[Music]
thank you
[Music]
all right
foreign
okay why don't we go and get started
so if you're in the ransomware and the
niche cyber security framework you're in
the right session
there's a lot going on today I want to
make sure I confirm that
uh real quick I want to introduce myself
I'm Randy Lee
uh in my past life I manage I.T I had a
number of organizations so Financial
Services Health Care I've been in the
mid-level I.T management and for those
that are still that are in middle level
it management
my heart goes out to you
because you have a lot of responsibility
but not not always empowered to make
those changes and we're going to talk
about some of the stuff that you can use
today
bring back your leadership team things
that we're seeing in the field
currently I'm a systems engineer at
veeam an evening customers
excellent I like seeing that so I spent
a lot of my time talking about data
protection
and we're if you look at V right as
employees we're all trying to change
that perception of backup as being
something you have to do to something
that you need to do it's really part of
your overall defensive strategy when it
comes to cyber security attacks so I
live locally if you're a game customer
please help to see me later right we
could talk about things that we can do
right health checks or other other
elements right of your environment I
live in Wauwatosa I Come From The Far
Far off land of Wauwatosa
anyone okay
so a couple topics we'll talk about we
only have 30 minutes there's a lot this
could be a multi
-day right or certainly multi-hour
session uh I'm just gonna give you some
introductory Concepts to nist a little
more about ransomware what we're seeing
by the way I have Joe Martin in the back
he'll happily field your questions as
well he's my manager at V thank you Joe
some ransomware headlines we all know
we've all seen them you know even you
know my kid was 10 years old he was
asking me what's ransomware all right we
all know it's out there we're seeing it
everywhere mainstream right I don't I'm
nothing with all the headlines but I'm
on ransomware alerts every day I see
them and every day I'm scared because
they're getting worse some of the
ransomware and mitigation costs and
these are some that I pulled together I
quite honestly these are probably
obsolete now
right we're seeing more and more attacks
more and more sophisticated attacks and
more and more financial implication or
or
Consequences right of those attacks
so let's talk a little about ransomware
is
right we've heard about it
what does it really mean right what are
what are we seeing a lot of so uh first
of all
there's a couple different types but by
the way I like to use one simple word
with ransomware it's extortion
someone is taking your data and selling
it to someone else someone is taking
your data not allowing you access to it
someone is not letting you into your
assistance if that doesn't qualify as
extortion
I don't know what does so really
when you're having conversations with
your leadership team with other people
with your security people consider using
that word right we are at risk for
extortion what do you mean ransomware oh
okay right
uh the the amount of rents were received
right this grows
there's a statistic that you know 51 of
people pay that Ransom that is scary
please don't pay the ransom there's a
couple different types that we really
talk about there's other variations so
we saw some of the the exploits before
but uh The lockerwear Ransom or
ransomware rather someone's taking your
keys
they got in your system they created
their own accounts they lock your
accounts out they trained credentials
and to get those back you need to pay
the ransom or take some other action by
the way there's a number of ways to help
with that Locker where ransomware I'm
seeing more often crypto wear ransomware
someone gets into your system
takes control of your data right they
encrypt your data they do something to
prevent you from having access to it
a little different than stealing it and
we'll talk about stages momentarily but
but it's happening every week
actually several times a week I'm gonna
call someone that is scared about or
concerned about it or was hit and and
we're only hearing a portion a lot of
people try to not talk about it please
don't hide those situations because they
only make it worse than someone else
so I also want to talk about uh Island
yes island hopping right it's a World
War II term where where we didn't just
go to you know our and Target we Island
hopped to get there supply chain right
if you yourself are very secure if you
give yourself a taken action there's
nothing to say that someone Downstream
from you right someone you work with
someone you have as a trusted partner
doesn't have an impact and you gave them
access to your victim
I was once asked I was at I.T director I
was asked by law enforcement
uh if I was concerned about someone's
ability to access the network I said No
I gave them full access
they had a warrant for their arrests
yeah this was someone else's issue but I
just given them access to the kingdom
right so we we trusted
another organization
and we should have uh I have the
aquarium in the corner
you guys hear what the fish tank isn't
in Las Vegas
yeah perfect example I'll just go and
add this device
by the way how many people have secure
networks at home
with devices excellent I knew this would
be the crowd to raise their hands on
that one I have isolated that works with
my iot devices
I'm too concerned what my rain doorbell
or my Nest security cam right they're
separate from everything else and I had
to be able to turn them on and turn them
off
uh ransomware examples these are some
that I came up with
uh the ones in in bold
are the ones I'm seeing or have seen
locally but uh Bryant uh Rebel had a
really bad netwalker attack in Illinois
maybe six months ago and throw a little
endorsement for my employer they're able
to recover with the in their situation
everything was taken out their veeam
servers are really across the board but
they had a mutable backups and we'll
come back to that topic they're able to
reinstall veeam and do restores and as a
