Latest / The HIDDEN Podcast by Babble / Episode 11: Is anyone watching your business at 2am?

Transcript

Episode 11: Is anyone watching your business at 2am? · The HIDDEN Podcast by Babble

• Steve: alert is really the first warning sign. So that's the thing that's telling you to do something. If we think about it from a point of view of a smoke alarm, smoke alarm makes some noise and you then have to jump into action and decide what you're gonna do next. What it's not doing is making that noise to tell you that the problem's all solved and sorted and gone away. So that's how I would think about the alerts. Lynn: Welcome to the HIDDEN Podcast, where we simplify cyber security and all things tech for those of you who, like me, need it to be explained without all the jargon. So if you've ever wondered why you still feel vulnerable, even though you've bought all the fancy tools, you've come to the right place. I'm your host, Lynn Murape, and my job is to take one of our resident experts and help them translate their cyber expertise into plain English. This means having practical conversations usually built around Babble's HIDDEN cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Joining me once again in the virtual studio today is Steve Hennessey. Welcome back, Steve. Steve: Morning, Leigh and Greg, to be back. Lynn: Great to have you back. So picture this. Your security technology detects something suspicious at two o'clock in the morning. An alert has been generated, but your own team is fast asleep and the office is closed. Today we're asking what happens next. Who receives the alert? How does somebody determine whether it is in fact serious? Who can take action? And how do you know whether your current support actually covers that chain from detection through to containment? So a lot to unpack, Steve. So let's start with the basics. Security tool does spot something suspicious and fires off an alert. What's actually happened at that point? Steve: Okay, so that's a great question, Lyn. So an alert is just that first early warning sign. So it's giving you a piece of information to tell you that something. is potentially happened or happening. So it might be something low level, like it's spotted something that's out of the ordinary, and that can then range all the way through to something that's suspicious activity, or indeed a system has been compromised. So the alert will usually give you the high level information on what's happened. Lynn: Okay, great. Thanks for that Steve. And you know, as you were speaking, I just basically deduced that not not all alerts are created equal. Is that something you would agree with? Steve: Yeah, absolutely. mean, some alerts are a little more than just a piece of information to let you know about something. So that might be that Lyn's decided to log on at three o'clock in the morning because she can't sleep and she's going to just do a little bit of extra work. There might be no problem with that whatsoever. And that happens quite often. But it could be that actually someone's pretending to be you and has logged in from another location, which is not your known location and so demands a different type of response. So I think the alert that can very much be on a sliding scale of one to 10, let's say. So one being just a piece of information, 10 being something critical has happened or is happening and you need to do something about it quickly. Lynn: Right, thanks for that Steve. So now how does someone inside the organization work out whether an alert is in fact a real threat or a false alarm or something that can just wait? Steve: think the challenge is whether the person inside the organisation has got the appropriate skill set to be able to do that, either as an individual or as a team. So we work with a wide range of customers and some of those people rely on people like Babbel entirely to understand threats and then respond to them and remediate with them. Whereas other organisations that might be slightly larger would have a team that would be able to understand the threat and then unpack that and then deal with that. from a response point of view. So one of the things that's important to understand is as a business, whether you sit in that scale and whether you need to have a closer working relationship with your MSP, Babbel in this instance, to understand who's going to do what. And I think having that blueprint is super important. Lynn: Yeah, I couldn't agree with you more. I mean, whenever I have these kinds of conversations with, you know, our other experts, you included, this issue or rather topic around ownership and governance comes up a lot. we had discussed that in the previous episode with Nisha. If you haven't seen or listened to that yet, please go ahead and do so. and we get into that with Niku in the next episode as well. But even in this episode, we are going to unpack that a little bit further. So that was good to raise now. But you know, switching gears to now what happens at 2 a.m., right when everybody has gone home for the day and is fast asleep. So let's say an alert fires off at 2 a.m. Where does it actually go? And can a business assume that someone is in fact watching it in real time? Steve: Okay, so when that dreaded... message, whether that's a text message or an email comes through and the person that receives it, we really hope at that point in time there's been some pre-work that will have happened to understand whether that is an information alert or whether that's a peace of mind alert to let someone know that someone else is going to do something. So again, it comes down to what