June 2, 2026 • 37 mins
Got a question or comment? Message us here!
What actually happens when a company gets hacked?
In this episode, we break down real-world incident response, from initial access and ransomware tactics to forensic investigation and common mistakes that make things worse. If your organization had an incident tomorrow, would you know what to do?
Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_02 (00:00):
What are common mistakes organizations make
during incident response?
SPEAKER_03 (00:03):
Uh turning the computer off.
Wow.
And that's a good one.
Any anything that results in youus losing logs.
Yeah.
Don't do that.
Um don't do that.
We see that all the time.
SPEAKER_00 (00:22):
You are now listening to the Secure AF
Podcast.
SPEAKER_03 (00:30):
Good morning, good afternoon, Internet.
I'm Donovan Farrow, CEO atAlias.
Today we're going to bediscussing everything you need
to know about incident response.
I have uh another fearlessleader here who's seen some wild
stuff.
This is Andrew Peters.
He does forensics, IR, threathunting, all that good stuff.
Did I miss something?
(00:51):
No.
It was mostly everything.
Perfect.
So today, like I said, we'regoing to talk about incident
response to kind of get someinformation out to the public.
Incident response is basicallywhen a company gets some type of
breach or even an event occurs.
We're going to talk about someof the uh threat actors and kind
of how they can conduct businessif they do attack your
(01:13):
organization, things you shoulddo, things you should not do.
And then also kind of uh scalingout with some maybe some
recommendations for training andstuff like that.
So you want to fast forward tothat part, you can.
It's not gonna hurt my feelings.
Whatever.
All right.
So, so Peters, uh, you kind offollow a lot of the um the APTs,
the advanced persistent threats.
(01:33):
Um, what's the latest one you'vebeen seeing today and what do
they do?
SPEAKER_02 (01:37):
Well, obviously the one that's really big in the
news right now is uh ShinyHunters.
Um we just had the uh That'sright.
The Canvas Canvas.
Canvas.
So they're they're very popular.
SPEAKER_03 (01:48):
And that's the that's the website, right, where
you do all the other marketeers.
I always like to call up breakthe third wall and look at Sam
in the back.
Yeah.
She gave us a thumbs up.
Okay.
Here you go.
SPEAKER_02 (01:58):
Yeah, so it's it's the uh the education platform
that colleges use to uh postassignments, tests, and grades,
uh discussion posts.
Um they were able to hit that,and then of course uh Quillin,
um they are still posting dozensof companies.
Is that how you say that?
I don't know.
(02:19):
You all know what I'm talkingabout.
Um pretty intense.
Is that is that China, theChinese?
Um we think Eastern Europeans.
Some people speculate China.
Um they think Eastern Europeanbecause some of the um I guess
documentation about them wasfound in Cyrillic.
Oh okay.
Um but no one really knows forsure.
SPEAKER_03 (02:37):
Gotcha.
Okay.
And what type of uh for forCanvas, what kind of attack was
that?
I mean, you can say, you know,incident response, like how do
you was it I don't know, there'sso many attack vectors.
SPEAKER_02 (02:48):
Uh reportedly that one was social engineering.
Um so uh it's my favorite.
R reportedly um there was therewas speculation that they fell
victim to a a fishing attack.
Okay.
Um what is that?
No, that is uh calling people onthe cell phone and and socially
engineering them and fishingwith like with the V though.
SPEAKER_03 (03:11):
Um yeah, so they had the kind of the popular attack
um scattered spider that did MGMum was pretty cool.
So I would say socialengineering.
Um do you know it once they gotpast, I guess got access through
uh voice.
Do you know what they did afterwhen they were inside?
Was it just a straight upransomware or do we even know?
SPEAKER_02 (03:30):
Um there's speculation.
Um, but if anything's beenconfirmed, I'm not I'm not aware
of it at this point in time.
SPEAKER_01 (03:36):
Did they pay the ransom?
SPEAKER_02 (03:38):
Um I don't uh I don't know if there was a ransom
for cancer.
SPEAKER_03 (03:41):
Okay.
Okay.
Did they just so what what Iguess then what happened?
If it wasn't ransomware, was itjust uh data steal and maybe
threat for exposure or was itlike a DDoS?
SPEAKER_02 (03:51):
Um I think it was um well it was visible to students.
Gotcha were attempting to loginto it.
So um it could have been formarketing as to if any data was
actually exfiltrated from that.
I don't think that we know thatyet.
Oh man.
SPEAKER_03 (04:04):
Okay.
Um and then let's talk about uhQuillin.
I think that's how you say that.
We don't know.
What what kind of attacks dothey do on their victims?
Um bunch of different stuff.
SPEAKER_02 (04:14):
Um they are one of the most prevalent um ransomware
organizations right now.
Yeah.
And they have a lot of differentum attack vectors and IOCs
because they have so manydifferent people that are
partnered with them.
Um they pay out a much higherpercentage of their ransom to
their affiliates.
Gotcha.
So there's a lot more differentmethods and techniques that
(04:36):
we're we're seeing.
Gotcha.
So the affiliates, what's what'stheir role with Quillin?
Um basically they're licensingthe ransomware software from
Quillin, and uh once they getaccess to an organization, they
purchase that uh Quillinransomware software so yeah,
they can execute on theorganization.
SPEAKER_03 (04:54):
Ransomware as a service.
Yeah, vertical, perfect.
See new business ideas happenall the time with these guys.
Very exciting.
So uh you've worked quite a fewincidents um with our company.
Can you give me like a from thebeginning breakdown?
How does that typically work?
I'm sure that's probably it'spretty intense.
Um I know we get a uh theaudience that comes to us
(05:15):
whenever it happens.
I mean, kind of go through thatbecause it it gets pretty deep.
Yeah, absolutely.
SPEAKER_02 (05:20):
Well, usually, uh unfortunately for us, most of
the time, if it's not a customerthat we have that we already
have a well-establishedrelationship with, if it's
somebody that we've never workedwith before, uh by the time we
get the call, they've alreadyhad uh full encryption execute
on their environment.
Yeah.
So they're hard down, everythingdoesn't work, it's all
encrypted, and they don't knowwhat to do.
SPEAKER_03 (05:40):
What what is uh so ransomware, that's an
encryption, right?
Yes.
Do they do they they typicallysteal the data first, right?
SPEAKER_02 (05:48):
Yes, they typically steal the data first, and then
they will ransom or encrypt allof the remaining devices on the
network as many as they can, andthen they will threaten to
release the data that they stoleif you do not pay.
Interestingly, though, um we'vekind of seen them move to not
even bother encrypting uh data.
Um they just take it and thenthreaten to publish it.
SPEAKER_03 (06:10):
I wonder if I mean it sounds maybe that's easier.
There's like, ah, you know what,we're just too lazy, we don't
care, we're just gonna threatento release it.
I guess they probably get paidmore that way, would be my
guess.
SPEAKER_02 (06:19):
I would guess as well.
Um I think it's less effort uhfor them and less chance of
getting caught since they're notexecuting encryption on a bunch
of endpoints.
Yeah.
And I think it's I guess that'strue.
At the end of the day, thethreat of it being publicized is
what's going to make people pay.
SPEAKER_03 (06:33):
And I assume blindsiding somebody like that
might be a little moretactically better for them than,
like you said, them knowing theransomware because it could be
stopped or blocked, and thenthey know that it happened, and
they may actually be able toremove their hooks they have in
an environment.
Okay.
I think about that.
Um I do know when we have a lot,we have the ransomware teams
come out, one of my favoritethings is our team typically
(06:54):
will physically go on site.
I mean, it's pretty rare.
Um, can you kind of explain thatprocess?
Like, hey, we've been, well,ransomware, or we've had an
event of uh we have an actorthat says they've stolen our
stuff.
Um, what what's the first thingthat we do?
SPEAKER_02 (07:08):
Absolutely.
So the first thing we want to dois we want to get in touch with
the customer and get basicallyas much background information
from them as possible.
Yeah.
Um, what machines are impacted?
Um, is it all the machines?
Is there a subnet or a VLAN thatisn't impacted?
Uh that's important information,you know.
Uh what type of networkingappliances that you had in
place, what versions they wererunning.
SPEAKER_03 (07:29):
Right.
And they always have all thisinformation ready.
No, never, never, never turn.
Maybe, maybe 1% of the time.
I think 1%.
I try to figure it was.
It was a pretty big company.
But yeah, like uh networkdiagram.
No, yes, no, nope, never.
I've never seen one.
Um that's really hard for us totroubleshoot if we don't have a
network diagram.
Um, really hard to troubleshootif uh you don't have access to
(07:50):
all your devices or even anasset list, I think is pretty,
pretty important, which we don'ttypically have that.
Um one of my favoritecorrelations for this is uh we
usually get called on a Thursdayafternoon because typically
they've been fighting it for afew days and then they're like,
oh man, tomorrow's Friday.
This sucks.
I'm not gonna have a weekend.
And then we come in, the firstthing we do, this is he's
(08:12):
technically he's correct, is wewe make sure that everyone eats
food.
Yeah.
Yep.
Because they haven't slept andthey're probably uh like shaking
from just drinking all of thisnon-sponsored stuff that's right
here.
And we bring pizza stuff likethat because they're they're
pretty worn out by then.
They bring us in to uh kind ofhelp work through the weekend
and kind of add somenon-technical information.
(08:34):
Is we have our team set in abouttwo to three teams, depending on
what the situation is, and wejust kind of grind for 24-7.
We get our own little chat groupso we can jump on videos.
We just leave it open for theteam, and we have um, I guess,
rotative uh communication to theon-site team and management.
So it's pretty exciting.
It it is really tough.
(08:55):
The team actually enjoys it,which is weird, but these guys
would they enjoy that time.
