotional
curtis:
00:01:00
support in this time of.
curtis:
00:01:04
I'm not doing anything until the entire shipment comes in., it's just ridiculous.
curtis:
00:01:09
I ordered this,
Prasanna Malaiyandi:
00:01:10
Have you heard about supply chain issues?
Prasanna Malaiyandi:
00:01:12
Curtis has this not.
curtis:
00:01:14
I gave them grace because of the supply chain, but here's the thing.
curtis:
00:01:19
This is made right up the road from me.
curtis:
00:01:22
Well, it's more like up the road from you, but it's made in California.
curtis:
00:01:26
It's vinyl.
curtis:
00:01:28
The manufacturing is happening in California.
curtis:
00:01:32
But the problem is that they've lied to me.
curtis:
00:01:35
They lied to me before.
curtis:
00:01:36
They told me it's in production because you know, they make several colors.
curtis:
00:01:40
They're like, oh, that color, it was really in demand.
curtis:
00:01:42
It's in production.
curtis:
00:01:43
Now.
curtis:
00:01:43
They told me that like three weeks ago, they said it's in production.
curtis:
00:01:46
It should ship out any day now.
curtis:
00:01:48
They're now claiming they're out of stock.
Prasanna Malaiyandi:
00:01:51
Oh,
curtis:
00:01:53
Right.
curtis:
00:01:53
They're like, oh yeah, we, we, we did it was in production.
curtis:
00:01:56
We didn't lie to you.
curtis:
00:01:57
We just didn't make enough.
curtis:
00:01:59
Well, why did you stop the production run before you made
curtis:
00:02:02
enough to fulfill back orders?
curtis:
00:02:04
I mean, I get that.
curtis:
00:02:05
You're behind.
curtis:
00:02:06
I get that you had a big promotion, but retooling, the production line is a pain.
curtis:
00:02:12
Right.
curtis:
00:02:12
So why would you retool it
Prasanna Malaiyandi:
00:02:16
Maybe they ran out of
curtis:
00:02:17
of color.
Prasanna Malaiyandi:
00:02:18
Yeah.
Prasanna Malaiyandi:
00:02:19
Whatever.
curtis:
00:02:22
So this is why you're here.
curtis:
00:02:23
You're here to make me not so angry.
curtis:
00:02:25
That's why I said you're my delayed shipment consultant.
curtis:
00:02:29
All I know is it's not in my hot little hands and I'm not doing squat in my
curtis:
00:02:33
garage until I get the entire shipment.
Prasanna Malaiyandi:
00:02:36
Just think though.
Prasanna Malaiyandi:
00:02:38
How about delayed gratification?
Prasanna Malaiyandi:
00:02:40
Once you finally get the pallets
curtis:
00:02:43
This is the ultimate in delayed gratification.
curtis:
00:02:45
I've never had so much trouble spending money in my life.
curtis:
00:02:49
Right.
curtis:
00:02:49
I mean, and that even includes the two recent, very expensive
curtis:
00:02:52
couches that we bought.
curtis:
00:02:54
There were way more expensive than this.
curtis:
00:02:56
Um, we ordered it and then they were like, it's in a ship off long beach.
curtis:
00:03:04
If you want to see your couches go to the long beach Harbor and look out into
curtis:
00:03:08
the water and you can see, and that was, that was promised like four weeks.
curtis:
00:03:12
And it was more like eight, but at least there, I was like, well, I'm part of
curtis:
00:03:15
the whole, you know, shipment problem.
curtis:
00:03:18
And I just had to wait, but here it's just frustrating because they,
curtis:
00:03:22
because they've miscommunicated,
Prasanna Malaiyandi:
00:03:23
Yeah.
Prasanna Malaiyandi:
00:03:24
I think that's the problem, right?
Prasanna Malaiyandi:
00:03:25
If they had not given you any information that yeah.
Prasanna Malaiyandi:
00:03:28
It's in production, right.
Prasanna Malaiyandi:
00:03:29
You probably would have been fine.
Prasanna Malaiyandi:
00:03:30
Yeah.
Prasanna Malaiyandi:
00:03:30
It's just shipping delays.
Prasanna Malaiyandi:
00:03:31
That's fine.
Prasanna Malaiyandi:
00:03:32
The fact that they told you now you're annoyed.
curtis:
00:03:35
Hashtag
Prasanna Malaiyandi:
00:03:35
it'll be
curtis:
00:03:36
#firstworldproblems.
Prasanna Malaiyandi:
00:03:38
Take a deep breath.
curtis:
00:03:43
Yeah, good times.
curtis:
00:03:45
Good times.
curtis:
00:03:47
Um,
curtis:
00:03:49
Our disclaimer, Prasanna works for Zoom.
curtis:
00:03:52
I work for Druva and, uh, the opinions that you hear are ours.
curtis:
00:03:56
This is not a podcast of either company.
curtis:
00:03:58
And a rate us at ratethispodcast.com/restore, or just
curtis:
00:04:03
click on your favorite pod catcher.
curtis:
00:04:05
And, uh, click down to the bottom and give us some stars, or maybe even a comment.
curtis:
00:04:10
Talk about how much you love Prasanna's beard.
curtis:
00:04:12
I'm good with that.
curtis:
00:04:13
And how it's so much longer and darker than mine and.
curtis:
00:04:18
And, uh, you know, if you're, if you're curious about such things, if any of
curtis:
00:04:23
these things, we talk about excite you either way then, uh, you know, @wcpreston
curtis:
00:04:29
on Twitter or wcurtispreston@gmail and, uh, you'll find me.
curtis:
00:04:35
So I see.
curtis:
00:04:39
I sent you this, this post that I, that I saw on Reddit, which it's well,
curtis:
00:04:45
it's actually a series of three posts from a Reddit user called snorkel42.
curtis:
00:04:52
Don't let his, you know, snorkeling ID fool you the, the person
curtis:
00:05:01
knows what they're talking about.
curtis:
00:05:03
I don't know.
curtis:
00:05:04
I don't know anything about this person.
curtis:
00:05:06
Other than that, they, they have, they post regularly in a
curtis:
00:05:11
subreddit called security cadence.
curtis:
00:05:15
Um, but he also posted he or she, I don't know if I mistaken
curtis:
00:05:21
mistakenly called the person.
curtis:
00:05:22
He, I apologize in advance for my misogeny, so.
curtis:
00:05:30
The, it was about ransomware and, and they are a specialist in the areas
curtis:
00:05:38
of security and many people had asked them to post stuff about ransomware
curtis:
00:05:47
and they had continually sort of said, I don't want to post about ransomware.
curtis:
00:05:54
And can you imagine why that would be
Prasanna Malaiyandi:
00:05:58
You're just sort of propagate well, it's ransomware you get
Prasanna Malaiyandi:
00:06:01
hit with, because there were a bunch of gaps before ransomware got hit and it's
Prasanna Malaiyandi:
00:06:06
better to address the problem rather than trying to address sort of the outcome.
curtis:
00:06:13
Yeah.
curtis:
00:06:14
So ransomware to this person is the symptom of a whole lot of bad things
curtis:
00:06:21
that you were already doing or not doing.
curtis:
00:06:24
And they've spent their career helping to make sure you do those things.
curtis:
00:06:30
But with the, I think two things, one is that obviously the ransomware attacks are
curtis:
00:06:38
getting to a fever pitch and then two.
curtis:
00:06:42
There is what we talked about on the previous episode, which was this concern
curtis:
00:06:47
about Russia and D w we did cover that.
curtis:
00:06:50
Didn't
curtis:
00:06:51
we?
Prasanna Malaiyandi:
00:06:51
Yeah, we cover the Conti ransomware gang
curtis:
00:06:54
Yeah.
curtis:
00:06:54
Yeah.
curtis:
00:06:55
Um, yeah, the, the, the Krebs on security post.
Prasanna Malaiyandi:
00:06:58
Yep.
curtis:
00:07:00
That the concern is that the level of the fever pitch that we're experiencing
curtis:
00:07:05
might actually go through the roof.
curtis:
00:07:07
And so they said, Hey, I'm gonna finally, I'm fine, fine.
curtis:
00:07:11
I'll post about ransomware, but even in their post about ransomware, it
curtis:
00:07:17
really wasn't that much about ransomware as much as it was about the things.
curtis:
00:07:22
Well, no, that's not true.
curtis:
00:07:23
I'll take that back.
curtis:
00:07:24
It was, it was here is the way ransomware works.
curtis:
00:07:29
And so I I'd say the first one, I'd say of the three series,
curtis:
00:07:34
The first one was about here's how to prevent it.
curtis:
00:07:37
Number one, like from getting in.
curtis:
00:07:39
The second was here's how to prevent it from doing more damage once it's in.
curtis:
00:07:43
And then the third one, it was okay.
curtis:
00:07:45
All right.
curtis:
00:07:45
You're totally screwed.
curtis:
00:07:46
You've got to reach for your backups.
Prasanna Malaiyandi:
00:07:47
Yeah.
curtis:
00:07:47
that
Prasanna Malaiyandi:
00:07:49
The one thing I would add to that , is he also was careful
Prasanna Malaiyandi:
00:07:52
saying, I don't want to just focus on the Conti ransomware and provide you steps
Prasanna Malaiyandi:
00:07:57
to prevent that because there are so many other ransomware flavors out there.
Prasanna Malaiyandi:
00:08:01
If you build something for just one.
Prasanna Malaiyandi:
00:08:04
You're not going to be protecting yourself.
Prasanna Malaiyandi:
00:08:05
Let's take a holistic approach.
Prasanna Malaiyandi:
00:08:07
And like you said, let's cover, how do you prevent it from getting in?
Prasanna Malaiyandi:
00:08:10
What, how do you prevent the spread of it?
Prasanna Malaiyandi:
00:08:12
And then how do you recover?
curtis:
00:08:15
Yeah.
curtis:
00:08:15
Good point.
Prasanna Malaiyandi:
00:08:17
The first one is called initial breach, I think
Prasanna Malaiyandi:
00:08:20
is how he titled the first article.
curtis:
00:08:22
Right.
curtis:
00:08:22
So the phishing basically, they're saying That That is the number
curtis:
00:08:30
one way that you get ransomware.
Prasanna Malaiyandi:
00:08:33
Yep.
Prasanna Malaiyandi:
00:08:33
Someone accidentally clicking an email, opening up something,
Prasanna Malaiyandi:
00:08:37
letting the attackers in, and they don't even know about it.
Prasanna Malaiyandi:
00:08:39
So how do you prevent your users from clicking on malicious links?
curtis:
00:08:45
now, now, it's interesting.
curtis:
00:08:47
This goes, yeah.
curtis:
00:08:49
Sorry.
curtis:
00:08:50
This goes somewhat against what, some of the advice of one of the guests
curtis:
00:08:56
that we had on the podcast, which was, they basically said, look, your
curtis:
00:09:01
people are going to click on stuff, stop relying on, you know, I dunno.
curtis:
00:09:07
I dunno if it's against, but, but he, he, de-prioritized training and, and like, uh,
curtis:
00:09:16
phishing assessments, didn't you think.
Prasanna Malaiyandi:
00:09:19
Yeah.
Prasanna Malaiyandi:
00:09:19
So.
Prasanna Malaiyandi:
00:09:20
This author does say training can only help you so much?
Prasanna Malaiyandi:
00:09:26
I think the couple things, the couple things though, that he did mention is,
Prasanna Malaiyandi:
00:09:31
um, you do need some level of training, but you need to make sure people don't
Prasanna Malaiyandi:
00:09:36
feel like they're being punished.
Prasanna Malaiyandi:
00:09:38
When they do the wrong thing, right?
Prasanna Malaiyandi:
00:09:41
You want that transparency.
Prasanna Malaiyandi:
00:09:42
You want to be telling people it's okay for you to say that I clicked
Prasanna Malaiyandi:
00:09:46
the wrong thing because then the IT team can try to evaluate what's
Prasanna Malaiyandi:
00:09:50
going on and try to contain it.
Prasanna Malaiyandi:
00:09:53
The sooner they know the better it is.
Prasanna Malaiyandi:
00:09:54
But if say someone's afraid because they're going to get in trouble.
Prasanna Malaiyandi:
00:09:57
They might be fired, right.
Prasanna Malaiyandi:
00:09:58
It becomes taboo then no one's going to report it.
Prasanna Malaiyandi:
00:10:01
And that's actually really bad.
curtis:
00:10:04
Yeah.
curtis:
00:10:04
Um, they said to prioritize rewarding over punishment.
curtis:
00:10:08
Right?
curtis:
00:10:08
Make it, make it known.
curtis:
00:10:09
Like you said, that it's okay to call in.
curtis:
00:10:11
We want you to call in, even if you messed up and, and then, and
curtis:
00:10:17
they also said consider doing your own phishing assessments.
curtis:
00:10:20
I read some of the comments and they talked about that.
curtis:
00:10:24
They had a thing where you, you, you got some.
curtis:
00:10:29
You got some, it was sort of some strikes and it was like 10 strikes.
curtis:
00:10:33
It was like, you could click on 10 malicious emails.
curtis:
00:10:38
And, and then it was the 10th.
curtis:
00:10:39
When, and that they actually had a series of escalations where, you
curtis:
00:10:43
know, it started out, Hey, you know, we really told you kind of thing.
curtis:
00:10:47
Um, I think you can do both.
curtis:
00:10:49
I think you can do both carrot and stick, right.
curtis:
00:10:50
Reward and punishment where yes.
curtis:
00:10:53
You want to reward people for calling in.
curtis:
00:10:55
Thank you for calling accidentally clicked and then.
curtis:
00:10:59
And then if the person clicks doesn't know, but you know, because you did a
curtis:
00:11:05
phishing assessment, you do a series of escalating things where that
curtis:
00:11:11
ultimately you can have a person.
curtis:
00:11:14
And this was discussed in the comments, not necessarily that you
curtis:
00:11:18
would fire somebody that, that keeps doing this, but you might say, okay,
curtis:
00:11:22
this person cannot be trusted with a straight internet connection.
