probably won't make it tonight. She said she might come in a little bit late. Okay. And Amanda and Zach are not coming. They're going to meet on Thursday. And I haven't heard from anybody else. I can check my email just to see if anything came in in the last couple minutes. I'm going to put a link to the shared slides. I saw that people had already started adding stuff to that. I'm going to make a couple of you co-hosts just in case. I just did something. We're still here. Yeah, I know. I can hear you. Well, there you are. Okay. I just have to minimize you so I can see two things at once. Okay. I did get a message from Joan and her subgroup is meeting via email, like sort of checking in via email and virtually rather than at this meeting. So, Jen, you're with Mia and Jay and they're not here. So I can open up the breakout rooms for Will and Catherine to get going. Yeah, Mia sent me a couple of things, but are they not coming tonight? Haven't heard from them. I can text Mia and ask. Here, I'll open up the breakout rooms and then you and I can stay behind, Jen, and we'll figure it out what makes sense. So the rooms are open. And I think last time Will and Catherine, you were both able to join your own room. But let me know if you need me to put you in there. Okay. Thanks. So Jay and Jen, I'm going to just shoot them a text. Okay. And then Amanda, Zach are not coming and Joan and they're all meeting elsewhere. So let's figure this out. I can hear my, I'm going to mute myself right now because I can hear someone coming into house. Okay. Text sent. But so did you see maybe you were the one that entered it, but did you see that there was information on the slides for the policy? Yeah, I did. I just, I didn't really do anything with that. I added just changed it to continuous improvement plan. So somebody's looking at that. They know what CIP meant. Wasn't really sure about the policy recommendations. Are we saying that these policies need to be updated or just reviewed? Well, my understanding was that they needed to be sort of looked at and updated through the lens of the diversity, equity and inclusion policy and mainly through the lens of the core values that we've put out as a committee. But I feel like there could be like a sentence or two on this slide to make sure that that's clear to people who are viewing the slide deck. Yeah. I'm not sure exactly. I think it was, you know, maybe consider revision of the following policies through the lens of the core values. Something like that. Maybe we should title it that then. Something. Where's the other one? Consider. What are you looking at, M, when you're pulling that up? Is that on our other? No, no, I just came up with that off the top of my head. Oh, okay. But I just remember, you know, that was sort of the initial talk when you and I and me and Jay all got together. That was sort of the initial conversation was sort of was like, it's not like, you know, it's just that each of these policies should be looked at through this new lens.  So you know what we're talking about. Okay. So I don't know what you just said exactly, but it sounded good. Okay. I can, I can type it out. So they're getting back to me now, and Mia says that she sent you an email about it yesterday. I did answer her on one part, but I didn't think it, maybe I didn't read the whole thing. Just kind of, yeah, I mute myself for a second. Yeah. Okay, one comment. Let me just see what I wrote for her. She sent me some of the policy recommendations that we had written up and then she assigned me a little, are you there? Can you hear me? Yep. Yeah. Okay. So it was a phrase and there was two replies, let's see. I said, so what she had written, because school handbooks are the place where relationships between the MRPS and the MPD will be operationalized, we encourage revisions to detail when it's necessary to call the police and when it's not necessary offering alternative steps. I wrote that I just stopped it as when it's necessary to call the police, noting that RP information can be noted in other areas. And there should only be a couple of places where an officer is called for assistance or notified of an incident. So I don't think that putting that alternatives, adding all the alternative steps in there just didn't seem, it seems like that should go somewhere else to me. Okay. So I think Jay said that you should check in with them. So maybe just respond to that email. With this, on this, this was, well, did they send me another email, are they saying? It sounds like Mia sent you an email about when and where and how you are going to complete the work of the policy recommendations that it probably wouldn't be at this meeting. That's what it sounds like to me. Okay. I can, do you want me to text her and tell her to resend it so that it's at the top of your inbox? Yeah, I'm just looking to see that. I have the document she sent and the slides that she sent. So maybe that's what she means is just that you guys are going to sort of work on it virtually. Maybe. So I just told her to resend it so that it's at the top of your inbox. And then I think you can just reply to both of them and make sure that they got your suggested edits. Yeah. I think that she did. Well, maybe not. She didn't read it. Read what I wrote. So not sure, but I'll look. Okay. All right. Sounds good. So yeah, we're having a regular meeting next Tuesday, the 13th. That I cannot come to because of I'm having a town meeting that night. Okay. I'm hosting. So yeah, I'm sure you're very busy. Okay. Well, so then yeah. And then the 14th, the night of the 14th is the presentation to the board. So we're nearing the end, Jen. It's happening. Die hards. Okay. All right. I'll look for her email. Okay, darling. All right. Sounds good. We'll see you soon. All right. Bye. Bye. And the question, one question is on the slide show. Do you want more of the core values spelled out, you know, like the paragraphs on the slide show? Do you just want the flow chart and then we talk about them? Or do we know what we're doing? I don't know. I mean, I'm sort of feeling like the slideshow should serve as like the landing pad for all of our materials so that when the board members go through the slideshow, they should be able to at least click on links to whatever we want them to be able to see. So you could sort of summarize on the slide, but then like link out to a more complete document. The one that you shared first, I don't