So um we talked about um I guesswhat happens, kind of what we
ask for when we go on site so wekind of get a scope of what has
happened.
Um let's kind of go back on theencryption part.
Um, if if someone says, hey,we're gonna pay or we want to
(09:16):
pay, um, what would be yourfirst recommendation for that?
Pay the ransomware actor, sorry.
SPEAKER_02 (09:22):
Um well, generally speaking, uh, we don't recommend
it.
Um these groups are criminals,and not only do we not want to
encourage them to continue doingthis to people, but we can't
guarantee that they willactually keep their word and
that they will not publish yourfiles or that they will actually
give you the decryptor key forthe answer.
SPEAKER_03 (09:43):
No honor amongst thieves.
Yeah.
Um Let's say, you know what?
I'm Bob the plumber and all mystuff's there my entire life.
So I will be happy to pay thisbecause allegedly the uh it's
covered by my insurance and thedeductible is way less than my
entire company stolen.
SPEAKER_02 (10:01):
Um yeah, it's uh it's a gamble.
Um that is ultimately that issomething that uh for most
businesses, your um chiefinformation security officer and
CEO are going to have to have aconversation about what is the
um cost to benefit ratio ofpaying them.
SPEAKER_03 (10:18):
Yeah, and maybe most of you guys don't have those,
that's which is fine.
Um we would be kind of part ofthat discussion.
Some sometimes they aresuccessful, sometimes they are
not successful.
Um, what we typically recommendon, I would say more on the
management side than thetechnical side, we're gonna go
to that next, is make sure ifyou do achieve that, we usually
will we'll bring in the toolthat you've purchased to decrypt
(10:39):
these, and we'll make surethere's no malware or any other
hooks inside of it to re-attackyou and make sure it works.
Because you can upload even totheir their whatever website or
Telegram or whatever it is, um,their tour website.
They'll say, if you would likeus to show we have the keys to
it, upload two documents or onedocument.
Highly recommend that might bethe most important document to
(11:00):
have.
It could be like some hook themto a database or maybe your
heavy customer list you can putand they'll decrypt it for you.
That's how you can verify uhthat they actually have the
right keys.
Um, a lot of attackers just havethe ransomware, but they don't
have the keys.
So you'll be paying forabsolutely nothing.
It's a good thing to test on thefront end.
But technically, um, let's sayyou get in there, what's the
(11:21):
what's and we say probablyvisibility, but how do how do we
go about that?
SPEAKER_02 (11:26):
So uh one of the first things that we'll do is if
the customer has a uh EDR or XDRsolution like CrowdStrike,
Sentinel One, Huntress, um, wewill get access to that.
We will begin looking at orwe'll have our SOC analysts
start looking at any alerts thathave come through recently.
We'll start having them look atthe actual um policies that
(11:47):
they're set to.
We've had uh as before, wherethey had all the tools in place.
Uh they had sentinel one, but itwas set to detect only.
SPEAKER_03 (11:54):
Oh, right.
Yeah.
Alert only, uh no no stopping.
Yep.
Perfect.
And wait, hold up though.
Alert, where were the alertsgoing?
Oh, that's because they wereclearly getting them.
SPEAKER_02 (12:02):
Uh no.
SPEAKER_03 (12:03):
No, they weren't.
SPEAKER_02 (12:04):
No one was looking at them.
Fantastic.
So we'll look at theconfiguration and any any recent
alerts.
If they don't have an EDR, wewill deploy one.
Okay, so we'll deployCrowdStrike on all their
endpoints.
We'll set up a DFIR site inCrowdStrike and we'll deploy it
to all their endpoints.
SPEAKER_03 (12:18):
Yeah, and that's and I would say kind of adding to
that, and that's because itsounds silly, but a lot of
people unintentionally willpurchase um an EDR or even a SIM
or something like that, and noone's watching the alerts.
Um, even in, I would say in thissector, there's a lot of people
who do IT or they did security,but they go somewhere else, and
all those changes, all thesettings configurations are left
(12:39):
the same, and they go to amailbox to someone who doesn't
even work there or hasn't workedthere for years.
Um that's why on our services,uh, we uh monitor a lot of
monitor and respond threat huntas well on these on these tools.
It's it's the alias team.
So the CrowdStrike, ArmorPoint,other tools we use.
Um, we do the research, we dothe reconnaissance.
If we need to freeze the machineso it can't contact the network,
(13:01):
we do that, isolate depending onwhat product you have, and we
will let you know if it's goodor bad.
Um and we kind of have 24-7support because my guys don't
sleep.
We have a staff that kind ofassists with that as well.
Um okay, so we got the EDR, wehave the information.
Um, I guess we have some redteam that helps in this too.
How do they help us on theinvestigative side?
SPEAKER_02 (13:22):
So our red team guys, our offensive security
team, um they have an incrediblyhigh success rate of basically
looking at the customer'sorganization as an attacker
would and thinking, you know, ifI was going to hack this
organization, what would I do?
They have a vulnerability intheir SSL VPN.
What would what would happen ifI were to attack that?
(13:43):
What would I have access to?
SPEAKER_03 (13:45):
About 90%.
It is actually kind of annoying,honestly.
Yeah.
I'm talking you guys.
Annoying, it's fine.
You're you're you're right,Claryl.
I'm the forensics guy.
They figure out what happenedbefore I do.
Yeah, yeah, yeah.
Yeah, but yeah, they don'treally collect data, so it's
fine.
We we we we get to be the heroesat the end of the day, I'm just
saying.
Um as a blue taper.
Um yeah, but they do every time.
So they basically evaluate theoutside of your sorry external
(14:07):
network that's connected to theinternet.
They typically use their owntools created in-house or even a
few scanners, and like I said,90% of the time they can usually
tell.
But you know, some of that data,which my favorite part is when
people are able to basicallybreach a firewall, the things
that make me not really it'sit's funny now, but it's not
funny in the moment, is youknow, everyone's like, oh, well,
(14:29):
our logs are in the firewall.
Like, that's perfect.
We want to go check out thoselogs.
Not all the time, but I'd say50% of the time, they're either
not logging at all or they haveseven days of logs, which
typically doesn't ever help us.
Um, I think average attacker,I'm guessing like 60 to 90 days
access before they actually pullbreach.
SPEAKER_02 (14:47):
Yeah, I think the shortest that I've seen is same
day.
Um, I'd say average time isusually somewhere between like
five to fifteen days.
Yeah.
And the longest of all timewe've seen is we we don't
actually know.
We speculate up to six months.
SPEAKER_03 (15:01):
Okay.
Yeah, and that's that's the onething that that we assist with
on that.
Sometimes people may not have aa true attack on your
environment, which may want toknow if something bad is in your
environment.
Um, us obtaining logs or justrunning logs over a certain
amount of days and uminvestigating those, we can
typically tell if there's sometype of heartbeat out to an
advanced persistent threat thatwe can determine and shut down
(15:24):
those connections so they don'tuh take control of your uh
company.
So so pretty exciting.
Um I guess kind of going downthat the investigation, any
other details about that and andI guess what makes us different
than other IR people, uh kind ofleading into the documentation
talked about is a forensics G.
SPEAKER_02 (15:44):
Yeah, absolutely.
Um well, based on the umquestions that we ask the um
client organization and what wesee in the EDR once we've either
gotten access to theirs or we'vedeployed it.
Yeah.
Um by this point, we usuallyhave a pretty good idea of what
patient zero is.
Okay.
Um and that's where we startforensic analysis on.
(16:05):
Um so um at that point we What'sa forensic analysis?
Uh forensic analysis, we'regoing to basically uh drill into
the binary on that machine andwe're going to figure out as
much information as possible.
SPEAKER_03 (16:17):
So he's so he's he's being facetious, it's fine.
Listen, he gets in there andhe's ripping pay, we'll see,
even deleted events, deletedoccurrences on the machine.
He's he's pulling memory, sohe's doing memory forensics,
he's doing actual digitalforensics, task forensics,
startup forensics, all thisstuff that's in the machine.
And I only say that to otherpeople who say they do it, those
are more of an and cybersecuritycompany than a cybersecurity
(16:40):
company.
Their IT guys, I would say us,what we do, we're more of like a
brain surgeon than like ageneral aesthetic doctor from
like a like a computer guy.
And you can call computer peoplethat just work at like an MSP.
They can't get as deep as wecan.
And what they'll typically do isum basically offer you to buy
whatever EDR they have and alsobuy new computers because you're
(17:02):
scared now.
So we have the opportunity to goin there and find patient zero,
figure out what happened,potentially what was stolen, and
validate if it did or did nothappen.
There are a few cases where umit's basically scareware.
They are threatening you withdata that may have been free on
the internet that they theyscraped, and they're saying,
hey, we broke into your company,we have all your data, here's
(17:23):
proof.
And they actually don't haveanything and people pay, and the
whole time they were not at riskat all.
So something to kind ofhighlight.
And then kind of going forward,like this is more of a another
what makes us different.
Um what if we what if we have togo to court?
What if we have to talk to FBI?
What if we have to submit stufflike we didn't the other day to
that um was that guy?
(17:45):
FBI?
Who was he?
The one that was talked to ourmarketing guy?
SPEAKER_02 (17:49):
Yeah, yeah, that was that he was FBI.
Okay, FBI.
SPEAKER_03 (17:51):
So that happens.
So how do what m what what do wedo that's different than other
companies?
SPEAKER_02 (17:56):
Um well we have uh you know, we basically follow
all the standard forensicprocesses that are taught by
organizations um like IACIS,SWIGD, um SANS.
Yeah.
So we follow all the standardum, you know, digital forensic
procedure.