Prasanna Malaiyandi:
00:11:26
Yup.
curtis:
00:11:27
Right.
curtis:
00:11:28
All email from this person will be monitored.
curtis:
00:11:30
Yeah.
curtis:
00:11:32
They can only open email that's straight from our Exchange server
curtis:
00:11:35
or whatever stuff like that.
Prasanna Malaiyandi:
00:11:37
So phishing was sort of one way that people get in.
Prasanna Malaiyandi:
00:11:40
Right.
Prasanna Malaiyandi:
00:11:40
But I think once they're in whichever mechanism it is, it's like, okay,
Prasanna Malaiyandi:
00:11:45
how do you detect that someone's in?
Prasanna Malaiyandi:
00:11:47
And I think Curtis, this is what you're going to say, right.
Prasanna Malaiyandi:
00:11:49
About sort of this notion of droppers.
curtis:
00:11:52
Yeah, I actually didn't know this part.
curtis:
00:11:54
That's I was fascinated that that basically that the actual phishing
curtis:
00:12:00
results in a very small piece of software whose job it is to install
curtis:
00:12:06
the actual piece of software
Prasanna Malaiyandi:
00:12:08
Yeah.
curtis:
00:12:09
and that he calls out a dropper.
Prasanna Malaiyandi:
00:12:11
Yep.
curtis:
00:12:12
Well, and so the idea is understand that that's the way it works,
curtis:
00:12:18
that a piece of code gets dropped in, and then that piece of code executes, and
curtis:
00:12:22
the only purpose of that piece of code is to download the other piece of code.
curtis:
00:12:27
And so they said that you could, you could stop that.
curtis:
00:12:30
You could say, well, you can't run arbitrary pieces of code in,
curtis:
00:12:36
in locations that are directly accessible by the end user,
curtis:
00:12:41
you know,
Prasanna Malaiyandi:
00:12:42
Or you could restrict what applications are allowed
Prasanna Malaiyandi:
00:12:44
to run on a laptop for instance,
curtis:
00:12:46
yes,
curtis:
00:12:46
Whitelisting, I think whitelisting is it, I think it's the, the best.
curtis:
00:12:53
The best way to stop stuff like this.
curtis:
00:12:56
It's also the highest touch because it means that every new
curtis:
00:13:00
application that anybody has to install, they have to get approval.
Prasanna Malaiyandi:
00:13:04
Yep.
Prasanna Malaiyandi:
00:13:05
think it's a way to guarantee sort of legitimate applications have gone through
Prasanna Malaiyandi:
00:13:09
some sort of validation process, security review, et cetera, before it's being
Prasanna Malaiyandi:
00:13:13
allowed to be deployed in your environment
curtis:
00:13:17
Right.
curtis:
00:13:18
And then the next thing it talked about was that a random file
curtis:
00:13:23
running should not be downloading files from the internet, right.
curtis:
00:13:27
That it should only be HTTP and HTTPS is downloading from the internet.
curtis:
00:13:32
And so.
curtis:
00:13:34
He said with exceptions, like, you know, um, uh, SFTP for example.
curtis:
00:13:39
So he talked about, he talked about, you know, again, accessing that also
curtis:
00:13:44
possibly blocking bizarre TLDs right.
curtis:
00:13:47
And unnecessary locations.
curtis:
00:13:49
You could just simply say, listen, uh, we don't have anything to do with Russia.
curtis:
00:13:53
Why would we download anything from Russia?
curtis:
00:13:57
And if there is somebody in our company that needs to download stuff from Russia,
curtis:
00:14:00
they will be, they will be accepted.
curtis:
00:14:01
That was a very running theme I heard was lock down everything and allow exceptions.
Prasanna Malaiyandi:
00:14:08
Yeah.
Prasanna Malaiyandi:
00:14:08
And, uh, it was going to bring up two things.
Prasanna Malaiyandi:
00:14:12
One was what's a TLD for our listeners?
curtis:
00:14:15
Oh, top level domain.
curtis:
00:14:17
That's like.com or dot ransomware.
curtis:
00:14:22
There is no dot
curtis:
00:14:23
ransomware,
curtis:
00:14:23
but.
Prasanna Malaiyandi:
00:14:24
And was it you, or was it one of our guests who were, who
Prasanna Malaiyandi:
00:14:27
was talking about how they worked at a company that completely locked down
Prasanna Malaiyandi:
00:14:32
their network and the network admin would never let them do their backups
Prasanna Malaiyandi:
00:14:36
and everything was by except.
curtis:
00:14:39
That was me.
curtis:
00:14:40
Yeah.
curtis:
00:14:40
Yeah.
curtis:
00:14:41
Uh, that was, I was a client of mine where they had internal firewalls and
curtis:
00:14:48
that's an example of, you know, going to the extreme of, well, now you're now
curtis:
00:14:52
you're preventing core business functions,
Prasanna Malaiyandi:
00:14:54
Yeah,
curtis:
00:14:55
right?
Prasanna Malaiyandi:
00:14:56
but
curtis:
00:14:57
they also talked about local firewalls, right.
curtis:
00:14:59
Which is what we were just talking about, that the, and we're going to get
curtis:
00:15:04
to that more in the next section is, so they're just looking, he's looking
curtis:
00:15:11
for ways to stop the dropper from getting yeah, exactly.
Prasanna Malaiyandi:
00:15:16
Yeah.
Prasanna Malaiyandi:
00:15:16
thought was an interesting point I'd never thought about is he does have a point
Prasanna Malaiyandi:
00:15:20
about they block newly created domains.
Prasanna Malaiyandi:
00:15:25
Right.
Prasanna Malaiyandi:
00:15:25
Which I thought that had been dormant for a while and then are now active,
Prasanna Malaiyandi:
00:15:29
which I thought was very interesting because it's something I had never
Prasanna Malaiyandi:
00:15:32
thought about, but it totally makes sense.
Prasanna Malaiyandi:
00:15:33
Usually when you get ransomware, right.
Prasanna Malaiyandi:
00:15:36
These actors, they spin up domains and they start
Prasanna Malaiyandi:
00:15:38
communicating, using that domain.
Prasanna Malaiyandi:
00:15:40
So he's like, yeah, you could have a policy to just block these domains.
Prasanna Malaiyandi:
00:15:43
So they can't actually reach back out to the command and control
Prasanna Malaiyandi:
00:15:46
servers to be able to download from the dropper, the actual exploit.
curtis:
00:15:53
Right.
curtis:
00:15:53
And, and they said they weren't aware of anything.
curtis:
00:15:59
Where that you can do this for free, but there are tools that are
curtis:
00:16:02
available to help you do This right.
curtis:
00:16:04
There's
Prasanna Malaiyandi:
00:16:05
remember, uh, what are the D D.
Prasanna Malaiyandi:
00:16:09
Uh, what were the initials?
Prasanna Malaiyandi:
00:16:11
The DNS
curtis:
00:16:12
DDI.
Prasanna Malaiyandi:
00:16:14
right.
Prasanna Malaiyandi:
00:16:14
And I think that goes to some of that as well.
Prasanna Malaiyandi:
00:16:16
Right.
Prasanna Malaiyandi:
00:16:16
Where it's like, Hey, if you have some of those controls in place, you can now
Prasanna Malaiyandi:
00:16:20
prevent unauthorized access to domains.
Prasanna Malaiyandi:
00:16:23
They should not be having access to.
curtis:
00:16:27
Exactly.
curtis:
00:16:28
And then they started talking about preventing lateral movement inside.
curtis:
00:16:33
Think about the ways that people need to move within your organization and allow
curtis:
00:16:40
that, but block all other movement, right.
curtis:
00:16:43
Lateral movement between servers and I, and I think, again, going back
curtis:
00:16:46
to that company, that was a perfect example of, they had blocked all
curtis:
00:16:51
lateral movement between all servers and I couldn't get my job done.
curtis:
00:16:56
They're only problem w and they should have done that.
curtis:
00:16:59
And, you know, they were forward thinking in that regard, but you do need to allow
curtis:
00:17:04
exceptions for things like backup, right.
curtis:
00:17:06
That is definitely a server to server lateral movement.
Prasanna Malaiyandi:
00:17:11
Yeah.
Prasanna Malaiyandi:
00:17:11
And it's also other simple things.
Prasanna Malaiyandi:
00:17:13
Like one of them was your favorite topic, right?
Prasanna Malaiyandi:
00:17:16
Locking down RDP and SSH.
Prasanna Malaiyandi:
00:17:18
Right.
Prasanna Malaiyandi:
00:17:18
If it's not needed, then lock it down.
Prasanna Malaiyandi:
00:17:20
Right.
Prasanna Malaiyandi:
00:17:21
SMB is the same way as well for vCenter, right?
Prasanna Malaiyandi:
00:17:25
Figuring out what actually needs access and what.
Prasanna Malaiyandi:
00:17:27
Needs to be available to the internet.
Prasanna Malaiyandi:
00:17:30
And one of the points he made is you should just assume that
Prasanna Malaiyandi:
00:17:33
your inner internal network is as hostile as internet access.
Prasanna Malaiyandi:
00:17:38
Right?
Prasanna Malaiyandi:
00:17:39
So once an exploit happens, you can't trust anything internally.
curtis:
00:17:44
They were also, I, you know, I didn't necessarily
curtis:
00:17:47
agree with this one here.
curtis:
00:17:48
And that was it's time to kill monolithic file servers.
curtis:
00:17:51
Right.
curtis:
00:17:52
Now I don't have a problem with the file server.
curtis:
00:17:55
It's just, I think when, when they mean monolithic file server, they're just
curtis:
00:17:58
saying a file server where everybody in the company can access all the data.
curtis:
00:18:02
I would agree there anybody that's doing that, you know, in a
Prasanna Malaiyandi:
00:18:07
Yeah.
Prasanna Malaiyandi:
00:18:08
Segregate the data isolate to departments that need access.
Prasanna Malaiyandi:
00:18:11
You use ACLs, make sure the people who need access have access and
Prasanna Malaiyandi:
00:18:15
then monitor who's accessing what.
curtis:
00:18:18
So they made a specific example of like, you know, just because just
curtis:
00:18:22
because accounts receivable gets attacked, something shouldn't happen to payroll.
curtis:
00:18:27
These are, these are both finance functions, but they're separate
curtis:
00:18:30
financial functions and they should have their own areas.
curtis:
00:18:35
Uh, and this is another one that I harp on is about protecting
curtis:
00:18:39
privileged credentials.
curtis:
00:18:41
And
Prasanna Malaiyandi:
00:18:42
don't just have your password tattooed
Prasanna Malaiyandi:
00:18:44
on your forehead, Curtis.
curtis:
00:18:47
They recommended implementing, uh, things like LAPS, which I had
curtis:
00:18:52
to look up, which stands for local administrator password solution.
Prasanna Malaiyandi:
00:18:57
Uh, setting a different random password for
Prasanna Malaiyandi:
00:18:59
the common local admin account on every computer in the domain.
Prasanna Malaiyandi:
00:19:04
So you don't use one password for everything.
curtis:
00:19:07
And then MFA, I think, I think every system, you know, every, every
curtis:
00:19:13
privileged account needs to have MFA and, you know, I'm sorry, that's a pain.
curtis:
00:19:18
I, you know, I use it all the time, but it what is
Prasanna Malaiyandi:
00:19:24
but wait, why do you need a privileged account?
Prasanna Malaiyandi:
00:19:28
You should.
Prasanna Malaiyandi:
00:19:30
Here's the thing.
Prasanna Malaiyandi:
00:19:30
Most times you should probably not need privileged accounts, so you do not need
Prasanna Malaiyandi:
00:19:34
to access your privileged accounts.
curtis:
00:19:36
Agreed, but, but they have to exist.
curtis:
00:19:39
And so you have to lock them down this way.
curtis:
00:19:41
I think what you're saying is MFA, shouldn't be that big of a deal for you.
curtis:
00:19:44
If you set up modern administration.
Prasanna Malaiyandi:
00:19:48
yeah.
Prasanna Malaiyandi:
00:19:49
And you should rarely be using that.
curtis:
00:19:52
Right.
curtis:
00:19:52
Right.
curtis:
00:19:54
And then very last on the list and I would have put it first, but you know, it's
curtis:
00:19:58
just me and that was patching your stuff.
Prasanna Malaiyandi:
00:20:00
How many times does that come up on the podcast?
Prasanna Malaiyandi:
00:20:03
When we talk about ransomware, you know,
curtis:
00:20:05
Yeah, exactly.
curtis:
00:20:07
So the next one is about.
curtis:
00:20:12
It's like, okay, so you got some ransomware.
curtis:
00:20:14
Let's talk about the things that they're going to try to do.
curtis:
00:20:17
The very first thing they listed was deleting of shadow copies.
curtis:
00:20:24
And so I, and really shadow copies are basically like he's talking
curtis:
00:20:30
about windows shadow copies.
Prasanna Malaiyandi:
00:20:31
Yeah, I think windows shadow copies.