have permission to view right now. Okay. So I think I'm, well, never mind. I'm on my work email, which always happens when I'm on Google. I am granting permission on both right now. Are you just, are you going to make it like anyone with link can view? Yes. Or are you adding my email? Okay. Well, I just added your email. Because right now I'm logged in with my other on my work email. Okay. So it just might take me a minute to figure out how to change over to the different Google account. Fun change the thing. There we go. Anyone with the link done for both. Okay. Right. So I'm on the one, the revised core values working draft and then the vision statement. Okay. So, yes, I mean, this just to the to the eye right away. I can see that it looks a little more clean and organized. So justice rooted in diversity. Great. Okay. So you did the thing where you have like a paragraph sort of overarching paragraph about the core value and then how to sort of build that into future work. Okay. And then the vision statement. I'm just going to read through it real quick. Not staring you while you so I wonder when we have in the presentation on the third slide. We're calling them core values. We have six core values. I wonder if we can be more clear. So we say in the vision statement, the work of the school safety and police relations committee have been guided by values and ideals that emerged from our extensive communications with the wider community. These values are grounded in our shared sense. So I wonder if somewhere in between those two sentences, if we could sort of clarify, you know, we I'm not feeling particularly articulate tonight, but you know, we were able to sort of whittle them down to six core values. That's not the word I would use whittle down, but something like that, like that, so that we are referencing like six core values that keep coming up in the presentation. Because I think that's the important thing we just want to keep coming. We want to use those six core values as like the guidepost for everything. So when we're talking about policy recommendations, the language that they're using, I believe there is core values. Yeah. Yes, yes, yes. And then later, we're making budget recommendations and I've started to type in through the lens of the core values identified by this committee. So just sort of being more explicit about even just adding these six core values to the second paragraph and then sort of summarizes them. Yeah. Also change foundational to core just adding I was afraid we were overusing core values. Yeah, I'm not sure what other people would say about that. To me, I just want to make sure that everyone understands what we're referencing that we're referencing these specific six values that were that we presented last time. And that we will be starting off the presentation with again this time. Okay. And sort of making it simple. I mean, I wonder we could even come up with some sort of like different title for them, you know, like core values around school safety or school safety core values or something like that. Because I know that I think there's other core values floating around in the district around other things, I'm sure. But so that's the only thing that stands out. It's, I think that this is great. Okay. Yeah. And then in terms of the presentation, the slides, right, so we just have that core values vision, and then the core values. And then, yeah, maybe like a summary more of a bullet point of that larger document, the revised core values working draft, maybe like some sort of like bullet pointed version of that along with a link to this will be good. Does that sound good to you? Or was there something else you were picturing? No, that sounds great. You want that bulleted version of each of the six core values after the like flow chart? Or is that going to be? However you think it makes sense. I mean, I think right now just looking at it seems to make sense for slide number four. So like the vision statement, and then the flow chart, and then the bulleted list. But I think that you will be the ones presenting this. So if you have a different style or way that you want to do it, that's totally fine. Whatever you think makes sense in terms of the way that you're planning to explain it to the school board members. Thursday was the deadline, right? Thursday by midnight. So that I have a little bit of time Friday morning to get it together and out. So that's that for the slideshow and the documents. Okay. Yeah. Does that seem manageable? I mean, I probably could like nine o'clock Friday morning or something. But my plan is to email it out in the morning of Friday. Our hope was to have it in front of the school board members, you know, before the meeting on the 14th. And then yeah, we just have a meeting that I think will probably end up being shorter next Tuesday the 13th because everybody has sort of final draft. I think, oh, the plan was final, final draft emailed to committee members, not to the board. And then on Tuesday, I think that was the plan. I'll double check with Mia. And then on Tuesday, we were going to have a chance to sort of run through the full draft and get any sort of like last minute changes or suggestions or additions so that it was like fully ready for Wednesday. And I'm starting to feel like we probably won't need that extra hour before the board meeting on Wednesday. So I think we can probably just plan on showing up to the board meeting at 6 30. But we can make that decision final next Tuesday. That'll make dinner time easier. Yeah.  