WEBVTT 00:00:00.000 --> 00:00:02.586 Hello and welcome to this videocast in which 00:00:02.586 --> 00:00:05.700 we'll look at how businesses can stay safe from cyber 00:00:05.700 --> 00:00:08.213 threats during the holiday season. I'm Warwick 00:00:08.213 --> 00:00:11.000 Ashford, a Senior Analyst at KuppingerCole Analysts 00:00:11.000 --> 00:00:15.800 and I'm joined by Danny Jenkins, CEO and Co-Founder of ThreatLocker. Welcome. 00:00:17.000 --> 00:00:18.700 Good morning and thank you for inviting me today. 00:00:19.300 --> 00:00:21.873 So Danny, the end of the year holiday season is 00:00:21.873 --> 00:00:24.500 coming up, supposedly the most wonderful time of 00:00:24.500 --> 00:00:26.602 the year, but we all know it can be the most 00:00:26.602 --> 00:00:28.800 vulnerable time of the year from a cyber crime 00:00:28.800 --> 00:00:31.950 point of view, with some reports claiming a 30% 00:00:31.950 --> 00:00:35.100 to 40% increase. In your experience, why is the 00:00:35.100 --> 00:00:37.928 holiday season from late November through December 00:00:37.928 --> 00:00:40.700 a popular period for cyber criminals to carry out 00:00:40.800 --> 00:00:43.530 attacks? Well really it's about time. The more 00:00:43.530 --> 00:00:46.200 likely a cyber criminal can cause damage, the 00:00:46.200 --> 00:00:47.865 more likely they're going to get paid. So cyber 00:00:47.865 --> 00:00:49.600 criminals often want to keep as much time on your 00:00:49.600 --> 00:00:51.901 network, encrypt as many files, extract as much 00:00:51.901 --> 00:00:54.300 data as possible. You're less likely to be caught 00:00:54.300 --> 00:00:56.300 on a holiday season where socks are running thin, 00:00:56.300 --> 00:00:58.300 users aren't paying attention to what's happening 00:00:58.300 --> 00:01:00.573 on their machine. If one machine's left unlocked, 00:01:00.573 --> 00:01:02.800 they can get onto that machine, they can use the 00:01:02.800 --> 00:01:05.877 whole weekend, or long weekend even, to do as 00:01:05.877 --> 00:01:09.500 much damage as possible. And there's also an increase 00:01:09.500 --> 00:01:12.568 in online activity transactions as well, I guess 00:01:12.568 --> 00:01:15.700 that also is a factor. Yeah absolutely, so people 00:01:15.700 --> 00:01:17.741 are traveling more, people are at the office 00:01:17.741 --> 00:01:20.200 more, they're more likely to click on things, there's 00:01:20.200 --> 00:01:22.429 people online more, they're more likely to get 00:01:22.429 --> 00:01:24.900 gift cards or be fooled into, oh you've been sent a 00:01:24.900 --> 00:01:26.449 Christmas gift card, or you've been sent this, 00:01:26.449 --> 00:01:28.100 and that's another reason they can gain access to 00:01:28.100 --> 00:01:30.828 those accounts. So now the next logical question 00:01:30.828 --> 00:01:33.500 would be, how can businesses protect themselves 00:01:33.500 --> 00:01:35.790 over the holiday period? But I'd argue that 00:01:35.790 --> 00:01:38.400 the holiday season should make no difference to a 00:01:38.400 --> 00:01:40.700 well-designed cyber security strategy, it should 00:01:40.700 --> 00:01:43.000 work equally well at any given time of the year, 00:01:43.100 --> 00:01:45.300 would you agree? No absolutely, so if you're 00:01:45.300 --> 00:01:48.000 doing everything right, the holiday period isn't going 00:01:48.000 --> 00:01:50.313 to make much difference, and there are a few 00:01:50.313 --> 00:01:53.100 extra things you can do, advising people to shut down 00:01:53.100 --> 00:01:55.600 their machines when they go home for the weekend, 00:01:55.600 --> 00:01:58.100 it might seem small but it means it's less likely 00:01:58.100 --> 00:02:00.893 to happen. Of course no one's bulletproof when it 