What Is Ransomware and Why Should You Care?

Building an incident response team is something you do before the incident, not during it. Prasanna, Dr. Mike Saylor, and I walk through who needs to be on that team, why each person matters, and how to get them lined up now so nobody’s scrambling when ransomware hits. We’re back after a few weeks off, and we came back with a topic I care a lot about. When I cracked a rim on my Tesla, I didn’t watch YouTube videos and grab a wrench. I called a team of people who know tires. Your cyber incident deserves the same treatment. Mike puts it plainly: you don’t want to be recruiting people when the house is on fire. We cover the core roles. There’s the incident commander, who keeps the business off the backs of the people putting out the fire. There are the subject matter experts on the tech side. And there’s the executive sponsor, who makes the calls you’re not allowed to make. We talk about why legal, compliance, PR, and finance need a seat at the table. We also explain why “there is no evidence customer data was accessed” is a very different sentence from “customer data was not accessed.” (Looking at you, LastPass.) Then we get into the outside help: your cyber insurance carrier, a third-party incident response firm with a retainer already signed, law enforcement, and your vendors. Mike explains what the FBI will and won’t do for you. He covers why you can’t just pay a ransom to anyone on the OFAC list, and why calling Bob on a Sunday is not a plan. If your current incident response plan is “we’ll figure it out,” this episode is for you. Listen in, then go write down some names. Chapters: 00:00 Cold open 01:30 We’re back (and Gemini let me down) 03:27 Why you need a team, not YouTube University 04:29 Know your team before the house is on fire 07:43 Fire crews, training, and the USS Constellation 09:27 Incident response is a business problem 12:02 Core roles: leaders and subject matter experts 14:14 Executive sponsors and who comes back first 16:09 Asset lists, owners, and pre-authorization 17:11 Incident commander vs. incident leads 20:00 Legal, compliance, and attorney-client privilege 22:59 PR and the LastPass problem 24:47 Finance and cyber insurance 27:07 Third-party incident response teams and retainers 32:06 Bringing in law enforcement 33:48 Sanctions, Bitcoin, and paying the ransom 38:05 Vendors who answer the phone on a weekend 39:34 Write it down and name your deputies 40:20 Tabletop exercises 43:06 Wrap-up

Endpoint hardening is the unglamorous work of closing the windows and locking the doors before somebody comes along and jiggles the handle. Prasanna, Dr. Mike Saylor and I walk through what that actually looks like: secure builds and golden images, which services to shut off, which ones to uninstall so a bad guy can't just switch them back on, USB lockdown, full disk encryption, BIOS and UEFI, and the phone in your pocket that logs onto your corporate Wi-Fi every morning. Mike opens with the analogy he uses in the book. Bad guys casing your organization are doing what a burglar does walking down your street — checking every door, every window, every garage. An unpatched box screaming its version number to the internet is a broken window with a sign on it. Then we get practical. Your receptionist's computer is running a web server she will never use. Your new Dell shipped with Xbox Game Bar running by default. Mike's point is that turning those off isn't enough, because an attacker living off the land will just turn them back on. Uninstall the thing. We also get into the argument nobody wins: locking down USB ports. Prasanna makes the end-user case, Mike makes the red team case, and we land on data leakage controls as the middle ground. Then Mike explains how he gets into a laptop that's suspended instead of logged off, and why your encrypted drive doesn't help you in that state. If you've been told you should harden your endpoints and nobody ever handed you the list, this one's for you. Start with one image, the lowest common denominator, and build from there. Don't let perfect be the enemy of good. CHAPTERS 00:00 Your receptionist's computer is running a web server 01:39 Welcome, with Prasanna and Dr. Mike Saylor 03:52 The house analogy: broken windows and unlocked doors 06:22 Do you just have to be safer than your neighbor? 08:49 Assume breach, and close the windows anyway 09:52 Secure builds and golden images 13:37 One image for everyone, or one per role? 14:39 Level one hardening: turning off what nobody uses 16:20 Xbox Game Bar, and why disabling isn't enough 19:07 The USB lockdown fight 22:46 BIOS, UEFI, and malware that survives a reimage 26:35 Full disk encryption only works if you log off 29:42 Physical access trumps everything 30:07 Port scans, Nmap, and banner grabbing 31:50 Building your hardening checklist 33:14 The endpoint in your pocket