And I think we have three expertwitnesses uh here um in
(18:18):
cybersecurity, incidentresponse, and digital forensics.
SPEAKER_03 (18:20):
As far as I know, I think we actually might have the
most like in like the middle ofthe United States.
East Coast, West Coast, I don'tknow, but we're pretty we're
pretty well up there.
Um and we've worked uh well overprobably 2,800 cases now.
Yeah, 2,800 cases, certifiedexpert witness in court.
And we don't get too much beef,especially if we're on the side
for an investigation, because wedo work in 10 with the FBI
(18:43):
sometimes on trying to obtainthe attack, or at least they're
getting evidence or informationabout it to try to recover.
Um, because we are talking aboutyou know ransomware and incident
response, but incident response,I'm gonna kind of take a
sidestep here, besides us beingexperts uh f expert witness to
the court.
Um, because we even have let'stalk about some internal
threats, like a rogue IT guy ora a rogue person in school or
(19:08):
something, or an incidenthappens.
It's there was a few schools umthat we worked that were in the
news that there were someinappropriate relations with
kids.
Um we worked a in a company thatthe IT guy was running payroll
for some reason.
Can you kind of explain that?
Because that's not your typicalattack.
I don't think people understandthat would be an incident
response as well.
(19:28):
How does that how does thatconnect?
SPEAKER_02 (19:30):
Yeah, it's uh it's very different.
Um not only is it going to bemore complicated just due to the
nature of this person being anemployee at the organization,
um, but also a lot of the peoplethat we're going to be working
with probably had personalrelationships with these people.
Um and unfortunately, it's areally bad situation sometimes,
(19:50):
particularly when you have um ITadministrators that are uh
working at these very smallcompanies and they have all of
the keys to the kingdom andthere is no oversight um over
them.
SPEAKER_03 (20:03):
Um and that's kind of uh what what kind of kind of
weirds me out like a lot ofcompanies, and you guys may or
may not know this for yourgroup, is they're also kind of
afraid to let people go that arein IT that have been there
forever.
And they're typically, I'm notsaying they're all malicious or
have bad intentions, but ifyou're if you're if you're
afraid to let them go, or someyou get some weird vibe if they
(20:26):
ask if you want to hire someoneor change your vendor, um,
that's something where we wouldcome in, kind of change the
direction is and we've not onlyyou know helped them figure out
what happened with the CFO, whathappened with the CEO, happened
with a principal.
Let's talk about um an IT personthat the company's afraid to let
them go.
How do we help in thatsituation?
(20:47):
Because that's still an incidentresponse.
SPEAKER_02 (20:50):
Well, I think that the the reason why they're
afraid to let them go is becauseuh they think that nobody else
is going to understand theactual IT infrastructure, which
is probably true.
Yep.
Um so you need to get someone inthere to learn it.
Aaron Powell So how do how do weassist with that?
Um well, uh there's a lot ofdifferent things that we've done
in the past, um, without withoutrevealing too much.
Um, usually um if it's like justsomebody retiring and they need
(21:15):
help uh taking over, then ofcourse it's no problem for us to
just come in and just you knowlearn the infrastructure and be
able to help somebody else takeownership of that as they hire a
new employee.
Um if they're not going to bearound much longer and it's for
uh less than amicablecircumstances.
Then we have had several caseswhere we've basically had to go
(21:35):
in and do a hostile takeover andum kind of covertly.
SPEAKER_03 (21:39):
Yeah.
We did that for Yeah, to giveyou an example, we did that for
a government uh agency, and Ican be pretty, it was actually
it's open record, so if you wantto look for it, you can.
Um basically had to go in there.
The IT person was activatingvideo cameras, uh sending spoof
emails to his new boss, um, wasturning on like uh cameras, had
access to it.
(22:00):
And was running a World of WarWarcraft server on the backup
ISP that was also connected tohis house.
So we were able to get thosethat information.
So when they let this person go,because he he was causing a lot
of damage to the agency itself.
And we were able to give theking the keys back to the
kingdom, if you will.
(22:20):
Um, very, very successful.
But yeah, if if anyone you feellike you're afraid of your IT
doing stuff like that, thatwould be an incident response
situation that we can we canassist with.
Or someone's retiring as well.
Um, we've also had a horriblesituation where the IT person
just got sick and they didn'tcome back to work and they
didn't know what to do.
So we're able to get access backto the servers and get the
passwords back.
(22:40):
Very unfortunate, but it it doeshappen.
So um always have a good backupplan.
Um I guess uh going on next,like you've had a lot of you've
had a lot of training.
Well, you dull on jobs too here,though.
Five years, by the way.
Let's go.
That's crazy town.
That makes you old.
Um I guess in your your careerhere, and also um I want to talk
about obviously there's I feellike you've had both, hands-on.
(23:03):
Um, you're pretty much gonnagraduate very soon.
With is it is it digitalforensics degree?
SPEAKER_01 (23:08):
Yeah, proper okay.
SPEAKER_03 (23:11):
And then you have certifications.
Can you talk about those threeand how kind of they fit in?
SPEAKER_02 (23:16):
Yeah, absolutely.
Um I think that um all of themare incredibly valuable.
Um, the hands-on experience andtraining um that I had here of
just actually getting hands on akeyboard and just learning how
all the software works um wasincredibly valuable.
Um, but I do think that there issomething to be said for
(23:37):
certifications and even maybedepending on the school um
academic education as well.
Sure.
Um and the reason why thecertifications, so the ones that
I have, um it is the uh the atleast the the most important one
is the IACS uh CFC certifiedforensic computer examiner.
And that um certification is asix-month process with four
(23:59):
practical examinations.
Yeah.
Um sounds awful.
And most of it is on the hexlevel.
SPEAKER_03 (24:05):
Is it like um is is that one you have to pass on at
a certain point, or is it youhave to how what's what's a
passing rate, I guess?
SPEAKER_02 (24:12):
I I didn't know uh so the first phase they call it
the peer review phase.
So you have another certifiedexaminer.
Um, you have one month toanalyze a forensic image, answer
about 50 to 100 questions on it,and then write a report about
you bindings, and that has to beall peer-reviewed by another uh
certificate.
SPEAKER_03 (24:31):
Aaron Powell Gotcha.
Just starting there, I meanwe're gonna continue on, but
that's why we would probablywant someone who's already been
vetted in that capital, uh thatvertical, and not just an IT guy
or someone who works herebecause they can do things and
I'll I promise I'll step back.
I was called the S-word, whichis the bad word that attorneys
don't like.
It's called spoliation.
See, gotcha.
Um and then so I mean, that'sthey don't know what that means.
(24:53):
So kind of going through thatthrough the class, um, I mean,
you learn about that and you gointo the details.
So you do that, you make sureeverything's good to go, so you
send it to them, then whathappens?
SPEAKER_02 (25:04):
Um well, so uh the sorry, are you talking about the
certification?
Yeah, certification.
Yeah, sorry, certification.
Yeah.
Um so after you complete that uhpeer-reviewed examination, which
you have a month to do, um, youeither get approved or have to
uh go back for revisions.
Yeah.
Um you can do as many revisionsas you want as long as you get
everything right within 30 days.
Sure.
(25:24):
Um but then you have to do thatfour times.
Okay.
And then after that, you have todo a final non-peer-reviewed uh
mock examination of a drive andthen a written exam.
And once you pass all that, um,you'll be certified.
And that was a very valuablebecause it forced you to learn.
And I always tell people umforensics, if if your idea of
(25:46):
forensics is just using thesoftware and just telling people
what the software says, that'swrong.
You have to be able toarticulate how the software is
parsing that data.
SPEAKER_03 (25:55):
And it's you have to explain the technology on the
stand.
And just so you know, if you'reon the stand, you get subpoenaed
either by maybe because here'swhat could happen, right?
You do, uh you have thistechnician do an IR thing.
They allegedly do some digitalforensics.
Now they're on the stand becauseI don't know, the companies that
they work for suing theinsurance company, and you got
(26:17):
to be careful because you can beheld personally liable just
because you say something that'snot true, and does not say
you're lying, but you can getper you can be personally liably
sued for a false statement basedoff digital forensics, which is
terrifying.
Yep.
So sorry, and we're gonna go,I'm gonna hear talk about the
the degree real quick.
Um, uh just kind of finishing upon that one.
SPEAKER_02 (26:37):
Yeah, um, I think that most colleges unfortunately
um don't do digital forensicsproperly.
Um, I would say that mysituation was a little bit
different.
Going to University of CentralOklahoma that has a very well
established forensics specificprogram.
Agreed.
And they actually teach all oftheir digital forensic classes
basically in guidance with theIACS certifications.
(26:58):
So it is more directed at, youknow, this is how a NTFS file
system works.
This is how a computer actuallyfunctions, and you need to
understand all of this beforeyou can actually even use the
software.
They don't let you use thesoftware until like the fourth
or fifth class.
Good.
Ones and zeros.
Yeah.
Yeah.
SPEAKER_03 (27:15):
That made you do it all in hex.
Yeah.
So and kind of that's kind ofseparating different
investigators, especiallyincident response.
Um, is there any other situationthat um we've been used in?
Maybe, maybe we jump in and theymay see something like happen,
like we definitely didn't get acall two weekends ago and and
kind of uh he called in.
(27:36):
I don't know if this is weird.
Like, how do we handle that?
They see something weird.
What is our response to that?
SPEAKER_02 (27:41):
Uh yeah, absolutely.
We basically uh um if it's oneof our established customers,
chances are we're probablyalready doing SOC monitoring for
them.
Um so we'll just jump in andbegin an investigation um using
the workflows that we have inour SOC and uh make a
determination on if we thinkit's um suspicious or not.
SPEAKER_03 (28:00):
Yeah, and just kind of say like, um, you know, we're
we're not our pricing can bebased off the situation.