00:02:00.893 --> 00:02:03.800 comes to security, but having the best technologies 00:02:03.800 --> 00:02:06.556 in place, and then putting an extra few steps in 00:02:06.556 --> 00:02:09.600 place, means that if the technology fails, if someone 00:02:09.600 --> 00:02:11.971 missed something, then it's less likely to be 00:02:11.971 --> 00:02:14.500 effective. Great thanks, so if we agree that the 00:02:14.500 --> 00:02:18.707 time of the year should make no difference to 00:02:18.707 --> 00:02:23.100 the level of cyber security resilience, I think 00:02:23.900 --> 00:02:26.067 what in your view are the key areas that 00:02:26.067 --> 00:02:29.100 businesses should focus on to reduce the likelihood of a 00:02:29.100 --> 00:02:31.800 successful cyber attack? I think if I was to pick 00:02:31.800 --> 00:02:34.500 the two areas, I'm going to focus on software and 00:02:34.500 --> 00:02:37.150 network, and the reason being every major cyber 00:02:37.150 --> 00:02:39.800 attack comes in one of two ways, one is a piece 00:02:39.800 --> 00:02:42.490 of software, a piece of malware, whether it's 00:02:42.490 --> 00:02:45.300 a backdoor vulnerability, or just an executable 00:02:45.300 --> 00:02:48.274 someone downloaded quick assist, or go to 00:02:48.274 --> 00:02:51.900 meeting from an attacker, so making sure you block 00:02:51.900 --> 00:02:54.127 untrusted software, making sure you limit what 00:02:54.127 --> 00:02:56.500 software can do in your environment, bear in mind 00:02:56.500 --> 00:02:58.704 every piece of software you run can see all of 00:02:58.704 --> 00:03:01.100 your data, so ring fencing technologies are really 00:03:01.100 --> 00:03:03.087 really cool for saying, okay this program can't 00:03:03.087 --> 00:03:05.200 see my files if it happens to be backdoor, whether 00:03:05.200 --> 00:03:07.081 it's a holiday season or not, it won't be able to 00:03:07.081 --> 00:03:09.000 access my data. The other thing is making sure you 00:03:09.000 --> 00:03:11.494 don't have open ports, shut down VPNs where you 00:03:11.494 --> 00:03:14.200 can, if you do have to have VPNs, make sure they're 00:03:14.200 --> 00:03:16.037 patched, make sure they've got limited access 00:03:16.037 --> 00:03:18.200 once they gain access to your environment, the amount 00:03:18.200 --> 00:03:20.878 of times I'll see someone get into a VPN then do 00:03:20.878 --> 00:03:23.500 a full network scan, gain access to servers, do 00:03:23.500 --> 00:03:25.774 remote encryption, again if you have a VPN it's 00:03:25.774 --> 00:03:28.000 probably to access one application, only allow 00:03:28.000 --> 00:03:30.650 it access to one application, so limiting open 00:03:30.650 --> 00:03:33.300 ports on your firewall, making sure your file, 00:03:33.300 --> 00:03:35.650 all those open ports are watched like a hawk, do 00:03:35.650 --> 00:03:38.000 regular port scans and make sure you're blocking 00:03:38.000 --> 00:03:42.800 untrusted software. And what about backup and recovery processes, I mean I know those are 00:03:42.800 --> 00:03:45.239 kind of considered to be old hat, but I mean 00:03:45.239 --> 00:03:47.900 we still we still need them. Backup and recovery 00:03:47.900 --> 00:03:50.448 isn't just about security, it's about things fail 00:03:50.448 --> 00:03:53.100 and when you're away for a long weekend too, if the 00:03:53.100 --> 00:03:55.100 power goes out no one's going to know the power's 00:03:55.100 --> 00:03:57.100 out and the UPS is probably just going to die and 00:03:57.100 --> 00:03:59.411 the server's going to shut down, you're more 00:03:59.411 --> 00:04:02.300 likely to have failure. Of course cyber crime is really 00:04:02.300 --> 00:04:04.701 about creating ransoms, making sure you don't get 00:04:04.701 --> 00:04:07.200 your data, if you can recover and restore your data 00:04:07.300 --> 00:04:09.219 having that in place is really really important as 00:04:09.219 --> 00:04:11.100 well, so make sure you've got a good backup, test 00:04:11.100 --> 00:04:13.352 that backup, but more importantly test the 00:04:13.352 --> 00:04:16.300 restore. What I'll always say is once a month go and do 00:04:16.300 --> 00:04:18.870 restores from your backup, quite often attackers 00:04:18.870 --> 00:04:21.600 will come in and change your backups to back up two 00:04:21.600 --> 00:04:23.924 terabytes of empty files, so you get your nice 00:04:23.924 --> 00:04:26.400 green backup report every month or every morning, 00:04:26.900 --> 00:04:29.176 but the reality is it wasn't successful because 00:04:29.176 --> 00:04:31.500 it backed up fake data. So testing your backups, 00:04:31.600 --> 00:04:34.600 making sure you've got good backup and recovery is really important as well. 00:04:35.200 --> 00:04:40.300 And how about automated response, something that kind of you know is going to just kick in 00:04:40.300 --> 00:04:42.127 even if somebody's asleep at the wheel or 00:04:42.127 --> 00:04:44.400 whatever at that time of the year, to kind of maybe 00:04:44.400 --> 00:04:47.078 complement the internal security team? Yeah actually and one 00:04:47.078 --> 00:04:49.800 of the things that has changed over the last two years is the 00:04:49.900 --> 00:04:55.500 speed in which attackers are I suppose causing impact. So an impact could be that they're 00:04:55.500 --> 00:04:57.331 encrypting your files or it could be that they're 00:04:57.331 --> 00:04:59.200 stealing your data. If we go back three years ago, 00:04:59.400 --> 00:05:01.898 attackers would come into your network or even a 00:05:01.898 --> 00:05:04.500 year ago and they'd look around, they'd do a scan, 00:05:04.600 --> 00:05:08.439 they'd do an IP scan, they'd enumerate 00:05:08.439 --> 00:05:14.400 privileges, maybe they'll create some admin accounts in the 00:05:14.400 --> 00:05:18.600 you'll see an admin account created, you'll respond, you'll see a privilege emulation, 00:05:19.000 --> 00:05:21.673 the SOC can respond. I saw an attack probably two 00:05:21.673 --> 00:05:24.400 months ago now, seven minutes from the moment they 00:05:24.400 --> 00:05:26.723 gained access to when they're exfilling data. 00:05:26.723 --> 00:05:29.200 So one of the things that we'll often suggest is 00:05:29.200 --> 00:05:31.142 creating automated response to tighten up 00:05:31.142 --> 00:05:33.700 security. So one of the policies I always recommend is 00:05:33.700 --> 00:05:35.689 in the event an indicator of compromise is 00:05:35.689 --> 00:05:38.200 triggered, you can't shut down a server automatically 00:05:38.200 --> 00:05:43.400 because the reality is 90% of indicators of compromise are false alerts, but maybe block 00:05:43.400 --> 00:05:49.400 admin tools. So if you go into my computer here and I went into PowerShell and try to 00:05:49.400 --> 00:05:53.300 enumerate privileges, I'll see PowerShell immediately close, I'll see command prompt 00:05:53.300 --> 00:05:55.428 close, I'll see registry editor close, I won't be 00:05:55.428 --> 00:05:57.600 able to open any of those apps within milliseconds 00:05:57.600 --> 00:06:00.213 that will happen. Now what this does is this 00:06:00.213 --> 00:06:03.300 means the SOC team now gets more time because you've 00:06:03.300 --> 00:06:05.700 just basically as an attacker had your hands tied 00:06:05.700 --> 00:06:08.100 behind your back. Quite often attackers will quit 00:06:08.100 --> 00:06:10.400 at that point. So if you can do that, if you're 00:06:10.400 --> 00:06:12.700 talking about servers automating, shutting