Building an Incident Response Team (Before You Need One)

When you need your incident response team, it's too late to

build your incident response team.

Yeah, we've been gone a few weeks.

Sorry about that.

My life got turned upside down for a bit, but we're back.

Prasanna, Dr. Mike Saylor, and I are talking about building an incident

response team before you actually need it.

We talk about things like who's in charge, who decides which app comes

back first when everybody's saying that theirs is the most important one.

Why do legal, PR, finance, and your cyber insurance company

all need to be at the table?

Also, why should your outside incident response team already

have a signed retainer?

We get into all of this on this week's episode.

If this is your first time watching or listening to me, I'm

W. Curtis Preston, AKA Mr. Backup.

I've been obsessing over backup, recovery, and now cyber recovery for over 30 years.

If that's your bag, I'm your guy.

You're not gonna find anyone that cares about this topic more than me.

Ever since 1993 when I had to tell my boss there were no backups of the

production database we just lost.

Now I've written five O'Reilly books, a blog, and now this podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up.

Hi, and welcome to The Backup Wrap Up.

I'm your host, W. Curtis Preston, AKA Mr. Backup.

We're back after a little bit of a break, and I have with me, the guy

who I hope goes to battle with me, against, Gemini, Prasanna Malaiyandi.

How's it going, Prasanna?

I'm good, Curtis.

I have no comment on your battles.

I wish you the best of luck, but that is a fight you will have to fight on your own

Yeah, So Gemini, Gemini let me down, Prasanna.

I was was using it to do some stuff for the podcast and then right

at the crucial moment Gemini's "What? What are you talking about?"

Yeah, no comment

it was like it said, "Hey, I'm focusing on the artificial part, of the

intelligence." so artificial I couldn't find the outline that we were looking for

and of course we have with us my co-author from, Learning Ransomware

Response and Recovery, Dr. Mike Saylor.

How's it going, Mike?

Doing well.

Hey, guys

are you having a better week than me?

I'm having quite the week

it's been a week.

haven't had any car damage or anything, in the real… It's all

been, it's all been, just work related

I've spent, way too many hours in a tire repair facility, due to a, sadly

a cracked rim, which I'm guessing we're blaming that on potholes.

But, luckily, replacing rims on a Tesla, super cheap.

So, um, I kid,

that sarcasm I sensed there, Curtis?

sarcasm

to come in.

of the weak.

Yeah.

so I, yeah, I had to go with aftermarket rims 'cause I wasn't

spending, It was, like, it was, like, close to, $900 or something on a rim.

I was like, "No, thanks."

So anyway, we are here to talk about,

cars, more cars?

at least, when you think about what was going on with me, I have a team

of people that I can, that when I have a t- when I have a tire problem, I

can bring my car to these people, and these people will take care of it.

I don't know squat about tires.

So I got a team of people to do that.

And that's what we're gonna talk about here today, is building a team of people

to help you when it's time, and notice I said when it's time to have an incident.

and just for clarification, this is like a real team, not YouTube University

or one of those things where you learn a bunch of information and that's it

Yeah.

you don't want to, be responding to a cybersecurity incident the way

that I respond to, let's say, an odd thing happening in my house, right?

and, Prasanna is right?

I'm gonna pull up YouTube, I'm gonna watch a bunch of videos, then at some

point in those videos, I'm either gonna say one of two things: "I can

do this," or, "There's no way I'm gonna do this." And and then I'm gonna

call, I'm gonna call people to make it

happen,

Anyway, Mike, what's your opinion about, the importance

of a incident response team?

the most important part is knowing who they are.

you don't wanna assemble that team when the house is on fire, 'cause you may

spend a lot of time trying to recruit somebody that just won't participate

or is the wrong resource to begin with.

So preparation is definitely key, when together a incident response

team and getting the buy-in and dedication and accessibility of the

people that you're gonna rely on

Before we talk about the team, maybe it might be helpful to talk about

like what is incident response and why do I even need a team to start with?

And so something happens and you need to, one, figure out like what happened, how to

stop the bleeding, and then try to figure out what went wrong and how to recover.

And so the incident response team has different skill sets

amongst different people, right?

If it's a cyber recovery targeting things, you might need more tech people.

