1 00:00:00,000 --> 00:00:04,700 I hope this talk will end up being like some sort of a rampage of some sort. 2 00:00:04,940 --> 00:00:15,240 And so the next, seriously, I hope this next talk will go, I mean, well, I guess, I mean, the title could not be more blunt. 3 00:00:15,400 --> 00:00:19,080 Like, what the hell happened? Ron Taylor. 4 00:00:25,780 --> 00:00:26,800 Thanks, Ming. 5 00:00:26,800 --> 00:00:30,360 Yeah, so I want to set the expectations really low. 6 00:00:30,540 --> 00:00:35,700 I've gotten about 12 hours of sleep over the last three days, like most of you. 7 00:00:38,720 --> 00:00:40,180 So who am I? 8 00:00:40,320 --> 00:00:41,340 My name is Ron Taylor. 9 00:00:42,420 --> 00:00:48,340 I've been in security for about 20 years on the offensive and defensive side, doing a little bit of everything. 10 00:00:49,400 --> 00:00:52,860 You can find me on Twitter under Gus Gorman. 11 00:00:53,300 --> 00:00:56,720 Does anyone know where that name Gus Gorman comes from? 12 00:00:56,800 --> 00:00:58,600 Come on. 13 00:00:59,080 --> 00:01:02,260 It's like one of the earliest hackers in movies. 14 00:01:03,320 --> 00:01:05,560 Richard Pryor played the character. 15 00:01:06,720 --> 00:01:07,440 Superman. 16 00:01:08,280 --> 00:01:09,260 Yep, that's right. 17 00:01:10,020 --> 00:01:11,480 So that's where it comes from. 18 00:01:11,840 --> 00:01:13,900 You can also find me on MySpace. 19 00:01:14,520 --> 00:01:17,520 You guys don't use MySpace? 20 00:01:18,800 --> 00:01:20,000 It's coming back. 21 00:01:20,080 --> 00:01:21,080 I'm telling you right now. 22 00:01:23,660 --> 00:01:24,380 I've... 23 00:01:24,660 --> 00:01:26,500 So I say that... 24 00:01:26,500 --> 00:01:30,760 I've been a hacker for 39 years because my mom says I've been breaking shit since I was born. 25 00:01:31,440 --> 00:01:32,360 That's probably right. 26 00:01:33,340 --> 00:01:34,700 Actually, I got to update that. 27 00:01:34,780 --> 00:01:36,840 Unfortunately, in a couple weeks, I turned 40. 28 00:01:37,280 --> 00:01:38,320 Sad face. 29 00:01:40,040 --> 00:01:42,140 I'm a member of the Packet Hacking Village. 30 00:01:42,300 --> 00:01:51,180 Like Ming said, we do a lot of work here to be ready for the talks, the challenges and everything. 31 00:01:51,500 --> 00:01:54,560 And we appreciate you guys coming out and making it successful. 32 00:01:55,360 --> 00:01:56,480 I also run a B2B. 33 00:01:56,500 --> 00:01:58,120 I run a B-Sides conference in Raleigh. 34 00:01:58,180 --> 00:02:01,460 So if anyone's in that general area, reach out to me. 35 00:02:01,520 --> 00:02:03,560 We'd love to have you come or speak there. 36 00:02:05,280 --> 00:02:06,940 So what we're here for. 37 00:02:07,120 --> 00:02:10,460 First of all, I need to give you a disclaimer. 38 00:02:12,400 --> 00:02:21,560 So I first want to start out by saying that in no way am I bashing the boots-on-the-ground people involved with OPM. 39 00:02:22,660 --> 00:02:26,180 We all know that when it comes to information security, 40 00:02:26,500 --> 00:02:31,540 even if you want to do the right thing, a lot of times it's not possible, 41 00:02:32,260 --> 00:02:36,900 whether it's financial reasons or political reasons. 42 00:02:37,300 --> 00:02:45,040 But we've all been in a situation where we've been financially or politically hindered from doing the right thing. 43 00:02:45,220 --> 00:02:51,200 So if anyone's ever worked for OPM or does work for OPM, please don't take offense to this. 44 00:02:51,920 --> 00:02:56,060 We all know that it's likely someone above your pay grade made the decision. 45 00:02:56,500 --> 00:02:57,640 So it led to this catastrophe. 46 00:02:59,730 --> 00:03:00,920 It's a really long week. 47 00:03:02,340 --> 00:03:04,420 So first of all, who is OPM? 48 00:03:04,780 --> 00:03:08,100 OPM is the Office of Personnel Management. 49 00:03:08,400 --> 00:03:15,060 They are the human resources division for the civilian agencies in the federal government. 50 00:03:15,590 --> 00:03:17,160 They do a few other things. 51 00:03:17,460 --> 00:03:26,480 In 2005, they took the responsibility on to do backstabbing. 52 00:03:26,500 --> 00:03:29,380 They did background checks for the Department of Defense. 53 00:03:29,640 --> 00:03:36,380 Well, they took it from the Department of Defense Security Service before that's DSS was who was doing it, right? 54 00:03:36,760 --> 00:03:41,080 So, you know, that data is kind of key because you'll see while we go through this, 55 00:03:41,220 --> 00:03:45,760 there's a lot of, you know, things that happened during that time frame. 56 00:03:47,720 --> 00:03:49,300 So what was lost in the breach? 57 00:03:50,340 --> 00:03:51,020 A lot. 58 00:03:51,620 --> 00:03:55,960 Twenty-five point, twenty-one point five million SF-86 forms. 59 00:03:56,440 --> 00:03:56,480 Twenty-one point five million SF-86 forms. 60 00:03:56,940 --> 00:03:57,240 Okay. 61 00:03:57,380 --> 00:04:00,460 So what is an SF-86 form? 62 00:04:01,400 --> 00:04:03,620 Has anyone here filled out an SF-86 form? 63 00:04:03,840 --> 00:04:04,360 Yeah. 64 00:04:04,740 --> 00:04:07,200 If you've ever tried to work for the government, 65 00:04:07,920 --> 00:04:11,700 if you've ever just filled out an application, didn't even get the job, 66 00:04:12,920 --> 00:04:14,740 that's in their database, okay? 67 00:04:14,820 --> 00:04:15,520 That was lost. 68 00:04:16,760 --> 00:04:20,280 It has a lot of information in there, 69 00:04:20,380 --> 00:04:25,660 information about your family members, friends, 70 00:04:27,200 --> 00:04:32,360 psychological information, I'll show you in the next slide a little bit more about that, 71 00:04:32,500 --> 00:04:38,460 but aside from that, four point two million personnel files containing information, 72 00:04:40,420 --> 00:04:44,620 essentially, you know, all of your personal information about your military records, 73 00:04:44,800 --> 00:04:50,360 things like that, and on top of it, five point six million sets of fingerprints. 74 00:04:50,740 --> 00:04:52,720 So why is that bad? 75 00:04:53,800 --> 00:04:54,820 You can't change them. 76 00:04:55,040 --> 00:04:56,460 You can't change them. 77 00:04:56,460 --> 00:04:57,200 You can't change that, right? 78 00:04:57,320 --> 00:05:00,560 Yeah, you lose a username and password, you can change that. 79 00:05:00,760 --> 00:05:02,240 You can't change your fingerprints. 80 00:05:02,400 --> 00:05:04,960 So now, five point six million people, 81 00:05:05,100 --> 00:05:07,640 their fingerprint data is essentially compromised, right? 