Prasanna Malaiyandi:
00:20:32
Yup.
curtis:
00:20:34
Right.
curtis:
00:20:34
And so there is a tool here, which I had never heard of called raccine.
curtis:
00:20:41
And it, it stops you from deleting shadow copies.
curtis:
00:20:48
He said it stops everybody from deleting them.
curtis:
00:20:50
So just realize that if you've got some regular thing that regularly deletes
curtis:
00:20:54
shadow copies, it'll break that, but it looks it's something on github.
curtis:
00:21:00
So it's, uh, you know, it's an open source tool.
Prasanna Malaiyandi:
00:21:03
And just reading that briefly, I think many backup
Prasanna Malaiyandi:
00:21:07
tools when you're backing up windows applications uses shadow copy.
Prasanna Malaiyandi:
00:21:11
So be careful if you are using that because you may not
Prasanna Malaiyandi:
00:21:15
be able to do your backups.
curtis:
00:21:16
Yeah, that's a good question.
curtis:
00:21:18
I, I guess, you know, I would differentiate between shadow
curtis:
00:21:24
copies made just for the purposes of backups and shadow copies that
curtis:
00:21:27
are made and then left there.
curtis:
00:21:27
I don't know if there's like a different.
curtis:
00:21:30
I know that when you make a snapshot, you say why you're making the snapshot.
Prasanna Malaiyandi:
00:21:34
Yeah.
curtis:
00:21:35
Um, but agreed that this is not something that you're just
curtis:
00:21:39
going to download and just implement,
Prasanna Malaiyandi:
00:21:43
Yeah.
curtis:
00:21:44
might break all your backups.
curtis:
00:21:46
Well, what it might do is it might allow you to create that snapshot,
curtis:
00:21:48
but then it leaves all those snapshots around and let you delete them.
curtis:
00:21:51
and you might get an error on your backup because you can't,
curtis:
00:21:53
it can't delete the snapshot.
Prasanna Malaiyandi:
00:21:55
yeah.
Prasanna Malaiyandi:
00:21:56
Or your production could run out of space and then your app dies.
curtis:
00:22:01
And then what's the next one
Prasanna Malaiyandi:
00:22:03
So the next one is a common theme for us.
Prasanna Malaiyandi:
00:22:07
Uh, when we talk about ransomware, it's less about the actual encrypting of data.
Prasanna Malaiyandi:
00:22:12
It's the fact that these ransomware actors, especially the Conti group,
Prasanna Malaiyandi:
00:22:16
they like to exfiltrate your data and steal sensitive data, and then hold you
Prasanna Malaiyandi:
00:22:20
hostage and be like, Hey, you want to pay?
Prasanna Malaiyandi:
00:22:22
Then you have to pay twice once for the decryption key.
Prasanna Malaiyandi:
00:22:25
And then once to make sure we don't publish your data.
Prasanna Malaiyandi:
00:22:28
And then sometimes they will still go and publish your data.
Prasanna Malaiyandi:
00:22:31
Right.
Prasanna Malaiyandi:
00:22:31
So in this post, he talks about sort of, how can you make sure
Prasanna Malaiyandi:
00:22:35
you can detect data exfiltration?
Prasanna Malaiyandi:
00:22:40
And he talks about everything from, if you have, if you understand network
Prasanna Malaiyandi:
00:22:45
patterns, you could look for anomalies.
Prasanna Malaiyandi:
00:22:47
Um, you can also look at other tools.
Prasanna Malaiyandi:
00:22:52
To see when data is actually being read and sent.
Prasanna Malaiyandi:
00:22:57
So there's some interesting tools that he talked about.
Prasanna Malaiyandi:
00:22:59
One that I never thought about, which was this mechanism called, uh,
Prasanna Malaiyandi:
00:23:04
from things called Canary tokens,
Prasanna Malaiyandi:
00:23:08
where it basically creates a false file.
Prasanna Malaiyandi:
00:23:12
And any time someone accesses it, it generates a token and sends it home.
Prasanna Malaiyandi:
00:23:16
And then it'll send you an email, say, Hey, by the way,
Prasanna Malaiyandi:
00:23:18
someone accessed this file.
Prasanna Malaiyandi:
00:23:20
So you can sort of get notified of, Hey, someone's accessing something, which
Prasanna Malaiyandi:
00:23:24
they probably normally never should be.
Prasanna Malaiyandi:
00:23:27
Because most of this ransomware software and data exfiltration, it's
Prasanna Malaiyandi:
00:23:31
just programmatically reading, like scanning folders, reading files, right.
Prasanna Malaiyandi:
00:23:36
Trying to figure out what to send.
curtis:
00:23:38
Right.
curtis:
00:23:39
And they mentioned both commercial solutions and open source solutions.
curtis:
00:23:44
Like the one you mentioned, they also mentioned something called, uh, Zeke,
curtis:
00:23:49
which, uh, And you know, that it analyzes NetFlow, but there are commercial
curtis:
00:23:54
tools, which we've mentioned on here.
curtis:
00:23:56
Um, and I, and I'd like to get, I'd like to get more of those companies on here.
curtis:
00:24:01
And their recommendation was the same as mine, which is looking
curtis:
00:24:05
for something that uses behavioral analytics to determine what is, and
curtis:
00:24:08
is not a normal file transfer, right.
curtis:
00:24:11
That should be able to spot a massive, uh, exfiltration attack..
curtis:
00:24:17
And then the response against encryption, they talked about the EDR
curtis:
00:24:25
XDR, which is I had to look that up.
curtis:
00:24:28
I was not in my, so this is what,
Prasanna Malaiyandi:
00:24:32
And point D
Prasanna Malaiyandi:
00:24:33
endpoint detection and response.
curtis:
00:24:36
right.
curtis:
00:24:36
Okay.
curtis:
00:24:37
So.
curtis:
00:24:38
The idea is that if you've got, if you've got the money to put something
curtis:
00:24:42
on each laptop that basically looks at and stops, massive file modifications,
curtis:
00:24:50
it would detect and stop those.
curtis:
00:24:51
Right.
curtis:
00:24:53
And then same thing with the, with the honeypot.
curtis:
00:24:56
I liked the idea with the creating an entire separate file server that has,
curtis:
00:25:01
has all the same file names, but just with junk data, watch for anybody doing
curtis:
00:25:05
anything there and then report on.
Prasanna Malaiyandi:
00:25:07
Yeah.
Prasanna Malaiyandi:
00:25:07
And the interesting thing is when he was talking about honeypots, I didn't
Prasanna Malaiyandi:
00:25:11
know, this is, he was like, oh yeah.
Prasanna Malaiyandi:
00:25:13
And then to make it more realistic, you, there are a couple things you can do.
Prasanna Malaiyandi:
00:25:17
You can map those device shares to actual endpoint devices.
Prasanna Malaiyandi:
00:25:22
So they show up there because if I'm a ransomware program and I'm just looking
Prasanna Malaiyandi:
00:25:26
at all the devices attached, right.
Prasanna Malaiyandi:
00:25:28
I don't know if it's real or not.
Prasanna Malaiyandi:
00:25:29
And the question came up, Hey, how do you hide it from your end users?
Prasanna Malaiyandi:
00:25:32
Because you don't want your end users clicking on it as well.
Prasanna Malaiyandi:
00:25:35
And there are registry commands in Windows, so you can actually hide them.
Prasanna Malaiyandi:
00:25:39
So your users don't actually see those drives.
Prasanna Malaiyandi:
00:25:43
And instead he suggested you actually bookmarked.
Prasanna Malaiyandi:
00:25:47
Shared drive letters with these honeypot shared drives because ransomware,
Prasanna Malaiyandi:
00:25:53
uh, programs are either going to start from a and work alphabetically
Prasanna Malaiyandi:
00:25:56
or start from Z and come backwards, to see what drives are available.
Prasanna Malaiyandi:
00:26:01
And then they'll just start looking that way.
curtis:
00:26:03
So, so put a honeypot at a and put a honeypot at z.
Prasanna Malaiyandi:
00:26:07
Yup.
curtis:
00:26:09
I like um,
Prasanna Malaiyandi:
00:26:12
were some really interesting things that he talked about.
curtis:
00:26:15
And we can only cover a little bit here.
curtis:
00:26:17
I just would highly recommend anybody that's interested in this, which should
curtis:
00:26:22
be everybody go read this thread.
curtis:
00:26:26
It's really well-written thread
Prasanna Malaiyandi:
00:26:28
It's like how to trick ransomware
Prasanna Malaiyandi:
00:26:29
and how to protect yourself.
curtis:
00:26:31
Right.
curtis:
00:26:36
then
Prasanna Malaiyandi:
00:26:36
jump onto the third?
Prasanna Malaiyandi:
00:26:38
Curtis.
curtis:
00:26:38
Yeah.
curtis:
00:26:38
Get up on the third?
curtis:
00:26:39
one.
Prasanna Malaiyandi:
00:26:39
Sorry, what is the third one about by the way?
curtis:
00:26:42
Oh, the third one well, basically it's like, well, you've been infected.
curtis:
00:26:45
What are we going to do?
curtis:
00:26:46
Worst case scenario you've been infected and it's spread, and now
curtis:
00:26:50
you need to reach for your backups.
curtis:
00:26:52
So they mentioned go to the, the, the incident response plan.
curtis:
00:26:57
And of course that assumes that you have one, which we've said
curtis:
00:27:00
that you need to have one, right?
curtis:
00:27:02
We we've mentioned repeatedly that a ransomware attack is
curtis:
00:27:06
not the same as a disaster.
curtis:
00:27:10
There are elements that I'd say a disaster is a subset of.
curtis:
00:27:14
Uh, typical DR response is a subset of a, of a ransomware attack response.
Prasanna Malaiyandi:
00:27:22
Think people get confused because in the end you're
Prasanna Malaiyandi:
00:27:24
trying to do the same things, right.
Prasanna Malaiyandi:
00:27:27
Get your data up.
Prasanna Malaiyandi:
00:27:29
But I think the steps and the number of people, the different types of
Prasanna Malaiyandi:
00:27:33
people involved are significantly different between just a normal DR.
Prasanna Malaiyandi:
00:27:37
Versus a ransomware recovery.
curtis:
00:27:39
Well, you know, simplistically to me, the biggest difference between,
curtis:
00:27:44
uh, responding to a ransomware attack and a disaster, it'd be the
curtis:
00:27:49
equivalent of like, if you're doing a DR and you've had a flood step
curtis:
00:27:53
number one is drain the data center,
curtis:
00:27:56
right?
curtis:
00:27:57
Get all the water out of the data center.
curtis:
00:27:59
Well, a ransomware attack is like, you're trying to drain the data center while you
curtis:
00:28:04
have a person standing there with a fire hose, it's filling up your datacenter.
curtis:
00:28:08
Right?
curtis:
00:28:08
the, that's the difference between a disaster recovery and a
curtis:
00:28:11
ransomware recovery is that they are actively still attacking you.
curtis:
00:28:15
And you're actively experiencing the disaster at the same time as
curtis:
00:28:19
you're trying to recover from it.
curtis:
00:28:22
And so they've got a good thing here on what should be
curtis:
00:28:27
in an incident response, right?
curtis:
00:28:28
Some things you have to have in your incident response plan
curtis:
00:28:32
got eight things about right.
curtis:
00:28:35
Procedures and policies and an incident firm.
curtis:
00:28:40
Right.
curtis:
00:28:40
You, you need, you basically get professionals, retain them now, right?
curtis:
00:28:46
Oh, by the way, I just, I just gotta throw out a really hilarious thing from,
curtis:
00:28:51
uh, my granddaughter Lily yesterday.
curtis:
00:28:55
So we have a friend, a mutual friend that was in a car accident a while back.
curtis:
00:29:02
Not, not seriously injured, but injured enough that there is a lawsuit that
curtis:
00:29:08
our, that, that that's going on.
curtis:
00:29:10
And Lily said, uh, she, you know, she, she mentioned that I couldn't, she couldn't
curtis:
00:29:17
pick her up because, you know, she was with her, she was with her lawyer and
curtis:
00:29:21
then she looks at me, we were just walking and then she's like, do I have a lawyer?
curtis:
00:29:29
I was like, no, I don't think you have a lawyer.
curtis:
00:29:32
You don't need a lawyer right now.
Prasanna Malaiyandi:
Speaker:
00:29:35
But, but you're right.
Prasanna Malaiyandi:
Speaker:
00:29:36
Most people don't even think about that.
Prasanna Malaiyandi:
Speaker:
00:29:38
Like even in like everyday, like normal situations, it's like, if
Prasanna Malaiyandi:
Speaker:
00:29:42
I, God forbid get arrested, right.
Prasanna Malaiyandi:
Speaker:
00:29:44
Who am I going to call?
Prasanna Malaiyandi:
Speaker:
00:29:45
It's like,
curtis:
00:29:46
Right.
curtis:
00:29:47
Yeah.
curtis:
00:29:48
And so w what they're saying here is, you know, go, go find who you're going to hire
Prasanna Malaiyandi:
00:29:55
who are you going to call Ghostbusters?
curtis:
00:29:57
going to call?
curtis:
00:29:58
And, um, you know, and they got a policy, oh, a policy.
curtis:
00:30:03
This is interesting policy for informing partners and customers and the media.
curtis:
00:30:07
Right?
curtis:
00:30:09
Decision-makers right.
curtis:
00:30:10
All of that stuff.
curtis:
00:30:11
This should all be decided upfront.
curtis:
00:30:13
You should be deciding that now.
curtis:
00:30:15
I don't know how many times we can say that.
Prasanna Malaiyandi:
00:30:17
Yep.