If it's some other type of incident, maybe it is a different set of folks you need.

it's just physical bandwidth.

not one person or even maybe even a couple of people could truly,

put out the fire in a timor.

and like fire, time is of the essence.

The faster you put the fire out, the, the less likely it's gonna spread.

So you wanna contain it, you wanna extinguish it, then

you wanna do some triage.

How did it happen, and how do we prevent it from happening again, and

how bad was the damage, and so on.

so the ability of one or just a couple of people to do all that, efficiently

and effectively is pretty rare.

and wouldn't bet on that even on our team.

I would want to know that I've got this pretty good list of people,

resources, skills, 'cause you never know what kind of fire it's gonna be.

that's why there's different classes of fire extinguisher, right?

there's dry fire extinguishers, there's wet, there's gas.

and so you have to assess what kind of incident, what kind of

fire it is, and then from your list of resources, you assemble the

right team, to tackle that problem

maybe it's, a terrorist attack.

Maybe it's a fire.

Maybe it is an actual fire, right?

I think immediately about the OVH fire, right?

th- there are just different people that are gonna have different skills, some

of which might be, they might just be really good at ordering stuff, right?

the, it's definitely a skill, especially in today's world, there's, it's a real

skill of acquiring new equipment, right?

because it can… You could go and say, "Okay, I need, I need 15 Dell

ABC 123s," and Dell's yeah, you can have those in two weeks," right?

Or six weeks or whatever, right?

so there are people that have been dealing with those scarcity issues right

now, and they're really good at it.

So in a case of a fire situation or a flood situation where the actual

equipment is physically damaged or completely obliterated, then that team

is going to be different than a team, a cyber team where the servers are

fine, everything's fine, it's just, they don't work, the way they used to.

All right.

and, we've been talking about, we've been talking about fire, and again, going back

to that, when you think about, I don't know about you guys, but I watch a lot

of TV, and I watch a lot of like "911" or, going all the way back to the '70s.

Wasn't that "Emergency," Mike?

W- that was, it was "Emergency," wasn't it, back in the day?

and one of the things that you see in that, in that world is you have a

concept of a fire team, and you have the concept of a probie, and you have

a concept of when they get to a fire, everyone knows what their job is, right?

you're, you got the guys whose job it is to find the fire hydrant.

You got the guys that are to hook the hose up to the fire hydrant.

You got the guys whose job it is to identify the, the hot spots of the fire.

and just like this, they do not figure that out on the spot.

They do training and they identify who these people are.

They do training.

as a Navy veteran, I can tell you that we went through training.

and, th- like you've heard, every Marine or rifleman, every

s- sailor is a fireman, right?

Because, when you go out to sea, i- if something bad happens, y- gotta know

what to do with a fire hose, right?

Didn't you have to deal with the fire on a ship once?

I did.

we don't have time to tell that story, but I participated in fire that many

would say was one of the top 10 worst, fires in the history of the US Navy,

where we dump- we accidentally dumped 10,000 gallons of jet fuel into the

boiler room, where as the citation goes, where there were a number of things

in excess of the flashpoint of JP-5.

we fought that fire for 29 hours right off the coast here.

good times back in 1988.

Feel free to look up the story of the USS Constellation.

Also I, would say that incident response is, it's not really, it's not as much like

of an IT problem, it's a business problem.

There are many things that are going to be taking place that, I… the IT part,

the cyber part is a part of it, the recovery part is part of it, the potential

ordering of new equipment is part of it.

But that, those are just parts of the overall thing that's happening,

which is a business problem.

There's also things like, having to respond the public, right?

you're having to notify the public of what's going on.

we've talked about that, I know, in the past on the podcast, where it's like it's

equally important to, that you keep your customer base and even just interested

parties aware of what's going on, because how you notify the public i- is going to

be pers- it's going to change how the, the incident is perceived, and that is

also part of the incident response team.

You have, you look very,

like you're

I…

thinking, Prasanna.

no.

I, as you were talking through, I was just thinking it's like a business, problem,

but I think, the incident response part itself where you're gathering these

people and they have their different jobs and other things like that is really,

the process you go through in order to solve the business problem that is

there where everyone is coordinating amongst all these various things.

But you have, that process defined, right?

