Latest / The DEX Show: A Show for IT Change Makers / 🗣️ ALL NEW PARALLEL: S1E2 - Leave No Trace

Transcript

🗣️ ALL NEW PARALLEL: S1E2 - Leave No Trace · The DEX Show: A Show for IT Change Makers

• 0:20
  Speaker 1: From Next Think and the creators of the Decks show.
• 0:23
  Speaker 1: It's parallel one it story told week by week because
• 0:27
  Speaker 1: technology problems don't happen in isolation or by themselves. They
• 0:32
  Speaker 1: happen in parallel. I'm Tim Flower. In our first episode,
• 0:37
  Speaker 1: we uncovered the mysterious theft of productivity at Zentech. Rogue script,
• 0:43
  Speaker 1: phantom processes, and employees caught in the crossfire. But what
• 0:48
  Speaker 1: if I told you this wasn't just bad luck or
• 0:51
  Speaker 1: a simple system failure. What if it was deliberate. Today
• 0:56
  Speaker 1: we follow a trail left by a single vandal criminal
• 1:00
  Speaker 1: that leaves no trace behind, one known only as the
• 1:04
  Speaker 1: Undocumented Change. What we uncover may change everything we thought
• 1:09
  Speaker 1: we knew about zen Tech's crisis, and possibly about the
• 1:13
  Speaker 1: very foundation of workplace technology itself. It started in a
• 1:17
  Speaker 1: meeting room somewhere deep in the heart of zen Tech's department,
• 1:22
  Speaker 1: A team of engineers huddled over a shared monitor, trying
• 1:25
  Speaker 1: to trace the origins of strange symptoms happening randomly around
• 1:29
  Speaker 1: the enterprise. I decided to talk with Pam, the IT
• 1:33
  Speaker 1: lead at zen Tech.
• 1:35
  Speaker 2: We knew the symptoms weren't happening that reason, but we
• 1:38
  Speaker 2: couldn't find any change control that would have caused them.
• 1:42
  Speaker 3: It wasn't part of any appointment logs, no version control,
• 1:46
  Speaker 3: no sign off. It was just like these problems just appeared.
• 1:52
  Speaker 1: That's when someone on the team considered a remote possibility.
• 1:55
  Speaker 1: Perhaps this was a change that had been made without
• 1:58
  Speaker 1: an official change request, without documentation, a change that didn't
• 2:03
  Speaker 1: exist in the official system of record, and obviously wasn't
• 2:06
  Speaker 1: reviewed by the CAB. Who knows what kind of testing
• 2:09
  Speaker 1: had been done. Dina runs the CAB, a group of
• 2:12
  Speaker 1: cross domain experts trained to look at the impact of
• 2:15
  Speaker 1: changes and also enforced the process of making changes.
• 2:20
  Speaker 2: We call them uses undocumented changes. Small changes used to
• 2:24
  Speaker 2: happen all the time because tech teams believed they were harmless,
• 2:29
  Speaker 2: but they were outlawed because some of them can really
• 2:32
  Speaker 2: cause significant damage, and this could be one of them.
• 2:35
  Speaker 2: Not only did the CAB not know about it, but
• 2:38
  Speaker 2: no one from the service areas knew about it either.
• 2:42
  Speaker 1: So was this just a small change causing big issues
• 2:45
  Speaker 1: or was something else going on? Was it a glitch
• 2:48
  Speaker 1: or was it really sabotage? And the change wasn't just
• 2:52
  Speaker 1: logging errors anymore? It was tracing intent to get more
• 2:57
  Speaker 1: visibility into this behavior, the team turned to Zentex platform.
• 3:01
  Speaker 1: Friend is the deck's lead for the company and gets
• 3:03
  Speaker 1: involved when others can't figure out complicated problems.
• 3:07
  Speaker 3: So the platform gave us something we knew was going
• 3:10
  Speaker 3: to be invaluable, and that's timestamps of the symptoms. And
• 3:14
  Speaker 3: those symptoms they started as soon as GPOs were processed
• 3:17
  Speaker 3: on devices Monday morning, so we could trace it back
• 3:22
  Speaker 3: to a specific GPO edit made that three fourteen am
• 3:27
  Speaker 3: on a Sunday morning by someone with admin level credentials,
• 3:32
  Speaker 3: and we could prove that the results we were seeing
• 3:34
  Speaker 3: across all departments on Monday morning were caused by this edit. Okay,
• 3:40
  Speaker 3: so great, but here it was the kicker. The credentials
• 3:44
  Speaker 3: were tied to an employee who hadn't worked here for
• 3:48
  Speaker 3: five years.
• 3:50
  Speaker 1: The change was small, insignificant on the surface, a single
• 3:55
  Speaker 1: line of code added to a GPO buried deep in
• 3:58