down 00:06:12.700 --> 00:06:14.704 browsers as well, so no one can exfill data, 00:06:14.704 --> 00:06:16.800 shutting down of tools like Microsoft terminal 00:06:16.800 --> 00:06:18.631 services client. At the end of the day, if it's 00:06:18.631 --> 00:06:20.500 a false positive, as long as users aren't upset, 00:06:21.300 --> 00:06:23.406 it's not going to impact the business. But if 00:06:23.406 --> 00:06:25.700 it's an IT guy doing something, creating an admin 00:06:25.700 --> 00:06:27.473 account, enumerating privileges, they probably 00:06:27.473 --> 00:06:29.400 should have created a ticket and put a maintenance 00:06:29.400 --> 00:06:31.338 period in anyway. And if they didn't, hard 00:06:31.338 --> 00:06:33.600 luck, they're going to get delayed by 10 minutes. 00:06:34.800 --> 00:06:39.300 Sounds good. So any organization that's aiming to reduce its attack surface to an absolute 00:06:39.300 --> 00:06:45.300 minimum should consider getting an outside cyber health check to identify security gaps, 00:06:45.400 --> 00:06:47.900 the internal security teams may have missed. Would you agree? 00:06:49.200 --> 00:06:54.200 Absolutely. People often ask me, should I have multiple EDRs or should I buy this level of 00:06:54.200 --> 00:06:56.220 detection if I've got this? And I would say, 00:06:56.220 --> 00:06:58.700 look, the answer is always going to be, if you can get 00:06:58.700 --> 00:07:00.678 more security, you're better off. But it isn't 00:07:00.678 --> 00:07:02.700 really a case of should I have multiple EDRs or 00:07:02.700 --> 00:07:07.700 an antivirus and an EDR or a detection response on the network and the client. The answer, 00:07:07.700 --> 00:07:10.900 the question should be, would I be better off spending my money elsewhere? 00:07:12.000 --> 00:07:14.005 And quite often, I would always say, once 00:07:14.005 --> 00:07:16.500 you've put in basic controls, once you think you're 00:07:16.500 --> 00:07:20.500 secure, once you've got untrusted softwares blocked, once you've got an EDR in place, 00:07:20.700 --> 00:07:22.579 once you've automated your tools, have it 00:07:22.579 --> 00:07:25.100 tested. One of the things we'll actually do, this is an 00:07:25.100 --> 00:07:27.100 automated test. I think human tests are great as 00:07:27.100 --> 00:07:29.100 well, but we'll actually give you a report every 00:07:29.100 --> 00:07:30.837 day. It's called a defense against 00:07:30.837 --> 00:07:33.800 configuration report, where it will show you 170 checks on 00:07:33.800 --> 00:07:36.024 endpoint every day. Do you have these security 00:07:36.024 --> 00:07:38.200 controls in place? And we can do that even if 00:07:38.200 --> 00:07:42.700 you're not a customer. We can just do a free trial and show you what that looks like. 00:07:43.400 --> 00:07:46.381 So in the UK, for example, there is the National 00:07:46.381 --> 00:07:49.300 Cyber Security Center, NCSC, that offers a kind 00:07:49.300 --> 00:07:52.079 of checkable cybersecurity service, which is a 00:07:52.079 --> 00:07:55.100 free government's tool for UK organizations to run 00:07:55.400 --> 00:07:57.613 simple external checks on common 00:07:57.613 --> 00:08:01.900 vulnerabilities. But in terms of sourcing other health checks, 00:08:01.900 --> 00:08:07.500 what would your guidelines there be? I would assume that there are some things that they 00:08:07.500 --> 00:08:13.600 should avoid. Well, so I think being careful about, don't just download health checks on 00:08:13.600 --> 00:08:16.122 your machine. Make sure you trust the vendor. 00:08:16.122 --> 00:08:18.700 Make sure they're reputable. So I would always 00:08:18.700 --> 00:08:22.000 say you want an external pen test. We have multiple external pen tests in ThreatLocker. 