Prasanna Malaiyandi:
00:30:18
And then they talk about restoring your data.
curtis:
00:30:20
Restoring your data.
curtis:
00:30:22
right?
curtis:
00:30:23
And I think how they said alright, three posts in and we
curtis:
00:30:26
can finally talk about backups.
curtis:
00:30:27
Right.
curtis:
00:30:29
It's interesting here.
curtis:
00:30:30
Right?
curtis:
00:30:30
And he talks about, you know, the typical call-out is that ransomware's
curtis:
00:30:33
going to target your backups.
curtis:
00:30:35
And so you need some sort of immutable backup solution.
curtis:
00:30:38
Right.
Prasanna Malaiyandi:
00:30:39
Um, he does also talk and I know Curtis, you're probably
Prasanna Malaiyandi:
00:30:43
going to have concerns with this, right?
Prasanna Malaiyandi:
00:30:45
That you don't have to be offsite to protect your backups properly.
Prasanna Malaiyandi:
00:30:50
He mentions that you could use strict network segmentation or other
Prasanna Malaiyandi:
00:30:55
mechanisms to ensure separation, which would protect you in the case
Prasanna Malaiyandi:
00:31:00
of ransomware, but may not protect you from all disasters that could occur.
curtis:
00:31:05
Agreed.
curtis:
00:31:06
And, and, and I don't, I don't have an issue with that, right.
curtis:
00:31:09
Obviously, you know, I'll say obviously I work at a service-based backup company.
curtis:
00:31:13
And we see that as the easy it's easy peasy.
curtis:
00:31:16
All our backups are off site.
curtis:
00:31:18
I I'm not against, you know, as a backup expert, I'm not against onsite backups.
curtis:
00:31:22
There's a lot of good reasons for an onsite copy, but I completely agree
curtis:
00:31:26
with this person that you have to protect that onsite copy from attacks.
curtis:
00:31:32
And there are a lot of very common backup designs, incredibly common backup designs
curtis:
00:31:39
that do not that the default installation of those products do not protect you.
curtis:
00:31:46
Right.
curtis:
00:31:47
And I, and I'll, you know, I don't wanna, I don't wanna pick on our friends at
curtis:
00:31:51
Veeam, but that's a perfect example.
curtis:
00:31:54
The guys from Veeam came on here and they explained to you, if you listen,
curtis:
00:31:58
if you, if you haven't seen those episodes, go back and listen to them.
curtis:
00:32:02
Uh, about, you know, when they talked about the, the Conti ransomware attacks
curtis:
00:32:06
and how you can configure your Veeam backups to protect against that.
curtis:
00:32:12
My concern is that most of their customers are not listening to this podcast, by
curtis:
00:32:17
the way, they're more than welcome.
curtis:
00:32:19
All 700,000 Veeam customers are more than welcome to come listen to the podcast.
curtis:
00:32:24
But if, if you just do the default installation and you don't take their
curtis:
00:32:28
recommendations on how to further protect your data, you know, it's no different
curtis:
00:32:33
than any of the other products, right?
curtis:
00:32:35
So
Prasanna Malaiyandi:
00:32:36
Read
curtis:
00:32:36
you've got to stop doing that.
curtis:
00:32:38
Read the manual, read the best practices.
curtis:
00:32:41
Call Rickatron.
curtis:
00:32:42
Rickatron'll sort, you out and.
curtis:
00:32:46
So he talks about that.
curtis:
00:32:47
He also talks about testing, testing, your backups.
curtis:
00:32:50
I'm editing right now, like literally in I'm in the middle of editing
curtis:
00:32:54
the podcast, the episode of the restore test gone horribly wrong.
Prasanna Malaiyandi:
00:32:59
backup.
curtis:
00:33:00
It's going to be a great episode.
curtis:
00:33:03
The.
curtis:
00:33:06
Yeah, Schrodinger's backup.
curtis:
00:33:07
Exactly.
curtis:
00:33:08
That's going to, if, yeah, if you haven't heard that episode
curtis:
00:33:11
go back and listen to it.
curtis:
00:33:12
It's a, it's a
Prasanna Malaiyandi:
00:33:12
Yeah.
curtis:
00:33:14
uh,
curtis:
00:33:14
episode.
Prasanna Malaiyandi:
00:33:15
article also refers to it, right?
Prasanna Malaiyandi:
00:33:16
Yeah.
curtis:
00:33:18
yes, he does.
curtis:
00:33:20
Uh, did he, did he actually refer to Shrodinger's
Prasanna Malaiyandi:
00:33:22
Yeah.
Prasanna Malaiyandi:
00:33:22
Yeah.
Prasanna Malaiyandi:
00:33:23
HInging your company's future on a schrodinger's backup thought
Prasanna Malaiyandi:
00:33:26
experiment is a terrible idea.
Prasanna Malaiyandi:
00:33:28
Don't do that.
curtis:
00:33:30
Nice.
curtis:
00:33:32
So, and then why don't you talk about the decryption part?
Prasanna Malaiyandi:
00:33:36
Yeah.
Prasanna Malaiyandi:
00:33:37
So I guess the final part right.
Prasanna Malaiyandi:
00:33:39
Is you've been hit with encryption, right?
Prasanna Malaiyandi:
00:33:41
So now what do you do?
Prasanna Malaiyandi:
00:33:43
And in most cases, it's.
Prasanna Malaiyandi:
00:33:47
You can try to get, like, if you're lucky, there might be a free
Prasanna Malaiyandi:
00:33:50
decryptor out there for your data.
Prasanna Malaiyandi:
00:33:52
It's just going to take a very long time.
Prasanna Malaiyandi:
00:33:55
Right.
Prasanna Malaiyandi:
00:33:56
And if you do pay the ransom and you have to understand that paying the ransom may
Prasanna Malaiyandi:
00:34:00
be illegal to some of these groups, right?
Prasanna Malaiyandi:
00:34:03
They'll give you back a decryption key.
Prasanna Malaiyandi:
00:34:05
Hopefully it'll work.
Prasanna Malaiyandi:
00:34:06
It's not, it's in the ransomware.
Prasanna Malaiyandi:
00:34:08
Group's best interest not to cheat you there, but you're
Prasanna Malaiyandi:
00:34:10
taking a risk there as well.
Prasanna Malaiyandi:
00:34:13
And then finally, Once you've actually decrypted your data.
Prasanna Malaiyandi:
00:34:17
You've gone back up and running.
Prasanna Malaiyandi:
00:34:19
There's nothing that prevents them from either coming back
Prasanna Malaiyandi:
00:34:22
and attacking you again, if you haven't fixed anything right.
Prasanna Malaiyandi:
00:34:25
Or the next group coming back.
Prasanna Malaiyandi:
00:34:27
Cause that's another common thing you see is one group gets in encrypts your data.
Prasanna Malaiyandi:
00:34:31
Another group figures out a different mechanism because they
Prasanna Malaiyandi:
00:34:33
know now that you're willing to pay.
Prasanna Malaiyandi:
00:34:35
And so they might come after you as well.
Prasanna Malaiyandi:
00:34:40
So even once you have your data decrypted, it's not the end of the story.
curtis:
00:34:46
Right.
curtis:
00:34:47
And then the there's a, there's a what's next and, and, and all of
curtis:
00:34:50
these words, and this is a really long series of posts, which I highly
curtis:
00:34:53
recommend you go look through.
curtis:
00:34:55
There's one part where they typed in all caps, and this is it right when
curtis:
00:34:59
you're done, whatever you did restore, pay the ransom, whatever it is.
curtis:
00:35:04
It's not over, you clearly have a serious gap in your defenses.
curtis:
00:35:09
You need to find these and fix them.
curtis:
00:35:11
And then this is all caps and you need to understand that those gaps are bigger
curtis:
00:35:15
than just whatever the initial breach vector was as highlighted in parts one
curtis:
00:35:19
and two of this series, there are several opportunities to stop a ransomware
curtis:
00:35:23
breach before it gets to this point.
curtis:
00:35:26
So, um, there, there was some other.
curtis:
00:35:32
It was another one that I read, uh, somebody, they said, well, if I, if
curtis:
00:35:35
I, if I was at a company that had a highly, I think it was actually in here.
curtis:
00:35:39
If I was at a company that a highly publicized breach does this hurt my
curtis:
00:35:44
chances of getting a job and the author of this article didn't think so, because they
curtis:
00:35:49
basically said you now have experience
Prasanna Malaiyandi:
00:35:51
Yep.
Prasanna Malaiyandi:
00:35:52
I think it was actually at the end of this article is where he wrote about that.
Prasanna Malaiyandi:
00:35:55
Yeah.
Prasanna Malaiyandi:
00:35:55
He's like, yeah.
Prasanna Malaiyandi:
00:35:56
It's something you should actually show that you've gone through this because for
Prasanna Malaiyandi:
00:36:00
a lot of people it's just theoretical.
Prasanna Malaiyandi:
00:36:02
They've never experienced it.
Prasanna Malaiyandi:
00:36:04
It's like you Curtis.
Prasanna Malaiyandi:
00:36:05
Right.
Prasanna Malaiyandi:
00:36:05
I can sit here and talk about like how to back up your data, how to restore
Prasanna Malaiyandi:
00:36:09
your data, ideally how it should be done.
Prasanna Malaiyandi:
00:36:11
Right.
Prasanna Malaiyandi:
00:36:12
But I've never cut my teeth in a production environment, trying to do a
Prasanna Malaiyandi:
00:36:15
restore with people, yelling at me over my shoulder or watching over my shoulder.
Prasanna Malaiyandi:
00:36:20
Right.
Prasanna Malaiyandi:
00:36:20
You have, and I think that's sort of the difference, right?
Prasanna Malaiyandi:
00:36:23
Is you have that experience because trial by fire.
curtis:
00:36:28
Yeah, I, you know, you just, you just reminded me of, and I know
curtis:
00:36:32
I've told this story before, but not everybody's listening to every episode.
curtis:
00:36:35
My, one of my favorite restore stories was, was back at my first big job.
curtis:
00:36:39
And we had somebody in the NOC that was coordinating the various things that
curtis:
00:36:45
were happening of this big restore.
curtis:
00:36:48
And we had another guy that was in the data center that
curtis:
00:36:50
was actually doing things and.
curtis:
00:36:54
He was talking to the person who was on the phone in the NOC.
curtis:
00:36:58
And he, he didn't know that he was on speaker.
curtis:
00:37:02
And so he said, he's like, oh, so you know where you are.
curtis:
00:37:06
I'm in the NOC.
curtis:
00:37:07
He goes, oh, so I suppose you have Tom and Tom standing on
curtis:
00:37:10
your left and right shoulder.
curtis:
00:37:12
And he was referring to our boss's boss and our boss's boss's boss.
curtis:
00:37:16
Right.
curtis:
00:37:17
And, um, the, uh, that would be Tom Thomaides and Tom Lackey.
curtis:
00:37:23
And they were indeed standing both on his left and right shoulder.
curtis:
00:37:29
And they said that when he said that, oh, so you have Tom and Tom standing
curtis:
00:37:32
on your left and right shoulder.
curtis:
00:37:33
He said they just both took one step back.
Prasanna Malaiyandi:
00:37:38
but it's true, right?
Prasanna Malaiyandi:
00:37:39
It's a stressful thing everyone's watching to make sure it goes perfect.
curtis:
00:37:43
Right.
curtis:
00:37:44
And, um, so, you know, we wish you all the best of luck.
curtis:
00:37:49
I continue to be concerned about our, our friends over there in the Ukraine.
curtis:
00:37:53
And, uh, we wish them the best of luck and.
curtis:
00:37:58
You should also be concerned about the potential ramifications that all of
curtis:
00:38:02
that has on continued further attacks on your data center and read this
curtis:
00:38:07
article, read every word of this article, not just this summary and, um, you
Prasanna Malaiyandi:
00:38:13
the three
curtis:
00:38:14
read all three parts and we'll, we'll put links to
curtis:
00:38:17
it in the show description so that you can easily find it.
curtis:
00:38:20
Cause finding stuff on Reddit is not necessarily easy.
curtis:
00:38:24
So, uh, Thanks again Prasanna for your wise, uh, shipping advice
curtis:
00:38:29
and, um, you know, a good, good commentary on article well.
Prasanna Malaiyandi:
00:38:34
anytime Curtis and I hope I know, normally when we talk
Prasanna Malaiyandi:
00:38:36
about ransomware, you get very depressed.
Prasanna Malaiyandi:
00:38:38
So I, it feels like this isn't a depressing article.
Prasanna Malaiyandi:
00:38:41
It feels like here are things you should be doing.
Prasanna Malaiyandi:
00:38:43
So
curtis:
00:38:45
Here are things that you should do now.
Prasanna Malaiyandi:
00:38:47
Yeah,
curtis:
00:38:48
Yeah, absolutely.
curtis:
00:38:49
So, all right, well, thanks to the listeners.
curtis:
00:38:52
Uh, you know, we'd be nothing without you remember to subscribe
00:00:00
What's a TLD for our listeners?
curtis:
00:00:02
Oh, top level domain.
curtis:
00:00:04
That's like.com or dot ransomware.
curtis:
00:00:13
Hi and welcome to Backup Central's Restore it All podcast.
curtis:
00:00:16
I'm your host, W.
curtis:
00:00:16
Curtis Preston, AKA Mr.
curtis:
00:00:18
Backup.
curtis:
00:00:19
And I have with me, my delayed shipment consultant, Prasanna Malaiyandi.
curtis:
00:00:23
How's it going , Prasanna?
Prasanna Malaiyandi:
00:00:25
I'm good.