We don't have to do like a fullengagement if you just have
questions about what is incidentresponse, like do I have
something going on?
We do 10-hour stuff all the timejust to like kind of make sure
everything's okay.
Sometimes we may have to deploysome tools that are a little
louder, a little longer, but umthat we can jump in and respond
(28:24):
in case we can show you thatnothing's wrong.
It could be a false pause thatwe could help you out with.
That's kind of all thing.
You don't have to be a currentcustomer to get that the those
services as well.
Um, I guess kind of uh rotatingup here, uh, anything else on
instant response that um we'vealready leaned in, uh, we took
care of them.
After that, we give them areport.
(28:45):
What do they need to dointernally to help maybe be
better or more reactive to theincident in case it does occur
or an event happens?
SPEAKER_02 (28:53):
Um It's going to depend on the organization and
their level of maturity.
I always tell people have anactual incident response plan.
If you don't have one, get aconsultant, have them help you
make one.
Um, have a list of criticalassets, have a network map, and
actually practice your incidentresponse and data recovery plans
with tabletop exercises.
SPEAKER_03 (29:15):
Yeah, and that's uh tabletop exercise is something
we do for incident response.
We typically, and it's uh gowith me, this may sound silly at
first, but we ask that anyC-level people's there.
We have one, the CEO, the CFO,director of HR, uh chief
counsel, because those decisionsare critical during an emergency
time.
Why does HR need to be there?
(29:35):
I get that one all the time.
Okay, you if you've beenransomware or your payroll
system's down, no one's gettingpaid.
Yep.
And if you miss a payroll, ifyou've been compromised and you
miss a payroll, uh youremployees get really sketched
out.
They get pretty afraid that theymight, they might, they may not
get paid.
And you could promise andpromise, but what is the plan B
for HR?
Legal as well.
(29:57):
What legal implicationimplications do they have with
their customers or theiremployees?
Because there are contracts.
There's also data breach clausesin them having uh either
customers or vendors that theyneed to respond to.
Different states have differentum compliance regulations.
It has to be if someone, I thinkone state is over 50 people
(30:18):
that's been compromised, one's100.
Depends on the state you livein.
Um, our our compliance gangster,Jonathan Kemet, knows pretty
much all of it jumps on.
We always lean on him for hisexpertise on that one.
Um, so tabletop exercise is ifyou so we have some people that
have an IO retainer that theyhold.
If they need us, we respond.
(30:38):
We don't have to do thecontracts, we're ready to go.
We can jump in in, you know, uh30 minutes, 10 minutes.
And then if they don't use that,we'll come in and do external
services, we'll do like anexternal pen test or a tabletop
exercise.
We can write the whole plandown.
We draft it up, we have you guysapprove it, and we kind of come
in and test that yearly, whichis which is pretty exciting.
So whether you're um in acurrent incident response or
(31:01):
concerned about somethinghappening or need an incident
response plan built, or justneed an overall uh kind of test
of the of your environment, uh,we can do that, and we have been
doing that for 16 years.
That's crazy.
It makes you feel super old.
That's good.
It's good though, 16 years.
And then we would also have thethe techno the technical
background to kind of have that.
Um, I guess on all that, yousaid a lot of things they can do
(31:24):
to help prepare just in casesomething does happen.
Is there anything else thatpeople should be aware about um
an incident response or an eventum kind of in their their
company that they could could dobetter today?
SPEAKER_02 (31:35):
Yeah, absolutely.
Uh budget for it.
It costs a ridiculous amount ofmoney.
SPEAKER_03 (31:40):
It does.
I mean, I would even say justfrom R from the hip, those go
from anywhere to 150 to 300grand.
That's just the ones I'm awareof, and that's kind of on the
technical side.
That doesn't count for theattorneys, and that doesn't
count for the downtime of thebusiness.
Um, and retainers are waycheaper than that, and kind of
locking in those rates with usare better.
(32:02):
So um incident response, theyhappen.
I think they're getting bigger,just like we talked about the um
the social engineering, um,which I this is kind of related
to that.
Uh deep fakes are coming inpretty pretty heavy.
Um, voice, uh, we've seen those.
Um right now we can do deep fakestuff.
Um, even for I think it's goodto practice with this stuff.
We need 15 seconds of yourvoice.
(32:24):
We can deepfake and do the uhmulti-factor authentication
through voice um authenticationum as today.
And that's just our our company.
So I think even having exerciseon that to protect from um
social engineering would beprobably a good uh uh practice
as well.
SPEAKER_02 (32:40):
Yep.
Social engineering is alwaysprobably going to be one of the
biggest risk factors becausepeople are stubborn.
You can't you can't patch ahuman.
Yeah.
Uh that's funny.
SPEAKER_03 (32:49):
Anyway, so we have some questions from from the I
don't know, the internet.
If you want to read any ofthose, that's fine.
We'll do like two and then we'llwrap this up.
SPEAKER_02 (32:58):
Uh what are common mistakes organizations make
during incident response?
Uh turning the computer off.
SPEAKER_03 (33:04):
Wow, and that's a good one.
Um I have such a long list forthat.
Yeah.
Um uh unplugging the firewall.
Um anything that results in youus losing logs.
Yeah, don't do that.
Um don't do that.
SPEAKER_02 (33:18):
I see that all the time.
SPEAKER_03 (33:19):
Yeah.
I used to say that uh anytimethere's an event and a you pull
the plug of uh you you erasememory on the machine and angel
loses its wings.
You guys heard that?
Just the opposite.
Don't do that.
Don't do that to us becauseyou're erasing historical stuff.
So you have a server that gotbreached or compromised.
That data on that could be formonths.
And it's critical because youprobably don't have logs.
(33:40):
And if we don't have your logs,we don't have your memory, we
might be able to tell maybe howthey got in.
We'd be guessing we can plug theholes, but we don't have like
definitive, like like actualevidence of that.
Also, don't have your attorneyslie.
That's a bad idea.
Yep.
We've had that before.
And don't tell me, I'm not gonnado that either.
Um, that was that was that wasinteresting.
(34:01):
That was fun.
Yeah, fun.
What else?
I could just keep going.
What else?
Don't do that.
Um, oh, don't ignore it.
Don't don't say when theyspecifically show you they've
hacked your data, we validatedthat they've compromised you,
and then your response is itnever happened.
That's a bad idea.
Yep.
SPEAKER_02 (34:18):
It's a bad idea.
That's also a bad idea.
Uh not reporting it to OCR orthe Department of Education or
any other government agenciesthat you might have a
responsibility to report to.
SPEAKER_03 (34:28):
Yeah, personal liability comes back.
I don't know if you guys heardof this, but it's happening.
Uh all the C levels and schoolsare you're personally liable for
not doing that.
So that's is it a felony?
It's more of a chemic question.
Yeah, I'm not sure.
It's a crime.
That's it.
I don't know.
Choose your own adventure.
What else?
I feel like there's gonna be onemore for you on that one.
SPEAKER_02 (34:47):
And you know, as the forensic sky, it's really just
stop pulling the plug oncomputers.
Yeah.
Um, the only time you shouldever pull the power plug on a
computer during an incidentresponse is if you look at it
and either the disk is beingformatted or the disk is being
encrypted.
Then pull the plug.
If not, just pull the Ethernetcable out.
SPEAKER_03 (35:04):
Absolutely.
Yes, there you go.
That's the answer.
Just unplug the Ethernet cableor turn off the Wi-Fi.
Let's do one more question.
That was a good one.
I like that one.
SPEAKER_02 (35:12):
Um What level of automation should be
incorporated into incidentresponse workflows?
SPEAKER_03 (35:19):
Man, I don't know.
SPEAKER_01 (35:21):
I want to say zero, but uh uh what level of
automation?
So we use we use quite a bit ofautomation.
Yeah um mostly with But it'sinside the program.
SPEAKER_02 (35:31):
Yeah, mostly with the tools that we use for
visibility.
We we will pretty much alwayseither get access to or deploy
EDRXCR in a sim solution.
SPEAKER_03 (35:39):
I guess changing the template, right?
So that would be I guess say thewhat am I saying?
You know, uh rule set inside theYeah.
SPEAKER_02 (35:45):
So so we'll have different um workflows inside of
CrowdStrike that either we havefor our environment or we'll
configure for a customer'senvironment.
Yeah.
Um where basically we'll gothrough, we'll take all the IOCs
and we'll um add them into that.
SPEAKER_03 (35:58):
Yeah, and I think that'd be hard harder for like
uh not consultants in ourbecause we see this, this is our
job on the daily.
So we have a pretty hard testedum configuration, if that makes
sense to you guys, in a toolthat we can give to you when we
come on site.
Because it's already we'vetested our environment.
Um we even see how pen testersuh can combat against it.
So that's pretty good.
(36:18):
And also we do the the weimmediately start kicking
firewall stuff out the door, uhlogs, so we can start evaluating
firewall logs if we can.
So that that works pretty well.
Um yeah, I guess uh any otherquestions or anything else on
that one.
SPEAKER_02 (36:32):
Um yeah, I I think at least for us, most of the
automation is either gonna comefrom from like CrowdStrike or
ArmorPoint, um, with just theautomated workflows for uh
alerts.
And then of course, uh someautomated tools that we might
use for the red team side ofthings, like uh we might do some
automated vulnerability scansand stuff like that.
But most of the actual likeinvestigation we do is manual.
SPEAKER_03 (36:52):
Okay.
Well, cool.
That's kind of ending our uh AFSecure AF podcast today.
This one will have been onincident response.
If you have any other questions,feel free to give us a call or
just email us.
Thank you so much for tuning in.
See ya, internet.