82 00:05:07,700 --> 00:05:13,460 So, you know, when we talk about the next generation of authentication, 83 00:05:16,020 --> 00:05:20,480 how can we really trust biometrics or fingerprints or biometrics? 84 00:05:20,580 --> 00:05:21,020 Can't. 85 00:05:21,840 --> 00:05:23,020 So that's a big problem. 86 00:05:23,520 --> 00:05:25,920 Note on the bottom here, I don't know if you can see that, but, 87 00:05:26,460 --> 00:05:32,580 the CIA, actually, does not use OPM for their data breaches or for their data breaches, 88 00:05:33,640 --> 00:05:35,260 yeah, I'm sure, of course they don't. 89 00:05:35,480 --> 00:05:37,400 For their background investigations. 90 00:05:37,540 --> 00:05:42,360 So it's interesting, but, you know, one of the articles that I read kind of pointed out 91 00:05:42,360 --> 00:05:48,840 something interesting that the fact that they didn't, you know, if someone, whoever 92 00:05:48,840 --> 00:05:55,140 has this data could essentially discern from that information, you know, if this person 93 00:05:55,140 --> 00:05:58,500 and is not in the database that I just stole, 94 00:05:58,720 --> 00:06:00,500 then that may mean they work for the CIA. 95 00:06:00,740 --> 00:06:05,440 So there was a report that right after the breach, 96 00:06:05,620 --> 00:06:10,300 a lot of the CIA folks were pulled out of places like China. 97 00:06:10,780 --> 00:06:12,360 Do you have a question? 98 00:06:22,020 --> 00:06:23,820 Yeah, it's interesting. 99 00:06:26,420 --> 00:06:28,940 So a little bit more about the SF-86. 100 00:06:29,240 --> 00:06:31,260 Shoot, you can't see that red very well. 101 00:06:32,960 --> 00:06:37,700 So to get a security clearance, you have to fill out an SF-86 form. 102 00:06:39,100 --> 00:06:41,500 I think the key things, there's a lot of information on here, 103 00:06:41,560 --> 00:06:43,700 and it's not meant to really go through all of it, 104 00:06:43,760 --> 00:06:46,600 but I think the key things is the investigations, 105 00:06:46,680 --> 00:06:51,020 they're designed to identify the type of information 106 00:06:51,520 --> 00:06:53,980 that could be used to coerce someone. 107 00:06:55,240 --> 00:06:59,320 To find out, is there a way that I can coerce them 108 00:06:59,320 --> 00:07:00,740 into betraying my country? 109 00:07:01,140 --> 00:07:03,380 That's what the SF-86 is for. 110 00:07:05,440 --> 00:07:13,540 And it also asks individuals to turn over the most personal data, 111 00:07:14,320 --> 00:07:16,120 details about their life. 112 00:07:17,060 --> 00:07:23,000 So you can kind of understand how this information, 113 00:07:23,280 --> 00:07:24,720 just start thinking about how this information, 114 00:07:25,140 --> 00:07:27,120 might be used against you, right? 115 00:07:31,700 --> 00:07:34,080 These are just some things out of the report, 116 00:07:34,260 --> 00:07:35,200 which we'll talk about, 117 00:07:35,420 --> 00:07:38,800 but some quotes from, so James Comey, 118 00:07:38,880 --> 00:07:42,300 he's someone who is fairly well known now, 119 00:07:43,320 --> 00:07:47,840 but he said the SF-86 lists every place he's ever lived 120 00:07:47,840 --> 00:07:49,160 since he was 18. 121 00:07:49,520 --> 00:07:53,940 His family members, siblings, all their information, of course. 122 00:07:54,400 --> 00:07:55,120 So it's, 123 00:07:55,140 --> 00:07:58,800 it's not just that individual person who filled out the SF-86, 124 00:07:59,140 --> 00:08:01,080 it's all their friends and family members 125 00:08:01,080 --> 00:08:02,500 that are affected by it as well. 126 00:08:04,460 --> 00:08:05,900 So, bad news. 127 00:08:08,080 --> 00:08:10,180 So here's where we're going to start kind 128 00:08:10,180 --> 00:08:14,340 of drawing other assertions about how this data is being used. 129 00:08:15,560 --> 00:08:18,840 So around the same time, there were a few other breaches 130 00:08:18,840 --> 00:08:20,560 that happened, large data breaches. 131 00:08:21,060 --> 00:08:25,000 So first of all, USIS, it was an OPM contract, 132 00:08:25,100 --> 00:08:25,120 it was an OPM contract. 133 00:08:25,140 --> 00:08:27,340 It was an OPM contractor that was actually doing 134 00:08:27,340 --> 00:08:30,560 background investigation stuff for OPM. 135 00:08:30,820 --> 00:08:34,720 They were breached in 2014, lost a ton of information. 136 00:08:36,500 --> 00:08:41,560 In December 2014, the other OPM contractor that they used 137 00:08:41,560 --> 00:08:43,380 was also breached, okay? 138 00:08:43,540 --> 00:08:46,540 So, you know, there should have been some sort of indication 139 00:08:46,540 --> 00:08:50,560 that OPM was a target around this time, right? 140 00:08:51,440 --> 00:08:52,540 All right. 141 00:08:53,700 --> 00:08:54,420 Anthem. 142 00:08:54,420 --> 00:08:58,440 Anthem, Primera, Empire, these are all other breaches 143 00:08:58,440 --> 00:09:01,540 that happened, and these same companies, 144 00:09:01,780 --> 00:09:06,740 they provide services for the government, right? 145 00:09:06,940 --> 00:09:09,540 So more information they're pulling together. 146 00:09:09,940 --> 00:09:11,300 Of course, Ashley Madison. 147 00:09:12,320 --> 00:09:14,620 Who was affected by the Ashley Madison breach? 148 00:09:14,780 --> 00:09:15,020 Anyone? 149 00:09:17,800 --> 00:09:19,580 I know you were, Greg. 150 00:09:20,320 --> 00:09:22,280 I know that guy was right there. 151 00:09:24,420 --> 00:09:27,040 Well, this is, it's important, and I'll tell you why in a second. 152 00:09:27,300 --> 00:09:31,620 And then, of course, between 2012 and 2015, 153 00:09:32,320 --> 00:09:34,300 that time frame, the OPM breach happened. 154 00:09:36,120 --> 00:09:38,980 So if you look at this, this was from, I think, 155 00:09:38,980 --> 00:09:40,080 the Washington Post. 156 00:09:40,300 --> 00:09:41,780 I should have, you know, looked into it more. 157 00:09:41,860 --> 00:09:45,400 But anyway, the person in the article kind of made this 158 00:09:46,200 --> 00:09:51,000 assertion that what they're doing is they're taking 159 00:09:51,000 --> 00:09:54,080 all these data breaches, and they're pulling all the information 160 00:09:54,080 --> 00:09:54,400 out of them. 161 00:09:54,400 --> 00:09:57,520 So they can correlate between them and say, hey, 162 00:09:57,620 --> 00:10:01,960 this person over here matches this person in this data breach 163 00:10:01,960 --> 00:10:02,620 that I found. 164 00:10:04,460 --> 00:10:07,680 How can we use that information against them, right? 165 00:10:07,760 --> 00:10:12,700 So if they, the SF-86 form says this person has, you know, 166 00:10:12,760 --> 00:10:16,440 a wife and three kids and lives, you know, wherever. 