It's if we need to do X because we got hit with, ransomware, here are

all the people that are involved.

Here are their roles and their responsibilities and what they're

targeting, and here's a person who's going and communicating with external

stakeholders or with the cyber insurance company or with executives, and legal

counsel and everything else, right?

So it's like bringing all these various people together who have

different expertise into a process in order to solve that business problem

Yeah, and that would be the incident response plan, right?

and then th- this is the team that's going to enact that.

And by the way, just, the other thing to just drive this home, the thing that

we… the, the whole core concept of the book was that there are a number

of books you can go get to tell you how not to get ransomware, right?

Or how not to get a cyberattack against you.

And our book is like, "You're probably gonna get ransomware." So

like statistically speaking, it's probably gonna happen to you, and so

you need to be able to… You need to prepare to be able to respond.

And let's start talking about, s- the core roles that we talk about when we're

building an incident response team.

Mike, you wanna lead there?

Sure.

I've got a funny story real quick.

I- you'll probably cut this out, but I w- I was on the Russ Martin Show years ago.

I don't know if you remember that guy.

he was a radio disc jockey in, in Dallas for a while, and

then just started a, a, a show.

And, they called me to ask about ransomware and, along the… during

the conversation he asked, what kind of things can we do to prevent

ransomware?" I told him to stop going to porn sites, and they hung up on me.

a- anyway

That's pretty

All right

that's solid advice for The record.

Solid advice

The same advice I gave some military officers.

But, yeah, so as far as developing the team, you wanna start with

your subject matter experts.

So you've got a, you've got a leader, and that leader can be,

situational.

and as a leader, I may say I'm in charge until I figure out that I'm not

the right person to be in charge, and that's really the right leader you want.

but then who are all your subject matter experts?

You want your network person, your system person, your backup person, architecture,

apps, database, on the technology side.

that's aware and can reach out to all your vendors.

and then I wanna go back to something you mentioned earlier, that a lot of

incidents aren't just an IT problem.

Business almost completely runs on technology within an organization,

so if IT's having an incident, it's gonna affect, affect or

impact the business to some degree.

and that's gonna drive like urgency and prioritization and some of that stuff,

and that's key too if you don't al-also already have subject matter experts from

the business side, then you're gonna get people calling you left and right telling

you their stuff is more important than the other people's stuff, and you've

gotta prioritize this and things that way.

which all goes back to making sure that you've done your diligence and

your homework on preparing how to, at least at a high level, respond

to an incident and who should be involved and who the key people are.

N- you talk about the, another thing that i- is really key here to dealing with

the situation that you just mentioned is that i- in addition to having an in- an

incident response coordinator or a person that's in charge of the incident itself,

you also need have previously identified who are the business people, who are the,

the executive sponsors of this event?

who is the person that we have to listen to, right?

And who are the people that if they call, we get to say, "You

go call that person," right?

I, I definitely remember I've been in incidents where in the middle of

those incidents, we're getting, just like you talked about, like competing,

instructions from different people in terms of my application is more important.

this is why we have a plan.

The plan in advance, we've already had all those discussions, hopefully.

We've al- already had those discussion about which applications

need to come up first, both from a technological perspective and

also a business perspective, right?

So like for example, we might decide that, Active Directory

has to come up first, right?

DNS has to come up first or second or whatever, because nothing

else is gonna come up, right?

But then there are business decisions of this particular part of the company has

to come up first because it's costing us X number of dollars per minute.

And if there is a decision that needs to be made in the moment where, based

on something that's going on with the business, that decision might

be made on high, and it definitely can't or not be made down here, right?

Even if you're the person in charge of this incident, you're not in

charge of the company, right?

and so it's really important to have executive sponsorship and a

person identified, back at the, at the executive level that we can

point to and, and to support us.

Any thoughts there?

Completely agree.

And capture all of that in writing.

and one of the easiest, I guess mo- almost fundamental things that you

should do, you've already got your asset list all your servers and applications.

a column that who's the, who the owner is of all, the IT owner and

the business owner, and their contact information, not just their email

address, but their phone number.