Will it be, you know, considered or what the money will be? Yeah, invested in. I mean, I hope so. You know, my working group with Amanda and Zach, we've come up with budget recommendations. And so I feel like those, and actually thanks for reminding me, I think we maybe should add a line just to say like, if they're, you know, to sort of consider the vision of school safety and the core values in potentially in this new like windfall that we're getting, you know, the recovery money. And do we know how much that is or? I don't have an exact figure and I wouldn't want to misquote it and take a guess. But I know, so they have that public forum and I'm sure Libby will get that question. Are you, are you able to go to the public forum? That's tomorrow night, right? Yeah, tomorrow night from 530 to 630. Yeah, I think I can, I might have my camera off. Yeah, so I'm sure you could ask that question. And if I don't hear it, if I don't hear that question asked, I could ask it for people. But I feel like she'll probably know roughly what it's, what it's supposed to be. But I, you know, the stuff that we're recommending is the community liaison position that's already planning to be grant funded through that money. So that's already sort of in the works and then trainings like professional development around restorative practices and trauma informed practices resiliency conflict resolution diversity equity inclusion. So like, I mean, there's always, you know, you can always invest more money in those things. And then the like formalizing the relationship between the community justice center and the schools. And so maybe before there might not have been a lot of money to like set aside for something like that. But maybe now we could help offset the cost of the community justice center in some way, you know, as they do work for our school. So is that the same thing as the payments? Yeah, so that was the like, it's like the truancy position. So that was part of the recovery money. I haven't really done my homework on if they're part of the same recovery package, or if it's somehow two separate things, but I think it's the same package. I'm pretty sure that's what I'm understanding. So yeah, I think definitely, you know, I think we can make it more explicit in our presentation that we want them to consider this work for that, you know, that windfall for that grant money for some of this work. What's that? How does slide two look? Look at you just getting busy while we chat away. I just realized like, oh, God, if I do this in three days, I just grabbed the second paragraph. Yes. Great. Yep. Full text of vision statement. I like that. Simple. I'm not a fan of a ton of text on slide. So I think this looks good. Yeah, this is pushing the pushing the envelope. Yeah. All right. Well, thank you both. Well, I'll hear from you Thursday and I'll send the draft. Oh, you know, we'll be sending the slides out. I guess everyone already has access to the slides, so they'll just know that it's ready to view on Friday morning, but I'll send an email out Friday. Do we want to just each the ones we worked on do the slides for those? Sure. Or I mean, I can, if we're just listening to them, I can do that right now. Like it wouldn't be, that wouldn't change with the revisions of the other expanding documents. So yeah, let me just get that done right now. Okay. See if it looks okay. Unless you have a burning desire to do it. But yeah. Refer to you for sure. Cool. Yeah, I'm on a slideshow roll. All right. So I'm going to close the meeting and we never had a, we never had a quorum anyway. So I don't think it was ended up being an official meeting, but I wonder if Orca will choose to show it or not. All right. We'll see you Tuesday. All right. Fantastic. Okay. Bye.


Hi everybody, this is Dave Vellante with theCUBE and welcome to Boston. We're covering storage here at Amazon Storage Day and we're looking at all the innovations and the expansion of Amazon's pretty vast storage portfolio. Duncan Lennox is here, he's the Director of Product Management for Amazon EFS. Duncan, good to see you. It's great to be here. So EFS stands for Elastic File System. What is Amazon EFS? That's right, EFS is our NFS based file system service designed to make it super easy for customers to get up and running with the file system in the cloud. So should we think of this as kind of on-prem file services just stuck into the cloud or is it more than that? It's more than that, but it's definitely designed to enable that. We wanted to make it really easy for customers to take the on-prem applications that they have today that depend on a file system and move those into the cloud. When you look at the macro trends, particularly as it relates to file services, what are customers telling you? Well, the first thing that we see is that it's still very early in the move to the cloud. The vast majority of workloads are still running on-prem and customers need easy ways to move those thousands of applications they might have into the cloud without having to necessarily rewrite them to take advantage of cloud native services. And that's a key thing that we built EFS for to make it easy to just pick up the application and drop it into the cloud without the application even needing to know that it's now running in the cloud. Okay, so that's transparent to the application and the workload. It absolutely is. We built it deliberately using NFS so that the application wouldn't even need to know that it's now running in the cloud. And we also built it to be elastic and simple for the same reason. So customers don't have to worry about provisioning the storage they need. It just works. NFS is hard. Making NFS simple and elastic is not a trivial engineering task, is it? It hadn't been done until we did it. A lot of people said it couldn't be done. How could you make something that truly was elastic in the cloud but still support the NFS? But we've been able to do that for tens of thousands of customers successfully. And what's the real challenge there? Is it to maintain that performance and the recoverability from a technical standpoint and engineering standpoint? Yeah, it's all of the above. People expect a certain level of performance, whether that's latency, throughput and IOPS that their application is dependent on. But they also want to be able to take advantage of that pay as you go cloud model that AWS created back with S3 13 years ago. So that elasticity that we offer to customers means they don't have to worry about CAPEX. They don't have to plan for exactly how much storage they need to provision. The file system grows and shrinks as they add and remove data. They pay only for what they're using and we handle all the heavy lifting for them to make that happen. This opens up a huge new set of workloads for your customers, doesn't it? It absolutely does. And a big part of what we see is customers wanting to go on that journey through the cloud. So initially they're starting with lifting and shifting those applications as we talked about it. But as they mature, they want to be able to take advantage of newer technologies like containerization and ultimately even serverless. All right, let's talk about EFS IA. Infrequently accessed files is really what it's designed for. Tell us more about it. Right, so one of the things that we heard a lot from