167 00:10:16,700 --> 00:10:18,120 This is his wife's information. 168 00:10:18,900 --> 00:10:21,300 And then he goes over to the Ashley Madison database 169 00:10:21,300 --> 00:10:23,540 and finds that same guy's information. 170 00:10:24,400 --> 00:10:28,640 He can coerce him basically by saying, hey, 171 00:10:28,880 --> 00:10:31,060 I'm going to tell your wife you're cheating on her, right? 172 00:10:31,600 --> 00:10:36,140 I mean, that's just one example of how this information 173 00:10:36,140 --> 00:10:37,580 can be used. 174 00:10:39,680 --> 00:10:44,120 But what they're doing is they're essentially building 175 00:10:44,120 --> 00:10:49,480 a dossier about each person in those databases, right? 176 00:10:50,100 --> 00:10:54,260 All that information is pulled into a database. 177 00:10:54,260 --> 00:10:59,180 And that database likely will be used in some way. 178 00:10:59,420 --> 00:11:04,060 Now, we'll talk a little bit more about whether it's being used 179 00:11:04,060 --> 00:11:07,760 and if we have any clues of how it's being used. 180 00:11:08,960 --> 00:11:14,100 But you can get an idea based on the different information 181 00:11:14,100 --> 00:11:18,100 that's been stolen, what's out there, right? 182 00:11:19,920 --> 00:11:21,840 So let's talk about the report. 183 00:11:22,140 --> 00:11:23,420 The majority of the information, 184 00:11:23,420 --> 00:11:26,040 the information that's here that I'm gonna talk about 185 00:11:26,040 --> 00:11:27,640 is based on this report. 186 00:11:29,060 --> 00:11:33,240 It's all open information, public information. 187 00:11:33,540 --> 00:11:36,020 I don't have any insider information at all. 188 00:11:36,520 --> 00:11:39,440 But I think it's really interesting. 189 00:11:39,660 --> 00:11:41,440 I started talking to a lot of folks about, 190 00:11:41,600 --> 00:11:44,940 who had been affected by it, and they really didn't, 191 00:11:44,940 --> 00:11:46,300 you know, we talked about this report. 192 00:11:46,520 --> 00:11:49,580 They really had no idea the impact of it. 193 00:11:49,720 --> 00:11:51,820 So that's kinda how this, you know, 194 00:11:52,320 --> 00:11:53,400 this topic is being brought up. 195 00:11:53,400 --> 00:12:02,520 talk came about was they didn't realize how bad, you know, OPM screwed up. And then that's 196 00:12:02,520 --> 00:12:07,420 kind of what we're going to talk about. So actually let me back up. So the report came 197 00:12:07,420 --> 00:12:14,000 out in December of 2016, right? So just last year. And it was done by the House Oversight 198 00:12:14,000 --> 00:12:20,320 Committee. This is the same group who investigated like Benghazi and things like that, okay? So 199 00:12:20,320 --> 00:12:26,640 they took, I think, three years, two and a half years to go through and investigate everything 200 00:12:26,640 --> 00:12:37,160 that happened and to determine, you know, kind of a timeline. So that's what we're going to talk 201 00:12:37,160 --> 00:12:43,780 about first is that timeline. Now, when we talk about the timeline here, I don't want you to 202 00:12:43,780 --> 00:12:49,240 think, you know, that they actually, this is when they found out the information. Most of what 203 00:12:49,240 --> 00:12:50,300 they found out was that it was a mistake. It was a mistake. It was a mistake. It was a 204 00:12:50,300 --> 00:12:51,460 mistake. It was a mistake. And I think that's what they thought it was after the report, after 205 00:12:51,460 --> 00:12:57,640 they did an investigation, okay? Because they really, they weren't monitoring anything. So 206 00:12:57,640 --> 00:13:04,580 first of all, the warnings were there, okay? The warnings were there before the breach. First 207 00:13:04,580 --> 00:13:11,160 of all, since early on, I think 2007 was probably the first time when they were really talking 208 00:13:11,160 --> 00:13:19,180 about APTs. And, you know, the government was warning agencies, hey, there's these threats out 209 00:13:19,180 --> 00:13:20,280 there. You need to be careful. You need to be careful. You need to be careful. You need to 210 00:13:20,280 --> 00:13:27,760 concerned about right but going back to 2005 the inspector general who's you 211 00:13:27,760 --> 00:13:34,300 know internal to OPM inspector general was was was telling them hey you are you 212 00:13:34,300 --> 00:13:38,400 have you know really bad security posture you're not doing two-factor 213 00:13:38,400 --> 00:13:44,320 authentication you know things like that and over and over again over the years 214 00:13:44,320 --> 00:13:52,300 you can see from 2005 to 2007 and then in 2008 2009 2010 they continued to raise 215 00:13:52,300 --> 00:13:58,140 that alert level saying hey you really need to do something here okay they 216 00:13:58,140 --> 00:14:02,520 ignored it and that's what we're going to talk about is exactly you know what 217 00:14:02,520 --> 00:14:11,080 happened so this all works out hey animations but this was a fun one to do 218 00:14:11,080 --> 00:14:11,400 so 219 00:14:13,120 --> 00:14:14,020 2000 July 220 00:14:14,020 --> 00:14:22,280 2012 so this is with first known adversary access to the network now they 221 00:14:22,280 --> 00:14:27,140 didn't find it in 2012 of course they didn't realize this until they did 222 00:14:27,140 --> 00:14:32,100 forensics and I think that the you know they actually found a piece of malware 223 00:14:32,100 --> 00:14:38,220 that they tied it tied them back to 2012 that's how they figured out that you 224 00:14:38,220 --> 00:14:40,080 know that was likely when they first got in 225 00:14:44,780 --> 00:14:51,940 between November in December 2013 I don't know the specific mm-hmm specific 226 00:14:51,940 --> 00:14:58,040 information they likely have found some sort of log or timestamp on on on 227 00:14:58,040 --> 00:15:03,520 TUbal where the indicated that they were moving around the network right so 228 00:15:03,520 --> 00:15:07,060 that for timeframes was where they realized 229 00:15:07,630 --> 00:15:12,520 someone is actually in their network know again they didn't realize that at 230 00:15:12,520 --> 00:15:12,920 that time. 231 00:15:13,040 --> 00:15:14,000 They, you know wanted the FBI but they, you know, not their you know, own literally anything that's equal. 232 00:15:14,000 --> 00:15:15,360 This is from the investigation. 233 00:15:18,040 --> 00:15:28,140 March 2014, the U.S. CERT notifies OPM and says, hey, your data is out there on the Internet. 234 00:15:28,480 --> 00:15:31,200 So someone is exfilling data from your network. 