service do you have in place? Is the business itself going to deal with the threat? Are they going to get their own people to do something about it? do they have a paid for service, something like an Mxdr service with a company like Babbel that is then going to jump on that threat, we're going to receive it, we're going to respond to it, we're going to resolve it and then the only alert that the customer is going to get is to tell them what happened and that they can carry on sleeping soundly because we've taken care of it for them. Lynn: Great points well made, as usual. And something that you said stood out to me simply because it is a technical term. So do you mind just unpacking what XDR is? Steve: Yeah, so when we talk about... Some people call it MDR, some people call it MXDR. Really it's about managed detection and response. So a service that is being provided to a customer to manage the detection of a problem and then the response to that problem. And I think that's the really important part of what we're talking about today because alerts are great because we all want to understand if there's a problem, but we then want to be able to understand what do we do? What do we do with that error message on our screen? to that fire alarm, what is the plan that has been put in place and who's going to help us in those circumstances and that's when you know making sure that you've got an appropriate service level in place is absolutely vital and understanding that with your MSPER. Lynn: Right. Great, great. And for those of you who are tuning in and are a little bit more curious about MDR, MXDR, all of these acronyms that, you know, are thrown around, we do unpack that in a little bit more depth in the upcoming episode. So stay tuned for that. But bringing us back to, you know, this two AM genuine threat scenario, Steve, what could happen between two AM and someone, you know, eventually logging in for the day. when the business opens again at nine AM. Steve: Wow. a huge amount of damage could be done during that time. So if you think about, know, if a business is going to start coming online at, let's say, eight o'clock, then you've got six hours there for someone to be in the system carrying out all sorts of actions. They could be looking for data. They could be trying to cause malicious damage. They could be trying to take key services offline. Think how much work you, genuine work, you can do inside of six hours. It's no different really from one of those bad guys or girls that might be in your environment and then doing the same but in a negative impact. you can go from something where someone is just potentially just sat there looking. So they might plan something and then they might want to then just monitor for a period of time to understand what you're doing, understand traffic, understand where there might be the vulnerabilities in your environment. But it might be that actually they're going to take the opportunity at 2 a.m. knowing that you're not going to be back online until 8am to spend six solid hours doing as much damage as possible and that's a worst case scenario. Lynn: Definitely. you know, it's something that no business owner wants to even think about, but it's something worth having a think about because you want to prepare for those worst case scenarios. And as you were speaking, you know, you were talking about this six hour gap where this bad actor is basically able to do whatever they want once they do gain access into your system, right? And I couldn't help but think about a previous statistic that Callum had dropped on A previous episode, episode seven, when we were talking about endpoint protection, he said the fastest attack that they have seen to date was 27 seconds for someone to come into the business and come out of the business undetected. So if that's 27 seconds, you can only imagine how much damage they can do in six hours. So some really crazy stats there. But you know, something that you had said earlier around you know, one's ability to detect and respond to these threats being heavily dependent on the skill set, right? Let's look at the typical SMB environment, Is it even realistic to expect a small internal IT team of, you know, one to two people to cover that round the clock monitoring and response? Steve: I think on this occasion my direct answer would have to be no, I don't think it is realistic. Those people will have almost certainly, if they're a smallish team, they will have been working for the core office hours. So if one of them is on call, then they're only gonna be doing that as a last resort, they're gonna be available in the event of a catastrophic issue taking place. So are they gonna have the right tools or the right skills and knowledge and understanding to be able to, first of all, understand the Secondly, respond to the threat and then thirdly resolve the threat and the issue. You know, I think realistically you have to understand what... One of the shortest supplies in our industry at the moment is security experts because they're in such high demand. Everyone wants access to them. Everyone wants them to work for their business or be available to their business. So if we've got a small IT team, we can't possibly ask them to be experts on every element of what they do inside the business. So I think in those instances, you need to lean into a partner organisation that can maybe offer that resource to you. at a service price instead of having to pay a full-time employee and then try and keep them up to date and up to speed in terms of their knowledge and understanding. Lynn: Yeah, so true. And