And there are certain cases where getting pre-authorization to do things

in a, critical moment will spare you the time of reaching out to those people.

for example, if the web server has ransomware, do I need to call the

owner, the business owner, and say, "Hey, I need to take that down, rebuild

it, 'cause it's gonna get worse"?

can I call them today and walk through a couple of critical situations and get

their pre-authorization to do X, Y, and Z?

Capture that in writing, and now you've got a playbook that says, "When these

things happen, just do it. get it done."

I have two questions.

the first is, do you normally have a incident lead for different types

of incidents , or is it just an incident lead at a company and all

incidents go through that one person?

So there can be, I, I'm trying not to say the word.

it, there can be more than one person, and sometimes it makes sense.

But usually there is coordinator, the incident commander, coordinator.

They're the ones that is… They're the buffer between the business and IT.

They're the ones that are, they're translating, they're setting expectations,

they're communicating, and they're keeping the business off of the people

that are trying to put the fire out.

much like the public liaison officer, for military law enforcement.

they're the face to the business side so that, "Don't look behind the curtain.

don't worry about what's going on back here.

It's gonna be okay.

and your next update will be in an hour." so that's the incident

commander, or coordinator.

And then you've got one to many leads because you may have, a situation

where this problem is so big, it's an infrastructure problem, it's a

database problem, it's a, data recovery problem, and you could have leads in

all those different areas that are

coordinated by, one, one additional, layer above them

I'd say the bigger you are as a company, the more likely it is you're

gonna have different people, right?

I, I pity the fool, t- that's at a small company and all of

these heads are you, right?

And we're gonna get to, one of the ways to ameliorate that, in a minute.

But bigger you… the more you can, Mike started out by talking

about subject matter experts.

The more you can have, the database person in charge of the database

situation, the backup person in charge of the backups, right?

The more you can have that available, because they're the ones that are

most equipped to deal with the weird things that they might encounter.

and, and I'd say th- there's no more position where that's relevant or

important than that, than the cyber one, because the, backups and recoveries,

they're, upfront they can be a lot of… They can be quite different,

but in the back end in a restore, most of them are very much the same.

it, but cyber is not at all, right?

Where, y- the, you've got this… All you know is something's going on.

Somebody's in the, in the woodwork.

and, we're not quite sure where they are, we're not quite sure who they are,

we're not quite sure what they're doing, but we know that something's going

on, and you've got to have somebody that really knows how to do that.

so that, that person is definitely, really important to have.

another group, speaking of the business, when we talk about, the,

the business, one of the other areas that we need are… two areas really,

and that's legal and then PR, right?

So legal is going to get involved in things like deciding whether or

to not to pay the ransom, right?

and w- what are the legal implications of that?

What are the legal implications of, let's say we've got an exfiltration

situation, and they've given us the proof of life that they have our data,

we now know what data they have, and legal can help make deter- de- the

determination this is something we care or don't care or, they know what

the, the impact of that is gonna be.

Was that

And I think also in some cases, like this is a very trying time for a

company, and so you may also want legal there in order to provide the advice,

legal advice and guidance and sort of the attorney-client privilege as

these discussions are happening, right?

Versus just being amongst like executive leadership or other things like that

Yeah, I completely agree with that.

there's several roles that you've mentioned that legal fills.

that attorney-client cl- attorney-client privilege is one

that we're seeing more these days, especially when you're engaging

outside resources to help you respond.

they want all of that to include the legal, team so that they

can put that under privilege.

one of the other areas is, compliance.

and so as the, the team is responding to the incident and providing feedback of

about what happened and been impacted, whether it's data or systems or, is it

an outage or a breach, it's on legal and the compliance team to determine if

that's a reportable incident and, the timing of that and the messaging for that.

and it's not just to, I, I guess to expand on that, it's not just

compliance for as far as messaging goes.

Even with PR involved, it's usually legal that's gonna to help massage, the language

around what we tell, third parties

Yeah, and that's gonna b- that, that is gonna be 100% based

on your jurisdiction, right?

I know, and obviously there are different types of data like HIPAA

data that have… and I could really only speak to the United States.

I'm sure th- I know like there's GDPR, that governs some of

the same kind of concepts.

But I know here in California, for example, if you, if customer data is

exposed, then you have a, a duty to inform within a reasonable amount of time.

reasonable is not defined.