235 00:15:31,420 --> 00:15:36,320 So at that point, OPM actually did start to monitor their network, right? 236 00:15:36,560 --> 00:15:40,100 And they identified Adversary 1. 237 00:15:40,180 --> 00:15:43,500 In the report, I think they call it something else, but Adversary 1. 238 00:15:46,420 --> 00:15:47,820 That was the first. 239 00:15:48,020 --> 00:15:50,260 That's when they started monitoring them, okay? 240 00:15:53,080 --> 00:15:59,320 At the same time, while they're monitoring them, like, literally, they're watching them exfiltrate data. 241 00:15:59,640 --> 00:16:01,320 But they're like, well, that's not information. 242 00:16:01,860 --> 00:16:03,860 It's not really important information. 243 00:16:05,480 --> 00:16:12,160 They were monitoring them to see how close they got to, like, the background databases, okay? 244 00:16:12,300 --> 00:16:13,980 But they said, okay, that's not that. 245 00:16:14,000 --> 00:16:14,560 That's not that big of a deal. 246 00:16:14,680 --> 00:16:20,640 And they were coming up with a plan to, you know, kill them, you know, get them out of their network. 247 00:16:20,800 --> 00:16:24,080 But at the same time, they did exfiltrate some data. 248 00:16:24,420 --> 00:16:28,820 What that data was was essentially the blueprints to their network. 249 00:16:28,960 --> 00:16:33,460 It had network diagrams, usernames, passwords, things like that, right? 250 00:16:33,640 --> 00:16:40,460 It was all the information that they needed to continue their attack, right? 251 00:16:40,540 --> 00:16:43,980 I mean, just keep in mind, this attack happened over a minute. 252 00:16:44,000 --> 00:16:44,320 It happened over many years. 253 00:16:44,480 --> 00:16:48,140 And that's usually how, you know, APT-type attacks work, right? 254 00:16:48,260 --> 00:16:49,540 I mean, they get in. 255 00:16:49,660 --> 00:16:50,660 They start moving around. 256 00:16:50,800 --> 00:16:51,620 They escalate privileges. 257 00:16:51,860 --> 00:16:55,600 They try to save stealth, exfiltrate data when they can. 258 00:16:55,840 --> 00:16:57,340 Just try not to get caught. 259 00:16:59,020 --> 00:17:02,680 So now they have enough information to continue moving through the network. 260 00:17:02,860 --> 00:17:05,460 They know where the crown jewels are. 261 00:17:05,540 --> 00:17:06,480 They just need to get there. 262 00:17:13,180 --> 00:17:13,620 So. 263 00:17:14,000 --> 00:17:21,580 So around that same time, May 2014, a second adversary, which likely is connected. 264 00:17:21,800 --> 00:17:22,800 We'll talk about that later. 265 00:17:23,140 --> 00:17:24,380 Can you guys hear me okay? 266 00:17:24,600 --> 00:17:27,060 Like, I feel like this mic is like, okay, good. 267 00:17:27,180 --> 00:17:28,340 Do I even need the mic? 268 00:17:28,480 --> 00:17:29,120 It's on a better day. 269 00:17:29,360 --> 00:17:29,980 This is better. 270 00:17:30,080 --> 00:17:31,020 No, when you're up close. 271 00:17:31,260 --> 00:17:32,180 Okay, you need the mic? 272 00:17:32,480 --> 00:17:32,580 Yeah. 273 00:17:32,700 --> 00:17:33,140 Okay. 274 00:17:33,420 --> 00:17:33,860 Okay. 275 00:17:34,180 --> 00:17:34,820 I'll try. 276 00:17:35,300 --> 00:17:37,080 I hate holding mics. 277 00:17:37,800 --> 00:17:42,240 So anyway, around that time, they gained another foothold. 278 00:17:42,380 --> 00:17:42,820 Okay. 279 00:17:42,820 --> 00:17:47,620 Now, remember, the contractors had been already breached at this point. 280 00:17:47,860 --> 00:17:48,020 Okay. 281 00:17:48,680 --> 00:17:54,060 What OPM was doing was to give their contractors access to the network. 282 00:17:54,280 --> 00:17:59,700 They were giving them a username and password to VPN in, connecting to their network. 283 00:18:01,760 --> 00:18:11,040 Well, likely, what Adversary 2 did was use that information to access the OPM network, 284 00:18:11,240 --> 00:18:12,700 which they later. 285 00:18:12,820 --> 00:18:17,860 Figured out that it was, oh, sorry, let me back up. 286 00:18:18,320 --> 00:18:20,640 So they gained a foothold, got into the network. 287 00:18:20,880 --> 00:18:26,880 So now at this point, if they kick out the other guy, it's okay because they have another foothold. 288 00:18:27,080 --> 00:18:33,040 And the other point about this foothold is that they look like a normal user. 289 00:18:33,360 --> 00:18:33,840 Okay. 290 00:18:33,880 --> 00:18:38,120 They're logging in from, you know, using credentials of a contractor. 291 00:18:39,040 --> 00:18:39,940 So that's bad. 292 00:18:40,240 --> 00:18:40,720 Okay. 293 00:18:41,240 --> 00:18:42,420 What would have fixed that? 294 00:18:42,820 --> 00:18:45,020 Two-factor authentication, maybe? 295 00:18:45,200 --> 00:18:46,440 Well, they weren't doing that. 296 00:18:49,680 --> 00:18:57,500 Their master plan to mitigate this issue with Adversary 1 was called the Big Bang. 297 00:18:57,920 --> 00:18:58,280 Okay. 298 00:18:58,400 --> 00:19:05,740 And when they noticed the Adversary 1 getting closer to the crown jewels, 299 00:19:06,000 --> 00:19:10,520 then they executed this plan and, you know, kicked them off the network. 300 00:19:10,660 --> 00:19:12,800 But as we know, it doesn't really matter. 301 00:19:12,800 --> 00:19:14,920 It doesn't really matter because they already had other footholds. 302 00:19:16,220 --> 00:19:18,180 And they weren't monitoring those. 303 00:19:19,660 --> 00:19:27,900 So between June and August of 2014, Adversary 2 starts moving throughout the network. 304 00:19:28,260 --> 00:19:28,660 Okay. 305 00:19:29,260 --> 00:19:37,240 It gets to the point where he's found the investigation data and starts exfiltrating that out of our network, 306 00:19:37,400 --> 00:19:38,160 out of their network. 307 00:19:38,660 --> 00:19:39,380 Okay. 308 00:19:42,060 --> 00:19:42,420 Okay. 309 00:19:42,800 --> 00:19:48,860 And so at that point, the data was out there, okay? 310 00:19:49,200 --> 00:19:54,940 And OPM has to come out and say, okay, we acknowledge that there was a breach. 311 00:19:55,600 --> 00:19:59,020 Actually, it was more, like it says here in response to press reports, 312 00:19:59,120 --> 00:20:03,560 because people found out, hey, I think OPM has a breach. 313 00:20:03,660 --> 00:20:08,160 They didn't want to talk about it, but eventually they had to kind of own up to it. 314 00:20:10,060 --> 00:20:12,380 But they didn't really say, oh, yeah, 315 00:20:12,380 --> 00:20:13,500 we lost background data. 316 00:20:13,640 --> 00:20:18,820 Matter of fact, what they did was they said, oh, it's just some old manuals. 