4 ms·

>because most companies have their backup ducks in a row That is the most optimistic thing I've read in a long time! I still consult with companies storing al

>because most companies have their backup ducks in a row That is the most optimistic thing I've read in a long time! I still consult with companies storing all of the company-owned accounts (facebook, instagram, website admin, government & tax portals, etc.) in a spreadsheet called "passwords.xlsx", in a folder called "passwords", on the root of the network with no access control. Frequently. (they do not have their backup ducks in a row, nor have any clue what "XDR" stands for)

wkat4242 2y ago
Really? We really don't do that anymore. We have a strong XDR (Extended Detection and Response), basically Antivirus + behavioural analysis + SIEM integration. A managed password manager, and even detection for such behaviour of stored passwords in plain text or office files (through Microsoft Purview DLP). XDR is an evolution of EDR (Endpoint Detection and Response) with a bit more in terms of data sources added (and a lot of marketing "Our <..>DR is better than yours because we have a cooler letter" :P Basically an XDR looks not only at malware but also at potentially malicious actions. This is a much more complete view because not every malicious action is triggered by malware. It can also be simply a user (and AI automation/control will be a new thing there). Big names in this are Crowdstrike (yes that one that killed half the enterprises), SentinelOne, Microsoft Defender for Endpoint (not to be confused with the normal consumer defender). An XDR will notice when a PC is doing a port scan, when a process is trying to gain root rights, when significant numbers of files are suddenly rewritten. It will immediately kill the process and/or trigger a ticket to the SOC (Security Operations Center). Who can take global actions on all endpoints to immediately kill the malware everywhere. It's pretty cool, you can trace back the entire process history, what launched what, what was were the system call parameters etc. Big companies really have this stuff figured out. Unfortunately exfiltration is harder to detect if the malicious actor is doing it through a cloud service that the company also subscribes to. If a company doesn't know what XDR is they are probably < 100 employees.
- ziddoap 2y ago
  >If a company doesn't know what XDR is they are probably < 100 employees. Indeed, I do cybersec consulting primarily for small to medium-sized businesses. And I would say, especially for small businesses, somewhere over half of them have no backup plan (among all the other issues). So, sadly, it is far from true that "most companies have their backup ducks in a row" .
  - wkat4242 2y ago
    True, I was mainly thinking about the enterprise field in which I work. Of course those are also the fattest targets for these actors. We get some really serious stuff very regularly. Which I can't elaborate on, but I mean, the threat model for a small / medium business is also much less heavy. Also, most enterprises have cybersecurity insurance that will just pay out (and thus keep this activity going, sadly). I don't think smaller businesses would have that.
    - technion 2y ago
      My time consulting across random organisations really has been the complete exact opposite of what you describe. I've walked into billion dollar orgs and campaigned unsuccessfully for backups. And I have seen sole traders with cyber insurance.
- MadsRC 2y ago
  Data exfil detection is a game of whack-a-mole. There is an endless variation of ways I can get data of your machine or out of your network. Your time is much better spend detecting or preventing compromise.
  - wkat4242 2y ago
    Yes, but for a company our size, to have something notable exfiltrated you are usually speaking about large volumes as well, which are easier to detect. And yes compromise detection is of course the priority. But it's not just one or the other. We do everything at the same time. The swiss cheese model and all that.
    - recursive 2y ago
      Whatever your company size is, there are many other company sizes that exist.
- regularfry 2y ago
  > most companies have their backup ducks in a row now > If a company doesn't know what XDR is they are probably < 100 employees. To say that "most companies are < 100 employees" would be to understate the margin by which that is true. According to https://www.naics.com/business-lists/counts-by-company-size/ https://www.naics.com/business-lists/counts-by-company-size/, there are 17,769,699 companies total in the US, of which 166,964 are > 100 employees (leaving the unknowns to one side). That's less than 1%.
  - CPLX 2y ago
    Right but half of all people employed in the US work for companies with 100+ employees.
    - ziddoap 2y ago
      I would not expect anyone who says "most businesses" in a sentence to be using the definition "the minority of businesses that most people work for".
    - regularfry 2y ago
      "Half of all people work for large companies which likely have..." and "Most companies have..." are two completely different statements.