SPEAKER_00 (37:14):
The Secure AF Podcast is a production of Alias
Cybersecurity.
Visit us online ataliascybersecurity.com.
All rights reserved.
What are common mistakes organizations make
during incident response?
SPEAKER_03 (00:03):
Uh turning the computer off.
Wow.
And that's a good one.
Any anything that results in youus losing logs.
Yeah.
Don't do that.
Um don't do that.
We see that all the time.
SPEAKER_00 (00:22):
You are now listening to the Secure AF
Podcast.
SPEAKER_03 (00:30):
Good morning, good afternoon, Internet.
I'm Donovan Farrow, CEO atAlias.
Today we're going to bediscussing everything you need
to know about incident response.
I have uh another fearlessleader here who's seen some wild
stuff.
This is Andrew Peters.
He does forensics, IR, threathunting, all that good stuff.
Did I miss something?
(00:51):
No.
It was mostly everything.
Perfect.
So today, like I said, we'regoing to talk about incident
response to kind of get someinformation out to the public.
Incident response is basicallywhen a company gets some type of
breach or even an event occurs.
We're going to talk about someof the uh threat actors and kind
of how they can conduct businessif they do attack your
(01:13):
organization, things you shoulddo, things you should not do.
And then also kind of uh scalingout with some maybe some
recommendations for training andstuff like that.
So you want to fast forward tothat part, you can.
It's not gonna hurt my feelings.
Whatever.
All right.
So, so Peters, uh, you kind offollow a lot of the um the APTs,
the advanced persistent threats.
(01:33):
Um, what's the latest one you'vebeen seeing today and what do
they do?
SPEAKER_02 (01:37):
Well, obviously the one that's really big in the
news right now is uh ShinyHunters.
Um we just had the uh That'sright.
The Canvas Canvas.
Canvas.
So they're they're very popular.
SPEAKER_03 (01:48):
And that's the that's the website, right, where
you do all the other marketeers.
I always like to call up breakthe third wall and look at Sam
in the back.
Yeah.
She gave us a thumbs up.
Okay.
Here you go.
SPEAKER_02 (01:58):
Yeah, so it's it's the uh the education platform
that colleges use to uh postassignments, tests, and grades,
uh discussion posts.
Um they were able to hit that,and then of course uh Quillin,
um they are still posting dozensof companies.
Is that how you say that?
I don't know.
(02:19):
You all know what I'm talkingabout.
Um pretty intense.
Is that is that China, theChinese?
Um we think Eastern Europeans.
Some people speculate China.
Um they think Eastern Europeanbecause some of the um I guess
documentation about them wasfound in Cyrillic.
Oh okay.
Um but no one really knows forsure.
SPEAKER_03 (02:37):
Gotcha.
Okay.
And what type of uh for forCanvas, what kind of attack was
that?
I mean, you can say, you know,incident response, like how do
you was it I don't know, there'sso many attack vectors.
SPEAKER_02 (02:48):
Uh reportedly that one was social engineering.
Um so uh it's my favorite.
R reportedly um there was therewas speculation that they fell
victim to a a fishing attack.
Okay.
Um what is that?
No, that is uh calling people onthe cell phone and and socially
engineering them and fishingwith like with the V though.
SPEAKER_03 (03:11):
Um yeah, so they had the kind of the popular attack
um scattered spider that did MGMum was pretty cool.
So I would say socialengineering.
Um do you know it once they gotpast, I guess got access through
uh voice.
Do you know what they did afterwhen they were inside?
Was it just a straight upransomware or do we even know?
SPEAKER_02 (03:30):
Um there's speculation.
Um, but if anything's beenconfirmed, I'm not I'm not aware
of it at this point in time.
SPEAKER_01 (03:36):
Did they pay the ransom?
SPEAKER_02 (03:38):
Um I don't uh I don't know if there was a ransom
for cancer.
SPEAKER_03 (03:41):
Okay.
Okay.
Did they just so what what Iguess then what happened?
If it wasn't ransomware, was itjust uh data steal and maybe
threat for exposure or was itlike a DDoS?
SPEAKER_02 (03:51):
Um I think it was um well it was visible to students.
Gotcha were attempting to loginto it.
So um it could have been formarketing as to if any data was
actually exfiltrated from that.
I don't think that we know thatyet.
Oh man.
SPEAKER_03 (04:04):
Okay.
Um and then let's talk about uhQuillin.
I think that's how you say that.
We don't know.
What what kind of attacks dothey do on their victims?
Um bunch of different stuff.
SPEAKER_02 (04:14):
Um they are one of the most prevalent um ransomware
organizations right now.
Yeah.
And they have a lot of differentum attack vectors and IOCs
because they have so manydifferent people that are
partnered with them.
Um they pay out a much higherpercentage of their ransom to
their affiliates.
Gotcha.
So there's a lot more differentmethods and techniques that
(04:36):
we're we're seeing.
Gotcha.
So the affiliates, what's what'stheir role with Quillin?
Um basically they're licensingthe ransomware software from
Quillin, and uh once they getaccess to an organization, they
purchase that uh Quillinransomware software so yeah,
they can execute on theorganization.
SPEAKER_03 (04:54):
Ransomware as a service.
Yeah, vertical, perfect.
See new business ideas happenall the time with these guys.
Very exciting.
So uh you've worked quite a fewincidents um with our company.
Can you give me like a from thebeginning breakdown?
How does that typically work?
I'm sure that's probably it'spretty intense.
Um I know we get a uh theaudience that comes to us
(05:15):
whenever it happens.
I mean, kind of go through thatbecause it it gets pretty deep.
Yeah, absolutely.
SPEAKER_02 (05:20):
Well, usually, uh unfortunately for us, most of
the time, if it's not a customerthat we have that we already
have a well-establishedrelationship with, if it's
somebody that we've never workedwith before, uh by the time we
get the call, they've alreadyhad uh full encryption execute
on their environment.
Yeah.
So they're hard down, everythingdoesn't work, it's all
encrypted, and they don't knowwhat to do.
SPEAKER_03 (05:40):
What what is uh so ransomware, that's an
encryption, right?
Yes.
Do they do they they typicallysteal the data first, right?
SPEAKER_02 (05:48):
Yes, they typically steal the data first, and then
they will ransom or encrypt allof the remaining devices on the
network as many as they can, andthen they will threaten to
release the data that they stoleif you do not pay.
Interestingly, though, um we'vekind of seen them move to not
even bother encrypting uh data.
Um they just take it and thenthreaten to publish it.
SPEAKER_03 (06:10):
I wonder if I mean it sounds maybe that's easier.
There's like, ah, you know what,we're just too lazy, we don't
care, we're just gonna threatento release it.
I guess they probably get paidmore that way, would be my
guess.
SPEAKER_02 (06:19):
I would guess as well.
Um I think it's less effort uhfor them and less chance of
getting caught since they're notexecuting encryption on a bunch
of endpoints.
Yeah.
And I think it's I guess that'strue.
At the end of the day, thethreat of it being publicized is
what's going to make people pay.
SPEAKER_03 (06:33):
And I assume blindsiding somebody like that
might be a little moretactically better for them than,
like you said, them knowing theransomware because it could be
stopped or blocked, and thenthey know that it happened, and
they may actually be able toremove their hooks they have in
an environment.
Okay.
I think about that.
Um I do know when we have a lot,we have the ransomware teams
come out, one of my favoritethings is our team typically
(06:54):
will physically go on site.
I mean, it's pretty rare.
Um, can you kind of explain thatprocess?
Like, hey, we've been, well,ransomware, or we've had an
event of uh we have an actorthat says they've stolen our
stuff.
Um, what what's the first thingthat we do?
SPEAKER_02 (07:08):
Absolutely.
So the first thing we want to dois we want to get in touch with
the customer and get basicallyas much background information
from them as possible.
Yeah.
Um, what machines are impacted?
Um, is it all the machines?
Is there a subnet or a VLAN thatisn't impacted?
Uh that's important information,you know.
Uh what type of networkingappliances that you had in
place, what versions they wererunning.
SPEAKER_03 (07:29):
Right.
And they always have all thisinformation ready.
No, never, never, never turn.
Maybe, maybe 1% of the time.
I think 1%.
I try to figure it was.
It was a pretty big company.
But yeah, like uh networkdiagram.
No, yes, no, nope, never.
I've never seen one.
Um that's really hard for us totroubleshoot if we don't have a
network diagram.
Um, really hard to troubleshootif uh you don't have access to
(07:50):
all your devices or even anasset list, I think is pretty,
pretty important, which we don'ttypically have that.
Um one of my favoritecorrelations for this is uh we
usually get called on a Thursdayafternoon because typically
they've been fighting it for afew days and then they're like,
oh man, tomorrow's Friday.
This sucks.
I'm not gonna have a weekend.
And then we come in, the firstthing we do, this is he's
(08:12):
technically he's correct, is wewe make sure that everyone eats
food.
Yeah.
Yep.
Because they haven't slept andthey're probably uh like shaking
from just drinking all of thisnon-sponsored stuff that's right
here.
And we bring pizza stuff likethat because they're they're
pretty worn out by then.
They bring us in to uh kind ofhelp work through the weekend
and kind of add somenon-technical information.
(08:34):
Is we have our team set in abouttwo to three teams, depending on
what the situation is, and wejust kind of grind for 24-7.
We get our own little chat groupso we can jump on videos.
We just leave it open for theteam, and we have um, I guess,
rotative uh communication to theon-site team and management.
So it's pretty exciting.
It it is really tough.
(08:55):
The team actually enjoys it,which is weird, but these guys
would they enjoy that time.
So um we talked about um I guesswhat happens, kind of what we
ask for when we go on site so wekind of get a scope of what has
happened.