even if they are, you know, for lack of a better term, a unicorn. Let's say they are skilled in every single facet of cybersecurity there is still that element of alert fatigue, right? They are only human at the end of the day. So I couldn't agree more that having a third party, a trusted third party that you know Steve: Yeah. Lynn: is going to keep a a lookout on your behalf is Absolutely mandatory for sure. So now switching gears to you know moving from this investigation period to actually taking action. Once an alert does look credible, what does the investigation need to establish before anyone can actually do something about it? Steve: So I suppose in terms of understanding what's wrong, you want to understand what the impact is. And sometimes that can take a little while because the actual true impact of a cyber attack cannot be understood immediately. In some instances, it's quite obvious. So let's say that if someone was, you know, putting a piece of ransomware on my machine and locking my files for once, for a better word, then the impact to me is obvious. I can't access those files. What I don't know is, is that impacting Lyn? Is that impacting other colleagues around the organisation? What other services have been affected? So I think all we can do in the first instance is triage, is try and understand what's happened and what do we need to react to instantly that's causing the biggest impact and causing the biggest problem. And then how do we then start to resolve those issues whilst at the same time gaining a deeper understanding of what the actual impact is across the wider business. And that then plays back to the point that you raised earlier, around that team, you know, there's only so many arms and legs that we've all got in terms of being able to spend time on things. So that's when having a partner can be absolutely vital because they can be helping with the physical work of talking to your clients, sorry, your in-house customers. They can be helping with the remediation to fix the problem, but they can also be helping with the investigation to see what's the wider impact, where did the threat come from in the first instance, is there still an active risk that that could get worse and that those bad actors are still in the environment. So having a team across all of these things as you can see you need so many different hats to be able to deal with the whole thing. I think that's where you really have to make sure you've got a third party helping you in some of these areas. Lynn: Yeah, most definitely, because even as you were just speaking, my mind was just internally exploding at all the work that goes into just keeping a business secure, right? So yeah, great points to raise. But something that you had said was a little bit of a technical term that I, as the layman in this conversation, want to unpack a little bit more because I think it leads into containment. So you had mentioned triage, right? So what does that look like? Is that a part of the containment process. Yeah, tell us a little bit more about that. Steve: I think when we talk about triage, what we're talking about really is that first response. know, when your little one falls over on the scooter outside and you go rushing out to see what's wrong, you assess what's happened straight away. You know, is it just a little cut on the knee? Have they broke something? Is there a bigger issue? And it's really the same sort of scenario. We're talking about cybersecurity, not scooter incidents. So the idea is really to understand what's happened, what's impacting. Can we understand as quickly as possible what the impact of the wider business is and then can we utilize that information to try and either put into play a plan that's going to fix and resolve those issues or trigger our business continuity plan or disaster recovery plan that's going to call into act some of these other third parties to help us to resolve it. So when I'm talking about triage it's just that initial first review of what's happening, what's the impact and what do we need to do about it. Lynn: Okay, great. Thanks for walking me through that, or walking us through that rather. Now, how does the that containment process look I know that might be a bit of a loaded question because threats are, different, but you know, you had spoken about starting by understanding the impact. So once all of that has been established, what, ordinarily should containment look like in practice? Steve: Yeah, so when I think about threats where we've been involved previously and we look back at those and what's happened, when we're talking about containment, it's really just trying to minimise the impact. So let's say that Steve Hennessy logs a problem on his system. When we triage the problem and we understand that Lin isn't experiencing the same problem and nor is person A or person B, it might be that the containment is really to just isolate Steve. So stop Steve from being able to get to other network resources. make sure his account is locked down, make sure his access is suspended, and then we can try and focus on is that just an isolated problem and have we contained it with that one individual and that individual's either identity or indeed physical equipment. Where it becomes much harder is where we then start to see actually the problem is wider. So everyone locked out of their email, none of us can access our SharePoint data, Salesforce is offline. it's a much bigger issue and then you know the people with bigger brains than me then have to understand what it is that's happening, what's gone wrong, where is this problem