But, And so yeah, you've gotta make sure that you're doing the,

what's, what is appropriate from a compliance perspective, right?

and speaking of which, we're talking about PR.

Outside of compliance, again, it's a matter of how do we properly

communicate this and how do we not communicate it, right?

We… I know Prasanna, we talked a lot on the

I w- I was just, I was thinking about

ahead.

space.

Ouch.

Yeah, that was a lot, right?

you have this desire, if you're somebody who communicates, with the public, like

your job is to make the company look good, you have this desire to minimize

the, the, the impact of the event or the, the, the perceived impact of the event.

actually the one that I'm really thinking about is actually, LastPass, right?

and it's like, "Well, they got the thing, but they didn't get the thing.

Well, they got… well, okay, well, they got the thing, but they didn't

get the thing. And then, well, they got the thing, but they didn't do the

thing." Yeah, they did all the things.

They got all the things and they did the thing and, and they just

kept, like revising the story.

the common phrase, and Mike, I'm sure you've seen this in so many

incidents, the common phrase is, "There is no evidence that customer

data has been accessed," right?

that's not the same thing as saying customer data has

not been accessed, right?

We do not yet have evidence that customer data has been accessed,

and so that, that's okay to say that until the evidence changes it.

But if you like, if you just come out and say, "Hey, customer data has not

been accessed," in the case of like LastPass saying vaults were not accessed,

it turns out they were accessed, right?

they're like, "Okay, they were accessed, but, it was encrypted, so they're probably

not gonna be able to get the stuff." okay, what we meant by that was, you don't

wanna have to keep re- replying that.

So you need somebody also on your team from a PR perspective that understands

those, those, nuances, right?

and, and then, we have finance on our list.

Why would finance be part of this, Mike?

Understand the impact of the incident.

how much are we losing an hour, a day?

How much did that thing cost?

How much money do you need to replace it?

Again, something also you should have pre-authorized.

but yeah, the, gonna know this, what the impact of this

incident has on the business

So I know in past episodes we've talked about cyber insurance and they come

in, they help you out, and there's a policy to help offset some of these

costs as you're looking to recover.

Is that coordinated by finance, by legal, by the incident response

commander, like all the above?

how does that flow with that external party?

It's usually compliance.

and so in, in larger companies, it's just called risk management.

So that's risk, compliance, insurance.

so from a traditional sense, risk is covered by insurance.

other organizations, it's either legal or actually somebody in IT as far as

vendor management goes, that would also manage the, insurance policies.

one of the things that, that we always recommend is include your insurance,

contact in your tabletop exercises, that helps you then learn what the expectations

are from insurance as to when, they want to be notified and how they want

to collaborate during an incident, even if it doesn't turn into a claim.

It's not like car insurance where you call and say, "I think I had an accident

that might-- I might need a claim." They're like, "Oh, really?" and so

it's not as, as bad as auto insurance.

corporate insurance is very helpful.

They'll actually give you some good tips and maybe even guidance, even

if it doesn't turn into a claim.

they'll work with you during an incident

and they also would have somebody that you can work with, during the incident, right?

To assist you in things like, negotiating if you end up having to

pay the ransom, negotiating the ransom.

This is somebody that, that obviously they want to negotiate

it down as little as possible.

and so you might have competing interests there, but this-- whoever that is,

we're talking about building the team.

Whoever that is, whoever your cyber insurance is, whoever your contact

is, you need to all of that, upfront.

And then, I'm going to, I'm gonna tackle this one, the next one, because otherwise

it would be, Mike promoting himself.

You also need, you need a third-party incident

response team, a blue team, as it were, right?

There's the blue teams and the red teams, right?

The blue teams are defense, red teams are offense.

And I very much… this is one of those things where don't

try this at home, kids, right?

is a professional driver on a closed track, whatever, whatever

analogy you want to use there.

the, the stories that I've heard from you, Mike, in terms of the, all of

the weird different ways that manifest themselves, then the way you respond

to those incidents really in the moment very much depends on your knowledge of

how, you're like, "Oh, we got this file.

That file has that extension.

That means this particular ransomware variant, which means that we're

dealing with the so-and-so group.

