Jay: What is going on? This is Jay and Michael here on The IT Director’s Podcast, powered by Clear Winds. How are you doing, Michael?

Michael: Hey, I am doing awesome, and I am excited. We have Stan here with us today. He’s the CEO of Clear Winds. Stan, how are you doing today?

Stan: Doing great. Appreciate y’all having me on.

Jay: Absolutely. Thanks, Stan. Stan is our CEO and owner of Clear Winds, and we have a great subject today. Stan has a lot of years of experience in this, and the topic today for IT directors is cybersecurity horror stories.

Michael: Yeah. It’s October, and Halloween is this month. I’m not necessarily a guy who gets out and does all of the spooky things. I’d rather go eat some candy and smile and wave at people. But in the holiday spirit of Halloween, the horror stories.

Jay: The horror stories in cybersecurity. Spooky stories about cybersecurity. There you go. We’ll get kicked off, Stan. Has a fake email ever shut down a whole company’s operations?

Stan: Well, yes. Phishing is one really popular way of getting into companies, and a lot of threat actors use it to try to get in initially. Today they make these emails that look very realistic. We had one of our customers where one of their users clicked on an email, and it gave the threat actors access into the system, into that user’s desktop. It happened over a period of time, but they used that to get into the laptop, which gave them a chance to look around the network. A few months later, they did ransomware across the customer’s whole system.

It really scared them. Interestingly enough, they had an AS400, and the threat actors were able to encrypt that also. So it was pretty wild.

Michael: For those who haven’t seen the back end of how this rolls out, I know we see a lot on the remediation side of what actually happens. You said a few months later. Can you go into that? I feel like a lot of people have this idea that somebody in a dark room is just waiting for you to click, and as soon as you click, boom, door shut. But that’s not the case.

Stan: No. A typical threat actor could take six to nine months between getting access to your location and actually doing the encryption or the ransomware. Sometimes it’s a lot faster, because they’ll see what they need. But here is how a threat actor usually works. They are usually just scanning IP addresses. They don’t know whether they’re scanning you or me or anyone else. They’re just scanning IP addresses and seeing if they can find an issue. Or they send out a bunch of emails and see what they can find.

Then somebody clicks on an email, or a scan says, “Oh, there’s a vulnerability here.” It may be two or three weeks before they come back and say, “Let me look into that and see what happened.” It may not be immediate, or it could be. You just never know. Then they start exploring, thinking, “Let me see where else I can go on the network.” So it’s a process. I’ve seen it take as long as six to nine months before they actually use their access.

Jay: Wow. And they’re just in the background, chugging along, gathering information and looking at human behavior. They might have keystroke applications they’re loading. They’re doing all kinds of things. And no one knew they were there for nine months until it happened. Wow.

Stan: That’s right.

Michael: Playing the long game. So, passwords. What’s the worst password mistake you’ve ever come across?

Stan: Another instance where somebody got into a company, and they were on this person’s laptop and realized there was a file on it that had all the passwords.

Jay: A password file.

Stan: A password file, and I think it was called Passwords.

Jay: Passwords, yeah.

Stan: So it wasn’t that hard.

Jay: A lot of people have probably been guilty of that.

Michael: Guilty. Yes.

Stan: Right. So they got the passwords, and they were able to get around the network and really affect things. When they went to encrypt, they were able to encrypt most of the information there. When you have these things, it’s important to have backups, because backups can help you restore what you had. But you also have to find out how they got in. There’s a lot of forensics. One of the things we like to do, once an attack happens, is figure out how they got in. The tools you have set up even beforehand can help you a lot.

I know a lot of companies are using EDR, endpoint detection and response, or you may hear MDR, for managed, or XDR. Those products can give you a lot of information, but you have to make sure you have the right one. Some of the ones out there do a good job of detecting, but when you get an attack and you want to go back and look at logs, there are no logs. So you have to make sure you’ve got not only the right brand, but also the right level of access at that company. Everybody’s heard of CrowdStrike and SentinelOne. They have different levels, so they don’t always include all the logs you need. When something happens, you need those logs to know what happened, because you could restore everything, but guess what? You just restored back to where they were.

Jay: Where they were, yeah.

Stan: And guess what? They can hack you again.

Jay: It’s funny you talk about that, Stan and Michael. I was guilty of this probably 15 years ago. As systems grew, being an IT director, you have all these systems. We didn’t have password managers and all these things back then.

Stan: Right.

Jay: So I had a CSV file or an Excel spreadsheet, and I probably did have it named Passwords. It covered the virtual environment, our SAN, our firewall, all of it. I needed one location. Thinking back, I was like, wow, that was not a very secure way to do that. But in today’s world, people still do that.