Um let's kind of go back on theencryption part.
Um, if if someone says, hey,we're gonna pay or we want to
(09:16):
pay, um, what would be yourfirst recommendation for that?
Pay the ransomware actor, sorry.
SPEAKER_02 (09:22):
Um well, generally speaking, uh, we don't recommend
it.
Um these groups are criminals,and not only do we not want to
encourage them to continue doingthis to people, but we can't
guarantee that they willactually keep their word and
that they will not publish yourfiles or that they will actually
give you the decryptor key forthe answer.
SPEAKER_03 (09:43):
No honor amongst thieves.
Yeah.
Um Let's say, you know what?
I'm Bob the plumber and all mystuff's there my entire life.
So I will be happy to pay thisbecause allegedly the uh it's
covered by my insurance and thedeductible is way less than my
entire company stolen.
SPEAKER_02 (10:01):
Um yeah, it's uh it's a gamble.
Um that is ultimately that issomething that uh for most
businesses, your um chiefinformation security officer and
CEO are going to have to have aconversation about what is the
um cost to benefit ratio ofpaying them.
SPEAKER_03 (10:18):
Yeah, and maybe most of you guys don't have those,
that's which is fine.
Um we would be kind of part ofthat discussion.
Some sometimes they aresuccessful, sometimes they are
not successful.
Um, what we typically recommendon, I would say more on the
management side than thetechnical side, we're gonna go
to that next, is make sure ifyou do achieve that, we usually
will we'll bring in the toolthat you've purchased to decrypt
(10:39):
these, and we'll make surethere's no malware or any other
hooks inside of it to re-attackyou and make sure it works.
Because you can upload even totheir their whatever website or
Telegram or whatever it is, um,their tour website.
They'll say, if you would likeus to show we have the keys to
it, upload two documents or onedocument.
Highly recommend that might bethe most important document to
(11:00):
have.
It could be like some hook themto a database or maybe your
heavy customer list you can putand they'll decrypt it for you.
That's how you can verify uhthat they actually have the
right keys.
Um, a lot of attackers just havethe ransomware, but they don't
have the keys.
So you'll be paying forabsolutely nothing.
It's a good thing to test on thefront end.
But technically, um, let's sayyou get in there, what's the
(11:21):
what's and we say probablyvisibility, but how do how do we
go about that?
SPEAKER_02 (11:26):
So uh one of the first things that we'll do is if
the customer has a uh EDR or XDRsolution like CrowdStrike,
Sentinel One, Huntress, um, wewill get access to that.
We will begin looking at orwe'll have our SOC analysts
start looking at any alerts thathave come through recently.
We'll start having them look atthe actual um policies that
(11:47):
they're set to.
We've had uh as before, wherethey had all the tools in place.
Uh they had sentinel one, but itwas set to detect only.
SPEAKER_03 (11:54):
Oh, right.
Yeah.
Alert only, uh no no stopping.
Yep.
Perfect.
And wait, hold up though.
Alert, where were the alertsgoing?
Oh, that's because they wereclearly getting them.
SPEAKER_02 (12:02):
Uh no.
SPEAKER_03 (12:03):
No, they weren't.
SPEAKER_02 (12:04):
No one was looking at them.
Fantastic.
So we'll look at theconfiguration and any any recent
alerts.
If they don't have an EDR, wewill deploy one.
Okay, so we'll deployCrowdStrike on all their
endpoints.
We'll set up a DFIR site inCrowdStrike and we'll deploy it
to all their endpoints.
SPEAKER_03 (12:18):
Yeah, and that's and I would say kind of adding to
that, and that's because itsounds silly, but a lot of
people unintentionally willpurchase um an EDR or even a SIM
or something like that, and noone's watching the alerts.
Um, even in, I would say in thissector, there's a lot of people
who do IT or they did security,but they go somewhere else, and
all those changes, all thesettings configurations are left
(12:39):
the same, and they go to amailbox to someone who doesn't
even work there or hasn't workedthere for years.
Um that's why on our services,uh, we uh monitor a lot of
monitor and respond threat huntas well on these on these tools.
It's it's the alias team.
So the CrowdStrike, ArmorPoint,other tools we use.
Um, we do the research, we dothe reconnaissance.
If we need to freeze the machineso it can't contact the network,
(13:01):
we do that, isolate depending onwhat product you have, and we
will let you know if it's goodor bad.
Um and we kind of have 24-7support because my guys don't
sleep.
We have a staff that kind ofassists with that as well.
Um okay, so we got the EDR, wehave the information.
Um, I guess we have some redteam that helps in this too.
How do they help us on theinvestigative side?
SPEAKER_02 (13:22):
So our red team guys, our offensive security
team, um they have an incrediblyhigh success rate of basically
looking at the customer'sorganization as an attacker
would and thinking, you know, ifI was going to hack this
organization, what would I do?
They have a vulnerability intheir SSL VPN.
What would what would happen ifI were to attack that?
(13:43):
What would I have access to?
SPEAKER_03 (13:45):
About 90%.
It is actually kind of annoying,honestly.
Yeah.
I'm talking you guys.
Annoying, it's fine.
You're you're you're right,Claryl.
I'm the forensics guy.
They figure out what happenedbefore I do.
Yeah, yeah, yeah.
Yeah, but yeah, they don'treally collect data, so it's
fine.
We we we we get to be the heroesat the end of the day, I'm just
saying.
Um as a blue taper.
Um yeah, but they do every time.
So they basically evaluate theoutside of your sorry external
(14:07):
network that's connected to theinternet.
They typically use their owntools created in-house or even a
few scanners, and like I said,90% of the time they can usually
tell.
But you know, some of that data,which my favorite part is when
people are able to basicallybreach a firewall, the things
that make me not really it'sit's funny now, but it's not
funny in the moment, is youknow, everyone's like, oh, well,
(14:29):
our logs are in the firewall.
Like, that's perfect.
We want to go check out thoselogs.
Not all the time, but I'd say50% of the time, they're either
not logging at all or they haveseven days of logs, which
typically doesn't ever help us.
Um, I think average attacker,I'm guessing like 60 to 90 days
access before they actually pullbreach.
SPEAKER_02 (14:47):
Yeah, I think the shortest that I've seen is same
day.
Um, I'd say average time isusually somewhere between like
five to fifteen days.
Yeah.
And the longest of all timewe've seen is we we don't
actually know.
We speculate up to six months.
SPEAKER_03 (15:01):
Okay.
Yeah, and that's that's the onething that that we assist with
on that.
Sometimes people may not have aa true attack on your
environment, which may want toknow if something bad is in your
environment.
Um, us obtaining logs or justrunning logs over a certain
amount of days and uminvestigating those, we can
typically tell if there's sometype of heartbeat out to an
advanced persistent threat thatwe can determine and shut down
(15:24):
those connections so they don'tuh take control of your uh
company.
So so pretty exciting.
Um I guess kind of going downthat the investigation, any
other details about that and andI guess what makes us different
than other IR people, uh kind ofleading into the documentation
talked about is a forensics G.
SPEAKER_02 (15:44):
Yeah, absolutely.
Um well, based on the umquestions that we ask the um
client organization and what wesee in the EDR once we've either
gotten access to theirs or we'vedeployed it.
Yeah.
Um by this point, we usuallyhave a pretty good idea of what
patient zero is.
Okay.
Um and that's where we startforensic analysis on.
(16:05):
Um so um at that point we What'sa forensic analysis?
Uh forensic analysis, we'regoing to basically uh drill into
the binary on that machine andwe're going to figure out as
much information as possible.
SPEAKER_03 (16:17):
So he's so he's he's being facetious, it's fine.
Listen, he gets in there andhe's ripping pay, we'll see,
even deleted events, deletedoccurrences on the machine.
He's he's pulling memory, sohe's doing memory forensics,
he's doing actual digitalforensics, task forensics,
startup forensics, all thisstuff that's in the machine.
And I only say that to otherpeople who say they do it, those
are more of an and cybersecuritycompany than a cybersecurity
(16:40):
company.
Their IT guys, I would say us,what we do, we're more of like a
brain surgeon than like ageneral aesthetic doctor from
like a like a computer guy.
And you can call computer peoplethat just work at like an MSP.
They can't get as deep as wecan.
And what they'll typically do isum basically offer you to buy
whatever EDR they have and alsobuy new computers because you're
(17:02):
scared now.
So we have the opportunity to goin there and find patient zero,
figure out what happened,potentially what was stolen, and
validate if it did or did nothappen.
There are a few cases where umit's basically scareware.
They are threatening you withdata that may have been free on
the internet that they theyscraped, and they're saying,
hey, we broke into your company,we have all your data, here's
(17:23):
proof.
And they actually don't haveanything and people pay, and the
whole time they were not at riskat all.
So something to kind ofhighlight.
And then kind of going forward,like this is more of a another
what makes us different.
Um what if we what if we have togo to court?
What if we have to talk to FBI?
What if we have to submit stufflike we didn't the other day to
that um was that guy?
(17:45):
FBI?
Who was he?
The one that was talked to ourmarketing guy?
SPEAKER_02 (17:49):
Yeah, yeah, that was that he was FBI.
Okay, FBI.
SPEAKER_03 (17:51):
So that happens.
So how do what m what what do wedo that's different than other
companies?
SPEAKER_02 (17:56):
Um well we have uh you know, we basically follow
all the standard forensicprocesses that are taught by
organizations um like IACIS,SWIGD, um SANS.
Yeah.
So we follow all the standardum, you know, digital forensic
procedure.
And I think we have three expertwitnesses uh here um in
(18:18):
cybersecurity, incidentresponse, and digital forensics.
SPEAKER_03 (18:20):
As far as I know, I think we actually might have the
most like in like the middle ofthe United States.