So this is how… And we know how they do, we know how they deal with things

because we've dealt with them before." only way you're gonna get that kind of

expertise is through in the field, in the trenches, and so that's why I do believe

strongly in having a team like yours, Mike, which is Black Swan Cybersecurity.

Mike is the CEO there.

And, bring, bringing you in, and again, we're talking

about building team up front.

This is part of the team.

Bring them in.

Do, there's this, this concept of a zero, zero dollar purchase order, right?

Create that relationship now.

maybe there's a retainer.

There probably is a retainer.

and then just have them, on speed dial so that in an incident, you can call them.

you wanna anything on there, Mike?

Sure.

That was great, Curtis.

I have nothing else to add.

the $0 retainers are a real thing, especially with law firms.

because, with law firms, they gotta, they have to do deconfliction

and some other things just to get all the paperwork out of the way

before they can even advise you.

so a lot of them offer $0 retainers just to start the relationship

and have all of that done.

And very similarly, incident response firms like ours, we would a retainer

in place also so that when you call us, we can start right then,

not five or eight hours later.

and then the other comment I was gonna make, as far as building

your incident response team, and Curtis touched on this, that team

doesn't have to be your employees.

we have several clients whose 100% of their incident response plan is call Mike.

and that's okay because they've identified they've, they have no internal resources

or bandwidth, and they need help.

and that incident response plan, just to wrap that thought up, doesn't

have to be everybody inside your organization, but somebody has to

be responsible for making the first, the first phone call and declaring it

an emergency and that kind of thing

Yeah.

And Curtis, going back to what you were saying about, okay, you should outsource,

I think even if the company was… had the subject matter experts in-house, it

still might be beneficial to still have a third-party incident response management

team on call just in case, like you may not know the latest and greatest of

what's going on or other things like that.

Or maybe you realize, "Hey, this is something that's like outside of my zone

of comfort." And just having someone else you could talk to, you can, spitball

ideas or thoughts around, and all the rest could be beneficial even if you

think you or your team is prepared.

Absolutely.

and

the…

so remember, while you're putting the fire out, you've also gotta keep the lights on.

So if you're a one-man shop or a, a shop that's already stretched thin

with resources, you need some backup so that when that incident happens, the

rest of the business doesn't shut down

I like that.

Yeah.

And so this is an idea of something that you could actually hand over

to a third party, so that you can, like you said, keep the lights on.

I like that.

I… earlier I made the comment that the bigger you are, the more likely

you are to have specialized people for each different, discipline.

I would say the opposite of that is also true.

The smaller you are, the more likely you're just gonna have one

person, and then your IRT is call Mike, just like Mike said, right?

or whoever it is, right?

There are, there are, companies, like Mike's that… But the idea is identify

who that is, create that relationship now, and so that you can just make a

phone call, during, during an incident.

Your insurance company will have a list of pre-approved vendors of

different skill sets, forensics, response, remediation support, all that.

So call them too, they're a good resource

And that would be something that would actually be potentially, I'm sure it's

gonna depend on your policy, potentially be covered by that, that, policy, right?

Yeah.

so here's one that I know that you're gonna wanna chime in on, Mike, and that

is, a relationship with law enforcement.

'Cause I know you're big on

For,

so

for sure.

Every incident that we work, we always ask if they're open

to, involving law enforcement.

there's a lot of benefit to that, and I'll cover those first, and

that is that they're gonna bring their exposure to similar incidents

at oth- in other organizations.

So how did this happen?

how did it go?

how did they recover?

did they pay the ransom?

How did that go?

Did they not pay the ransom?

What were the repercussions?

All that stuff law enforcement will share with you.

they will expect some collaboration.

"Hey, we, we're here, we'd like, a copy of that evidence also." 'cause

that's going to their case file and help them track down these bad guys.

and then tools, and possibly even solutions.

And a- an example of a solution would be company A gets hit with

ransomware, they paid the ransom, they got the decryption key, and then

you get hit with the same ransomware.

The FBI, as an example, may give you that ransomware key that the other company paid

for to see if it helps you you pay the ransom or before you spend a whole lot

of time trying to recover on your own.

one of the things that law enforcement does not do is guarantee that

they're gonna get your money back or that you're-- they're gonna

clean your data off the internet.