00:08:22.100 --> 00:08:25.600 We have them organized by our CIO, but we also have them organized by the business side, 00:08:25.800 --> 00:08:29.500 the financial side, to make sure that the CIO isn't even necessarily testing. So having 00:08:30.500 --> 00:08:34.400 advanced paid pen tests is always a good idea. Unfortunately, it costs money. It could be 00:08:34.400 --> 00:08:37.874 $5,000, $10,000. It's not, or pounds. It's not 00:08:37.874 --> 00:08:41.500 necessarily cheap. But even free health reports, 00:08:41.600 --> 00:08:43.580 we'll do free health reports. We'll show you what 00:08:43.580 --> 00:08:45.600 software. There are good cybersecurity vendors out 00:08:45.600 --> 00:08:47.318 there and say, this is what you're running. This 00:08:47.318 --> 00:08:49.000 is what your risks are. And just have a look at 00:08:49.000 --> 00:08:51.380 them and see if you can get rid of them. And 00:08:51.380 --> 00:08:54.300 quite often, 90% of the risks found on a health report 00:08:54.300 --> 00:08:59.200 by you configuring your system properly, they can go away with no cost to you. 00:08:59.800 --> 00:09:01.965 And they're just going to harden your 00:09:01.965 --> 00:09:05.300 environment and not even bother the user because the user 00:09:05.300 --> 00:09:09.200 aren't using most of those configurations anyway. Great. Thanks, Danny. So in summary, 00:09:09.300 --> 00:09:13.200 the ways to reduce the likelihood of becoming a victim of a cyber attack at any time 00:09:13.300 --> 00:09:18.200 is to close any known gaps to reduce the attack surface of the organization. One, 00:09:18.200 --> 00:09:20.384 by controlling what applications are allowed to 00:09:20.384 --> 00:09:22.800 run in your business IT environment and what they're 00:09:23.000 --> 00:09:25.689 to do. Two, by controlling who has access to 00:09:25.689 --> 00:09:28.500 what under what specific circumstances and for 00:09:28.600 --> 00:09:31.235 defined periods of time. Three, by ensuring 00:09:31.235 --> 00:09:34.300 that you have tried and tested backup and recovery 00:09:34.300 --> 00:09:36.827 processes. And four, by ensuring that you have 00:09:36.827 --> 00:09:39.300 24 by seven monitoring detection and response 00:09:39.300 --> 00:09:44.900 capability, supplementing internal capabilities with external services when necessary. 00:09:45.300 --> 00:09:47.900 Any closing thoughts from you, Danny? No, I think 00:09:47.900 --> 00:09:50.500 that's really it. Making sure you put those basic 00:09:50.500 --> 00:09:52.332 controls in place, closing network ports, 00:09:52.332 --> 00:09:54.700 making sure you close internal ports as well, because 00:09:54.700 --> 00:10:00.700 untrusted devices on your own network can be a big problem. And having that 24 hour a day, 00:10:01.300 --> 00:10:03.513 it's really important because you want a 00:10:03.513 --> 00:10:06.500 service that doesn't go home on Christmas Eve and say, 00:10:07.200 --> 00:10:09.150 unfortunately, we have a whole bunch of people 00:10:09.150 --> 00:10:11.100 here in ThreatLocker that work 24 hours a day. 00:10:11.200 --> 00:10:13.450 Well, they don't, but the team does. And they 00:10:13.450 --> 00:10:15.700 get to work on the Christmas shift. It sucks, 00:10:15.700 --> 00:10:20.600 but for them, but it means that someone's watching your systems when you're at home, 00:10:20.700 --> 00:10:22.888 enjoying your holidays. Thanks, Danny, for 00:10:22.888 --> 00:10:25.700 joining us and sharing your insights into the key ways 00:10:25.700 --> 00:10:30.500 businesses can reduce their attack surface throughout the year and not just during the 00:10:30.500 --> 00:10:34.700 holidays. And thanks to you for watching. We hope that you found it useful. Thank you.