317 00:20:18,820 --> 00:20:23,160 It wasn't, you know, really important information, so don't worry about it. 318 00:20:23,660 --> 00:20:24,100 Okay. 319 00:20:24,400 --> 00:20:25,420 Is that because they didn't know? 320 00:20:28,860 --> 00:20:32,700 They only thought that the network diagrams and the manuals were the only things stolen at that point? 321 00:20:32,840 --> 00:20:35,960 They were eager to the fact that Adversary 2 had actually exfiltrated that data? 322 00:20:36,860 --> 00:20:37,300 Yeah. 323 00:20:37,860 --> 00:20:41,680 It's still kind of unclear as to exactly what they knew. 324 00:20:42,560 --> 00:20:45,520 But, yeah, most likely they knew that. 325 00:20:45,620 --> 00:20:49,160 I mean, after the investigation, which we'll talk about a little bit more. 326 00:20:49,220 --> 00:20:49,820 And here's the thing. 327 00:20:50,300 --> 00:20:51,960 I should have put this in my disclaimer. 328 00:20:52,560 --> 00:20:55,500 There's a lot of political aspects to this situation. 329 00:20:56,060 --> 00:20:57,580 I'm not going to get into that stuff. 330 00:20:58,280 --> 00:21:02,660 I think it's worth you guys reading the report. 331 00:21:03,300 --> 00:21:07,520 It's only 240-something pages, but it's a page turner. 332 00:21:07,520 --> 00:21:09,700 Let me tell you, it's actually really interesting. 333 00:21:10,320 --> 00:21:12,360 But that information is interesting. 334 00:21:12,380 --> 00:21:15,260 I mean, it's a lot of information that's in there, too, where they kind of make, you know, 335 00:21:15,260 --> 00:21:22,500 they talk about the political aspect of it and exactly why decisions were made and who lied to who and things like that. 336 00:21:22,600 --> 00:21:24,300 But, anyway, I'm not going to talk about that. 337 00:21:25,980 --> 00:21:26,420 Okay. 338 00:21:26,560 --> 00:21:36,400 So moving forward, in December 2014, you know, they've pilfered the OPM network at this point, 339 00:21:36,580 --> 00:21:38,380 got all the information they needed there, 340 00:21:38,580 --> 00:21:41,580 and they finally made their way over to the... 341 00:21:42,380 --> 00:21:44,680 the Department of Interior's data center, 342 00:21:45,320 --> 00:21:51,540 and this is where they started exfiltrating personnel data records, okay? 343 00:21:51,840 --> 00:21:53,500 That's where all that stuff was stored. 344 00:21:56,860 --> 00:21:59,080 So they exfiltrate that data. 345 00:22:00,040 --> 00:22:06,220 In March 2016, so, like, OPM at this point, they have no idea, right? 346 00:22:06,260 --> 00:22:09,420 They thought, hey, we got this guy out, no big deal, right? 347 00:22:10,560 --> 00:22:11,240 Everything's good. 348 00:22:11,400 --> 00:22:11,820 They didn't... 349 00:22:11,820 --> 00:22:13,120 they weren't monitoring anything. 350 00:22:13,380 --> 00:22:17,500 They didn't put any extra controls in place to, you know, 351 00:22:17,500 --> 00:22:19,680 to make sure that no one else is in their network. 352 00:22:19,880 --> 00:22:22,980 At this point, they still think, hey, we kicked that guy out. 353 00:22:23,040 --> 00:22:23,940 We know what we're doing, right? 354 00:22:24,580 --> 00:22:25,880 Well, they didn't, okay? 355 00:22:26,140 --> 00:22:29,360 And they continued to pilfer even more information. 356 00:22:29,680 --> 00:22:32,140 They found fingerprint databases, like we said. 357 00:22:32,700 --> 00:22:33,780 I mean, that's... 358 00:22:34,440 --> 00:22:36,040 that's pretty serious. 359 00:22:40,700 --> 00:22:41,660 In April, 360 00:22:41,820 --> 00:22:50,680 April 2015, an IT contractor, essentially, stumbles upon something that might be interesting, okay? 361 00:22:51,200 --> 00:22:53,400 They, you know, they weren't monitoring anything. 362 00:22:53,600 --> 00:22:57,980 They didn't have the controls in place to figure out, you know, is there an insider threat? 363 00:22:58,120 --> 00:23:00,160 So is there a compromised machine on my network? 364 00:23:00,280 --> 00:23:01,960 They didn't really know, okay? 365 00:23:03,500 --> 00:23:05,400 So they just stumbled upon it. 366 00:23:05,420 --> 00:23:11,800 And the way that he stumbled upon it was there was a call out to OPM, right? 367 00:23:11,820 --> 00:23:12,980 OPMsecurity.org. 368 00:23:13,400 --> 00:23:14,820 Sounds legit, right? 369 00:23:14,920 --> 00:23:16,680 But this guy actually, he knew. 370 00:23:16,780 --> 00:23:18,760 He said, wait, we don't have that domain. 371 00:23:19,240 --> 00:23:20,240 That's kind of weird. 372 00:23:20,540 --> 00:23:27,400 So, you know, at that point, they start investigating it because they said, something's wrong here, you know? 373 00:23:29,080 --> 00:23:36,060 And, well, at that point, you know, they had the oh, shit moment, right? 374 00:23:36,440 --> 00:23:38,960 And they said, okay, we got a problem. 375 00:23:39,760 --> 00:23:41,060 They're still in our network. 376 00:23:41,060 --> 00:23:42,540 And they've been there for a long time. 377 00:23:42,740 --> 00:23:44,640 So we need some help. 378 00:23:46,880 --> 00:23:53,000 So moving forward, April 2016, at that point, they actually called in Silence. 379 00:23:54,400 --> 00:23:56,740 They had been working with Silence in the past. 380 00:23:57,720 --> 00:24:04,840 And they just decided, we're not going to deploy their protection tools, okay? 381 00:24:05,080 --> 00:24:06,100 They could have. 382 00:24:06,220 --> 00:24:10,420 And back in 2014, they were playing. 383 00:24:11,200 --> 00:24:13,760 There were people who were saying, hey, we need to put this in place. 384 00:24:13,940 --> 00:24:14,820 But they didn't. 385 00:24:14,820 --> 00:24:19,840 Even though they knew that there were adversaries in their network, they knew that they were a target. 386 00:24:21,200 --> 00:24:22,180 They didn't do it. 387 00:24:23,480 --> 00:24:31,220 And like I said, whether or not that was politically motivated, it's different. 388 00:24:32,880 --> 00:24:37,980 And then, of course, pretty quickly, once they realized, hey, we've got a problem. 389 00:24:38,060 --> 00:24:38,920 Now we need help. 390 00:24:39,060 --> 00:24:40,820 We need to get this first. 391 00:24:40,820 --> 00:24:41,540 We need to get this person out of the network. 392 00:24:41,760 --> 00:24:52,220 Of course, they deployed the solution, the Silence Protect, and started identifying stuff. 393 00:24:52,720 --> 00:24:54,820 And I like this quote right here. 394 00:24:56,400 --> 00:25:03,680 The engineer that came in from Silence, he said, literally, the tool lit up like a Christmas tree. 395 00:25:03,760 --> 00:25:09,180 They found so much stuff within hours that it just lit up like a Christmas tree. 396 00:25:10,300 --> 00:25:10,600 So. 397 00:25:10,820 --> 00:25:14,080 Of course, I'm sure they had another oh, shit moment there, too. 398 00:25:17,080 --> 00:25:26,680 And May 20th, 2015, OPM, of course, now at this point, they've determined, yeah, we've got a problem. 