occurring and how is it impacting so many different systems and then we you know we're getting into the realms end of the service itself which we probably need to get someone more skilled around that than me to describe that. Lynn: Yeah, it takes a village after all, right? Now let's Steve: Yeah. Lynn: say that a business has, you know, got an MSP in place that does this great work that you're talking about, you know, the triaging, the you know, talking to in house customers, the isolating accounts or devices, things like that. Now, who should have the authority to go ahead and, take action by isolating an account or a device? And then shortly after that, you know What happens now if nobody can get a hold of the business? Steve: Yeah, it's a great question, Lynne. And again, this is something that happens in my experience way earlier than any event that takes place, hopefully. When we talk to customers about these services, we talk about a run book. So we talk to them about understanding exactly what you've just asked. Who's going to be responsible? What's going to happen if something happens at 3 p.m. in the afternoon versus 3 a.m. in the morning? What systems do you want to give us the authority to be able to respond to an action. So let's say that the customer is, and we've got some real life examples, maybe in manufacturing and they run a 24-7 production line. If there's a problem at 3 a.m. in the morning and we see a threat and it's our role in the run book to do something about it, has the customer given us the authority to not just shut down the back office systems, but potentially shut down something that might then impact the production line? And that would be the beating heart of that business if they're not producing those goods, then they're not actually creating revenue for themselves for future orders, etc. So it's a really big question and one that has to be understood really carefully. So what we do is we walk that through with customers to start to ask the questions about responsibility and roles and we create example cases and you can't know every single one that might happen. But we do our best to try and cover as many as we can based on our experience and working with other clients and that then sets out a really really clear understanding for both the client and us as the MSP about who's going to do what as well as the security partner that we're working with on that particular customer. Lynn: as you were speaking, I couldn't help but get flashbacks to our previous conversation when we were talking about disaster recovery. Yes, we were primarily talking about backups, but you know, when you were talking about this run book, I immediately thought, could that be synonymous to an incident response plan? Steve: Absolutely, yeah, absolutely. And something that should be understood right at the highest level. So when we talk to customers, we might not be talking directly at this point when we're talking about the run book with the C-suite, but actually to ensure that they have a knowledge and understanding about who's doing what and what the responsibilities are if the worst were to happen. That's vital from our perspective. So we are at pains with our customers to make sure that once that's happened, We then share that with the rest of the board for the customer so that they're really, really clear about who's going to do what. And they might have some input on that. They might say, well, actually, we only want these three people in our organisation to be responsible for actually turning the production line off. And that might not be a member of the Babel team. So we might then need to talk to them about, what does that look like in reality? Because if there was a threat, and that's continuing to then operate across your environment whilst we wait for that, OK, are you coming? comfortable with that, what damage might that do. So yeah, it's a good way to walk through scenarios with a customer in a more controlled environment because what we don't want is for the first time of us to be understanding what that plan looks like is to be when we're in the thick of it, when we've got an incident happening. If we think about our children, and I've used this analogy with you before, Lynne, but if we think about the fire tests that we do with children at school, we do it because they need to understand what's going to happen when heaven for something were to go wrong and there was an actual fire in the school we want them to be so well drilled about what they need to do that this horrible thing that's happening in the background doesn't have an impact on them because they're used to it, they understand it, they can go and do what they've practiced many times before and we take that thought process absolutely into the conversations that we have with a customer around making sure there's a clear plan. Lynn: it just goes to show that IT cybersecurity is not just an IT problem, you know, because you already mentioned how this run book, incident response plan, the whole lot of it is run past the C suite and members of the board as well, because everybody essentially needs to be on that same page in terms of who is responsible for what and having those set measures in in place. So now let's switch gears to our listeners and viewers out there who may be now considering, you know, investing in this 24 by 7 coverage and what that looks like, right? So when a service says that it offers 24 by 7 monitoring, Steve, what should a buyer check is actually included in that package? Steve: The first piece of advice that I would give to anyone is if you've got a 