East Coast, West Coast, I don'tknow, but we're pretty we're
pretty well up there.
Um and we've worked uh well overprobably 2,800 cases now.
Yeah, 2,800 cases, certifiedexpert witness in court.
And we don't get too much beef,especially if we're on the side
for an investigation, because wedo work in 10 with the FBI
(18:43):
sometimes on trying to obtainthe attack, or at least they're
getting evidence or informationabout it to try to recover.
Um, because we are talking aboutyou know ransomware and incident
response, but incident response,I'm gonna kind of take a
sidestep here, besides us beingexperts uh f expert witness to
the court.
Um, because we even have let'stalk about some internal
threats, like a rogue IT guy ora a rogue person in school or
(19:08):
something, or an incidenthappens.
It's there was a few schools umthat we worked that were in the
news that there were someinappropriate relations with
kids.
Um we worked a in a company thatthe IT guy was running payroll
for some reason.
Can you kind of explain that?
Because that's not your typicalattack.
I don't think people understandthat would be an incident
response as well.
(19:28):
How does that how does thatconnect?
SPEAKER_02 (19:30):
Yeah, it's uh it's very different.
Um not only is it going to bemore complicated just due to the
nature of this person being anemployee at the organization,
um, but also a lot of the peoplethat we're going to be working
with probably had personalrelationships with these people.
Um and unfortunately, it's areally bad situation sometimes,
(19:50):
particularly when you have um ITadministrators that are uh
working at these very smallcompanies and they have all of
the keys to the kingdom andthere is no oversight um over
them.
SPEAKER_03 (20:03):
Um and that's kind of uh what what kind of kind of
weirds me out like a lot ofcompanies, and you guys may or
may not know this for yourgroup, is they're also kind of
afraid to let people go that arein IT that have been there
forever.
And they're typically, I'm notsaying they're all malicious or
have bad intentions, but ifyou're if you're if you're
afraid to let them go, or someyou get some weird vibe if they
(20:26):
ask if you want to hire someoneor change your vendor, um,
that's something where we wouldcome in, kind of change the
direction is and we've not onlyyou know helped them figure out
what happened with the CFO, whathappened with the CEO, happened
with a principal.
Let's talk about um an IT personthat the company's afraid to let
them go.
How do we help in thatsituation?
(20:47):
Because that's still an incidentresponse.
SPEAKER_02 (20:50):
Well, I think that the the reason why they're
afraid to let them go is becauseuh they think that nobody else
is going to understand theactual IT infrastructure, which
is probably true.
Yep.
Um so you need to get someone inthere to learn it.
Aaron Powell So how do how do weassist with that?
Um well, uh there's a lot ofdifferent things that we've done
in the past, um, without withoutrevealing too much.
Um, usually um if it's like justsomebody retiring and they need
(21:15):
help uh taking over, then ofcourse it's no problem for us to
just come in and just you knowlearn the infrastructure and be
able to help somebody else takeownership of that as they hire a
new employee.
Um if they're not going to bearound much longer and it's for
uh less than amicablecircumstances.
Then we have had several caseswhere we've basically had to go
(21:35):
in and do a hostile takeover andum kind of covertly.
SPEAKER_03 (21:39):
Yeah.
We did that for Yeah, to giveyou an example, we did that for
a government uh agency, and Ican be pretty, it was actually
it's open record, so if you wantto look for it, you can.
Um basically had to go in there.
The IT person was activatingvideo cameras, uh sending spoof
emails to his new boss, um, wasturning on like uh cameras, had
access to it.
(22:00):
And was running a World of WarWarcraft server on the backup
ISP that was also connected tohis house.
So we were able to get thosethat information.
So when they let this person go,because he he was causing a lot
of damage to the agency itself.
And we were able to give theking the keys back to the
kingdom, if you will.
(22:20):
Um, very, very successful.
But yeah, if if anyone you feellike you're afraid of your IT
doing stuff like that, thatwould be an incident response
situation that we can we canassist with.
Or someone's retiring as well.
Um, we've also had a horriblesituation where the IT person
just got sick and they didn'tcome back to work and they
didn't know what to do.
So we're able to get access backto the servers and get the
passwords back.
(22:40):
Very unfortunate, but it it doeshappen.
So um always have a good backupplan.
Um I guess uh going on next,like you've had a lot of you've
had a lot of training.
Well, you dull on jobs too here,though.
Five years, by the way.
Let's go.
That's crazy town.
That makes you old.
Um I guess in your your careerhere, and also um I want to talk
about obviously there's I feellike you've had both, hands-on.
(23:03):
Um, you're pretty much gonnagraduate very soon.
With is it is it digitalforensics degree?
SPEAKER_01 (23:08):
Yeah, proper okay.
SPEAKER_03 (23:11):
And then you have certifications.
Can you talk about those threeand how kind of they fit in?
SPEAKER_02 (23:16):
Yeah, absolutely.
Um I think that um all of themare incredibly valuable.
Um, the hands-on experience andtraining um that I had here of
just actually getting hands on akeyboard and just learning how
all the software works um wasincredibly valuable.
Um, but I do think that there issomething to be said for
(23:37):
certifications and even maybedepending on the school um
academic education as well.
Sure.
Um and the reason why thecertifications, so the ones that
I have, um it is the uh the atleast the the most important one
is the IACS uh CFC certifiedforensic computer examiner.
And that um certification is asix-month process with four
(23:59):
practical examinations.
Yeah.
Um sounds awful.
And most of it is on the hexlevel.
SPEAKER_03 (24:05):
Is it like um is is that one you have to pass on at
a certain point, or is it youhave to how what's what's a
passing rate, I guess?
SPEAKER_02 (24:12):
I I didn't know uh so the first phase they call it
the peer review phase.
So you have another certifiedexaminer.
Um, you have one month toanalyze a forensic image, answer
about 50 to 100 questions on it,and then write a report about
you bindings, and that has to beall peer-reviewed by another uh
certificate.
SPEAKER_03 (24:31):
Aaron Powell Gotcha.
Just starting there, I meanwe're gonna continue on, but
that's why we would probablywant someone who's already been
vetted in that capital, uh thatvertical, and not just an IT guy
or someone who works herebecause they can do things and
I'll I promise I'll step back.
I was called the S-word, whichis the bad word that attorneys
don't like.
It's called spoliation.
See, gotcha.
Um and then so I mean, that'sthey don't know what that means.
(24:53):
So kind of going through thatthrough the class, um, I mean,
you learn about that and you gointo the details.
So you do that, you make sureeverything's good to go, so you
send it to them, then whathappens?
SPEAKER_02 (25:04):
Um well, so uh the sorry, are you talking about the
certification?
Yeah, certification.
Yeah, sorry, certification.
Yeah.
Um so after you complete that uhpeer-reviewed examination, which
you have a month to do, um, youeither get approved or have to
uh go back for revisions.
Yeah.
Um you can do as many revisionsas you want as long as you get
everything right within 30 days.
Sure.
(25:24):
Um but then you have to do thatfour times.
Okay.
And then after that, you have todo a final non-peer-reviewed uh
mock examination of a drive andthen a written exam.
And once you pass all that, um,you'll be certified.
And that was a very valuablebecause it forced you to learn.
And I always tell people umforensics, if if your idea of
(25:46):
forensics is just using thesoftware and just telling people
what the software says, that'swrong.
You have to be able toarticulate how the software is
parsing that data.
SPEAKER_03 (25:55):
And it's you have to explain the technology on the
stand.
And just so you know, if you'reon the stand, you get subpoenaed
either by maybe because here'swhat could happen, right?
You do, uh you have thistechnician do an IR thing.
They allegedly do some digitalforensics.
Now they're on the stand becauseI don't know, the companies that
they work for suing theinsurance company, and you got
(26:17):
to be careful because you can beheld personally liable just
because you say something that'snot true, and does not say
you're lying, but you can getper you can be personally liably
sued for a false statement basedoff digital forensics, which is
terrifying.
Yep.
So sorry, and we're gonna go,I'm gonna hear talk about the
the degree real quick.
Um, uh just kind of finishing upon that one.
SPEAKER_02 (26:37):
Yeah, um, I think that most colleges unfortunately
um don't do digital forensicsproperly.
Um, I would say that mysituation was a little bit
different.
Going to University of CentralOklahoma that has a very well
established forensics specificprogram.
Agreed.
And they actually teach all oftheir digital forensic classes
basically in guidance with theIACS certifications.
(26:58):
So it is more directed at, youknow, this is how a NTFS file
system works.
This is how a computer actuallyfunctions, and you need to
understand all of this beforeyou can actually even use the
software.
They don't let you use thesoftware until like the fourth
or fifth class.
Good.
Ones and zeros.
Yeah.
Yeah.
SPEAKER_03 (27:15):
That made you do it all in hex.
Yeah.
So and kind of that's kind ofseparating different
investigators, especiallyincident response.
Um, is there any other situationthat um we've been used in?
Maybe, maybe we jump in and theymay see something like happen,
like we definitely didn't get acall two weekends ago and and
kind of uh he called in.
(27:36):
I don't know if this is weird.
Like, how do we handle that?
They see something weird.
What is our response to that?
SPEAKER_02 (27:41):
Uh yeah, absolutely.
We basically uh um if it's oneof our established customers,
chances are we're probablyalready doing SOC monitoring for
them.
Um so we'll just jump in andbegin an investigation um using
the workflows that we have inour SOC and uh make a
determination on if we thinkit's um suspicious or not.
SPEAKER_03 (28:00):
Yeah, and just kind of say like, um, you know, we're
we're not our pricing can bebased off the situation.
We don't have to do like a fullengagement if you just have
questions about what is incidentresponse, like do I have
something going on?