399 00:25:26,780 --> 00:25:28,180 We've got malware all over our network. 400 00:25:28,260 --> 00:25:30,320 People have owned us left and right. 401 00:25:31,120 --> 00:25:33,100 I think we have to notify Congress. 402 00:25:33,820 --> 00:25:40,380 Because they actually have a requirement to notify Congress when something like this happens. 403 00:25:40,820 --> 00:25:44,120 Which is likely why they were downplaying it for so long. 404 00:25:44,920 --> 00:25:47,900 So they notify Congress on May 27th. 405 00:25:48,900 --> 00:25:50,240 OPM briefs the media. 406 00:25:50,520 --> 00:25:54,300 So at this point, they come out and they say, listen, we're sorry. 407 00:25:54,880 --> 00:25:55,920 We're so sorry. 408 00:25:56,420 --> 00:25:58,660 We lost your data. 409 00:26:00,000 --> 00:26:02,500 It's about 4.2 million records. 410 00:26:02,900 --> 00:26:05,640 Of course, we know now it was a lot more than that. 411 00:26:05,860 --> 00:26:06,360 Okay. 412 00:26:06,620 --> 00:26:09,200 And they kind of downplay it the whole time, right? 413 00:26:09,260 --> 00:26:10,700 You know, they're trying to downplay it. 414 00:26:10,700 --> 00:26:12,020 And not make it seem so serious. 415 00:26:15,100 --> 00:26:18,200 At this point, so USR comes in. 416 00:26:18,610 --> 00:26:21,180 And, you know, they're doing their investigation as well. 417 00:26:21,420 --> 00:26:27,680 And they also realize, hey, it's not just this 4.2 million, you know, records. 418 00:26:27,940 --> 00:26:31,420 There's also background data investigation that was stolen. 419 00:26:32,440 --> 00:26:33,740 Another oh, shit moment. 420 00:26:35,460 --> 00:26:40,340 At that point, the director, who was Director Archuleta, 421 00:26:40,700 --> 00:26:46,260 she says, okay, yeah, we lost the background data information, too. 422 00:26:47,120 --> 00:26:52,120 So she's kind of forced to acknowledge that. 423 00:26:54,320 --> 00:27:01,040 So in June, after 74 days of deployment of the Cylance Protect software, 424 00:27:01,680 --> 00:27:05,160 they deployed it on 10,000-something computers. 425 00:27:05,380 --> 00:27:08,140 They found 2,000 pieces of malware. 426 00:27:09,740 --> 00:27:10,540 Nearly one. 427 00:27:10,700 --> 00:27:14,100 One piece of malware for every five computer devices. 428 00:27:15,540 --> 00:27:17,760 That's a lot of malware on a network. 429 00:27:18,040 --> 00:27:20,160 And who knows how long it was there. 430 00:27:20,280 --> 00:27:24,540 Right now, we know, after the investigation, the first piece they found in 2012. 431 00:27:25,640 --> 00:27:32,100 You know, if you work in defense, you know, time to remediation, time to detection is key. 432 00:27:32,300 --> 00:27:38,360 If you don't find it within, you know, within hours, likely they've already started taking your data. 433 00:27:38,520 --> 00:27:38,980 Okay. 434 00:27:39,000 --> 00:27:40,280 And gaining a better foothold. 435 00:27:40,700 --> 00:27:43,720 So their network's completely rooted at this point. 436 00:27:44,100 --> 00:27:44,880 It's owned. 437 00:27:45,400 --> 00:27:46,400 What do they do? 438 00:27:46,620 --> 00:27:47,020 Okay. 439 00:27:47,420 --> 00:27:48,680 I would pull the plug. 440 00:27:48,840 --> 00:27:52,060 But, you know, at this point, you know, what's the point? 441 00:27:52,380 --> 00:28:00,500 But in July, OPM comes out and says, hey, yeah, we need to update that number. 442 00:28:00,680 --> 00:28:02,300 It wasn't as small as we thought. 443 00:28:02,540 --> 00:28:06,640 It was actually 21.5 million people compromised. 444 00:28:07,060 --> 00:28:10,020 And, of course, July 10th. 445 00:28:10,700 --> 00:28:12,300 Director Archuleta resigns. 446 00:28:12,400 --> 00:28:13,280 Very convenient. 447 00:28:17,440 --> 00:28:22,000 September 23rd, OPM updates the estimate about the fingerprints. 448 00:28:22,200 --> 00:28:25,440 Because originally they said, yeah, it was like 1.1 million fingerprints. 449 00:28:25,780 --> 00:28:28,720 Now they say, no, it's actually about 5 million. 450 00:28:28,860 --> 00:28:30,520 But, you know, give or take a couple million. 451 00:28:30,540 --> 00:28:31,260 What does it matter? 452 00:28:31,600 --> 00:28:31,660 You know? 453 00:28:32,380 --> 00:28:32,940 Yeah. 454 00:28:33,780 --> 00:28:40,520 And then, prior to testifying before the committee, the CIO. 455 00:28:40,700 --> 00:28:48,300 Donna Seymour resigns. So again that's convenient. Which delayed the investigation because now 456 00:28:48,300 --> 00:28:59,000 she's not there. Anyway, I won't talk, I won't go down that rat hole. But like I said, read the 457 00:28:59,000 --> 00:29:05,960 report. This is more information, interesting information there. Okay. So again from the 458 00:29:05,960 --> 00:29:15,080 report, the key findings, they had, first of all, they failed to prioritize their data. In 2005 459 00:29:15,660 --> 00:29:22,260 they took on all this background information investigation. They took on the responsibility of 460 00:29:22,260 --> 00:29:28,340 doing the background investigation and storing it. Right? They had to secure it. That was their 461 00:29:28,340 --> 00:29:34,340 responsibility. But they never changed, when they did that they never changed their security 462 00:29:34,340 --> 00:29:35,940 posture. They never said, hey, we're going to do this. And they're always trying to do it. 463 00:29:35,960 --> 00:29:42,900 we have really even more important information, we need to secure it better. 464 00:29:42,940 --> 00:29:44,980 We need to put other mechanisms in place. 465 00:29:46,570 --> 00:29:49,140 So, you know, that's a key finding there. 466 00:29:51,000 --> 00:29:52,340 Multi-factor authentication. 467 00:29:52,860 --> 00:30:00,580 So I think the federal government started requiring multi-factor authentication, I don't know, 2005, 2007. 468 00:30:00,580 --> 00:30:10,800 If anyone, you know, is involved with, like, DISA STIGs and requirements like that, you know, it's been there for a long time, okay? 469 00:30:11,240 --> 00:30:12,840 They weren't doing it, you know? 470 00:30:12,980 --> 00:30:17,820 The inspector general said since 2005, hey, you've got to do this, you've got to put this in place. 471 00:30:18,020 --> 00:30:19,480 They still didn't, okay? 472 00:30:19,560 --> 00:30:23,360 Even after this compromise in 2015, they still hadn't done it. 473 00:30:24,100 --> 00:30:26,640 I mean, come on. 474 00:30:27,980 --> 00:30:29,780 Usernames and passwords get stolen. 