Latest / CYBR.Signal / A Couple of Post-Breach Lessons

Transcript

A Couple of Post-Breach Lessons · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:04
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: Want to talk about an incident a friend of mine had.
• 0:08
  SPEAKER_00: So he called me the other day and said that a certain three-letter agency had showed up at his doorstep and said that there was bad stuff going on in their network.
• 0:17
  SPEAKER_00: They were under active attack.
• 0:20
  SPEAKER_00: He called me up for some advice, but he also had a company that he worked with, a vendor that he worked with to help him start clearing things up.
• 0:31
  SPEAKER_00: So luckily they got stuff done, they got the access closed pretty quickly.
• 0:35
  SPEAKER_00: It was a pretty fast response.
• 0:37
  SPEAKER_00: But there were a couple of lessons I took from it.
• 0:40
  SPEAKER_00: One is a lesson I think I said on my last Cyber Sunday, which was around not or needing to sweat the small stuff.
• 0:49
  SPEAKER_00: The reason that's a lesson from this one is because specifically there was a misconfiguration in his network as he was doing some work that caused basically gave the attackers the perfect access, and it was using uh a vulnerability that we all know and love, log4j.
• 1:10
  SPEAKER_00: And that that was just in one little spot where he had a misconfiguration and he had a vulnerability where there shouldn't have been a misconfiguration in the first place.
• 1:24
  SPEAKER_00: So little things like that, small stuff, got it fixed quickly, but it was a mistake on his part.
• 1:32
  SPEAKER_00: It's absolutely, I mean, mistakes happen, but it can happen.
• 1:35
  SPEAKER_00: So doing those or looking for those small things, making sure you don't leave those things open, checking on the small things, that one big lesson.
• 1:45
  SPEAKER_00: It's a small thing with a big lesson.
• 1:47
  SPEAKER_00: And he learned it.
• 1:49
  SPEAKER_00: He's usually really good at this stuff, he's very meticulous.
• 1:51
  SPEAKER_00: I I know this guy very well, uh, but this happened.
• 1:54
  SPEAKER_00: So that's the first thing.
• 1:57
  SPEAKER_00: Second thing is allocation of resources and the proper resources, I should say.
• 2:02
  SPEAKER_00: So my friend has not a lot of resources that he's given, unfortunately, to secure the his environment.
• 2:18
  SPEAKER_00: It's just is what it is.
• 2:20
  SPEAKER_00: Business decisions have been made, not to allocate a lot of that, a lot of resources to that.
• 2:25
  SPEAKER_00: So he's kind of sitting there out on his own sometimes, most of the time, all the time, working on this.
• 2:32
  SPEAKER_00: What saved him in this one outside of the response by the agency that I was talking about, was that he had the proper resource waiting in the wings for him to help him figure out what was going on.
• 2:48
  SPEAKER_00: So that vendor I was talking about, that part vendor partner of his, came in, did a triage on their incident response, figured out what was going on, was able to track it down, and was able to stop it relatively quickly, where he had very little damage at all.
• 3:06
  SPEAKER_00: I don't think he had any damage.
• 3:08
  SPEAKER_00: Now they're you know, obviously continually checking that.
• 3:11
  SPEAKER_00: So while he didn't have the resources, he doesn't have all of the resources he needs to properly secure the network, he actually does a really good job because he knows what he needs to do to lock things down and he's got it fairly controlled.
• 3:28
  SPEAKER_00: But because he had somebody waiting in the wings and he had done that planning with the company that could handle that stuff for him, he was able to stop this relatively quickly.
• 3:38
  SPEAKER_00: Now, what would have happened if that agency had not come to the door and told him something was going on?
• 3:44
  SPEAKER_00: That I think that's part of the lesson, too, because some of the resources that he has probably wouldn't have quickly shown that uh he's got some he's got a problem going on, so he might have been in more trouble.
• 3:56
  SPEAKER_00: So kudos to that agency for doing that, but um he probably wouldn't have he probably would have learned that lesson the hard way on having the right resources had they not been there.
• 4:12
  SPEAKER_00: So again, looking at the small things, I've I've talked about that before.
• 4:16
  SPEAKER_00: I'll I'll talk about it over and over and over again.
• 4:19
  SPEAKER_00: Doesn't matter matter how big your environment is, you need to sweat the small stuff, look for the little things, don't ignore those things.
• 4:26
  SPEAKER_00: Uh you know, forest for the trees type of thing.
• 4:30
  SPEAKER_00: And then, second off, make sure you've got the right resources and they're allocated correctly, even if you can't have active resources or all the resources you need on a day to day basis, have some way of planning and have some resources to back you up in case something bad happens.
• 4:47
  SPEAKER_00: So, let me know what you think.
• 4:49
  SPEAKER_00: Happy Cyber Sunday, see you next time.