result of that water it's like but by
the way the ransomware request 2.1
million dollars that day
the request dropped at 400 000 as a
service resource then they paid nothing
like those are the fun stories
so I'm seeing a bad rabbit I'm seeing
crypto Locker there's others on here as
well but these are the ones that kind of
pop into my mind as uh as let's put the
stack together
top entry points
the big one right email
uh I got an email from my CEO once he
asked me to click on something for some
report no no I'm not going to be doing
that I don't even trust emails for my
boss
yeah
um leveraging vulnerabilities we talked
about vulnerabilities they're everywhere
they continue to get worse we find more
and more
what's uh what's the how many patches
did Microsoft release last month
it was quite a few
so they're out there remote desktop
protocol hey welcome to covid let's give
our own RDP and hope for the best
we're seeing entry points there that are
are scary uh drive-by attacks they click
on this website and while you're there
click on this link whoops that's a
perfect example of the drive-by attack
we're seeing a lot of that
and then USB devices
um
please be careful of those
and also I had a QR code up earlier let
me scan that
okay
you should know
no I'm not kidding this is actually a
bean phone
good answer
by the way there's something on the
bottom here
it's a weird trick now I it's not my
trick it's something I read and some of
you are nodding like you may have heard
about this before
if you are in the Russian Federation and
you attack others
outside the Russian Federation they
don't care
if you're the Russian Federation and you
attack someone within the Russian
Federation they will find you
why not put a Russian keyboard set
virtual on your system somewhere so that
when they scan
that software automatically stops
running and removes itself I have no
idea if this works no one's ever told me
yep it worked because there's no real
way of knowing
something happened and went away no one
was was wiser consider that there's a
link to it I'll make sure you have
access to that link as well
uh ransomware stages
different things different people right
stage zero is someone found a hole a
hole right a vulnerability into your
environment we all have them we don't
know where they are we try to plug them
we try to stop them but they're out
there somewhere
right that we all have them
stage one the Bad actors have access to
an individual system or multiple systems
are limited maybe they took over
someone's notebook
someone's you know individual file
server right very limited in scope we're
still not concerned it's not a good
thing
but it's relatively isolated
right now we start getting into stage
two they have access to data and they're
able to take that data
all right
uh 14 percent
uh firms indicate that the time between
compromise and detection is up to six
months so someone making your system now
you don't know it they may be pulling
down data selling the data displaying
that data you know who knows now we
start getting into the stereo once and
we're at stage three
where they have right access this is
where the actual encryption happens had
a customer call me he said this on a
Monday he called me said on Saturday I
got a call that things were weird at
work
like what does that mean he goes I don't
know either so I drove in yeah things
were weird files were disappearing I
looked at my server I saw someone
encrypting my data
okay that's weird what'd you do I unplug
the Nick right away
so he hadn't took immediate action we're
gonna come back to that there's a
question I have later to ask you but
that's where we start seeing an impact
that's where you know the beam where I
work right we are not a cyber security
company specifically but we are part of
your cyber security strategy right there
isn't an ability to recover and we have
methods of recovery we'll cover some of
those and then stage four this is where
it gets really scary they introduced new
hooks into your system right creating
new accounts
we'll talk about some of the ways to
help with something stages speaking of
Bad actors
had to throw that in
all right so cyber security versus cyber
security Frameworks I think we all
practice good cyber security
at least we try to right I passed my
desktops at home I have my kids pass
their devices
we're all doing something that we think
is good
practicing good cyber security
principles is a good thing
is not as good as having an active cyber
security framework
again what do you mean by framework I
have guidelines I have standards anyone
up cisps
excellent okay so you know about some of
these cyber security Frameworks but it's
about best practices and it's continuous
I like to remind people of the concept
of do care versus due diligence if you
took your cissp exam you probably saw
that due care is trying to do the right
thing at the moment due diligence do
diligence is doing the right thing all
the time and then doing it again next
week and the week after that and keeping
that that process up
[Music]
there's a number of Frameworks
some of them cost money some of them are
better than others the one I really
personally like is the nist cyber
security framework
and again
what's your favorite version of Linux
right
same kind of thing here what's your
favorite cyberspic framework I like this
one because they're it's it's very
thorough it's very complete
they cover a lot and I'm just going to
show you some samples we only have you
know 30 minutes here
um you know first of all what is nist
right it's a non-regulatory agency uh it
used to be the National Bureau of
Standards right if you go back some
years and it's part of the Department of
Commerce right the non-reculatory agency
is a big part of this right they're not
here to enforce rules they're here to
give you um give you help
right and it's all about providing you
resources they're always updating their
stuff we're trying to I think the latest
version we're in a one dot something
version
uh the the uh version 1.01 so it's a
collection of Standards guidelines and
best practices to manage cyber security