475 00:30:29,900 --> 00:30:30,440 They knew that. 476 00:30:30,440 --> 00:30:31,720 They knew that they were stolen, okay? 477 00:30:31,900 --> 00:30:34,120 But they still didn't put this in place. 478 00:30:34,440 --> 00:30:37,060 So that's a pretty serious thing, right? 479 00:30:37,200 --> 00:30:38,360 To me, it's negligence. 480 00:30:42,640 --> 00:30:44,340 They didn't encrypt the database. 481 00:30:45,420 --> 00:30:47,620 I mean, they've, yeah. 482 00:30:48,300 --> 00:30:49,620 So that's what they said. 483 00:30:49,720 --> 00:30:57,420 They said, well, and actually, if you can go on YouTube and watch the proceedings from when Congress was grilling them, 484 00:30:57,500 --> 00:30:59,620 and some of it was really, really entertaining. 485 00:31:00,440 --> 00:31:07,140 But they essentially said, well, our systems are too old to do encryption. 486 00:31:09,260 --> 00:31:09,860 Okay. 487 00:31:10,100 --> 00:31:11,560 Well, that's a problem. 488 00:31:11,700 --> 00:31:12,280 We get that. 489 00:31:12,420 --> 00:31:15,400 But that still doesn't mean it's okay, right? 490 00:31:15,540 --> 00:31:22,640 I mean, this is information that if stolen can affect lots of lives in different ways. 491 00:31:22,780 --> 00:31:27,140 So, again, another major finding that they weren't encrypting anything. 492 00:31:29,100 --> 00:31:29,700 Yeah. 493 00:31:29,780 --> 00:31:30,280 So, sorry. 494 00:31:30,440 --> 00:31:31,260 I kind of already said this. 495 00:31:31,300 --> 00:31:33,560 Legacy systems was their excuse. 496 00:31:38,080 --> 00:31:44,020 So, like I said, they just didn't listen to the inspector general. 497 00:31:44,160 --> 00:31:52,540 Another thing you'll find in the report is that there really wasn't a good relationship between the inspector general and the OPMCIO, right? 498 00:31:52,840 --> 00:31:55,220 Which caused a lot of political issues. 499 00:31:55,520 --> 00:31:57,940 And essentially, they were just ignoring everything they said. 500 00:31:58,060 --> 00:31:59,560 The inspector general came in and said, hey. 501 00:31:59,560 --> 00:32:01,340 You guys got to do this, this, this. 502 00:32:01,460 --> 00:32:02,400 And we recommend this. 503 00:32:02,520 --> 00:32:03,860 They just said, okay. 504 00:32:04,360 --> 00:32:04,720 Whatever. 505 00:32:04,880 --> 00:32:05,320 We'll do it. 506 00:32:05,560 --> 00:32:06,320 Don't worry about it. 507 00:32:08,120 --> 00:32:12,360 They had, they didn't even have an inventory of what was on their network. 508 00:32:12,740 --> 00:32:12,980 Okay. 509 00:32:13,060 --> 00:32:14,340 If you're in defense, you know. 510 00:32:14,820 --> 00:32:17,140 If you don't know it's there, you can't defend it. 511 00:32:18,020 --> 00:32:18,380 Okay. 512 00:32:18,420 --> 00:32:19,140 I mean, it's key. 513 00:32:19,620 --> 00:32:21,060 Visibility on your network is key. 514 00:32:21,800 --> 00:32:24,680 So, they had no inventory of what was on their network. 515 00:32:25,120 --> 00:32:25,480 Okay. 516 00:32:26,200 --> 00:32:26,920 Big problem. 517 00:32:29,640 --> 00:32:43,520 So, another key thing here, which is, you know, it's not a technical finding, but what they had found was that they looked at it and they said, OPM is only spending $7 million a year on cybersecurity. 518 00:32:44,040 --> 00:32:48,440 They were actually at the lowest level of all the agencies, you know. 519 00:32:48,840 --> 00:32:57,240 And I'm just thinking about, you know, one of the Staples commercials, you know, where the guy's like, hey, I just saved us all this money by shopping at Staples, right? 520 00:32:57,360 --> 00:32:58,660 Just think about that one. 521 00:32:58,780 --> 00:32:59,280 You know. 522 00:32:59,280 --> 00:33:06,220 You know, they were probably like, hey, we only save, our budget is really low and, you know, we don't have to, we don't spend that much money. 523 00:33:06,400 --> 00:33:14,120 Well, that's a problem because that just shows that they weren't putting, you know, they didn't value that data. 524 00:33:14,260 --> 00:33:17,580 They didn't see the value in spending money on cybersecurity. 525 00:33:18,700 --> 00:33:28,700 They were essentially the biggest target of all the agencies and they just, they didn't protect it in that way. 526 00:33:32,780 --> 00:33:39,460 Two-factor authentication, that was one of the critical security controls, but there was a lot of other things. 527 00:33:40,400 --> 00:33:45,520 Obviously, if they're not doing two-factor authentication, there's a lot of other things that they probably weren't doing. 528 00:33:48,880 --> 00:33:50,980 So, this is an interesting thing. 529 00:33:51,780 --> 00:33:56,180 If you work in government, there's a thing called authority to operate. 530 00:33:56,500 --> 00:33:58,780 It's essentially kind of a sign-off where... 531 00:33:58,780 --> 00:34:03,880 They say, okay, your networks, your systems are up to spec. 532 00:34:04,120 --> 00:34:05,620 They meet the requirements. 533 00:34:06,620 --> 00:34:09,940 You get a sign-off that says you can operate them, okay? 534 00:34:11,840 --> 00:34:13,660 They didn't really care about that. 535 00:34:13,860 --> 00:34:26,560 They basically were all the systems, especially the personnel investigations processing system, which is where they input all the data and everything, had no ATO, right? 536 00:34:26,940 --> 00:34:28,240 They were ignoring it. 537 00:34:29,000 --> 00:34:37,500 For a long time, which is, I mean, if anyone works in, you know, DOD or government, you know an ATO is really important. 538 00:34:38,340 --> 00:34:44,440 So, you know, it's a big violation of it that way. 539 00:34:46,320 --> 00:34:48,240 So, I thought this was a key thing. 540 00:34:48,340 --> 00:34:53,060 It's hard to see here, but the fact that they had no logging. 541 00:34:53,240 --> 00:34:58,500 I mean, they were really, they essentially were doing no logging on the network or the database. 542 00:34:59,580 --> 00:35:12,260 There's really no way to know what documents that were stolen and what was, you know, the scope of the breach. 543 00:35:12,500 --> 00:35:25,900 And another thing that they don't really point it out too much in the report, but the truth is because they don't have the logging, who's to say that they didn't modify any data, right? 544 00:35:26,000 --> 00:35:27,600 And that's a whole other aspect. 545 00:35:28,780 --> 00:35:41,880 They could have entered some, if it's a nation state, you know, you want to get someone implanted, you can, here's your security clearance right here, you know, you pass. 546 00:35:42,680 --> 00:35:46,600 And they had no way to determine that because they weren't logging any of that information. 