our customers of course is can you make it cheaper? We love it, but we'd like to use more of it. And what we discovered is that we could develop this infrequent access storage class. And how it works is you turn on a capability we call life cycle management and it's completely automated after that. So we know from industry analysts and from talking to customers that the majority of data, perhaps as much as 80%, goes pretty cold after about a month and it's rarely touched again. So we develop the infrequent access storage class to take advantage of that. So once you enable it, which is a single click in the console or one API call, you pick a policy, 14 days, 30 days. And we monitor the read-write IO to every file individually. And once a file hasn't been read from or written to in that policy period, say 30 days, we automatically and transparently move it to the infrequent access storage class, which is 92% cheaper than our standard storage class. It's only two and a half cents in our US East One region as opposed to 30 cents for our standard storage class. Two and a half cents per gigabyte per month? Per gigabyte month. Things we've done for customers that we're particularly excited about is that it remains active file system data. So we move your file to the infrequent access storage class, but it does not appear to move in the file system. So for your applications and your users, it's the same file in the same directory. So they don't even need to be aware of the fact that it's now on the infrequent access storage class. You just get a bill that's 92% cheaper for storage for that file. I was like that. Okay, and it's simple to set up. You said it's one click and then I set my policy and I can go back and change my policy. That's exactly right. We have multiple policies available. You can change it later. You can turn off lifecycle management if you decide you no longer need it later. So how do you see customers taking advantage of this? What do you expect the adoption to be like and what are you hearing from them? Well, what we heard from customers was that they'd like to keep larger workloads in their file systems, but because the data tends to go cold and isn't frequently accessed, it didn't make economic sense to say to keep large amounts of data in our standard storage class, but there's advantages to them in their businesses. For example, we've got customers who are doing genomic sequencing and for them to have a larger set of data always available to their applications, but not costing them as much as it was, allows them to get more results faster as one example. You obviously see that. Yeah, what we're trying to do all the time is help our customers be able to focus less on the infrastructure and the heavy lifting and more on being able to innovate faster for their customer. So Duncan, some of the sort of fundamental capabilities of EFS include high availability and durability. Tell us more about that. Yeah, when we were developing EFS, we heard a lot from customers that they really wanted higher levels of durability and availability than they'd typically been able to have on-prem. It's super expensive and complex to build high availability and high durability solutions. So we've baked that in as a standard part of EFS. So when a file is written to an EFS file system and that acknowledgement is received back by the client, at that point the data is already spread across three availability zones for both availability and durability. What that means is not only are you extremely unlikely to ever lose any data, if one of those AZs goes down or becomes unavailable for some reason to your application, you continue to have full read-write access to your file system from the other two availability zones. So traditionally, this would be a very expensive proposition to do sort of on-prem and multiple data centers. Maybe talk about how it's different in the cloud. Yeah, it's complex to build. There's a lot of moving parts involved in it because in our case with three availability zones, you're talking about three physically distinct data centers, high-speed networking between those and actually moving the data so that it's written not just to one, but to all three. And we handle that all transparently under the hood in EFS. It's all included in our standard storage tier cost as well. So it's not something that customers have to worry about for either a complexity or a cost point of view. So very, I guess low RPO and RTO, am I understanding that? Essentially zero, if you will, between the three availability zones because once your client gets that acknowledgement back, it's already durably written to the three availability zones. All right, we'll give you last word just in the world of file services. What should we be paying attention to? What kinds of things are you really trying to achieve? I think it's helping people do more for less faster. So there's always more we can do and helping them take advantage of all the services AWS has to offer. Spoken like a true Amazonian. Duncan, thanks so much for coming on theCUBE. Thank you. I appreciate it. All right, and thank you for watching. Everybody will be back from Storage Day in Boston. You're watching theCUBE.


So I'm just on a King George Street here in Jerusalem one of the main traffic arteries in the city and as I was walking I Noticed a flag and as a flag buff I'm sad to say that I did not immediately recognize what this flag is It is the flag of the Republic of Kosovo and as the plaque here attests This is the embassy of the Republic of Kosovo in Jerusalem Israel So I'm not sure exactly what Kosovo status is via via the international community But they do have an embassy building here in Jerusalem one of a few well minus the U.S And I think Guatemala Two states and there are a bunch of consulates here most of which are actually accredited to the PA or officially the city of Jerusalem