Stan: That’s right. Another way to help with those passwords, obviously, is to have complex passwords. But the other thing you can do is have multi-factor authentication. That can definitely help.

Jay: Yes. And then having a password vault, a password manager, that we offer as an organization.

Stan: Correct. A password vault is very critical. You feel like you have to keep a list of passwords, which I get. You don’t want to use the same password for every place you go online. You want different passwords, because it may not even be you or your company that gets hacked. It could be the company you’re accessing that gets hacked. Well, guess what? They got that password. So if you had “password” as your password over there, they’ll say, “Oh, they used it there. Let’s try it here.”

Michael: But I think it’s even more than that. What we’ve been talking about on several other episodes is trying to help people think differently. A password, I think we can feel comfortable with it: “This is my login.” Well, you have a login so other people can’t log into your specific profile or account. That password isn’t just for you. It’s there to protect others from coming in and gaining access. The more challenging you make it, yes, it might be frustrating, but there’s a purpose. You’re frustrating others who are trying to impersonate you or steal your info. So I think you have to bring it up and say, “This is why we’re doing this.”

Jay: That’s so good. Stan, what about this? Tell me about a time when a company thought they were protected with their backups and then they were not. What happened?

Stan: Like I just mentioned, backups are very important. We had a customer that was doing backups for themselves, and we said, “You really need to get those backups offsite.” They said, “Oh, it’s no problem. We have a place on the other side of the county, 30 or 40 miles away. That’s where we’re doing our backups, so it is offsite.” I said, well, yes, that does help. If you have a tornado, a fire, or something like that, it does protect against that. But if you have a security issue and they get to the whole network.

Jay: The whole network, because it’s all in the same place.

Stan: Yes. In this instance, the threat actor had gotten in and encrypted all their data, but they also encrypted the backups. So they had nothing. Sometimes we’ve been in situations where they didn’t have backups, but it turned out they were about to do a firmware update or an upgrade on their main system, and their provider had done a backup. We were able to restore from something like that. These guys had nothing. It was a total rebuild.

Jay: Wow. And that’s a terrible feeling as an IT director, or as a CEO. You’re looking and you say, “We had this event,” only to find out your backups are locked, and you don’t have anything past that. That’s never a good feeling. That’s where we, as an organization, can offer help with that. For our customers, we use backup with redundancy, cloud, and different things, and we validate it. That’s another thing. If they had been validating it, they would have had it tested and stood up somewhere.

Stan: That’s right.

Michael: Yeah, and I think we’ve shared this before, but it’s always worth mentioning: when you’re doing backups, test them and validate them. I can think of another organization we worked with that literally backed up the same day over and over again for about six years. It was literally the same day, from around 2019, every day for however many years, and they didn’t know.

Stan: Right. That’s exactly why you want to make sure those backups are looked at every day. That’s what our organization does. If you back up to our facilities, we check the backups every single day to make sure they’re right. The other thing is you have to test them. You have to do a restore at least once a year to prove that you can restore and get to your data. As you know, we’ve talked to many prospects and clients who haven’t done anything and never tested it. Or they say, “Yeah, we tested about four years ago.” I say, “If you’re not testing every year, who cares if you back it up if you can’t restore?”

Jay: Yeah. And not to get too technical and in the weeds, Michael, but at Clear Winds, we use Veeam. That’s our preferred backup method. Veeam is so amazing because you can restore offsite, off network, to a whole different VLAN, bring up the virtual machine, and make sure it works, and it doesn’t impact production. Our SOC team does these all the time. The average person out there doesn’t have the tools to do that. I think it makes a big difference.

Stan: Right. That’s one thing we’ve always done. If you’re backing up with us, we try to provide space so you can restore to it. We understand that if the system at your location goes down, or maybe you’re in Azure or something and you don’t trust it at that moment, that’s okay. We’ll restore in our facility. You don’t want to be on that for very long, but it gives you a chance to get up and running, with people doing work, so you can meet what you need to for your clients and prospects. Then maybe two or three weeks later, when you feel confident in your environment, you can migrate it back.

Michael: Okay, another story. What is the most shocking thing you found in a company’s Microsoft setup?

Stan: Shocking is probably not the right word on this one, but I will tell you about some things that really came to light about two years ago. Well, let me say that threat actors were taking advantage of them two years ago. Microsoft Active Directory has some protocols. One of them is NTLM. It stands for New Technology LAN Manager, I think. It’s an older technology. I know it says “new technology,” but it’s actually older. It was doing a job, but a lot of the authentication between devices had low encryption. It was easy to break. There was something going around called pass the hash. It was a hash used with the authentication, and it could be intercepted as it went from device to device. Once they have that, they can use it, because that authentication usually isn’t changing. So that was one way.