talk to a lot of customers we don't know
where to start with cyber security we
know we're concerned about it we've
heard about it
we know other people are being hit our
competitors were just hit I got a call
on a Saturday uh morning once I'm a CIO
hey can you talk to us about cyber
security I said sure thing you know
Monday morning 10 a.m because can we do
it earlier okay what's going on right
some of their competitors were hit they
knew they needed some immediate action
but they don't know where to start
they they knew there's policies out
there let me talk about this right I'm
not going to deal with all your new
stuff for you but let me introduce you
to the concept
extremely extremely uh comprehensive
and there is some federal enforcement
right if you go back to executive order
13636
it's about nist right presidential order
get your standards up there's a bunch of
links out here too
what is the cyber security framework I
can't go into all that right in 30
minutes I do want to introduce you to
the concept basically it's about
identifying
protecting
detecting responding and recovering
in that order yes but it's continuous
right you may get different stages
within different systems
and you're always you should always be
doing it there's no real no idle time
for it now ideally you can automate some
of these processes get your executive
leadership involved
right what's the one thing executive
leadership likes to do about it making
someone else's problem
privacy protection of this data that is
all a C Level right or board of
directors conversation
and and you bring the tools we are as
I.T people as technology people we are
custodians
we are not the owners of data we own
some of our own data but the reality is
we're kind of we're kind of like law
enforcement
right we we make sure and apply the
appropriate controls limitations called
security call what you want
there's a lot to this slide but again it
focuses on I identify protect
uh detect respond
and recover most of my time is is spent
a little bit of a lot of protection
hopefully up around we're doing some
protection uh some detection a lot of
recovery there's a number of ways we can
recover a lot of the customers here if
you have questions on how to reduce the
recovery well not your game customer
doesn't matter happy to help have to
show you some some things that we've
seen success with some areas where we've
not seen some success let's break this
down a little bit further okay there's a
lot in this eye chart
we'll make sure you get a copy otherwise
just go to the next site then it breaks
down those sections uh one key element
identifying your assets
I remember a specifically had a
situation where I remember this like it
was yesterday
uh someone built a server and brought it
into our office and plugged it in and
then uh opened up a hires and tickets
when it didn't work right shame on us
for not knowing it was there we let them
do that we're unaware they did that
that's part of our identification
we should have been
you know very clearly aware that it was
there shame on them for not involving
I.T
but all the the protection we had in
mind all the the placeholders we had to
keep track of all the stuff were out the
window at that point because they uh
went around I.T
I'm not going to go through all these
specifics but I highly encourage you to
look at that in this cyber security
framework
and bring this back to your leadership
teams get them involved this is not an
I.T issue by the way I can't tell you
many times
that as a vmsc customers ask me what
their data retention requirements should
be
I don't know
I can give you some ideas
but I don't think even you should answer
that question the zit director that is
something that comes out of legal so
back to my Healthcare days I went to my
health care or my legal team My
Healthcare Department
emphasis on legal and I said what are
data retention requirements their answer
was just an I.T issue
it is you should be barking at me you
should be chewing me out right now
because I don't have this up to your
standards well we don't have standards
yeah that's the problem you need to tell
me what we're doing otherwise I'm going
to back up three days
and that's it
and by the way it's your issue not mine
it wasn't quite so adversarial when I
brought this up with them but you
understand the point so identify right
develop an organizational understanding
to manage cyber security
it's a cultural
you know we all go through the cyber
security training it's not a lot of fun
users don't like having to do it it is
extremely essential you know every time
I take one I learn something
and if I'm learning something in my role
where I do this all the time you should
be learning a lot
protect
and I'll show you a couple slides to
talk about protection so as a recovery
company as a data protection company uh
as someone that helps you
restore data when necessary this is a
key element of what we do
uh there's a couple rules or a couple
guidelines right our own best practices
but there are industry standard that I
like to talk about first of all is the
three two one rule I'm expanding that a
little bit three copies of your data on
at least two different devices with one
off site
so maybe I have uh my Milwaukee my
location I have a couple I have a
primary array I have a backup array and
then I send my data to some other City
to Madison right three copies two
different devices with one off site we
like to make sure we test those backups
we have ways to do within veeam there
are other applications that do that as
well by all means if you have the test
of your backups assume they don't work
and I need a full a full test
and there's a lot of threats to that I
can I can show you a couple well zero
but also one of those kinds of being
immutable we'll come back to that
momentarily management Zone if you want
an easy thing to do take all your
recovery systems put it in a completely
separate environment whatever
credentials I log into my production
environment with I use different
credentials for my recovery environment
it makes it a little more difficult to
manage but I guarantee you you'll be