wkat4242 2y ago

Really? We really don't do that anymore. We have a strong XDR (Extended Detection and Response), basically Antivirus + behavioural analysis + SIEM integration. A managed password manager, and even detection for such behaviour of stored passwords in plain text or office files (through Microsoft Purview DLP). XDR is an evolution of EDR (Endpoint Detection and Response) with a bit more in terms of data sources added (and a lot of marketing "Our <..>DR is better than yours because we have a cooler letter" :P Basically an XDR looks not only at malware but also at potentially malicious actions. This is a much more complete view because not every malicious action is triggered by malware. It can also be simply a user (and AI automation/control will be a new thing there). Big names in this are Crowdstrike (yes that one that killed half the enterprises), SentinelOne, Microsoft Defender for Endpoint (not to be confused with the normal consumer defender). An XDR will notice when a PC is doing a port scan, when a process is trying to gain root rights, when significant numbers of files are suddenly rewritten. It will immediately kill the process and/or trigger a ticket to the SOC (Security Operations Center). Who can take global actions on all endpoints to immediately kill the malware everywhere. It's pretty cool, you can trace back the entire process history, what launched what, what was were the system call parameters etc. Big companies really have this stuff figured out. Unfortunately exfiltration is harder to detect if the malicious actor is doing it through a cloud service that the company also subscribes to. If a company doesn't know what XDR is they are probably < 100 employees.

ziddoap 2y ago
>If a company doesn't know what XDR is they are probably < 100 employees. Indeed, I do cybersec consulting primarily for small to medium-sized businesses. And I would say, especially for small businesses, somewhere over half of them have no backup plan (among all the other issues). So, sadly, it is far from true that "most companies have their backup ducks in a row" .
- wkat4242 2y ago
  True, I was mainly thinking about the enterprise field in which I work. Of course those are also the fattest targets for these actors. We get some really serious stuff very regularly. Which I can't elaborate on, but I mean, the threat model for a small / medium business is also much less heavy. Also, most enterprises have cybersecurity insurance that will just pay out (and thus keep this activity going, sadly). I don't think smaller businesses would have that.
  - technion 2y ago
    My time consulting across random organisations really has been the complete exact opposite of what you describe. I've walked into billion dollar orgs and campaigned unsuccessfully for backups. And I have seen sole traders with cyber insurance.
MadsRC 2y ago
Data exfil detection is a game of whack-a-mole. There is an endless variation of ways I can get data of your machine or out of your network. Your time is much better spend detecting or preventing compromise.
- wkat4242 2y ago
  Yes, but for a company our size, to have something notable exfiltrated you are usually speaking about large volumes as well, which are easier to detect. And yes compromise detection is of course the priority. But it's not just one or the other. We do everything at the same time. The swiss cheese model and all that.
  - recursive 2y ago
    Whatever your company size is, there are many other company sizes that exist.
regularfry 2y ago
> most companies have their backup ducks in a row now > If a company doesn't know what XDR is they are probably < 100 employees. To say that "most companies are < 100 employees" would be to understate the margin by which that is true. According to https://www.naics.com/business-lists/counts-by-company-size/ https://www.naics.com/business-lists/counts-by-company-size/, there are 17,769,699 companies total in the US, of which 166,964 are > 100 employees (leaving the unknowns to one side). That's less than 1%.
- CPLX 2y ago
  Right but half of all people employed in the US work for companies with 100+ employees.
  - ziddoap 2y ago
    I would not expect anyone who says "most businesses" in a sentence to be using the definition "the minority of businesses that most people work for".
  - regularfry 2y ago
    "Half of all people work for large companies which likely have..." and "Most companies have..." are two completely different statements.