The direction was, “Let’s move away from NTLM.” The other thing is Kerberos. Kerberos is another authentication method, a little more modern, and it’s what people are using. But there’s something called Kerberoasting.

Jay: Kerberoasting?

Stan: Yeah, Kerberoasting. With Kerberos, the passwords there, those hashes, could also be intercepted. They use a little better encryption, but you can take that offline. The threat actor can take it back and say, “I’m going to try to take this hash and crack it.” In the meantime, they know that once they’ve figured it out, they can introduce it back in and then have access to the whole network through Active Directory.

Jay: Wow.

Stan: I’ve seen that a few times, and it’s very devastating. They can get around really quickly. So it’s very important to harden your environment, your Active Directory environment, whether that’s on-premises or in Azure. We even do 365 hardening. All of these things are key to hardening your environment. Part of that is additional encryption. Using very long, complex passwords is key. And it’s not even just your password. You’re an admin, so you have an admin password, but there are also service accounts. People don’t think about those service accounts, and the passwords on them don’t change. Threat actors can use those service accounts. You need to change them. One of our clients got hacked, and I think their system admin was changing those Kerberos passwords once an hour. He was doing it every hour just to make sure, in the meantime, while we were helping them recover. I think that’s very key.

Jay: That’s great. What about this? Tell us a story, Stan, about how a company lost a large amount of money from just one email.

Stan: We’ve seen that a few times, but there was one time in particular. The threat actor had gotten into their email server, and all they were doing was monitoring every email that came through.

Jay: Which is interesting, too. They’re just there.

Stan: Yeah, just looking. The owner, the CEO, was about to buy a piece of property. He was having conversations with his attorney, saying, “What do you think?” and maybe negotiating with the other party. Then he decided, “I’m going to buy it.” He told the attorney, “I’m ready to buy.” At that moment, the threat actor cut the attorney off and made every email from that person go to the threat actor. You could see it in the email itself. They changed one character. But the average person is not looking at that. It’s a trusted source, and they trust it.

So then it comes to the point where it’s, “Where do I need to wire the money?” Well, the threat actor sends over an account, and the CEO sends $750,000.

Jay: Now we’re not talking about $750.

Stan: That’s right. $750,000.

Jay: That’s a chunk.

Stan: I think about a day went by, and he said, “I haven’t heard back from you. What’s going on?” I think he actually called him. And he said, “I don’t have the money.” And he said, “I sent it yesterday.” They were scrambling, and that’s when they found out they had been hacked and lost that $750,000. I think they got the FBI involved on that one, but by the time they had even contacted the banks, that money was gone. I think it hit the account and was gone in about 60 seconds. It was gone that fast. Over time, I think they ended up getting maybe a couple hundred thousand back. He lost a lot of money.

Jay: You’re talking about losing half a million dollars, pretty much, right?

Stan: That’s right.

Jay: When you were telling that story, Stan, I was thinking about conversations I’ve been in about cybersecurity, about spoofing and Bitcoin and all of this. Once you transmit money, it is almost impossible to get it back, because you initiated it. It’s really a gray area. It’s like, well, how do you know you wouldn’t send him that, really? And once it hits that account, they’re going offshore. It’s gone. Good for them that they got some back, but man.

Stan: They got some of it back. One of the things I learned, and this happened years ago, but when it happened to him, it taught me a lesson too. I asked, “What can I learn from this?” Here’s what I learned: even if I’m having emails go back and forth, I will pick up the phone. I don’t even call the number on the email. I ask, “What’s the title company? What’s the attorney?” I go look up that person’s number, and I call them. I say, “I want you to verify your account information before I wire this.” That’s just another check, and it’s outside the whole email. I wouldn’t even take any information from that email. I just ignore it and go find another number to verify from a human source.

Jay: That’s a tough one right there, Stan. You lose half a million dollars and you can never get it back. But that kind of stuff happens every day.

Michael: It does. These are multiple instances where someone’s environment is vulnerable and has been vulnerable without them knowing. Are there things they can do, just as a safety check, to make sure? Any recommendations you’d have for people who are listening?

Stan: For that one, I would definitely make a call. For the one about Microsoft and looking at Kerberos, I’d have someone go in, and we offer a service like that for hardening. Get your 365, your Azure, your on-prem location, whatever you have, hardened. Make sure you have a good password policy and that you’re doing MFA, multi-factor authentication. Make sure you’re not only doing that on everybody’s personal account. You have to be doing it on your service accounts. You have to be doing it on everything.