Welcome back to the Cyber Underground where we dig deep to find out how cyber security touches all of a sudden our everyday lives. Today here again I have my exceptional co-host Mr. Andrew Lanny, Andrew the security guy. Hey everybody, how's it? And we have a great guest for you today, Mr. Mike Fafflund. Yeah, what's up Mike? I always dispel his name correctly. A Navy man. Thanks Sam. Right. Thanks for having me. Two Navy guys in a Marine, you know. Oh well, don't judge me. All right. That's a long time ago. You're forgiven. We love the Marines. Well, we have a purpose, right? And let's talk about your purpose. Yeah. We're at the US Navy on the cyber protection team. Wow. A lot of people don't even know it exists. It's true. We don't advertise. We don't advertise. It's not like you do public service analysis. That's all I can say about that. No. That's it? No. Yeah, you don't have to commercialize it. Yeah, I do. I do defense for the DOD and I've had the opportunity over a decade of doing not just defense but also offense. So I've gotten the full information security perspective. So I have a huge respect insecurity for pen testing because I got to do it on steroids with the government. Yeah. So call it to the government, you know. Which you can tell it's all about, right? We need to know the deep details, man. No, but it's been great. I think a big limitation of a lot of security analysts is they don't understand the offensive side. So as you do that and beyond just pen testing but having to really hide yourself, you know, through cyberspace, you can really respect and better analyze when an attack is happening on your network. So I've really appreciated that opportunity. So today you get a console or you get handed a thread and you get to watch it move around and play and fight back. How's it going, man? What are you doing in there? So you can't tell us. Tell us what you can. Like any other, you know, manager and information security and the DOD actually has a lot more money than a lot of industry. Sure. Really? Oh, they have my money. Yeah, that's right. It's just yours. No, but a lot of companies, you know, they just need to make the profit, you know. Right. But executives need the paycheck. But no, but when you have to decide. And that's what's important to them. Like competition is tough. So they just don't have the budget. So thankfully, we... To afford the good tools. We have a decent one. Thankfully, we're budgeting for this in our government. Yeah, we need it in government. But government's a massive target. There's an OPM breach. I'm a victim of that. Yeah, so our information's already... Yeah, thank you. You too. I'm sorry. They're somewhere, yeah. Thank you. OPM, by the way. Thank you so much. Mike's information is valuable. Mine's not. Just so we're clear. That's not true. You should go for someone that's older with a big debt. Yeah, yeah. As if there's actually money in it. You know the older word. Yeah, it's fair. It's fair. It's fair. Just see what audience knows. We're both older than Mike here. So that's okay. That's okay. You can bring out the old words. You guys are 32 and I'm 18, right? Right, right, right. Exactly. All right, all right. Let's talk about some kill chain, man. Can you give us an example? I mean, this WannaCry came out and we don't actually know if it was an e-mail first or if this was a network warm breach across multiple networks. What's the anatomy of just a basic ransomware attack and how did WannaCry work with this? So ransomware is not complicated.  What made WannaCry unique is not that it's some big innovation in ransomware. So much as the vast scope in which it propagated around the world because of the exploits it was using. And those exploits happened to be stolen and released by Shadowbrokers, which is an unknown group. But that's what made WannaCry so interesting. People tend to focus on the malware and this goes across most texts. It's just easy to identify so the media says, hey, let's talk about WannaCry. But really it's the exploits which made this interesting because that enabled a couple hundred thousand. I'm not sure what the count's up to right now. Computers around the world all get ransomware. And those exploits are eternal blue and there's a couple others. Now we're looking at 200,000 systems the last count I saw. Yeah, that's a lot of old, right? Can we talk about that SMB mechanism? So it's version one, version two, they're old. How does that work? What was it built for? We're talking about a Windows server messaging block that's attacked in this vulnerability specifically. Yeah, but the old one. Right, and so the old one, the one I used. And there's a lot of, the facts are not allowed yet. So it's unclear why the United States wasn't hit very hard. Maybe it's just because we use legitimate operating systems and we patch. But it's interesting the different parts of the world how the infection rate is higher or lower. But certainly, so Windows released a patch for this I think in April or March. Yeah.  Right. Or if you have, I was reading a report about 30% of antivirus stop want to cry. Actually caught it, cool. So which I'd love to see, and I think they should do this more when there's big incidents globally, but show how antivirus is performing. You know, consumer reports. Sure, you have a gauge, you know, silence did this, semantic did this. Because some of those companies are pushing the virus. Others are not. If you got antivirus, you still got to update your antivirus. That's true. You don't update your antivirus, it's useless. Silence is more like the machine learning though. So it's looking at stuff coming across the bus, a little different animal. So I have a good friend that works with silence. Oh, I don't. And I think they're going in a whole new direction. Antivirus used to be just blacklist. Yeah, signature. But now it's much more neural networks, machine learning, and that's the future. Yeah. It's a different discussion probably, but it wouldn't surprise me ten years from now if malware is a thing of the past. Yeah, that's awesome. I was talking about baseline. There's a great optimistic viewpoint. I'd like to go for the optimist, but we're in cyber, so he usually goes the other way, unfortunately. The end of malware. I love it. I mean, we have application whitelisting. I mean, whitelisting approaches, of course, are the most secure because anything that doesn't fall on that whitelist can't run. So if you did that on network, you also could stop an attack like this. But with these companies, they know more than government does. They know more than the media does. These big companies that have antivirus on hundreds of thousands of machines or millions, they can get all that data in real time. They can do their own scrubbing of essentially whitelisting, looking for anomalies. And that's how they feed for silence. That's how they feed their AI to learn more and more about what's been bad. It's fascinating. So let me ask your personal opinion. You