Least privilege best practices start with one uncomfortable question: does this person actually need this access? A hospital in Portugal answered yes for everybody, gave every employee doctor-level access to patient records, and got hit with a 400,000 euro GDPR fine. The court's read was that they hadn't even attempted the concept. Mike Saylor, Prasanna, and I get into what least privilege really means, then move straight to the part nobody wants to talk about: where you start when everybody already has domain admin. Mike lays out three approaches, from "turn everything off and see who screams" to a real analysis of job roles. We talk about why role-based administration is the vehicle that gets you there, and why role sprawl will eat you alive if you build a custom role for every human in the building. From there we get into segregation of duties, which accounting figured out decades before IT did. Your admin account should not be the account you use to check Gmail. That leads into non-repudiation, su versus sudo, and why logs have to leave the box and land in a SIEM before somebody edits them. The last third is action items. Inventory your privileged accounts, your service accounts, your support accounts, and the fire call accounts you break glass for. Track more than the name and the privilege level: who owns it, why it exists, when the password changed, when it expires. And if you run backups, split your roles apart. Editing backup configs, running backups, and doing restores should not be the same permission. Somebody quietly shortening retention is invisible to the person watching last night's job reports. A restore never trips an alarm at all. If your admins fight you on any of this, Mike has a thought about that too. 00:00 The hospital where the janitor could read your chart 04:26 The 400,000 euro fine, and the failed appeal 07:50 What least privilege actually means 08:54 Three ways to start when everyone has too much 11:17 Access that follows people as jobs change 12:57 Role-based administration is the vehicle 16:13 Role sprawl and the 80/20 rule 18:26 Segregation of duties, borrowed from accounting 20:28 Back when everybody had root: su and sudo 21:59 Non-repudiation and getting logs into a SIEM 25:31 Inventory privileged, service, and fire call accounts 27:41 The three backup roles you should separate 32:39 What your account inventory should track 35:31 Expiring accounts nobody uses 36:42 When admins push back, be concerned

Password length vs complexity isn't a close call. Dr. Mike Saylor joins Curtis and Prasanna to explain why the capital letter, the number, and the special character your bank demands do less for you than simply adding characters. Mike walks through the rainbow table project — an operation that has spent years computing password hashes nonstop and will sell you 20 terabytes of the results. Nobody cracks your password. They look it up. The catch, and the whole reason this episode matters, is that the project has only reached ten characters after all that work. The three also cover why some LastPass customers had their vaults drained and others didn't, where the 16-character recommendation comes from, how to build a passphrase you'll remember, whether forced password rotation accomplishes anything, and what happened when Mike rolled out fingerprint-locked laptops to fifty field employees. Get the book: Learning Ransomware Response and Recovery at stopransomware.com

RDP security best practices come down to one rule most admins break on day one: that protocol has no business facing the internet. Dr. Mike Saylor and Prasanna Malaiyandi join me to break down why RDP earned the nickname Ransomware Deployment Protocol, who's out there scanning for your open port right now, and what to actually do about it. Here's the part that gets me. Every Windows box ships with this thing turned on. You didn't ask for it. Nobody handed you a manual. It's just there, running, waiting. Mike calls it a dollar store hammer — still a tool, still gets the job done, just not the one you'd pick if anybody gave you a budget. I call it a hack-me sign taped to your back. We get into how initial access brokers work, and it's less sophisticated than you'd hope. Somebody runs a Shodan query, gets a list of every exposed RDP service on the planet with IP addresses and device types, cross-references it against leaked credentials, packages the whole thing up, and sells it. Mike says the recon that used to take days now takes about 30 seconds with the AI tools floating around the dark net. Then there's the credentials-don't-even-matter problem. Default RDP traffic isn't encrypted internally. Mike walks through a routing table poisoning job where his team captured an admin's keystrokes going to a server. No login required. Just be in the middle. The back half is all fixes. Block the protocol and the port, not one or the other, because attackers will happily move to a different port. Check 3389 before you kill it — your database might be sitting on it. Enforce network level authentication. Put a VPN or a zero trust product in front, and Mike points out enterprise-grade stuff runs about six bucks a user now, so the "no budget" excuse is thinner than it used to be. Bastion hosts. Group policy. Monitoring at the endpoint, network, and firewall layers, with a governance layer on top so you know what's allowed before something breaks at 2am. Prasanna plays devil's advocate the whole way through and swears he isn't pro-RDP. Mike wears three hats and can't pick one. I have exactly one opinion and I'm not moving off it. CHAPTERS: 00:00 Windows ships with a back door 01:26 Welcome and my Facebook Marketplace weekend 03:18 Why RDP means Ransomware Deployment Protocol 04:46 What RDP actually does 05:51 Blue hat, red hat: Mike's split opinion 06:11 Does RDP deserve its bad reputation? 08:10 On by default, and you can't fully kill it 09:30 The back door nobody locks 11:52 Does the cloud secure RDP for you? 14:12 Who scans for exposed RDP, and how Shodan works 17:10 Initial access brokers explained 18:36 Vulnerabilities that skip credentials entirely 19:08 Unencrypted traffic and stolen keystrokes 20:38 The never-on-the-internet rule 20:59 The network survival stack: VPN and zero trust 23:22 Block the port and the service 24:17 Stopping lateral movement once they're inside 25:25 Network level authentication 27:50 Port 3389: check before you block it 29:44 Bastion hosts 30:26 Monitoring, auditing, and governance 31:19 Blue, red, and purple hats