They don't do that.

and I've been in a lot of incidents where the, the victim said, "Yeah,

I'll work with law enforcement only if they help me get my money back or

they help me, they're gonna prosecute, they're gonna catch these bad guys."

they're not gonna sign up for that.

if they're able to, great, but they're not gonna, they're

not even gonna talk about it.

Mike, I know sometimes, there are restrictions in terms of I

know we've talked about on prior podcasts, like who you are allowed

to pay ransomware to depending on sanctions and other things like that.

Do you find that some companies are cautious to bring in, the

feds in order to help them out because of those sort of concerns?

No.

for a couple reasons.

One, paying the ransom is not something that you're probably gonna be able to

do on your own, that's simply because we don't, most of us, 99% of us don't

have, just extra Bitcoin laying around.

and so i- in a lot of organizations, your ransom isn't $10, it's,

hundreds of thousands of dollars or a million dollars or more.

And so now you've gotta go out and get, source your Bitcoin

for that amount of money, and that's very difficult and timely.

to source a million dollars in Bitcoin's gonna take you a- about a month, and

most ransomware gangs give you a couple of days, maybe 10 days at the most.

can… we've strung one out about 10 days, just the back and

forth trying to buy some time.

the other part of that is we're gonna engage insurance.

Insurance is the one that's gonna negotiate the

உம்

hopefully with their own negotiators, not a third party like the guy in

Canada that was actually working with ransomware guys and getting a cut of it.

I don't know if you heard that in the

Yeah

Yeah

but the insurance company's gonna deal with it.

So anyone other than you dealing with the ransom is gonna be responsible for making

sure that who they're paying isn't on the, the restricted payee list, the OFAC list.

and it, and that, that's tricky also 'cause, bad guy A is supported by bad

guy B, who has a shell company that's funded by someone on the OFAC list.

How in the world are you gonna know that?

Right

but involving law enforcement, they're not gonna get into

your transactional business.

They're looking at the technical aspects of the incident and what

happened and how they can help, and what information they can collect.

If you ask them, for help, with the ransom and ransom negotiation, they will help,

but they're not gonna inject themselves

Okay.

that

So it's not like the TV shows and movies where there's a kidnapping

and the FBI comes and they're like, "We will handle them. Drop." And then

they swarm everyone and all the rest, and things always end up going bad.

and the reason for that is because of their priorities.

that's a human kidnapping.

That is a priority.

They will take jurisdiction.

They will take lead on that investigation once it's reported to law enforcement.

Similarly, in an incident response, if your incident turns out to be part of

one of their priorities, like terrorist funding, terrorist activity, then yes,

they're gonna get a little bit more in your business because that truly does fall

in some of their focus areas, and they'll, they will wanna get more involved.

But at the same time, they're not just gonna start taking stuff and doing

stuff, but they will start asking a lot of questions and want some answers

Now earlier, M- Mike, you used the acronym, OFAC.

That's the Office of Foreign Assets Control, and they maintain a list

of basically entities, typically government entities, right?

and no, they're not government entities, right?

they're terror- They're basically businesses that are connected with, I

stuff

terrorist organizations.

Is that, is there a better name there?

Just bad stuff.

It's not all terror.

Yeah,

Yeah, bad stuff

yeah.

and paying people on that list is a crime.

or I guess I should say

We,

be a crime.

yeah, it can, be a crime

you can file an exception with the Treasury, but that takes time.

and you don't wanna do it after the fact.

You don't wanna pay it and then file the exception.

You wanna file the exception and then hopefully they'll fast-track

it, and there are some organizations that, that they will fast-track

it, but still it's days of…

And it's mo- most of these happen over the weekend, and so you're not gonna get your

exception in to somebody until Monday, and so you're already a couple days behind

is not one of those, better ask for forgiveness than ask for permission?

It's, yeah, it's not one of those, huh?

All right.

no.

Not unless you like wearing jumpsuits and flip-flops

So the final thing on our list is, of course, vendors, right?

the, you need to be aware of who it is from a vendor perspective

that you're gonna call.

You need to know, what vendors you're using, if this is part of your asset list,

the services that you're gonna be using because again, they are also going to be

experts in their particular discipline, and that Can come into, account quite

a bit during, during an incident.

about vendors, though.