Prasanna Malaiyandi:
00:00:25
Curtis, wait, what's delayed.
curtis:
00:00:29
my, my, my flooring shipment, you know,
curtis:
00:00:31
and I, I turn to you for.
Prasanna Malaiyandi:
00:00:33
what I thought you received one.
curtis:
00:00:38
I did I did, but . I ordered a big shipment of flooring, and then
curtis:
00:00:42
I ordered a much smaller shipment and I did that in two shipments because
curtis:
00:00:46
I couldn't order all of it at once.
curtis:
00:00:47
And then I had to order like another 10% and the second shipment I received the
curtis:
00:00:51
second shipment like three weeks ago, I still haven't received the first shipment.
curtis:
00:00:55
And, um, I just turned to you for, for, you know, emotional
curtis:
00:01:00
support in this time of.
curtis:
00:01:04
I'm not doing anything until the entire shipment comes in., it's just ridiculous.
curtis:
00:01:09
I ordered this,
Prasanna Malaiyandi:
00:01:10
Have you heard about supply chain issues?
Prasanna Malaiyandi:
00:01:12
Curtis has this not.
curtis:
00:01:14
I gave them grace because of the supply chain, but here's the thing.
curtis:
00:01:19
This is made right up the road from me.
curtis:
00:01:22
Well, it's more like up the road from you, but it's made in California.
curtis:
00:01:26
It's vinyl.
curtis:
00:01:28
The manufacturing is happening in California.
curtis:
00:01:32
But the problem is that they've lied to me.
curtis:
00:01:35
They lied to me before.
curtis:
00:01:36
They told me it's in production because you know, they make several colors.
curtis:
00:01:40
They're like, oh, that color, it was really in demand.
curtis:
00:01:42
It's in production.
curtis:
00:01:43
Now.
curtis:
00:01:43
They told me that like three weeks ago, they said it's in production.
curtis:
00:01:46
It should ship out any day now.
curtis:
00:01:48
They're now claiming they're out of stock.
Prasanna Malaiyandi:
00:01:51
Oh,
curtis:
00:01:53
Right.
curtis:
00:01:53
They're like, oh yeah, we, we, we did it was in production.
curtis:
00:01:56
We didn't lie to you.
curtis:
00:01:57
We just didn't make enough.
curtis:
00:01:59
Well, why did you stop the production run before you made
curtis:
00:02:02
enough to fulfill back orders?
curtis:
00:02:04
I mean, I get that.
curtis:
00:02:05
You're behind.
curtis:
00:02:06
I get that you had a big promotion, but retooling, the production line is a pain.
curtis:
00:02:12
Right.
curtis:
00:02:12
So why would you retool it
Prasanna Malaiyandi:
00:02:16
Maybe they ran out of
curtis:
00:02:17
of color.
Prasanna Malaiyandi:
00:02:18
Yeah.
Prasanna Malaiyandi:
00:02:19
Whatever.
curtis:
00:02:22
So this is why you're here.
curtis:
00:02:23
You're here to make me not so angry.
curtis:
00:02:25
That's why I said you're my delayed shipment consultant.
curtis:
00:02:29
All I know is it's not in my hot little hands and I'm not doing squat in my
curtis:
00:02:33
garage until I get the entire shipment.
Prasanna Malaiyandi:
00:02:36
Just think though.
Prasanna Malaiyandi:
00:02:38
How about delayed gratification?
Prasanna Malaiyandi:
00:02:40
Once you finally get the pallets
curtis:
00:02:43
This is the ultimate in delayed gratification.
curtis:
00:02:45
I've never had so much trouble spending money in my life.
curtis:
00:02:49
Right.
curtis:
00:02:49
I mean, and that even includes the two recent, very expensive
curtis:
00:02:52
couches that we bought.
curtis:
00:02:54
There were way more expensive than this.
curtis:
00:02:56
Um, we ordered it and then they were like, it's in a ship off long beach.
curtis:
00:03:04
If you want to see your couches go to the long beach Harbor and look out into
curtis:
00:03:08
the water and you can see, and that was, that was promised like four weeks.
curtis:
00:03:12
And it was more like eight, but at least there, I was like, well, I'm part of
curtis:
00:03:15
the whole, you know, shipment problem.
curtis:
00:03:18
And I just had to wait, but here it's just frustrating because they,
curtis:
00:03:22
because they've miscommunicated,
Prasanna Malaiyandi:
00:03:23
Yeah.
Prasanna Malaiyandi:
00:03:24
I think that's the problem, right?
Prasanna Malaiyandi:
00:03:25
If they had not given you any information that yeah.
Prasanna Malaiyandi:
00:03:28
It's in production, right.
Prasanna Malaiyandi:
00:03:29
You probably would have been fine.
Prasanna Malaiyandi:
00:03:30
Yeah.
Prasanna Malaiyandi:
00:03:30
It's just shipping delays.
Prasanna Malaiyandi:
00:03:31
That's fine.
Prasanna Malaiyandi:
00:03:32
The fact that they told you now you're annoyed.
curtis:
00:03:35
Hashtag
Prasanna Malaiyandi:
00:03:35
it'll be
curtis:
00:03:36
#firstworldproblems.
Prasanna Malaiyandi:
00:03:38
Take a deep breath.
curtis:
00:03:43
Yeah, good times.
curtis:
00:03:45
Good times.
curtis:
00:03:47
Um,
curtis:
00:03:49
Our disclaimer, Prasanna works for Zoom.
curtis:
00:03:52
I work for Druva and, uh, the opinions that you hear are ours.
curtis:
00:03:56
This is not a podcast of either company.
curtis:
00:03:58
And a rate us at ratethispodcast.com/restore, or just
curtis:
00:04:03
click on your favorite pod catcher.
curtis:
00:04:05
And, uh, click down to the bottom and give us some stars, or maybe even a comment.
curtis:
00:04:10
Talk about how much you love Prasanna's beard.
curtis:
00:04:12
I'm good with that.
curtis:
00:04:13
And how it's so much longer and darker than mine and.
curtis:
00:04:18
And, uh, you know, if you're, if you're curious about such things, if any of
curtis:
00:04:23
these things, we talk about excite you either way then, uh, you know, @wcpreston
curtis:
00:04:29
on Twitter or wcurtispreston@gmail and, uh, you'll find me.
curtis:
00:04:35
So I see.
curtis:
00:04:39
I sent you this, this post that I, that I saw on Reddit, which it's well,
curtis:
00:04:45
it's actually a series of three posts from a Reddit user called snorkel42.
curtis:
00:04:52
Don't let his, you know, snorkeling ID fool you the, the person
curtis:
00:05:01
knows what they're talking about.
curtis:
00:05:03
I don't know.
curtis:
00:05:04
I don't know anything about this person.
curtis:
00:05:06
Other than that, they, they have, they post regularly in a
curtis:
00:05:11
subreddit called security cadence.
curtis:
00:05:15
Um, but he also posted he or she, I don't know if I mistaken
curtis:
00:05:21
mistakenly called the person.
curtis:
00:05:22
He, I apologize in advance for my misogeny, so.
curtis:
00:05:30
The, it was about ransomware and, and they are a specialist in the areas
curtis:
00:05:38
of security and many people had asked them to post stuff about ransomware
curtis:
00:05:47
and they had continually sort of said, I don't want to post about ransomware.
curtis:
00:05:54
And can you imagine why that would be
Prasanna Malaiyandi:
00:05:58
You're just sort of propagate well, it's ransomware you get
Prasanna Malaiyandi:
00:06:01
hit with, because there were a bunch of gaps before ransomware got hit and it's
Prasanna Malaiyandi:
00:06:06
better to address the problem rather than trying to address sort of the outcome.
curtis:
00:06:13
Yeah.
curtis:
00:06:14
So ransomware to this person is the symptom of a whole lot of bad things
curtis:
00:06:21
that you were already doing or not doing.
curtis:
00:06:24
And they've spent their career helping to make sure you do those things.
curtis:
00:06:30
But with the, I think two things, one is that obviously the ransomware attacks are
curtis:
00:06:38
getting to a fever pitch and then two.
curtis:
00:06:42
There is what we talked about on the previous episode, which was this concern
curtis:
00:06:47
about Russia and D w we did cover that.
curtis:
00:06:50
Didn't
curtis:
00:06:51
we?
Prasanna Malaiyandi:
00:06:51
Yeah, we cover the Conti ransomware gang
curtis:
00:06:54
Yeah.
curtis:
00:06:54
Yeah.
curtis:
00:06:55
Um, yeah, the, the, the Krebs on security post.
Prasanna Malaiyandi:
00:06:58
Yep.
curtis:
00:07:00
That the concern is that the level of the fever pitch that we're experiencing
curtis:
00:07:05
might actually go through the roof.
curtis:
00:07:07
And so they said, Hey, I'm gonna finally, I'm fine, fine.
curtis:
00:07:11
I'll post about ransomware, but even in their post about ransomware, it
curtis:
00:07:17
really wasn't that much about ransomware as much as it was about the things.
curtis:
00:07:22
Well, no, that's not true.
curtis:
00:07:23
I'll take that back.
curtis:
00:07:24
It was, it was here is the way ransomware works.
curtis:
00:07:29
And so I I'd say the first one, I'd say of the three series,
curtis:
00:07:34
The first one was about here's how to prevent it.
curtis:
00:07:37
Number one, like from getting in.
curtis:
00:07:39
The second was here's how to prevent it from doing more damage once it's in.
curtis:
00:07:43
And then the third one, it was okay.
curtis:
00:07:45
All right.
curtis:
00:07:45
You're totally screwed.
curtis:
00:07:46
You've got to reach for your backups.
Prasanna Malaiyandi:
00:07:47
Yeah.
curtis:
00:07:47
that
Prasanna Malaiyandi:
00:07:49
The one thing I would add to that , is he also was careful
Prasanna Malaiyandi:
00:07:52
saying, I don't want to just focus on the Conti ransomware and provide you steps
Prasanna Malaiyandi:
00:07:57
to prevent that because there are so many other ransomware flavors out there.
Prasanna Malaiyandi:
00:08:01
If you build something for just one.
Prasanna Malaiyandi:
00:08:04
You're not going to be protecting yourself.
Prasanna Malaiyandi:
00:08:05
Let's take a holistic approach.
Prasanna Malaiyandi:
00:08:07
And like you said, let's cover, how do you prevent it from getting in?
Prasanna Malaiyandi:
00:08:10
What, how do you prevent the spread of it?
Prasanna Malaiyandi:
00:08:12
And then how do you recover?
curtis:
00:08:15
Yeah.
curtis:
00:08:15
Good point.
Prasanna Malaiyandi:
00:08:17
The first one is called initial breach, I think
Prasanna Malaiyandi:
00:08:20
is how he titled the first article.
curtis:
00:08:22
Right.
curtis:
00:08:22
So the phishing basically, they're saying That That is the number
curtis:
00:08:30
one way that you get ransomware.
Prasanna Malaiyandi:
00:08:33
Yep.
Prasanna Malaiyandi:
00:08:33
Someone accidentally clicking an email, opening up something,
Prasanna Malaiyandi:
00:08:37
letting the attackers in, and they don't even know about it.
Prasanna Malaiyandi:
00:08:39
So how do you prevent your users from clicking on malicious links?
curtis:
00:08:45
now, now, it's interesting.
curtis:
00:08:47
This goes, yeah.
curtis:
00:08:49
Sorry.
curtis:
00:08:50
This goes somewhat against what, some of the advice of one of the guests
curtis:
00:08:56
that we had on the podcast, which was, they basically said, look, your
curtis:
00:09:01
people are going to click on stuff, stop relying on, you know, I dunno.
curtis:
00:09:07
I dunno if it's against, but, but he, he, de-prioritized training and, and like, uh,
curtis:
00:09:16
phishing assessments, didn't you think.
Prasanna Malaiyandi:
00:09:19
Yeah.
Prasanna Malaiyandi:
00:09:19
So.
Prasanna Malaiyandi:
00:09:20
This author does say training can only help you so much?
Prasanna Malaiyandi:
00:09:26
I think the couple things, the couple things though, that he did mention is,
Prasanna Malaiyandi:
00:09:31
um, you do need some level of training, but you need to make sure people don't
Prasanna Malaiyandi:
00:09:36
feel like they're being punished.
Prasanna Malaiyandi:
00:09:38
When they do the wrong thing, right?
Prasanna Malaiyandi:
00:09:41
You want that transparency.
Prasanna Malaiyandi:
00:09:42
You want to be telling people it's okay for you to say that I clicked
Prasanna Malaiyandi:
00:09:46
the wrong thing because then the IT team can try to evaluate what's
Prasanna Malaiyandi:
00:09:50
going on and try to contain it.
Prasanna Malaiyandi:
00:09:53
The sooner they know the better it is.
Prasanna Malaiyandi:
00:09:54
But if say someone's afraid because they're going to get in trouble.
Prasanna Malaiyandi:
00:09:57
They might be fired, right.
Prasanna Malaiyandi:
00:09:58
It becomes taboo then no one's going to report it.