24-7 service, and in this instance it's a monitoring service, the next question should be, so what? So if you're monitoring and an alert gets sent through to Lyn at 3 a.m. in the morning, so what? What are you gonna do with it? How are you gonna respond to it? Do you have the skillsets? Do you have the contacts internally? So we need to be understanding what it is that we're buying, what are we taking, and what's the benefit to us? as an organisation or to the client as an organisation because if you're going to send someone a piece of information at 3am in the morning and they have no idea what to do with it or how to respond you may as well not have that in the first place so there needs to be more in place than just monitoring unless of course you have the skills in-house and the people that are going to receive that information are going to know what to do and how to react to it. Lynn: it just goes back to one of those acronyms, you know, MDR. It's monitoring, detection, and response, right? Because those are three very different jobs which we get into in the next episode. But bringing us back here, a lot of businesses hear this twenty four by seven monitoring and response, and then assume that there's an enterprise price tag attached to it. Would you say that's a fair assumption? Steve: I don't think it is anymore, but it is something that happens all of the time. In the too many years to remember that I've been in this industry, what always happens is that the enterprise customers have access to, because they are typically larger organizations with larger budgets, they'll have access to technology first because they're prepared to pay because of the risk offset that they're looking to minimize. What always happens is that cascades downwards. So SMBs start to gain access to it at a date to be confirmed. and then now start to buy into that at different levels. What we're seeing with cyber security is that this is, you mentioned it earlier, it's not an IT problem, it's an everyone problem. This is happening on our mobile phones, on our fridges, anything that's got internet access has got the possibility to be accessed and then used in a misproper way. So what you need to be thinking about is you need to be saying to yourself, what might this cost our business if a threat were to occur and how can I not explore the options about what it might cost me? know, burglar alarms, security systems, they all have different levels of cost associated with them and it's the same across the board in all different environments. But what I would urge a customer to do is just explore it with their MSP, try and get a level of understanding about what it might cost on a per user basis per month. to protect yourself against a threat like that. And there's no silver bullet, so I don't think anyone out there is going to 100 % guarantee that you're never going to have a problem. But what they will provide you with is assurance that if you do have a problem, that they're going to be able to respond to it effectively. So the question around, is there a misconception around cost? I think there is. I think people think it's very expensive. It's not something that's right for me. I'm too small as an organization. But from a Babbel perspective, We have customers that probably some customers are small as five seats, actually their business is providing really important services to really important individuals and they want to be sure that if they need to be able to use their systems that they're available to them. And so actually on a per user basis it becomes quite affordable. So I would really urge them to have that conversation and understand it better because I think they might be pleasantly surprised. Lynn: just goes to show that really nobody is too small to target. You know, that's a common misconception that comes up in a lot of these conversations. And I love the fact That you know there is that per user pricing model as well. So if you are a smaller business, then you are able to find a cheaper but comprehensive solution, nonetheless. It's all about just finding that best fit for you and of course working with the right partner, right? So let's say a business wants to try to build this capability strictly in-house. Does it ever make sense to build this capability internally? And when is Is it more realistic to just elicit outside help? Steve: I think it would be wrong of me to say it never makes sense because in certain organisations they have the budget and the capability to be able to employ all those different roles that we spoke about earlier. But I think as you start to move into what I would call core SMB marketplace, unfortunately we have to be careful about where we allocate budget and in an ideal world which we don't live in, you would have someone to manage every job. But as we well know in small business many of us will occupy multiple roles and that will be the case across security as well. So I think when you start to think about, know, start to list out the different people that you need to be fully secure and then you start to think about keeping them up to date, keeping them trained, keeping them certified, keeping them interested so no one else pinches them, then actually that can become quite an expensive outlay because, you know, none of us want to create talent internally and then have a constant convey about of going elsewhere. So I think when we start to think about the value proposition, what can I get for my money if I spend on a per head basis and then tap into some of these larger organisations that have got this skill set sitting there versus having to go and pay for those people and bring them in and train them and keep them up to speed. I think for most SMBs it becomes a no-brainer that actually the outsourcing model is a far more effective way to do it. Lynn: Yeah, definitely. I mean, as you were listing out the different capabilities and the fact that, these cyber experts are in high demand as well. And you just take a step back and you look at, the average small to medium-sized business, cybersecurity, as crucial and important as it is, you know, they their main focus is not necessarily keeping their business safe, but it's actually remaining productive, remaining competitive, So you don't want to take away too many. any resources away from that either by trying to build all of this in-house. So does every business genuinely need the same level of after hours cover in your opinion? Steve: No, I don't think so. All businesses are different, aren't they? So some organizations will operate maybe on a transactional basis or they're true 24-7. So they're always trading, always providing services to their customers. So naturally, companies of that nature would probably need a slightly different level of protection because they're, if you like, always on, they're always providing that service. When you categorize yourself though maybe as a nine to five business, that's where you then start to get to a place where you then start to ask the question, well, if I'm not here, do I need to worry about it? Well, I think in those circumstances, yes, you do. Because most commonly, threats tend to happen outside the working day for obvious reasons because there's less people there to stop them. So I think when you look statistically, threats will be five o'clock on a Friday afternoon or Friday evening is a common one. because they then potentially give themselves all of Friday, all of Saturday, all of Sunday before anyone comes back online on the Monday to notice something's wrong. making sure that, you know, the reason why there isn't a one size fits all is because businesses want to have that flexibility to either bespoke it for them or to be able to take different tiers of response. And so I don't think that there is a standard offering that fits for everybody, but I think there's some nice different bandings that you as an organisation should talk to your provider about where you feel you might fit into it. And I think what would be interesting is where you start the conversation, where you end the conversation, i.e. some customers saying to themselves, we'll be absolutely fine, you know, we only need it for this period of time. Often you'll have an hour or so meeting, conversation with that customer and now they'll convince themselves that that's the opposite and actually they need protection far more throughout the working day and outside of the working day. and because you know threats don't stop they don't sleep they're constant Lynn: That's right. And, as you were speaking, I was just thinking back to, the prevalence of supply chain attacks in particular. So there might be those nine to five businesses that think, no, we don't really need, that twenty four by seven monitoring and coverage and all of that. But you know, you also need to not just think about your business and your customers, but, your supply chain as well. So the last question that I have for you, Steve, is if a business is assuming someone is already watching and responding to their alerts, what's the one question they should ask tomorrow to their MSP? to find out if that's actually true. Steve: That's a great question. I'm not sure I can be as concise as one question, but I'll... I'll try and get as close to that as possible. But I think what I would be saying is, you know, give them your scenario. If a threat alert happens at 2am in the morning, what will I get from my mother? What are you going to do about it? And ask them to list that, not from a technical point, but from a layman's point of view about are they going to get the alert, respond to the alert, remediate the alert, and then provide the comfort to the customer that it's all taken care of and indeed any actions that might need to be taken as a follow-up. is all of that included in the cost of the service that they take today? And I think if the answer to that is no, or certain elements of that are not included, then the customer should start to understand and work backwards so that they can see where their risk exposure is and at what point is their MSP going to stop. Because if they just get the alert and then hold it nice and neat and tight until nine, AM the next morning, that's not really going to be any good to anybody. So you probably then want to think about a different type of service. yeah, asking the question about, tell me what would happen in that scenario, because it doesn't have to be a technical conversation. It can just be a normal business conversation. Lynn: Yeah, definitely. Great solid advice there, Steve. So without further ado, it has been an absolute pleasure talking to you and learning from you today. Thank you for stopping by this virtual studio of ours. But yes, thank you so much. It's been a great conversation. Steve: Thanks, Lee. Pleasure as always. See you soon. Lynn: Take care. That's a wrap on today's episode of the Hidden Podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if today's conversation left you with more questions than answers, bring them over to our upcoming webinar on managed cyber security. We will cover them live. Register using the link in the description below, and until next time, don't let your risks stay hidden.