Jay: And your admin logins, your AD logins, not just your email. A lot of people use MFA on their email but not on their Active Directory accounts to log into their devices.

Stan: That’s right. And get rid of accounts. Some service accounts are definitely not needed. Go eliminate accounts you don’t need.

Jay: As Stan was talking about sending the $750,000, I started thinking about all these money transmittal services that are out there. Venmo, Cash App, Zelle, all these things, and they’re used heavily in today’s world. Personally, I try not to use them at all. I have one because you almost have to in today’s world, since a lot of people want to send money and transmit. I was talking to Stan over the weekend about my son, who has a photography business and gets a lot of payments through Venmo. I explained to him, “Venmo is not a bank. That money is not even secure.” If you read through their disclaimers, and this is not knocking Venmo or anything, none of those are banks. They’re basically saying, “This is just a transmittal service. We’re not securing any of this.” That’s kind of weird when you think about it. I’m even kind of suspect of all those services, because you just never know. You get a request that I think is from Michael, and it’s not really Michael. I send him $1,000, and I’m like, “Oh, man. Who did I just pay?”

Michael: I know it. I’ve had that happen from a friend. Her account got hacked, and whoever it was started sending out requests like, “Hey, I’m really trying to send my kid to baseball this year. Is there any way you could give me 200 to help cover this?” And they did that to how many other people? We called and said, “Hey, is everything good? Are you okay?” That’s when she realized she got hacked. That wasn’t her. They had some ways to get some of it back, but it wasn’t everything.

Jay: Sure. Once you send it, it’s really on that person. Even with the FBI, you actively sent it.

Stan: And one other thing about prevention that we really haven’t talked about. One of the very common ways threat actors get into an environment is phishing. Those emails. You have to train your users not to click on them. You set up spam filters and everything, but we know you have to do human training, because the threat actors are good.

Jay: Human training.

Stan: Yeah. You have to do security awareness training, something we offer a lot. You need to teach them what they need to do, and then you need to test them. That’s another thing we do. We do a lot of testing even on our own people, to make sure they’re not clicking on things they should not click on.

Jay: Michael and I have talked about phishing and security awareness training. The human element around clicking on emails and such is how threat actors get in. Most people are pretty secure. They have tools on their firewalls, and they have hardening and different things. But if a human clicks on a link, that is a phishing attack, and there’s no software that’s going to stop that. That’s where security awareness training comes in.

Stan: Exactly.

Michael: On that note, I know there’s another instance. How did 8,000 people’s information get stolen because of a phishing event?

Stan: That was a person in this company who basically provided information through a link in the email. The email said, “Hey, do you want to see the CSP video?” They gave them some login information, told them where to go, and gave them a link. Fortunately, they figured it out pretty quickly. That’s why it was only 8,000. It could have been 800,000.

Jay: And I thought about this, Michael. You and I were talking last week. We’re working with one of our local vendors to do some application development for them. They wanted to send us some sensitive data, but we have our own internal SFTP, a secure file transmission system, where we can send a link and they can send files back to us. A lot of people just don’t take advantage of those things. They’ll just email files. We were onsite doing an assessment for a local municipality, and the police officers were writing their tickets and entering Social Security numbers and driver’s license numbers into a Google Form, and emailing it to their other officers. We said, “Guys, that’s such a security risk,” because there’s no security around that. But people just don’t know what they don’t know. They’re trying to just share information. Someone gets Social Security numbers, 8,000 people.

Stan: That’s a lot. No doubt.

Jay: Stan, what about this? We talked about wiring money. Have you ever followed stolen money from a cyber attack and seen where it ended up?

Stan: I personally haven’t, but I’ve talked to some banks that have. Similar to the $750,000 one, there was an instance where a bank had a customer, and it was not nearly as much, about $50,000, that they tried to track. Again, it was a similar situation. They replied to an email they didn’t verify. They did try to track that money, and as far as they could track it, it had jumped five times. It was pretty impressive, really.

Jay: It goes offshore to other countries that are not part of our banking structure, so it’s hard to track.

Stan: It is. They were able to track it through five banks, and it still wasn’t there. Still wasn’t there. Who knows how many times they jumped it? But all of those hops are very rapid. As soon as it hits one bank, it goes to the next, and to the next. They have automatic processes, so as soon as that money hits, it gets transferred.

Jay: They’re proficient in hiding the money, and getting it somewhere they can probably withdraw it and convert it to some other currency or whatever they’re doing.