Prasanna Malaiyandi:
00:10:01
And that's actually really bad.
curtis:
00:10:04
Yeah.
curtis:
00:10:04
Um, they said to prioritize rewarding over punishment.
curtis:
00:10:08
Right?
curtis:
00:10:08
Make it, make it known.
curtis:
00:10:09
Like you said, that it's okay to call in.
curtis:
00:10:11
We want you to call in, even if you messed up and, and then, and
curtis:
00:10:17
they also said consider doing your own phishing assessments.
curtis:
00:10:20
I read some of the comments and they talked about that.
curtis:
00:10:24
They had a thing where you, you, you got some.
curtis:
00:10:29
You got some, it was sort of some strikes and it was like 10 strikes.
curtis:
00:10:33
It was like, you could click on 10 malicious emails.
curtis:
00:10:38
And, and then it was the 10th.
curtis:
00:10:39
When, and that they actually had a series of escalations where, you
curtis:
00:10:43
know, it started out, Hey, you know, we really told you kind of thing.
curtis:
00:10:47
Um, I think you can do both.
curtis:
00:10:49
I think you can do both carrot and stick, right.
curtis:
00:10:50
Reward and punishment where yes.
curtis:
00:10:53
You want to reward people for calling in.
curtis:
00:10:55
Thank you for calling accidentally clicked and then.
curtis:
00:10:59
And then if the person clicks doesn't know, but you know, because you did a
curtis:
00:11:05
phishing assessment, you do a series of escalating things where that
curtis:
00:11:11
ultimately you can have a person.
curtis:
00:11:14
And this was discussed in the comments, not necessarily that you
curtis:
00:11:18
would fire somebody that, that keeps doing this, but you might say, okay,
curtis:
00:11:22
this person cannot be trusted with a straight internet connection.
Prasanna Malaiyandi:
00:11:26
Yup.
curtis:
00:11:27
Right.
curtis:
00:11:28
All email from this person will be monitored.
curtis:
00:11:30
Yeah.
curtis:
00:11:32
They can only open email that's straight from our Exchange server
curtis:
00:11:35
or whatever stuff like that.
Prasanna Malaiyandi:
00:11:37
So phishing was sort of one way that people get in.
Prasanna Malaiyandi:
00:11:40
Right.
Prasanna Malaiyandi:
00:11:40
But I think once they're in whichever mechanism it is, it's like, okay,
Prasanna Malaiyandi:
00:11:45
how do you detect that someone's in?
Prasanna Malaiyandi:
00:11:47
And I think Curtis, this is what you're going to say, right.
Prasanna Malaiyandi:
00:11:49
About sort of this notion of droppers.
curtis:
00:11:52
Yeah, I actually didn't know this part.
curtis:
00:11:54
That's I was fascinated that that basically that the actual phishing
curtis:
00:12:00
results in a very small piece of software whose job it is to install
curtis:
00:12:06
the actual piece of software
Prasanna Malaiyandi:
00:12:08
Yeah.
curtis:
00:12:09
and that he calls out a dropper.
Prasanna Malaiyandi:
00:12:11
Yep.
curtis:
00:12:12
Well, and so the idea is understand that that's the way it works,
curtis:
00:12:18
that a piece of code gets dropped in, and then that piece of code executes, and
curtis:
00:12:22
the only purpose of that piece of code is to download the other piece of code.
curtis:
00:12:27
And so they said that you could, you could stop that.
curtis:
00:12:30
You could say, well, you can't run arbitrary pieces of code in,
curtis:
00:12:36
in locations that are directly accessible by the end user,
curtis:
00:12:41
you know,
Prasanna Malaiyandi:
00:12:42
Or you could restrict what applications are allowed
Prasanna Malaiyandi:
00:12:44
to run on a laptop for instance,
curtis:
00:12:46
yes,
curtis:
00:12:46
Whitelisting, I think whitelisting is it, I think it's the, the best.
curtis:
00:12:53
The best way to stop stuff like this.
curtis:
00:12:56
It's also the highest touch because it means that every new
curtis:
00:13:00
application that anybody has to install, they have to get approval.
Prasanna Malaiyandi:
00:13:04
Yep.
Prasanna Malaiyandi:
00:13:05
think it's a way to guarantee sort of legitimate applications have gone through
Prasanna Malaiyandi:
00:13:09
some sort of validation process, security review, et cetera, before it's being
Prasanna Malaiyandi:
00:13:13
allowed to be deployed in your environment
curtis:
00:13:17
Right.
curtis:
00:13:18
And then the next thing it talked about was that a random file
curtis:
00:13:23
running should not be downloading files from the internet, right.
curtis:
00:13:27
That it should only be HTTP and HTTPS is downloading from the internet.
curtis:
00:13:32
And so.
curtis:
00:13:34
He said with exceptions, like, you know, um, uh, SFTP for example.
curtis:
00:13:39
So he talked about, he talked about, you know, again, accessing that also
curtis:
00:13:44
possibly blocking bizarre TLDs right.
curtis:
00:13:47
And unnecessary locations.
curtis:
00:13:49
You could just simply say, listen, uh, we don't have anything to do with Russia.
curtis:
00:13:53
Why would we download anything from Russia?
curtis:
00:13:57
And if there is somebody in our company that needs to download stuff from Russia,
curtis:
00:14:00
they will be, they will be accepted.
curtis:
00:14:01
That was a very running theme I heard was lock down everything and allow exceptions.
Prasanna Malaiyandi:
00:14:08
Yeah.
Prasanna Malaiyandi:
00:14:08
And, uh, it was going to bring up two things.
Prasanna Malaiyandi:
00:14:12
One was what's a TLD for our listeners?
curtis:
00:14:15
Oh, top level domain.
curtis:
00:14:17
That's like.com or dot ransomware.
curtis:
00:14:22
There is no dot
curtis:
00:14:23
ransomware,
curtis:
00:14:23
but.
Prasanna Malaiyandi:
00:14:24
And was it you, or was it one of our guests who were, who
Prasanna Malaiyandi:
00:14:27
was talking about how they worked at a company that completely locked down
Prasanna Malaiyandi:
00:14:32
their network and the network admin would never let them do their backups
Prasanna Malaiyandi:
00:14:36
and everything was by except.
curtis:
00:14:39
That was me.
curtis:
00:14:40
Yeah.
curtis:
00:14:40
Yeah.
curtis:
00:14:41
Uh, that was, I was a client of mine where they had internal firewalls and
curtis:
00:14:48
that's an example of, you know, going to the extreme of, well, now you're now
curtis:
00:14:52
you're preventing core business functions,
Prasanna Malaiyandi:
00:14:54
Yeah,
curtis:
00:14:55
right?
Prasanna Malaiyandi:
00:14:56
but
curtis:
00:14:57
they also talked about local firewalls, right.
curtis:
00:14:59
Which is what we were just talking about, that the, and we're going to get
curtis:
00:15:04
to that more in the next section is, so they're just looking, he's looking
curtis:
00:15:11
for ways to stop the dropper from getting yeah, exactly.
Prasanna Malaiyandi:
00:15:16
Yeah.
Prasanna Malaiyandi:
00:15:16
thought was an interesting point I'd never thought about is he does have a point
Prasanna Malaiyandi:
00:15:20
about they block newly created domains.
Prasanna Malaiyandi:
00:15:25
Right.
Prasanna Malaiyandi:
00:15:25
Which I thought that had been dormant for a while and then are now active,
Prasanna Malaiyandi:
00:15:29
which I thought was very interesting because it's something I had never
Prasanna Malaiyandi:
00:15:32
thought about, but it totally makes sense.
Prasanna Malaiyandi:
00:15:33
Usually when you get ransomware, right.
Prasanna Malaiyandi:
00:15:36
These actors, they spin up domains and they start
Prasanna Malaiyandi:
00:15:38
communicating, using that domain.
Prasanna Malaiyandi:
00:15:40
So he's like, yeah, you could have a policy to just block these domains.
Prasanna Malaiyandi:
00:15:43
So they can't actually reach back out to the command and control
Prasanna Malaiyandi:
00:15:46
servers to be able to download from the dropper, the actual exploit.
curtis:
00:15:53
Right.
curtis:
00:15:53
And, and they said they weren't aware of anything.
curtis:
00:15:59
Where that you can do this for free, but there are tools that are
curtis:
00:16:02
available to help you do This right.
curtis:
00:16:04
There's
Prasanna Malaiyandi:
00:16:05
remember, uh, what are the D D.
Prasanna Malaiyandi:
00:16:09
Uh, what were the initials?
Prasanna Malaiyandi:
00:16:11
The DNS
curtis:
00:16:12
DDI.
Prasanna Malaiyandi:
00:16:14
right.
Prasanna Malaiyandi:
00:16:14
And I think that goes to some of that as well.
Prasanna Malaiyandi:
00:16:16
Right.
Prasanna Malaiyandi:
00:16:16
Where it's like, Hey, if you have some of those controls in place, you can now
Prasanna Malaiyandi:
00:16:20
prevent unauthorized access to domains.
Prasanna Malaiyandi:
00:16:23
They should not be having access to.
curtis:
00:16:27
Exactly.
curtis:
00:16:28
And then they started talking about preventing lateral movement inside.
curtis:
00:16:33
Think about the ways that people need to move within your organization and allow
curtis:
00:16:40
that, but block all other movement, right.
curtis:
00:16:43
Lateral movement between servers and I, and I think, again, going back
curtis:
00:16:46
to that company, that was a perfect example of, they had blocked all
curtis:
00:16:51
lateral movement between all servers and I couldn't get my job done.
curtis:
00:16:56
They're only problem w and they should have done that.
curtis:
00:16:59
And, you know, they were forward thinking in that regard, but you do need to allow
curtis:
00:17:04
exceptions for things like backup, right.
curtis:
00:17:06
That is definitely a server to server lateral movement.
Prasanna Malaiyandi:
00:17:11
Yeah.
Prasanna Malaiyandi:
00:17:11
And it's also other simple things.
Prasanna Malaiyandi:
00:17:13
Like one of them was your favorite topic, right?
Prasanna Malaiyandi:
00:17:16
Locking down RDP and SSH.
Prasanna Malaiyandi:
00:17:18
Right.
Prasanna Malaiyandi:
00:17:18
If it's not needed, then lock it down.
Prasanna Malaiyandi:
00:17:20
Right.
Prasanna Malaiyandi:
00:17:21
SMB is the same way as well for vCenter, right?
Prasanna Malaiyandi:
00:17:25
Figuring out what actually needs access and what.
Prasanna Malaiyandi:
00:17:27
Needs to be available to the internet.
Prasanna Malaiyandi:
00:17:30
And one of the points he made is you should just assume that
Prasanna Malaiyandi:
00:17:33
your inner internal network is as hostile as internet access.
Prasanna Malaiyandi:
00:17:38
Right?
Prasanna Malaiyandi:
00:17:39
So once an exploit happens, you can't trust anything internally.
curtis:
00:17:44
They were also, I, you know, I didn't necessarily
curtis:
00:17:47
agree with this one here.
curtis:
00:17:48
And that was it's time to kill monolithic file servers.
curtis:
00:17:51
Right.
curtis:
00:17:52
Now I don't have a problem with the file server.
curtis:
00:17:55
It's just, I think when, when they mean monolithic file server, they're just
curtis:
00:17:58
saying a file server where everybody in the company can access all the data.
curtis:
00:18:02
I would agree there anybody that's doing that, you know, in a
Prasanna Malaiyandi:
00:18:07
Yeah.
Prasanna Malaiyandi:
00:18:08
Segregate the data isolate to departments that need access.
Prasanna Malaiyandi:
00:18:11
You use ACLs, make sure the people who need access have access and
Prasanna Malaiyandi:
00:18:15
then monitor who's accessing what.
curtis:
00:18:18
So they made a specific example of like, you know, just because just
curtis:
00:18:22
because accounts receivable gets attacked, something shouldn't happen to payroll.
curtis:
00:18:27
These are, these are both finance functions, but they're separate
curtis:
00:18:30
financial functions and they should have their own areas.
curtis:
00:18:35
Uh, and this is another one that I harp on is about protecting
curtis:
00:18:39
privileged credentials.
curtis:
00:18:41
And
Prasanna Malaiyandi:
00:18:42
don't just have your password tattooed
Prasanna Malaiyandi:
00:18:44
on your forehead, Curtis.
curtis:
00:18:47
They recommended implementing, uh, things like LAPS, which I had
curtis:
00:18:52
to look up, which stands for local administrator password solution.
Prasanna Malaiyandi:
00:18:57
Uh, setting a different random password for
Prasanna Malaiyandi:
00:18:59
the common local admin account on every computer in the domain.
Prasanna Malaiyandi:
00:19:04
So you don't use one password for everything.
curtis:
00:19:07
And then MFA, I think, I think every system, you know, every, every
curtis:
00:19:13
privileged account needs to have MFA and, you know, I'm sorry, that's a pain.
curtis:
00:19:18
I, you know, I use it all the time, but it what is
Prasanna Malaiyandi:
00:19:24
but wait, why do you need a privileged account?
Prasanna Malaiyandi:
00:19:28
You should.
Prasanna Malaiyandi:
00:19:30
Here's the thing.
Prasanna Malaiyandi:
00:19:30
Most times you should probably not need privileged accounts, so you do not need
Prasanna Malaiyandi:
00:19:34
to access your privileged accounts.
curtis:
00:19:36
Agreed, but, but they have to exist.
curtis:
00:19:39
And so you have to lock them down this way.
curtis:
00:19:41
I think what you're saying is MFA, shouldn't be that big of a deal for you.
curtis:
00:19:44
If you set up modern administration.
Prasanna Malaiyandi:
00:19:48
yeah.
Prasanna Malaiyandi:
00:19:49
And you should rarely be using that.
curtis:
00:19:52
Right.
curtis:
00:19:52
Right.
curtis:
00:19:54
And then very last on the list and I would have put it first, but you know, it's
curtis:
00:19:58
just me and that was patching your stuff.
Prasanna Malaiyandi:
00:20:00
How many times does that come up on the podcast?