We do 10-hour stuff all the timejust to like kind of make sure
everything's okay.
Sometimes we may have to deploysome tools that are a little
louder, a little longer, but umthat we can jump in and respond
(28:24):
in case we can show you thatnothing's wrong.
It could be a false pause thatwe could help you out with.
That's kind of all thing.
You don't have to be a currentcustomer to get that the those
services as well.
Um, I guess kind of uh rotatingup here, uh, anything else on
instant response that um we'vealready leaned in, uh, we took
care of them.
After that, we give them areport.
(28:45):
What do they need to dointernally to help maybe be
better or more reactive to theincident in case it does occur
or an event happens?
SPEAKER_02 (28:53):
Um It's going to depend on the organization and
their level of maturity.
I always tell people have anactual incident response plan.
If you don't have one, get aconsultant, have them help you
make one.
Um, have a list of criticalassets, have a network map, and
actually practice your incidentresponse and data recovery plans
with tabletop exercises.
SPEAKER_03 (29:15):
Yeah, and that's uh tabletop exercise is something
we do for incident response.
We typically, and it's uh gowith me, this may sound silly at
first, but we ask that anyC-level people's there.
We have one, the CEO, the CFO,director of HR, uh chief
counsel, because those decisionsare critical during an emergency
time.
Why does HR need to be there?
(29:35):
I get that one all the time.
Okay, you if you've beenransomware or your payroll
system's down, no one's gettingpaid.
Yep.
And if you miss a payroll, ifyou've been compromised and you
miss a payroll, uh youremployees get really sketched
out.
They get pretty afraid that theymight, they might, they may not
get paid.
And you could promise andpromise, but what is the plan B
for HR?
Legal as well.
(29:57):
What legal implicationimplications do they have with
their customers or theiremployees?
Because there are contracts.
There's also data breach clausesin them having uh either
customers or vendors that theyneed to respond to.
Different states have differentum compliance regulations.
It has to be if someone, I thinkone state is over 50 people
(30:18):
that's been compromised, one's100.
Depends on the state you livein.
Um, our our compliance gangster,Jonathan Kemet, knows pretty
much all of it jumps on.
We always lean on him for hisexpertise on that one.
Um, so tabletop exercise is ifyou so we have some people that
have an IO retainer that theyhold.
If they need us, we respond.
(30:38):
We don't have to do thecontracts, we're ready to go.
We can jump in in, you know, uh30 minutes, 10 minutes.
And then if they don't use that,we'll come in and do external
services, we'll do like anexternal pen test or a tabletop
exercise.
We can write the whole plandown.
We draft it up, we have you guysapprove it, and we kind of come
in and test that yearly, whichis which is pretty exciting.
So whether you're um in acurrent incident response or
(31:01):
concerned about somethinghappening or need an incident
response plan built, or justneed an overall uh kind of test
of the of your environment, uh,we can do that, and we have been
doing that for 16 years.
That's crazy.
It makes you feel super old.
That's good.
It's good though, 16 years.
And then we would also have thethe techno the technical
background to kind of have that.
Um, I guess on all that, yousaid a lot of things they can do
(31:24):
to help prepare just in casesomething does happen.
Is there anything else thatpeople should be aware about um
an incident response or an eventum kind of in their their
company that they could could dobetter today?
SPEAKER_02 (31:35):
Yeah, absolutely.
Uh budget for it.
It costs a ridiculous amount ofmoney.
SPEAKER_03 (31:40):
It does.
I mean, I would even say justfrom R from the hip, those go
from anywhere to 150 to 300grand.
That's just the ones I'm awareof, and that's kind of on the
technical side.
That doesn't count for theattorneys, and that doesn't
count for the downtime of thebusiness.
Um, and retainers are waycheaper than that, and kind of
locking in those rates with usare better.
(32:02):
So um incident response, theyhappen.
I think they're getting bigger,just like we talked about the um
the social engineering, um,which I this is kind of related
to that.
Uh deep fakes are coming inpretty pretty heavy.
Um, voice, uh, we've seen those.
Um right now we can do deep fakestuff.
Um, even for I think it's goodto practice with this stuff.
We need 15 seconds of yourvoice.
(32:24):
We can deepfake and do the uhmulti-factor authentication
through voice um authenticationum as today.
And that's just our our company.
So I think even having exerciseon that to protect from um
social engineering would beprobably a good uh uh practice
as well.
SPEAKER_02 (32:40):
Yep.
Social engineering is alwaysprobably going to be one of the
biggest risk factors becausepeople are stubborn.
You can't you can't patch ahuman.
Yeah.
Uh that's funny.
SPEAKER_03 (32:49):
Anyway, so we have some questions from from the I
don't know, the internet.
If you want to read any ofthose, that's fine.
We'll do like two and then we'llwrap this up.
SPEAKER_02 (32:58):
Uh what are common mistakes organizations make
during incident response?
Uh turning the computer off.
SPEAKER_03 (33:04):
Wow, and that's a good one.
Um I have such a long list forthat.
Yeah.
Um uh unplugging the firewall.
Um anything that results in youus losing logs.
Yeah, don't do that.
Um don't do that.
SPEAKER_02 (33:18):
I see that all the time.
SPEAKER_03 (33:19):
Yeah.
I used to say that uh anytimethere's an event and a you pull
the plug of uh you you erasememory on the machine and angel
loses its wings.
You guys heard that?
Just the opposite.
Don't do that.
Don't do that to us becauseyou're erasing historical stuff.
So you have a server that gotbreached or compromised.
That data on that could be formonths.
And it's critical because youprobably don't have logs.
(33:40):
And if we don't have your logs,we don't have your memory, we
might be able to tell maybe howthey got in.
We'd be guessing we can plug theholes, but we don't have like
definitive, like like actualevidence of that.
Also, don't have your attorneyslie.
That's a bad idea.
Yep.
We've had that before.
And don't tell me, I'm not gonnado that either.
Um, that was that was that wasinteresting.
(34:01):
That was fun.
Yeah, fun.
What else?
I could just keep going.
What else?
Don't do that.
Um, oh, don't ignore it.
Don't don't say when theyspecifically show you they've
hacked your data, we validatedthat they've compromised you,
and then your response is itnever happened.
That's a bad idea.
Yep.
SPEAKER_02 (34:18):
It's a bad idea.
That's also a bad idea.
Uh not reporting it to OCR orthe Department of Education or
any other government agenciesthat you might have a
responsibility to report to.
SPEAKER_03 (34:28):
Yeah, personal liability comes back.
I don't know if you guys heardof this, but it's happening.
Uh all the C levels and schoolsare you're personally liable for
not doing that.
So that's is it a felony?
It's more of a chemic question.
Yeah, I'm not sure.
It's a crime.
That's it.
I don't know.
Choose your own adventure.
What else?
I feel like there's gonna be onemore for you on that one.
SPEAKER_02 (34:47):
And you know, as the forensic sky, it's really just
stop pulling the plug oncomputers.
Yeah.
Um, the only time you shouldever pull the power plug on a
computer during an incidentresponse is if you look at it
and either the disk is beingformatted or the disk is being
encrypted.
Then pull the plug.
If not, just pull the Ethernetcable out.
SPEAKER_03 (35:04):
Absolutely.
Yes, there you go.
That's the answer.
Just unplug the Ethernet cableor turn off the Wi-Fi.
Let's do one more question.
That was a good one.
I like that one.
SPEAKER_02 (35:12):
Um What level of automation should be
incorporated into incidentresponse workflows?
SPEAKER_03 (35:19):
Man, I don't know.
SPEAKER_01 (35:21):
I want to say zero, but uh uh what level of
automation?
So we use we use quite a bit ofautomation.
Yeah um mostly with But it'sinside the program.
SPEAKER_02 (35:31):
Yeah, mostly with the tools that we use for
visibility.
We we will pretty much alwayseither get access to or deploy
EDRXCR in a sim solution.
SPEAKER_03 (35:39):
I guess changing the template, right?
So that would be I guess say thewhat am I saying?
You know, uh rule set inside theYeah.
SPEAKER_02 (35:45):
So so we'll have different um workflows inside of
CrowdStrike that either we havefor our environment or we'll
configure for a customer'senvironment.
Yeah.
Um where basically we'll gothrough, we'll take all the IOCs
and we'll um add them into that.
SPEAKER_03 (35:58):
Yeah, and I think that'd be hard harder for like
uh not consultants in ourbecause we see this, this is our
job on the daily.
So we have a pretty hard testedum configuration, if that makes
sense to you guys, in a toolthat we can give to you when we
come on site.
Because it's already we'vetested our environment.
Um we even see how pen testersuh can combat against it.
So that's pretty good.
(36:18):
And also we do the the weimmediately start kicking
firewall stuff out the door, uhlogs, so we can start evaluating
firewall logs if we can.
So that that works pretty well.
Um yeah, I guess uh any otherquestions or anything else on
that one.
SPEAKER_02 (36:32):
Um yeah, I I think at least for us, most of the
automation is either gonna comefrom from like CrowdStrike or
ArmorPoint, um, with just theautomated workflows for uh
alerts.
And then of course, uh someautomated tools that we might
use for the red team side ofthings, like uh we might do some
automated vulnerability scansand stuff like that.
But most of the actual likeinvestigation we do is manual.
SPEAKER_03 (36:52):
Okay.
Well, cool.
That's kind of ending our uh AFSecure AF podcast today.
This one will have been onincident response.
If you have any other questions,feel free to give us a call or
just email us.
Thank you so much for tuning in.
See ya, internet.
SPEAKER_00 (37:14):
The Secure AF Podcast is a production of Alias
Cybersecurity.
Visit us online ataliascybersecurity.com.
All rights reserved.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.