don't have to represent the government. Oh, that's it. This is my personal opinion. I got to ask your personal opinion because we're on the same kind of sphere here. So I was in the podcast you sent me, and in there they mentioned that the time stamp on that patch was from February. So Microsoft sits on these things. What do you think about that? I mean, there's a business model and then there's the security model, and they seem to be divergent in this case, right? They don't want to patch Windows XP because they don't want to encourage businesses to stay on XP to grind that out to whatever the ROI is going to be forever. And on the other hand, you want the world not to grind to a halt. So do you sit on this patch? Do you release this patch? Which I want to know both your opinions on this one. Sure. It was nice of them to release a patch. That was benevolent. I think very benevolent. I mean, there's some industrial systems or some healthcare systems. There's some other gear out there that's got an XP operating system, and those manufacturers haven't developed a product to run on something else. So unfortunately, there's places in the world that are living with some of this. Should they? I think it's irresponsible. I mean, this could have been a lot worse because we all know, like, are there critical infrastructure systems still using XP, you know? Sure. State of Hawaii still using XP? No. Sure. No. What you show up is the hospitals in England. Yeah. If you read that. And I don't know if anyone died from this. That'd be interesting. I haven't seen that statistic yet, but I did see statistics changed. Like, when this first came out, I thought, oh, people are saying Windows XP is prevalent. And I say it, a national health system in the UK. What I saw was that now the statistics say it's mostly Windows 7. That's what I read that today. One percent was XP. One percent is XP. And Monday, we thought it was 150 million XP machines. Right, right. And I thought that was, oh, my God, that's exceptional. But now, Windows 7 makes a little bit more sense. I mean, people are dragging it out. It's good people have upgraded their operating system. I mean, they're still outdated. Yeah. Right. But no one wants to go to Vista. And they're afraid to go to TN7. There was a patch for 7, but they didn't do the patching, right? So as you mentioned, right? So, you know, just normal routine maintenance, right? You got to do it. You got to stay up with it. And they were saying it could get into the backups. Yeah. So if there's a time bomb in there, they could be delayed, get into the backups. And then even in your backups, when you restore them, you've got the virus again, and it'll go out looking for other computers on the network. And so this was an opportunistic attack where it's a worm that just spread, you know, as it could. And we're not sure if it started by email, you know, or it just spread SMB. I mean, usually you'd block SMB at the firewall, but it's unclear. Maybe it's a USB stick. So right in? Well, it's a lot of USBs to start propagating on May 12th. May 12th? True. Maybe. Maybe? Do you have that sprinkling of them in the parking lot? All over the world? Yeah. That's a big investment, actually. Yeah, I think it was. I know I would have said email. But yeah, there's still some gaps of knowledge of, you know, how else it might have spread beyond the obvious exploits that are built into this worm. I'm amazed at the gaps of knowledge we have even now after five, six days. Well, I think maybe you can't always talk about it. Do you guys have visibility on things, you know, that are coming at you before the rest of the world? I mean, do you get some updates that, you know, everybody else is like, let me find out three days later. No comment. Oh, man. That's terrible. Well, I just hope so. That's just from my perspective. I hope so, too. There are speculations that it's North Korea. Sure. We can see that. It is interesting. It's really disappointing how unsuccessful it is. Well, I imagine the attackers are. So there were a few flaws in this malware, and they haven't made a lot of money. You would have expected an attack on a couple hundred thousand systems would make a lot of money. But very early on, they learned that there were some issues, so the Bitcoin addresses were limited. It wasn't an automated system. Also, there's no reported, at least I haven't heard any reported, people actually recovering their files. It's questionable if the attackers are actually tracking all the private keys to decrypt all of that. So I think once people started hearing that, the number of people paying the $300 or $600 ransom is plummeted. So there's. They've only. I have less than a hundred thousand, I think. There's two tools there. Well, actually there's three tools out that I read about, and one of them is WANAKIWI. It actually looks at the computer's memory and scans to see if it can find the prime factorials, the P and the Q numbers they use in the calculations, to calculate the actual secret key to decrypt this malware so people haven't shut off their computer. So they did find a, have a workaround. Right. There's a one. If you had, you had long January booted your computer. I read that one. As soon as you reboot your computer, the chances are that memory block's been overwritten. Right. So it's active memory, right? You have to keep your power on. Good. So there's a chance you can recover your files, plus the NSA keeps reused keys. And that further shows, you know, it's more amateur. Because there is ransomware out there. Most of it, which we can't decrypt. Some of it is poorly implementing the encryption. Yeah, right. And this does sound like there was one person in accounts payable handling all the Bitcoin transactions. There was, it's not automated at all. So the, the, the podcast was, let's do, that you sent me. It was really interesting. I got it. Who was that from? It was out of risky.biz. The risky.biz, that's Australia. It's a good one. So a couple of Aussies talking about that, and they're really good. You can't watch this show, that's second best. Right. Thank you. So maybe it was a test, right? So maybe it's a test to see what kind of SMB was. I'm scared, you know. But this is testing the water. How do things, how do things crawl around? I don't think so. And this is why. So there's, this exploit's been, been seen already in the wild. So there's a good chance actually the other way around, this actually showed us that these, these computers might have already had malware, maybe even from this exploit. Okay.  But it's possible that these systems were already had malware. They were mining Bitcoin or sending spam or, you know, doing all those botnet kinds of things. Gotcha. So because this exploit's been out. So I think it's really just bringing to attention. So the exploit, you're talking about the mines bitware we found on the podcast from Risky Bids. They said that that exploit that mines Bitcoins turns off SMB. So it protects you from WannaCry. So if you're mining Bitcoin, there was saying it's, it's better to be mining Bitcoin than losing your share. Sure. That's right. It is. So yeah. Somehow it wants to defend its turf. Right. It's interesting that you say so. I heard from a healthcare, a guy came from a healthcare symposium yesterday at this. These folks were saying that it was first found in their backups. And I hadn't heard that. Oh. And so they had lost their backups and they had to go back a long ways. Like he said like 30 or 40 days to find some that weren't infected. And so did they not, you know, notice it and run it in their back? Did it attack? You know, it's interesting that that was there. Even if you tested the backups, you might not know. Right? Because the exploit is not active. So you might not be able to find it except for 30% of the antivirus actually caught this thing. Right. So we're going to take a break right now. Everybody will be right back. Come right back in about a minute and we'll keep on going. Welcome back to the Cyber Underground. I'm your host Dave Stevens. With me here today are my exceptional co-host Andrew Lanning, Andrew the security guy, and Mike Fafflin from the U.S. Navy Cyber Protection Command. Where's it? Team. Team. Okay. You don't have your own command. No. He's working on it. Working on it. Someday you're trying to take over. Lieutenant commander. Soon to be, right? Soon to be. I'm here personally though. I'm not a representative of the government. He's just here to share what he can. Yeah, that's right. You couldn't show up in uniform yet because you can't represent. It's really difficult to get people from the NSA here. I wonder why. I don't know why. Put their face on the screen. I wonder why. They're asking these questions. I don't know how to ask them. They just shut me down. Twitter working right now, and we just got a comment here. Mike got a rash from WannaCry. Is this true? It's true. Had to spend a long time in the chair. Really? Let's go show you. Is it? Can you show us? Yeah. We don't have FCC rules because we're not broadcasting. You can do whatever you want. We can have the black fuzz. Nice. You should just do it. Keep it behind the screen, right? There's a question I want, number six. Who are the shadow brokers, Mike? It's a great question. Well, they've been linked to Russia. What do you think? They have. I mean, they've been linked to Russia. What's that link? Is that a strong link? Is there proof there? I'm not an expert at shadow brokers. But yeah, what's interesting though is so shadow brokers, they've been releasing information about the Equation Group, which everyone thinks is the NSA. And how it relates to WannaCry is the exploits that are being used by WannaCry were leaked by the shadow brokers. So Microsoft released a patch in March. Shadow brokers released this exploit publicly in April. Yeah. Which is interesting. So what that shows is the shadow brokers, when they see that Microsoft patched what was a zero day, they then released, well, now the exploit's known. Or at least... Maybe they're just training us to do our updates. Maybe we'll be working together. I hope that's true. Yeah. I hope people start doing their updates now. I mean, this taught you that, right? I mean... If you have a plan to keep your company working 24-7 and making money, paying people, serving your customers, the best thing to do is never to go down. And the best way to prevent that, update your system. Have tested backups. Mm-hmm. Train your staff. Don't let this happen in the first place. Hopefully there's a good wake-up call for most of the world. I mean, the U.S. is pretty good. Again, the U.S., you know, we weren't hit that hard by this, but most, a lot of the world, you know, China, Southeast Asia, Middle East, they don't patch. That's what it seems like, right? The whole world will be more secure if we all patch.   Because a lot of those botnets are taking over machines that are just unpatched. What's the history of Shadowbrokers? Have they been around for a while? Have they been active? Have they caused trouble like this before? What do you know? He's working great questions, Dave. So what about Vault 7? What about Vault 7? Do you know anything about WikiLeaks and Vault 7, which is where they dump all the stuff that they get from people like Shadowbrokers? So again, not my area of expertise. I think that's Vault 7 is more of the CIA. Oh, okay. Which is how we learned that our TVs are listening to us. Even that one. I heard an interesting interview with James Clapper, former head of the CIA. Is that James Clapper? And he was saying that you might not want to stop this exploit of the Samsung TVs. CIA is not supposed to spy on its citizens, but if a foreign actor, a bad actor, got inside the U.S. boundaries, inside the U.S. borders, and was operating inside of the country, you might want them to be able to spy on that person via a Samsung TV. Now, they don't want to watch me walk around naked in the house. I don't think anyone wants to watch that. My wife wants to watch that, but I wouldn't want to watch that. What is he talking about? Spies. You might want to watch that. What does this have to do with want to cry? Do I want to cry? Do I want to cry if we see him walking around like this? You'd want to cry. Where is the content? There's a question of, you know, are exploits potentially good? They can be used for good things versus bad. There's a balancing act. So NSA, they developed this exploit for good reasons. If you think NSA does good things, which I think they... I want to believe that. I do. They defend America, right? But then it got leaked, and now it's been used, and potentially, again, people could have died from these hospitals where the systems were helpful. I haven't heard that yet. I haven't heard it all day, so this is good news. But certainly, it's had a big impact, and so it's hurt people's health. Surgery's delayed. That's the fact. Yeah, definitely. I was with a show last week, and Matt Rosenquist was there. He's IBM's cybersecurity strategist, and for sure, not want to cry, but already there's been a patient on the table, and the gear needed was ransomed when they turned it on. So they bring in the IT in the operating room. They're like, dude, you've got to get this working now. So there's been threats to life, for sure, but not want to cry related, but ransomware related. So want to cry exploits SMB, and one of my kids in their 20s asked me to... I kind of described in her terms what this want to cry does, how we exploit on a network on SMB. And tell me if I'm too off on this, because here's how I described it. There's a hallway, and there's a bunch of locked rooms, and each one has a digital keypad, and someone finds out that there's a secret override code on all those digital keypads.  But somewhere in that last week, someone had gone around to five of those doors and updated the keypads to take out that secret override code. So only five of the doors can be entered. So five of the doors are vulnerable systems, whereas five of them have been patched, and you cannot get them. Is that close to how want to cry works on a network? Can you tell us? Yes. So it's a really good exploit. This is a top... So I think Eternal Blue is the initial exploit, which was released by Shadowbrokers, but it's really effective. I mean, I don't know if it's 100%, but it seems very... if a system's unpatched, I don't know if it's a buffer overflow that the mechanism is for running malicious code on the system, but it takes advantage of that open port for SMB, and it's able to run malicious code. And then it does some other things, uploads the next payload. So it goes out there to the network, see if there's any more machines on the network, no more computers. Sees if this vulnerability exists. If it does, knocks on the door, tries to exploit it. If it can, it's on the system. That's interesting when you have a mixed network, some XP, some 7, some 10s that have been patched. So some of your systems aren't vulnerable at all. So theoretically, you can keep those systems running. For want to cry. Absolutely. I think most backups probably have not been targeted. It depends on how the backup is running. That's what I was wondering. I thought it was odd. Maybe it's a backup on a Windows 7. Maybe it's a good reason to go with cloud backups or another type of solution where someone else is going to patch it if you're not responsible to do that. It shouldn't be hot, right?  And there should be some kind of rotation. Right. That's what you're doing, not just one backup. And check them, too. Restore your backups. Make sure they work. People messed that up. So Mike, put yourself into the security role, CIO role of a corporation, right? What's your incident response like? You hear this is a couple of computers have got ransomware. What do you do? Because they call you first. So ransomware, I'm like it. So in this case, though, it's not a targeted attack. When I think it's a response, if it's just computers that are opportunistically targeted like this, there's not an adversary actively moving across your network. So there's a big difference between a targeted attack versus an opportunistic attack. So this is opportunistic. If it was a targeted attack, I'd want to maybe take a little bit more time to understand, before taking any action on the network, what I want to understand all the indicators of compromise and where are they on the network? And I want to deploy signatures to my ideas. So you're information gathering. Information gathering. But before really taking much action, maybe isolate some systems. But the idea is if it's targeted, you don't want to alert the adversary that you know they're there because they could become destructive. They could change out their implants to something else so that you can't find their backdoors that are hidden so you clean them off and they're still there. So there's a big difference between how you respond to a targeted attack versus an opportunistic. If it's opportunistic, there's no adversary actively watching what you do on the network, which is the case with WannaCry. So in this case, you can just isolate those systems. And in this case, we know it's ransomware. So maybe you wait until you get a decrypter that works, which most ransomware, you don't get that luxury. But in this case, it seems like it wasn't the top experts that wrote WannaCry. So we could do that. It looks like that, yeah. So at this point, I mean, maybe just isolate those systems, patch the rest of your network, install a good antivirus, and then maybe you can get the data back if there's data you want to get back. The crazy thing is most IT departments would inform everybody to take their systems offline and they'd probably send out an email. Well, in this case, because it's a rapidly spreading worm, you probably do want to disconnect the organization from the internet. Right? Right. Immediately. And if there are systems, isolate them and then patch. And then you're nice and good. This is a good case for subnetting your network, right? Finance has this, CIO Group has this, and CEO and the marketing, they're all different networks that you can unplug from the collective to get them offline. So if they're infected, they don't affect anybody else. Right. You want to subnet that. So that takes good planning. And that's one of the things we fail at as U.S. businesses overall, I think. We don't plan ahead very far. We have this mentality of just, get the shareholders there, they're cut, and then we'll take our bonus, and then six months later we do the same thing. We don't plan year over year how are we going to patch these systems, how are we going to secure these systems. Let's hire a CIO. Let's give them a budget, the main thing you don't get right to get a CIO. A lot of this is basic network hygiene, which is just not being maintained. Very common in business, very common in municipal government with strained budgets. I mean, it's hard when you have an organization of 10,000 machines. I mean, it's hard to keep them all patched. That's right. And especially if you only got one or two guys. Well, that's all good news, everybody. Thanks for joining us on this armor and a crown. Thanks for being with us, Mike and Andrew. Thanks as always. You guys are exceptional. Stay safe, everybody. Aloha.