Prasanna Malaiyandi:
00:20:03
When we talk about ransomware, you know,
curtis:
00:20:05
Yeah, exactly.
curtis:
00:20:07
So the next one is about.
curtis:
00:20:12
It's like, okay, so you got some ransomware.
curtis:
00:20:14
Let's talk about the things that they're going to try to do.
curtis:
00:20:17
The very first thing they listed was deleting of shadow copies.
curtis:
00:20:24
And so I, and really shadow copies are basically like he's talking
curtis:
00:20:30
about windows shadow copies.
Prasanna Malaiyandi:
00:20:31
Yeah, I think windows shadow copies.
Prasanna Malaiyandi:
00:20:32
Yup.
curtis:
00:20:34
Right.
curtis:
00:20:34
And so there is a tool here, which I had never heard of called raccine.
curtis:
00:20:41
And it, it stops you from deleting shadow copies.
curtis:
00:20:48
He said it stops everybody from deleting them.
curtis:
00:20:50
So just realize that if you've got some regular thing that regularly deletes
curtis:
00:20:54
shadow copies, it'll break that, but it looks it's something on github.
curtis:
00:21:00
So it's, uh, you know, it's an open source tool.
Prasanna Malaiyandi:
00:21:03
And just reading that briefly, I think many backup
Prasanna Malaiyandi:
00:21:07
tools when you're backing up windows applications uses shadow copy.
Prasanna Malaiyandi:
00:21:11
So be careful if you are using that because you may not
Prasanna Malaiyandi:
00:21:15
be able to do your backups.
curtis:
00:21:16
Yeah, that's a good question.
curtis:
00:21:18
I, I guess, you know, I would differentiate between shadow
curtis:
00:21:24
copies made just for the purposes of backups and shadow copies that
curtis:
00:21:27
are made and then left there.
curtis:
00:21:27
I don't know if there's like a different.
curtis:
00:21:30
I know that when you make a snapshot, you say why you're making the snapshot.
Prasanna Malaiyandi:
00:21:34
Yeah.
curtis:
00:21:35
Um, but agreed that this is not something that you're just
curtis:
00:21:39
going to download and just implement,
Prasanna Malaiyandi:
00:21:43
Yeah.
curtis:
00:21:44
might break all your backups.
curtis:
00:21:46
Well, what it might do is it might allow you to create that snapshot,
curtis:
00:21:48
but then it leaves all those snapshots around and let you delete them.
curtis:
00:21:51
and you might get an error on your backup because you can't,
curtis:
00:21:53
it can't delete the snapshot.
Prasanna Malaiyandi:
00:21:55
yeah.
Prasanna Malaiyandi:
00:21:56
Or your production could run out of space and then your app dies.
curtis:
00:22:01
And then what's the next one
Prasanna Malaiyandi:
00:22:03
So the next one is a common theme for us.
Prasanna Malaiyandi:
00:22:07
Uh, when we talk about ransomware, it's less about the actual encrypting of data.
Prasanna Malaiyandi:
00:22:12
It's the fact that these ransomware actors, especially the Conti group,
Prasanna Malaiyandi:
00:22:16
they like to exfiltrate your data and steal sensitive data, and then hold you
Prasanna Malaiyandi:
00:22:20
hostage and be like, Hey, you want to pay?
Prasanna Malaiyandi:
00:22:22
Then you have to pay twice once for the decryption key.
Prasanna Malaiyandi:
00:22:25
And then once to make sure we don't publish your data.
Prasanna Malaiyandi:
00:22:28
And then sometimes they will still go and publish your data.
Prasanna Malaiyandi:
00:22:31
Right.
Prasanna Malaiyandi:
00:22:31
So in this post, he talks about sort of, how can you make sure
Prasanna Malaiyandi:
00:22:35
you can detect data exfiltration?
Prasanna Malaiyandi:
00:22:40
And he talks about everything from, if you have, if you understand network
Prasanna Malaiyandi:
00:22:45
patterns, you could look for anomalies.
Prasanna Malaiyandi:
00:22:47
Um, you can also look at other tools.
Prasanna Malaiyandi:
00:22:52
To see when data is actually being read and sent.
Prasanna Malaiyandi:
00:22:57
So there's some interesting tools that he talked about.
Prasanna Malaiyandi:
00:22:59
One that I never thought about, which was this mechanism called, uh,
Prasanna Malaiyandi:
00:23:04
from things called Canary tokens,
Prasanna Malaiyandi:
00:23:08
where it basically creates a false file.
Prasanna Malaiyandi:
00:23:12
And any time someone accesses it, it generates a token and sends it home.
Prasanna Malaiyandi:
00:23:16
And then it'll send you an email, say, Hey, by the way,
Prasanna Malaiyandi:
00:23:18
someone accessed this file.
Prasanna Malaiyandi:
00:23:20
So you can sort of get notified of, Hey, someone's accessing something, which
Prasanna Malaiyandi:
00:23:24
they probably normally never should be.
Prasanna Malaiyandi:
00:23:27
Because most of this ransomware software and data exfiltration, it's
Prasanna Malaiyandi:
00:23:31
just programmatically reading, like scanning folders, reading files, right.
Prasanna Malaiyandi:
00:23:36
Trying to figure out what to send.
curtis:
00:23:38
Right.
curtis:
00:23:39
And they mentioned both commercial solutions and open source solutions.
curtis:
00:23:44
Like the one you mentioned, they also mentioned something called, uh, Zeke,
curtis:
00:23:49
which, uh, And you know, that it analyzes NetFlow, but there are commercial
curtis:
00:23:54
tools, which we've mentioned on here.
curtis:
00:23:56
Um, and I, and I'd like to get, I'd like to get more of those companies on here.
curtis:
00:24:01
And their recommendation was the same as mine, which is looking
curtis:
00:24:05
for something that uses behavioral analytics to determine what is, and
curtis:
00:24:08
is not a normal file transfer, right.
curtis:
00:24:11
That should be able to spot a massive, uh, exfiltration attack..
curtis:
00:24:17
And then the response against encryption, they talked about the EDR
curtis:
00:24:25
XDR, which is I had to look that up.
curtis:
00:24:28
I was not in my, so this is what,
Prasanna Malaiyandi:
00:24:32
And point D
Prasanna Malaiyandi:
00:24:33
endpoint detection and response.
curtis:
00:24:36
right.
curtis:
00:24:36
Okay.
curtis:
00:24:37
So.
curtis:
00:24:38
The idea is that if you've got, if you've got the money to put something
curtis:
00:24:42
on each laptop that basically looks at and stops, massive file modifications,
curtis:
00:24:50
it would detect and stop those.
curtis:
00:24:51
Right.
curtis:
00:24:53
And then same thing with the, with the honeypot.
curtis:
00:24:56
I liked the idea with the creating an entire separate file server that has,
curtis:
00:25:01
has all the same file names, but just with junk data, watch for anybody doing
curtis:
00:25:05
anything there and then report on.
Prasanna Malaiyandi:
00:25:07
Yeah.
Prasanna Malaiyandi:
00:25:07
And the interesting thing is when he was talking about honeypots, I didn't
Prasanna Malaiyandi:
00:25:11
know, this is, he was like, oh yeah.
Prasanna Malaiyandi:
00:25:13
And then to make it more realistic, you, there are a couple things you can do.
Prasanna Malaiyandi:
00:25:17
You can map those device shares to actual endpoint devices.
Prasanna Malaiyandi:
00:25:22
So they show up there because if I'm a ransomware program and I'm just looking
Prasanna Malaiyandi:
00:25:26
at all the devices attached, right.
Prasanna Malaiyandi:
00:25:28
I don't know if it's real or not.
Prasanna Malaiyandi:
00:25:29
And the question came up, Hey, how do you hide it from your end users?
Prasanna Malaiyandi:
00:25:32
Because you don't want your end users clicking on it as well.
Prasanna Malaiyandi:
00:25:35
And there are registry commands in Windows, so you can actually hide them.
Prasanna Malaiyandi:
00:25:39
So your users don't actually see those drives.
Prasanna Malaiyandi:
00:25:43
And instead he suggested you actually bookmarked.
Prasanna Malaiyandi:
00:25:47
Shared drive letters with these honeypot shared drives because ransomware,
Prasanna Malaiyandi:
00:25:53
uh, programs are either going to start from a and work alphabetically
Prasanna Malaiyandi:
00:25:56
or start from Z and come backwards, to see what drives are available.
Prasanna Malaiyandi:
00:26:01
And then they'll just start looking that way.
curtis:
00:26:03
So, so put a honeypot at a and put a honeypot at z.
Prasanna Malaiyandi:
00:26:07
Yup.
curtis:
00:26:09
I like um,
Prasanna Malaiyandi:
00:26:12
were some really interesting things that he talked about.
curtis:
00:26:15
And we can only cover a little bit here.
curtis:
00:26:17
I just would highly recommend anybody that's interested in this, which should
curtis:
00:26:22
be everybody go read this thread.
curtis:
00:26:26
It's really well-written thread
Prasanna Malaiyandi:
00:26:28
It's like how to trick ransomware
Prasanna Malaiyandi:
00:26:29
and how to protect yourself.
curtis:
00:26:31
Right.
curtis:
00:26:36
then
Prasanna Malaiyandi:
00:26:36
jump onto the third?
Prasanna Malaiyandi:
00:26:38
Curtis.
curtis:
00:26:38
Yeah.
curtis:
00:26:38
Get up on the third?
curtis:
00:26:39
one.
Prasanna Malaiyandi:
00:26:39
Sorry, what is the third one about by the way?
curtis:
00:26:42
Oh, the third one well, basically it's like, well, you've been infected.
curtis:
00:26:45
What are we going to do?
curtis:
00:26:46
Worst case scenario you've been infected and it's spread, and now
curtis:
00:26:50
you need to reach for your backups.
curtis:
00:26:52
So they mentioned go to the, the, the incident response plan.
curtis:
00:26:57
And of course that assumes that you have one, which we've said
curtis:
00:27:00
that you need to have one, right?
curtis:
00:27:02
We we've mentioned repeatedly that a ransomware attack is
curtis:
00:27:06
not the same as a disaster.
curtis:
00:27:10
There are elements that I'd say a disaster is a subset of.
curtis:
00:27:14
Uh, typical DR response is a subset of a, of a ransomware attack response.
Prasanna Malaiyandi:
00:27:22
Think people get confused because in the end you're
Prasanna Malaiyandi:
00:27:24
trying to do the same things, right.
Prasanna Malaiyandi:
00:27:27
Get your data up.
Prasanna Malaiyandi:
00:27:29
But I think the steps and the number of people, the different types of
Prasanna Malaiyandi:
00:27:33
people involved are significantly different between just a normal DR.
Prasanna Malaiyandi:
00:27:37
Versus a ransomware recovery.
curtis:
00:27:39
Well, you know, simplistically to me, the biggest difference between,
curtis:
00:27:44
uh, responding to a ransomware attack and a disaster, it'd be the
curtis:
00:27:49
equivalent of like, if you're doing a DR and you've had a flood step
curtis:
00:27:53
number one is drain the data center,
curtis:
00:27:56
right?
curtis:
00:27:57
Get all the water out of the data center.
curtis:
00:27:59
Well, a ransomware attack is like, you're trying to drain the data center while you
curtis:
00:28:04
have a person standing there with a fire hose, it's filling up your datacenter.
curtis:
00:28:08
Right?
curtis:
00:28:08
the, that's the difference between a disaster recovery and a
curtis:
00:28:11
ransomware recovery is that they are actively still attacking you.
curtis:
00:28:15
And you're actively experiencing the disaster at the same time as
curtis:
00:28:19
you're trying to recover from it.
curtis:
00:28:22
And so they've got a good thing here on what should be
curtis:
00:28:27
in an incident response, right?
curtis:
00:28:28
Some things you have to have in your incident response plan
curtis:
00:28:32
got eight things about right.
curtis:
00:28:35
Procedures and policies and an incident firm.
curtis:
00:28:40
Right.
curtis:
00:28:40
You, you need, you basically get professionals, retain them now, right?
curtis:
00:28:46
Oh, by the way, I just, I just gotta throw out a really hilarious thing from,
curtis:
00:28:51
uh, my granddaughter Lily yesterday.
curtis:
00:28:55
So we have a friend, a mutual friend that was in a car accident a while back.
curtis:
00:29:02
Not, not seriously injured, but injured enough that there is a lawsuit that
curtis:
00:29:08
our, that, that that's going on.
curtis:
00:29:10
And Lily said, uh, she, you know, she, she mentioned that I couldn't, she couldn't
curtis:
00:29:17
pick her up because, you know, she was with her, she was with her lawyer and
curtis:
00:29:21
then she looks at me, we were just walking and then she's like, do I have a lawyer?
curtis:
00:29:29
I was like, no, I don't think you have a lawyer.
curtis:
00:29:32
You don't need a lawyer right now.
Prasanna Malaiyandi:
Speaker:
00:29:35
But, but you're right.
Prasanna Malaiyandi:
Speaker:
00:29:36
Most people don't even think about that.
Prasanna Malaiyandi:
Speaker:
00:29:38
Like even in like everyday, like normal situations, it's like, if
Prasanna Malaiyandi:
Speaker:
00:29:42
I, God forbid get arrested, right.
Prasanna Malaiyandi:
Speaker:
00:29:44
Who am I going to call?