happy in the end the easy thing to do
and if you're a vegan customer
it's you know minister to that
leverage immutability we just had a
conversation in the hallway with someone
that made their data immutable
and by that I mean locking so will not
be modified or changed right I write my
data 7 mutability for 90 days cannot be
deleted they had the CEO of that
organization called the CEO the cloud
provider or the organization say please
delete our data and they refuse to do it
good for them it's immutable the number
one target for like net Walker attacks
is your recovery systems they go after
your recovery systems first because the
oil recovery systems they have a lot
more leverage
so use immutability that could be on
premise well I have another slide tool
we'll come back to that
uh encryption
if you haven't encrypted your data in
the cloud someone else will
so please be careful about that
and don't lose your encryption keys I
can't find them for you
thank you for asking
so three copies of the data two
universes at least one off site test
your backups and make sure there's no
errors let's talk a little bit about
immutability and I kind of hit on it
already I see cloud-based immutability I
write my data to a cloud provider I ask
the cloud provider to make sure that
data cannot be deleted for a certain
period of time I've had security people
call me up can you we want to change our
usability policy can you help no you got
to wait until the boss expires and then
you know redo it which is a good thing
that's working by Design I have a number
of customers putting in their own
immutable targets what's the best way to
secure a Windows server
yes or replace it
with Linux
by the way true story my kid wanted he
was 11 years old what a PC in his room I
said not a problem but it's got to run
Linux
what you need to know this
right you wanted the boots by the way
for those playing the home game uh
there's a lot of reasons to do that so
object storage object immutability based
on your own cloud or based on your own
platform
so make sure that's protected backups
are not archives archives are not
backups and please snapshots are not
backups
they're all part of your strategy
snapshots perfect use
well use use snapshots but don't assume
that they're going to help you in
long-term situations we utilize SV we
utilize snapshots as part of our
production strategy we'll take a
snapshots on the array do the do a
backup and then put them in archive a
backup is something is broken I need to
get it back
I had a customer who's Dr plant and I
completely understand the logic the our
plan was to recover from the cloud did
100 terabytes of data
it's going to take a few weeks right so
have an on-premise as well
um yeah
and then detect
there's a number of things to detect
I'll give you a couple little patterns
to look for and again this is all about
data recovery if you see a high write
rate and high read rate and high
processors something's going on
someone could be reading your data
encrypting that data and then writing
that data somewhere else
you know huge red flag maybe it's normal
but make sure you look at another
another big one is uh hey my duplication
ratios went down to zero yeah
something's going on
those are flags remember we said the
dwell time
these help solve that dwell time
hopefully with all that dwell time
they're waiting three or four months to
do an actual attack but in the meantime
they've encrypt your data or done
something right these are indicators
that you may want to take some action
and then respond
recover right these are all elements
that that we could get into by the way
what's the difference between a Dr plan
and a ransomware recovery plan
one maybe you lost Hardware right but
the other you lost data you should have
the same level of attention in a lot of
the same hooks right into your data
recovery plan with a ransomware attack
as you do with Dr
uh by the way please please don't hide
something if something happens please
report it
ic3 they're very willing to help great
organization something happens please
tell them
I've had organizations that kind of just
don't really want to let people know I
completely get it it just makes the
situation worse and they're they're here
to help
and don't pay the ransom by the way
what's a vulnerability a threat and a
risk right well of vulnerabilities
we connect to the internet right we have
email there's all vulnerabilities you
know threats something is actually
happening someone's trying to go after
you right so my vulnerabilities plus my
threats there's my risk
right it's a combination of those
elements we know we can't avoid
vulnerabilities we can reduce them we
know we can't avoid threats we can
reduce them but if you combine those
together the amount of vulnerabilities I
have plus the the threats that I have
that equals my total risk couple or
three questions I want to leave here
with
do you have authorization to take action
in the event of a cyber security events
that's huge uh something was happening
uh I don't know I better call Bob no
kick ass and do something
have a pre-op be able to take that
action up front uh do you have an
instant response plan not in your head
in writing if you want a template I can
help you you look them up on Google or I
can send you some good ones
and then have you ever done tabletop
exercises
walk in hey we have a wire I see this
happening what should we do you know you
know everyone braced on uh by the way
if you're interested in doing tabletop
exercises we're going to be doing some
some customer tabletop exercises in the
next few months where we throw scenarios
out and see how people react uh you will
learn a lot I will learn a lot we'll all
learn a lot from each other
so tabletop exercises are very important
but I had a customer employment the
table that exercises and then the next
week they're able to ransomware and I
thought it was another table that says
no this is legit you gotta go so that's
um all that I got any questions on Ben
Affleck
bad actor okay
any other questions
so I'm looking forward to seeing
everyone later come by
scan me we'll see you at happy hour
[Applause]
right here
[Music]