  Speaker 1: the infrastructure, but the effects rippled out word like throwing
• 4:01
  Speaker 1: a pebble into a still pond.
• 4:04
  Speaker 2: It redirected processes for devices and ways we couldn't predict
• 4:07
  Speaker 2: CPU usage spikes.
• 4:09
  Speaker 3: Network latency increase, and it only targeted certain employees executive
• 4:15
  Speaker 3: clid facing teams people who couldn't afford downtime, and.
• 4:19
  Speaker 1: While IT scrambled to uncover the mystery, employees at zen
• 4:22
  Speaker 1: Tech were starting to lose hope. Productivity was plummeting, client
• 4:26
  Speaker 1: relationships were fraying, and it's reputation was on the line.
• 4:31
  Speaker 1: So I went to one of their field offices to
• 4:32
  Speaker 1: talk with an impacted employee.
• 4:35
  Speaker 3: We were just tired. They helped. ESK would fix.
• 4:39
  Speaker 4: One problem and two more would pop up.
• 4:41
  Speaker 3: Every time they fixed something, something else would break, and
• 4:43
  Speaker 3: I can't afford that, so I usually don't even call.
• 4:46
  Speaker 2: They're good people, but it's like they're playing whack a
• 4:48
  Speaker 2: mole with my job on the line.
• 4:50
  Speaker 1: At the same time, whispers began to circulate among the staff,
• 4:54
  Speaker 1: Whispers about sabotage, about someone working against the company from within.
• 4:59
  Speaker 1: It was just it's too strange that it couldn't solve this.
• 5:02
  Speaker 1: Ella shared something that many in IT had also feared
• 5:05
  Speaker 1: declining trust.
• 5:07
  Speaker 4: People started pointing fingers. Maybe it was someone in IT,
• 5:11
  Speaker 4: or maybe an old employee trying to get revenge. It
• 5:14
  Speaker 4: made you paranoid, just not knowing what was going on.
• 5:17
  Speaker 4: And as much as we need the IT teams to
• 5:19
  Speaker 4: support us, we started to question our trusts in the department.
• 5:24
  Speaker 1: The paranoia wasn't entirely unfounded. The DEX team's investigation of
• 5:28
  Speaker 1: the credentials used to make the change led them to
• 5:31
  Speaker 1: a name, Sarah Green, a Formers and Tech employee terminated
• 5:36
  Speaker 1: after a high profile data breach. But here's the thing.
• 5:40
  Speaker 1: Sarah Green disappeared five years ago. No social media, no
• 5:44
  Speaker 1: job history, nothing on LinkedIn. It was like she never existed.
• 5:49
  Speaker 3: It felt like a dead end.
• 5:51
  Speaker 2: But then we found something else and encrypted on the
• 5:55
  Speaker 2: same domain controller. It didn't seem to be part of
• 5:58
  Speaker 2: the world GPO, but there were.
• 6:00
  Speaker 3: It was an.
• 6:00
  Speaker 2: Encrypted call being made to an external source somehow, and
• 6:04
  Speaker 2: then we decrypted it. And that's really when.
• 6:07
  Speaker 3: Things got weird.
• 6:10
  Speaker 1: Weird because the file didn't contain code, It contained a manifesto.
• 6:16
  Speaker 3: It was kind of like reading a diary someone talking
• 6:19
  Speaker 3: about how technology was ruining the workplace, how the systems
• 6:24
  Speaker 3: we relied on were enslaving us, and how it was
• 6:27
  Speaker 3: time to fight back.
• 6:29
  Speaker 1: Was Sarah Green the saboteur or was just a pawn
• 6:33
  Speaker 1: in something larger. As the team continued their investigation, they
• 6:37
  Speaker 1: began to uncover patterns that stretched far beyond Zen Tech,
• 6:41
  Speaker 1: undocumented changes, rogue scripts, crashes that didn't make sense, and
• 6:45
  Speaker 1: a reference to something that kept appearing over and over again.
• 6:49
  Speaker 1: The Foundation.
• 6:51
  Speaker 3: It's bigger than Zen Tech, it's bigger than OX.
• 6:53
  Speaker 1: This is systemic, and it's been happening for years, three
• 6:57
  Speaker 1: five years by one estimate.
• 6:59
  Speaker 3: But what is the foundation and why are they targeting
• 7:02
  Speaker 3: companies like us?
• 7:04
  Speaker 1: The Text team found one clue that allowed them to
• 7:07
  Speaker 1: solve a problem and get rid of a bad GPO,
• 7:10
  Speaker 1: but opened up a whole host of other issues happening
• 7:12
  Speaker 1: in the dark. Next week, we'll dig deeper. We'll talk
• 7:16
  Speaker 1: to some former employees, some experts, and maybe, just maybe,
• 7:20
  Speaker 1: we'll find out who's really behind the manifesto found from
• 7:23
  Speaker 1: an undocumented change