Prasanna Malaiyandi:
Speaker:
00:29:45
It's like,
curtis:
00:29:46
Right.
curtis:
00:29:47
Yeah.
curtis:
00:29:48
And so w what they're saying here is, you know, go, go find who you're going to hire
Prasanna Malaiyandi:
00:29:55
who are you going to call Ghostbusters?
curtis:
00:29:57
going to call?
curtis:
00:29:58
And, um, you know, and they got a policy, oh, a policy.
curtis:
00:30:03
This is interesting policy for informing partners and customers and the media.
curtis:
00:30:07
Right?
curtis:
00:30:09
Decision-makers right.
curtis:
00:30:10
All of that stuff.
curtis:
00:30:11
This should all be decided upfront.
curtis:
00:30:13
You should be deciding that now.
curtis:
00:30:15
I don't know how many times we can say that.
Prasanna Malaiyandi:
00:30:17
Yep.
Prasanna Malaiyandi:
00:30:18
And then they talk about restoring your data.
curtis:
00:30:20
Restoring your data.
curtis:
00:30:22
right?
curtis:
00:30:23
And I think how they said alright, three posts in and we
curtis:
00:30:26
can finally talk about backups.
curtis:
00:30:27
Right.
curtis:
00:30:29
It's interesting here.
curtis:
00:30:30
Right?
curtis:
00:30:30
And he talks about, you know, the typical call-out is that ransomware's
curtis:
00:30:33
going to target your backups.
curtis:
00:30:35
And so you need some sort of immutable backup solution.
curtis:
00:30:38
Right.
Prasanna Malaiyandi:
00:30:39
Um, he does also talk and I know Curtis, you're probably
Prasanna Malaiyandi:
00:30:43
going to have concerns with this, right?
Prasanna Malaiyandi:
00:30:45
That you don't have to be offsite to protect your backups properly.
Prasanna Malaiyandi:
00:30:50
He mentions that you could use strict network segmentation or other
Prasanna Malaiyandi:
00:30:55
mechanisms to ensure separation, which would protect you in the case
Prasanna Malaiyandi:
00:31:00
of ransomware, but may not protect you from all disasters that could occur.
curtis:
00:31:05
Agreed.
curtis:
00:31:06
And, and, and I don't, I don't have an issue with that, right.
curtis:
00:31:09
Obviously, you know, I'll say obviously I work at a service-based backup company.
curtis:
00:31:13
And we see that as the easy it's easy peasy.
curtis:
00:31:16
All our backups are off site.
curtis:
00:31:18
I I'm not against, you know, as a backup expert, I'm not against onsite backups.
curtis:
00:31:22
There's a lot of good reasons for an onsite copy, but I completely agree
curtis:
00:31:26
with this person that you have to protect that onsite copy from attacks.
curtis:
00:31:32
And there are a lot of very common backup designs, incredibly common backup designs
curtis:
00:31:39
that do not that the default installation of those products do not protect you.
curtis:
00:31:46
Right.
curtis:
00:31:47
And I, and I'll, you know, I don't wanna, I don't wanna pick on our friends at
curtis:
00:31:51
Veeam, but that's a perfect example.
curtis:
00:31:54
The guys from Veeam came on here and they explained to you, if you listen,
curtis:
00:31:58
if you, if you haven't seen those episodes, go back and listen to them.
curtis:
00:32:02
Uh, about, you know, when they talked about the, the Conti ransomware attacks
curtis:
00:32:06
and how you can configure your Veeam backups to protect against that.
curtis:
00:32:12
My concern is that most of their customers are not listening to this podcast, by
curtis:
00:32:17
the way, they're more than welcome.
curtis:
00:32:19
All 700,000 Veeam customers are more than welcome to come listen to the podcast.
curtis:
00:32:24
But if, if you just do the default installation and you don't take their
curtis:
00:32:28
recommendations on how to further protect your data, you know, it's no different
curtis:
00:32:33
than any of the other products, right?
curtis:
00:32:35
So
Prasanna Malaiyandi:
00:32:36
Read
curtis:
00:32:36
you've got to stop doing that.
curtis:
00:32:38
Read the manual, read the best practices.
curtis:
00:32:41
Call Rickatron.
curtis:
00:32:42
Rickatron'll sort, you out and.
curtis:
00:32:46
So he talks about that.
curtis:
00:32:47
He also talks about testing, testing, your backups.
curtis:
00:32:50
I'm editing right now, like literally in I'm in the middle of editing
curtis:
00:32:54
the podcast, the episode of the restore test gone horribly wrong.
Prasanna Malaiyandi:
00:32:59
backup.
curtis:
00:33:00
It's going to be a great episode.
curtis:
00:33:03
The.
curtis:
00:33:06
Yeah, Schrodinger's backup.
curtis:
00:33:07
Exactly.
curtis:
00:33:08
That's going to, if, yeah, if you haven't heard that episode
curtis:
00:33:11
go back and listen to it.
curtis:
00:33:12
It's a, it's a
Prasanna Malaiyandi:
00:33:12
Yeah.
curtis:
00:33:14
uh,
curtis:
00:33:14
episode.
Prasanna Malaiyandi:
00:33:15
article also refers to it, right?
Prasanna Malaiyandi:
00:33:16
Yeah.
curtis:
00:33:18
yes, he does.
curtis:
00:33:20
Uh, did he, did he actually refer to Shrodinger's
Prasanna Malaiyandi:
00:33:22
Yeah.
Prasanna Malaiyandi:
00:33:22
Yeah.
Prasanna Malaiyandi:
00:33:23
HInging your company's future on a schrodinger's backup thought
Prasanna Malaiyandi:
00:33:26
experiment is a terrible idea.
Prasanna Malaiyandi:
00:33:28
Don't do that.
curtis:
00:33:30
Nice.
curtis:
00:33:32
So, and then why don't you talk about the decryption part?
Prasanna Malaiyandi:
00:33:36
Yeah.
Prasanna Malaiyandi:
00:33:37
So I guess the final part right.
Prasanna Malaiyandi:
00:33:39
Is you've been hit with encryption, right?
Prasanna Malaiyandi:
00:33:41
So now what do you do?
Prasanna Malaiyandi:
00:33:43
And in most cases, it's.
Prasanna Malaiyandi:
00:33:47
You can try to get, like, if you're lucky, there might be a free
Prasanna Malaiyandi:
00:33:50
decryptor out there for your data.
Prasanna Malaiyandi:
00:33:52
It's just going to take a very long time.
Prasanna Malaiyandi:
00:33:55
Right.
Prasanna Malaiyandi:
00:33:56
And if you do pay the ransom and you have to understand that paying the ransom may
Prasanna Malaiyandi:
00:34:00
be illegal to some of these groups, right?
Prasanna Malaiyandi:
00:34:03
They'll give you back a decryption key.
Prasanna Malaiyandi:
00:34:05
Hopefully it'll work.
Prasanna Malaiyandi:
00:34:06
It's not, it's in the ransomware.
Prasanna Malaiyandi:
00:34:08
Group's best interest not to cheat you there, but you're
Prasanna Malaiyandi:
00:34:10
taking a risk there as well.
Prasanna Malaiyandi:
00:34:13
And then finally, Once you've actually decrypted your data.
Prasanna Malaiyandi:
00:34:17
You've gone back up and running.
Prasanna Malaiyandi:
00:34:19
There's nothing that prevents them from either coming back
Prasanna Malaiyandi:
00:34:22
and attacking you again, if you haven't fixed anything right.
Prasanna Malaiyandi:
00:34:25
Or the next group coming back.
Prasanna Malaiyandi:
00:34:27
Cause that's another common thing you see is one group gets in encrypts your data.
Prasanna Malaiyandi:
00:34:31
Another group figures out a different mechanism because they
Prasanna Malaiyandi:
00:34:33
know now that you're willing to pay.
Prasanna Malaiyandi:
00:34:35
And so they might come after you as well.
Prasanna Malaiyandi:
00:34:40
So even once you have your data decrypted, it's not the end of the story.
curtis:
00:34:46
Right.
curtis:
00:34:47
And then the there's a, there's a what's next and, and, and all of
curtis:
00:34:50
these words, and this is a really long series of posts, which I highly
curtis:
00:34:53
recommend you go look through.
curtis:
00:34:55
There's one part where they typed in all caps, and this is it right when
curtis:
00:34:59
you're done, whatever you did restore, pay the ransom, whatever it is.
curtis:
00:35:04
It's not over, you clearly have a serious gap in your defenses.
curtis:
00:35:09
You need to find these and fix them.
curtis:
00:35:11
And then this is all caps and you need to understand that those gaps are bigger
curtis:
00:35:15
than just whatever the initial breach vector was as highlighted in parts one
curtis:
00:35:19
and two of this series, there are several opportunities to stop a ransomware
curtis:
00:35:23
breach before it gets to this point.
curtis:
00:35:26
So, um, there, there was some other.
curtis:
00:35:32
It was another one that I read, uh, somebody, they said, well, if I, if
curtis:
00:35:35
I, if I was at a company that had a highly, I think it was actually in here.
curtis:
00:35:39
If I was at a company that a highly publicized breach does this hurt my
curtis:
00:35:44
chances of getting a job and the author of this article didn't think so, because they
curtis:
00:35:49
basically said you now have experience
Prasanna Malaiyandi:
00:35:51
Yep.
Prasanna Malaiyandi:
00:35:52
I think it was actually at the end of this article is where he wrote about that.
Prasanna Malaiyandi:
00:35:55
Yeah.
Prasanna Malaiyandi:
00:35:55
He's like, yeah.
Prasanna Malaiyandi:
00:35:56
It's something you should actually show that you've gone through this because for
Prasanna Malaiyandi:
00:36:00
a lot of people it's just theoretical.
Prasanna Malaiyandi:
00:36:02
They've never experienced it.
Prasanna Malaiyandi:
00:36:04
It's like you Curtis.
Prasanna Malaiyandi:
00:36:05
Right.
Prasanna Malaiyandi:
00:36:05
I can sit here and talk about like how to back up your data, how to restore
Prasanna Malaiyandi:
00:36:09
your data, ideally how it should be done.
Prasanna Malaiyandi:
00:36:11
Right.
Prasanna Malaiyandi:
00:36:12
But I've never cut my teeth in a production environment, trying to do a
Prasanna Malaiyandi:
00:36:15
restore with people, yelling at me over my shoulder or watching over my shoulder.
Prasanna Malaiyandi:
00:36:20
Right.
Prasanna Malaiyandi:
00:36:20
You have, and I think that's sort of the difference, right?
Prasanna Malaiyandi:
00:36:23
Is you have that experience because trial by fire.
curtis:
00:36:28
Yeah, I, you know, you just, you just reminded me of, and I know
curtis:
00:36:32
I've told this story before, but not everybody's listening to every episode.
curtis:
00:36:35
My, one of my favorite restore stories was, was back at my first big job.
curtis:
00:36:39
And we had somebody in the NOC that was coordinating the various things that
curtis:
00:36:45
were happening of this big restore.
curtis:
00:36:48
And we had another guy that was in the data center that
curtis:
00:36:50
was actually doing things and.
curtis:
00:36:54
He was talking to the person who was on the phone in the NOC.
curtis:
00:36:58
And he, he didn't know that he was on speaker.
curtis:
00:37:02
And so he said, he's like, oh, so you know where you are.
curtis:
00:37:06
I'm in the NOC.
curtis:
00:37:07
He goes, oh, so I suppose you have Tom and Tom standing on
curtis:
00:37:10
your left and right shoulder.
curtis:
00:37:12
And he was referring to our boss's boss and our boss's boss's boss.
curtis:
00:37:16
Right.
curtis:
00:37:17
And, um, the, uh, that would be Tom Thomaides and Tom Lackey.
curtis:
00:37:23
And they were indeed standing both on his left and right shoulder.
curtis:
00:37:29
And they said that when he said that, oh, so you have Tom and Tom standing
curtis:
00:37:32
on your left and right shoulder.
curtis:
00:37:33
He said they just both took one step back.
Prasanna Malaiyandi:
00:37:38
but it's true, right?
Prasanna Malaiyandi:
00:37:39
It's a stressful thing everyone's watching to make sure it goes perfect.
curtis:
00:37:43
Right.
curtis:
00:37:44
And, um, so, you know, we wish you all the best of luck.
curtis:
00:37:49
I continue to be concerned about our, our friends over there in the Ukraine.
curtis:
00:37:53
And, uh, we wish them the best of luck and.
curtis:
00:37:58
You should also be concerned about the potential ramifications that all of
curtis:
00:38:02
that has on continued further attacks on your data center and read this
curtis:
00:38:07
article, read every word of this article, not just this summary and, um, you
Prasanna Malaiyandi:
00:38:13
the three
curtis:
00:38:14
read all three parts and we'll, we'll put links to
curtis:
00:38:17
it in the show description so that you can easily find it.
curtis:
00:38:20
Cause finding stuff on Reddit is not necessarily easy.
curtis:
00:38:24
So, uh, Thanks again Prasanna for your wise, uh, shipping advice
curtis:
00:38:29
and, um, you know, a good, good commentary on article well.
Prasanna Malaiyandi:
00:38:34
anytime Curtis and I hope I know, normally when we talk
Prasanna Malaiyandi:
00:38:36
about ransomware, you get very depressed.
Prasanna Malaiyandi:
00:38:38
So I, it feels like this isn't a depressing article.
Prasanna Malaiyandi:
00:38:41
It feels like here are things you should be doing.
Prasanna Malaiyandi:
00:38:43
So
curtis:
00:38:45
Here are things that you should do now.
Prasanna Malaiyandi:
00:38:47
Yeah,
curtis:
00:38:48
Yeah, absolutely.
curtis:
00:38:49
So, all right, well, thanks to the listeners.
curtis:
00:38:52
Uh, you know, we'd be nothing without you remember to subscribe