One interesting question is I know you probably wanna use the same

vendors that you have, but say for instance, Curtis, you brought up the

point that, you need tel- 10 Dell servers, and the person is, they don't

have it available for two months.

As part of the vendors, do you start to reach out proactively to other

vendors who might be able to supply maybe not a Dell, but maybe a Lenovo

or some other system that could satisfy those needs, even though you may not

currently be using it, but at least so you have those contacts established?

Definitely falls

I agree with that.

category, right?

establish,

add one more thing on the vendors is don't just have a list.

Actually talk to them.

Yeah

call your vendor contacts and say, "Look, I know you're an 8:00 to 5:00

guy, but when I have a problem on the weekend, who do I call? Do y'all have

an incident response team? Do you have a hotline?" figure all that stuff out

today, because if you don't, you're gonna be calling Bob, and he's not

gonna answer his phone on Sundays or Saturdays or whatever it is, and you

may have to go to that fallback plan.

if you've put some thought, forethought into that, that's a great idea

And then just a final thing here is this needs to be a real list, right?

This is not just something, we sat around and we're like, "Yeah, we should

probably have legal there, and we should probably have…" This needs to be a

recorded, written down list of people.

And also, don't forget the deputies, by the way, right?

Because, Curtis is going on vacation, and, isn't gonna be answering his phone.

And,

assistant coach?

yeah, exactly, right?

and then also, now, then once you have the team, this is also what tabletop

exercises, which we've talked about quite a bit before, this is when you get

that team involved, just like you said, bringing in the insurance, the cyber

insurance people as part of that tabletop.

but you can't have the tabletop if you don't know who the team is.

Identify the team up front, and then, bring them in.

Any final thoughts, Mike?

My final thought is to make sure you train on it.

having everybody go, "Yeah, sign me up. I'll do that." once

a year, we're gonna do that.

Yeah

let's sit around a table or hop on a Zoom call.

I've done so many that are virtual now.

There's no excuse to not go through an hour or two once a year to make sure

that you've actually walked through a problem and gone, "You know what?

Maybe I'm not the right person for that," or, "The phone number I have

for that person isn't right," or, "That person left," or whatever it is.

Walk through it, and that's when you're gonna start to identify things that

need to be updated, changed, or added

Yeah, and, the other thing is, again, this is about fostering a sort of a,

of this, of cybersecurity, culture of, defense and, and keeping current on

the things that are happening, right?

you look at, just something as silly as what happened to me at

the beginning of this episode.

I was trying to find… I've got a list of topics that we

were supposed to be working on.

I haven't done this for a while.

We took a little break, and, suddenly, the tool that I've been using to

help me maintain that list, it changed how it worked in between,

and, I was caught flat-footed.

Don't do that.

Don't do that to yourself.

the more often you can do this, the more often you, you refresh

and you keep current on the way everything works, right?

and you keep your brain working.

And, what about you, Prasanna?

Any final thoughts about building your IRT?

No, I think you and Mike covered it.

The only thing I was gonna chime in on was like, yeah, thing-

this list shouldn't be static.

Your team sh- isn't static, right?

It is gonna be constantly evolving and changing.

As people come into the organizations, you start handling new types of incidents.

Maybe you start to expand beyond to different types of vendors.

So it's very dynamic and fluid, and so I think I liked what Mike said, at

least meet once a year to do tabletop exercise so then you can identify, like,

where are the gaps in your incident response plan and your team, so you can

start filling those out ahead of time.

I would say smaller, more frequent tabletops I think is better

than just one giant tabletop.

the, the pressure becomes, I think, too much when you do it just once a year.

fans of the podcast have heard me tell stories about the way we used to do

incident response back in the day, and I remember that being hell, right?

and, the, so the more often you meet and the more often you establish

just this, this idea that the purpose of a tabletop to learn,

to find out who screwed up, right?

Or who doesn't know this.

Technically it is to

Safe place.

it's… What's that?

It's a Safe place.

It's a safe place Yeah.

So right.

thanks guys for, chatting with me once again.

Thanks, Prasanna

Anytime

Anytime, Curtis, and don't worry, we'll get your stuff all together and we'll

figure out our topics for next time too.

You are forgiven.

All right.

That is a wrap

The Backup Wrap-Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening