Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:20):
From Next Think and the creators of the Decks show.
It's parallel one it story told week by week because
technology problems don't happen in isolation or by themselves. They
happen in parallel. I'm Tim Flower. In our first episode,
we uncovered the mysterious theft of productivity at Zentech. Rogue script,
(00:43):
phantom processes, and employees caught in the crossfire. But what
if I told you this wasn't just bad luck or
a simple system failure. What if it was deliberate. Today
we follow a trail left by a single vandal criminal
that leaves no trace behind, one known only as the
(01:04):
Undocumented Change. What we uncover may change everything we thought
we knew about zen Tech's crisis, and possibly about the
very foundation of workplace technology itself. It started in a
meeting room somewhere deep in the heart of zen Tech's department,
A team of engineers huddled over a shared monitor, trying
(01:25):
to trace the origins of strange symptoms happening randomly around
the enterprise. I decided to talk with Pam, the IT
lead at zen Tech.
Speaker 2 (01:35):
We knew the symptoms weren't happening that reason, but we
couldn't find any change control that would have caused them.
Speaker 3 (01:42):
It wasn't part of any appointment logs, no version control,
no sign off. It was just like these problems just appeared.
Speaker 1 (01:52):
That's when someone on the team considered a remote possibility.
Perhaps this was a change that had been made without
an official change request, without documentation, a change that didn't
exist in the official system of record, and obviously wasn't
reviewed by the CAB. Who knows what kind of testing
had been done. Dina runs the CAB, a group of
(02:12):
cross domain experts trained to look at the impact of
changes and also enforced the process of making changes.
Speaker 2 (02:20):
We call them uses undocumented changes. Small changes used to
happen all the time because tech teams believed they were harmless,
but they were outlawed because some of them can really
cause significant damage, and this could be one of them.
Not only did the CAB not know about it, but
no one from the service areas knew about it either.
Speaker 1 (02:42):
So was this just a small change causing big issues
or was something else going on? Was it a glitch
or was it really sabotage? And the change wasn't just
logging errors anymore? It was tracing intent to get more
visibility into this behavior, the team turned to Zentex platform.
Friend is the deck's lead for the company and gets
(03:03):
involved when others can't figure out complicated problems.
Speaker 3 (03:07):
So the platform gave us something we knew was going
to be invaluable, and that's timestamps of the symptoms. And
those symptoms they started as soon as GPOs were processed
on devices Monday morning, so we could trace it back
to a specific GPO edit made that three fourteen am
(03:27):
on a Sunday morning by someone with admin level credentials,
and we could prove that the results we were seeing
across all departments on Monday morning were caused by this edit. Okay,
so great, but here it was the kicker. The credentials
were tied to an employee who hadn't worked here for
(03:48):
five years.
Speaker 1 (03:50):
The change was small, insignificant on the surface, a single
line of code added to a GPO buried deep in
the infrastructure, but the effects rippled out word like throwing
a pebble into a still pond.
Speaker 2 (04:04):
It redirected processes for devices and ways we couldn't predict
CPU usage spikes.
Speaker 3 (04:09):
Network latency increase, and it only targeted certain employees executive
clid facing teams people who couldn't afford downtime, and.
Speaker 1 (04:19):
While IT scrambled to uncover the mystery, employees at zen
Tech were starting to lose hope. Productivity was plummeting, client
relationships were fraying, and it's reputation was on the line.
So I went to one of their field offices to
talk with an impacted employee.
Speaker 3 (04:35):
We were just tired. They helped. ESK would fix.
Speaker 4 (04:39):
One problem and two more would pop up.
Speaker 3 (04:41):
Every time they fixed something, something else would break, and
I can't afford that, so I usually don't even call.
Speaker 2 (04:46):
They're good people, but it's like they're playing whack a
mole with my job on the line.
Speaker 1 (04:50):
At the same time, whispers began to circulate among the staff,
Whispers about sabotage, about someone working against the company from within.
It was just it's too strange that it couldn't solve this.
Ella shared something that many in IT had also feared
declining trust.
Speaker 4 (05:07):
People started pointing fingers. Maybe it was someone in IT,
or maybe an old employee trying to get revenge. It
made you paranoid, just not knowing what was going on.
And as much as we need the IT teams to
support us, we started to question our trusts in the department.
Speaker 1 (05:24):
The paranoia wasn't entirely unfounded. The DEX team's investigation of
the credentials used to make the change led them to
a name, Sarah Green, a Formers and Tech employee terminated
after a high profile data breach. But here's the thing.
Sarah Green disappeared five years ago. No social media, no
(05:44):
job history, nothing on LinkedIn. It was like she never existed.
Speaker 3 (05:49):
It felt like a dead end.
Speaker 2 (05:51):
But then we found something else and encrypted on the
same domain controller. It didn't seem to be part of
the world GPO, but there were.
Speaker 3 (06:00):
It was an.
Speaker 2 (06:00):
Encrypted call being made to an external source somehow, and
then we decrypted it. And that's really when.
Speaker 3 (06:07):
Things got weird.
Speaker 1 (06:10):
Weird because the file didn't contain code, It contained a manifesto.
Speaker 3 (06:16):
It was kind of like reading a diary someone talking
about how technology was ruining the workplace, how the systems
we relied on were enslaving us, and how it was
time to fight back.
Speaker 1 (06:29):
Was Sarah Green the saboteur or was just a pawn
in something larger. As the team continued their investigation, they
began to uncover patterns that stretched far beyond Zen Tech,
undocumented changes, rogue scripts, crashes that didn't make sense, and
a reference to something that kept appearing over and over again.
The Foundation.
Speaker 3 (06:51):
It's bigger than Zen Tech, it's bigger than OX.
Speaker 1 (06:53):
This is systemic, and it's been happening for years, three
five years by one estimate.
Speaker 3 (06:59):
But what is the foundation and why are they targeting
companies like us?
Speaker 1 (07:04):
The Text team found one clue that allowed them to
solve a problem and get rid of a bad GPO,
but opened up a whole host of other issues happening
in the dark. Next week, we'll dig deeper. We'll talk
to some former employees, some experts, and maybe, just maybe,
we'll find out who's really behind the manifesto found from
an undocumented change