Stan: Yeah. Here’s another little instance. Another bank, again not our customer but somebody I was talking to, ended up with a number of customer records out on the dark web, and they didn’t even know it. Somebody told them, “You know you have about 12,000 records on the dark web?” And they said, “No, we didn’t know.” It just shows, again, that somebody could hack you and you don’t even know it. You just don’t even know it.

I know one of the things we’ve talked about is school data. Student data is very fragile. If you put in Social Security numbers, you have a kid who’s six years old. A threat actor could be opening up all kinds of credit cards and everything on this person. You never know. What six-year-old is going to have a credit card? They’re not going to find out until they’re 18, and they say, “Oh yeah, your credit is crappy.” You don’t know.

Jay: Exactly. And there was a major SIS company that had a data breach nationally, and that’s the first thing you and I were talking about at the data conference we were at. They could be doing stuff for years until these kids get to be 18 or 19, then they go to buy a car and say, “I’ve got a 520? What? I’ve never even done anything.” The student information is super critical.

Michael: It is. I heard somebody else we were talking to say they were trying to implement MFA for six-year-olds, and it’s like, okay, yours is a hippo. That’s your sign. Then they go tell the world, or whoever, that it’s a hippo. So there’s really no easy way to do it.

Jay: Well, state policy in the state of Alabama is a mandate. MFA has to be on every K12 student, teacher, everything. So it’s hard. For a third grader or a kindergartner, how do you do MFA? They have to be creative. They use QR codes and different things. But they’re at least trying. And Social Security numbers are not even in the student information system anymore, at least in Alabama, because of what happened. They don’t even want to be responsible for that.

Stan: Exactly.

Jay: I’ve enjoyed this episode.

Stan: If you don’t mind, I’m going to give y’all just one more thing that our listeners need to be thinking about, in terms of what’s new. AI. It’s new, and it’s a great thing. We’re doing a lot of fabulous things with it here at Clear Winds, and I know a lot of other companies are too. But there are also threat actors doing things with it.

Jay: Oh, yeah. They’re doing great things with it too.

Stan: We’ve heard Anthropic say that, with some of the updates they’ve done, it’s able to find vulnerabilities like nobody’s ever been able to before. It’s very fast. That gives a threat actor a really good chance to act on things quicker. So that’s one thing I would encourage all of our listeners to do: make sure you’re updating your firmware and doing your software updates, all of that. I know our managed services team does a fantastic job of monitoring and making sure that as soon as those updates come out, they get applied. Because some of these hacks are coming in before the update is even out there.

Jay: Correct.

Stan: Even a company like us, we can try to eliminate any access from the outside, but until that update comes out, there’s not much we can do. So pay a lot of attention. At least try to get software updates done as quickly as you can, because we’ve seen where essentially a zero-day attack can happen. A vulnerability comes out, there’s a CVE, which is the security issues that get published out there. I’ve seen it a day later, we’ve had a customer hit, and we say, “The patch just came out today.” It just came out today. We’ll get it done, but there really wasn’t anything we could do.

Jay: You’re exactly right, Stan. The AI tools that are out there, Claude, OpenAI, Grok, are incredible platforms.

Stan: They’re amazing.

Jay: They’re amazing. But they’re also amazing for the threat actors. That goes to the whole point of phishing, security awareness, the Office 365 hardening. You need to have all these things in place because these tools are developing so rapidly. If we don’t have our stuff straight, they’re just going to keep evolving. That’s where the human element you talked about is so big. I’ve learned so much from this, Michael, listening to Stan. I kind of think of it as Tales from Stan. Cyber stories from Stan. Cyber horror stories. These things are real. And the average person just thinks, “Oh, that’s not going to happen to me.” Until you’re missing $750,000.

Stan: I’ve heard that so much. Customers say, “We’re just too small. They wouldn’t want to do us.” Like I said earlier in this episode, all they’re doing is scanning IPs and sending out emails. They don’t know who they’re sending them to. They’re just looking for vulnerabilities.

Jay: Looking for vulnerabilities, yeah. And it’s not if, it’s when. It will happen. So that’s why you have to be protected. Take that human knowledge, the training, and train your people. The more aware you are, and the more human elements involved, the more apt you are to protect yourself against these cyber storms coming.

So, man, we appreciate you coming on today. Thank you.

Stan: Thank you, Jay. Thank you, Michael.

Jay: As always, go follow us on all the social media platforms, The IT Director’s Podcast. We’re here to serve you guys and to give you great information. Keep sending in great recommendations for shows and questions, and we appreciate everyone. This is Jay and Michael, and we are out.

Stan: Thanks.