547 00:35:48,100 --> 00:35:49,620 So, a little scary. 548 00:35:52,800 --> 00:35:54,960 So, I skipped this slide. 549 00:35:55,400 --> 00:35:56,700 Oh, I guess I didn't. 550 00:35:56,980 --> 00:35:58,200 As far as attribution. 551 00:36:00,360 --> 00:36:01,060 Oh, no. 552 00:36:01,140 --> 00:36:01,580 Sorry. 553 00:36:01,760 --> 00:36:02,300 Let me back up. 554 00:36:02,580 --> 00:36:13,400 So, one of the indications, which, like I said, the report doesn't go too technical into exactly what the malware did and, you know, things like that. 555 00:36:13,580 --> 00:36:21,480 But what they identified was that it was using, the malware they did find was using a version of HiKit A and HiKit B. 556 00:36:21,900 --> 00:36:26,660 And I don't think I have a slide on it, but one of the interesting things that I found was, 557 00:36:26,660 --> 00:36:43,480 I almost kind of feel like the attackers weren't that sophisticated because they were hiding it in a DLL that was, the name of it was linked to McAfee antivirus or McAfee security, whatever they call it. 558 00:36:44,440 --> 00:36:46,680 And they weren't running that, right? 559 00:36:46,780 --> 00:36:49,560 So, you know, OPM wasn't even running that. 560 00:36:49,600 --> 00:36:55,980 So, that was kind of one of the indications, like, that, you know, that there was a malware problem because, 561 00:36:56,660 --> 00:37:00,540 they found this file and they're like, wait, it's a McAfee file. 562 00:37:00,680 --> 00:37:01,940 We don't run McAfee, right? 563 00:37:02,180 --> 00:37:06,960 But the majority of the government and DOD does run McAfee. 564 00:37:08,100 --> 00:37:14,400 I know U.S. Army, that's one of their, you know, main endpoint protection things, right? 565 00:37:14,580 --> 00:37:15,540 So, it's kind of standardized. 566 00:37:15,740 --> 00:37:24,040 So, anyway, they were kind of, they were guessing, but you would think that they would have done a little bit more recon to determine whether, what they were really running. 567 00:37:24,700 --> 00:37:26,580 But, like I said, here's the other. 568 00:37:26,660 --> 00:37:33,100 The other thing was, we talked about this a little bit more, but they were watching them take the data, okay? 569 00:37:34,240 --> 00:37:41,000 But the truth is, they were never able to determine how they actually got entry. 570 00:37:41,180 --> 00:37:42,360 Like I said, no logging. 571 00:37:43,100 --> 00:37:46,140 So, they still don't really know how they, they know they were there. 572 00:37:46,260 --> 00:37:50,380 They saw them exfiltrating data and eventually they found that they were monitoring. 573 00:37:50,640 --> 00:37:55,840 But they still don't know, even after all this investigation, how they initially got in. 574 00:37:56,540 --> 00:37:58,440 Likely it was a compromised machine, right? 575 00:37:58,500 --> 00:38:03,480 Usually it was some sort of client-side attack over the web or email or something like that. 576 00:38:03,720 --> 00:38:06,260 It's not too difficult to attack clients. 577 00:38:08,200 --> 00:38:24,500 But another thing that they, you know, they realized, too, was later on they said, okay, yeah, maybe that the original data breach with the manuals and everything, maybe that really was a big problem. 578 00:38:24,820 --> 00:38:25,340 So. 579 00:38:25,840 --> 00:38:37,460 You know, they acknowledged later on that, yeah, that data was probably used to, the manuals and things like that, it was likely used for them to continue their attacks. 580 00:38:38,280 --> 00:38:39,980 So, interesting stuff. 581 00:38:41,100 --> 00:38:48,860 And, you know, because of that, they determined in the report that they likely could have stopped this. 582 00:38:48,980 --> 00:38:55,060 When they initially were alerted by CERT that there was some exfiltration happening. 583 00:38:55,840 --> 00:39:01,960 And when OPM came out and downplayed it and said, hey, yeah, it's not that big of a deal, it's just some old manuals. 584 00:39:01,960 --> 00:39:08,180 If they had put in place protections at that point, they could have stopped it. 585 00:39:08,760 --> 00:39:16,440 But instead, they downplayed it and, of course, all the rest of the data was stolen. 586 00:39:17,400 --> 00:39:20,060 Which, you know, it's pretty serious. 587 00:39:20,420 --> 00:39:23,640 I already talked about this one here with OPM security. 588 00:39:25,840 --> 00:39:28,440 This is one of the things that I talked about a little bit. 589 00:39:28,640 --> 00:39:33,580 But the silence tools were available to them as early as June 2014. 590 00:39:34,340 --> 00:39:37,280 And like I said, they could have put those in place. 591 00:39:37,380 --> 00:39:38,280 They could have deployed them. 592 00:39:38,320 --> 00:39:40,100 But they decided not to. 593 00:39:41,340 --> 00:39:46,500 Even after the big bang, they decided not to purchase. 594 00:39:47,020 --> 00:39:50,780 They kind of quoted it and they evaluated it. 595 00:39:50,840 --> 00:39:54,140 But they said, no, you know, we think we got the guy out. 596 00:39:54,240 --> 00:39:55,440 So, we're not going to. 597 00:39:55,440 --> 00:39:56,380 We're not going to buy it. 598 00:39:58,700 --> 00:40:08,960 Oh, and so you see here, the CEO of Silence said that their excuse was that there were political challenges on the desktop. 599 00:40:09,280 --> 00:40:17,140 So, if any of you have worked with government or in government IT, of course, you know there's a lot of, you know, segmentation. 600 00:40:17,140 --> 00:40:20,260 And this group doesn't work well with this group. 601 00:40:20,360 --> 00:40:23,780 And political reasons for not doing things. 602 00:40:23,920 --> 00:40:24,180 Okay. 603 00:40:24,280 --> 00:40:25,180 So, this is one. 604 00:40:25,440 --> 00:40:26,940 Major aspect of it. 605 00:40:29,680 --> 00:40:32,980 You know, once they put in the silence tools, they immediately found. 606 00:40:33,200 --> 00:40:34,440 I don't work for silence. 607 00:40:34,720 --> 00:40:39,640 But, you know, they should probably, you know, give me a T-shirt or something for talking about them. 608 00:40:41,780 --> 00:40:42,540 But, yeah. 609 00:40:42,620 --> 00:40:45,160 So, they implemented silence protect. 610 00:40:45,680 --> 00:40:47,780 And it lit up like a Christmas tree. 611 00:40:49,720 --> 00:40:51,600 So, as far as attribution. 612 00:40:52,540 --> 00:40:53,580 Attribution is not easy. 613 00:40:53,780 --> 00:40:54,940 When we hear things. 614 00:40:54,940 --> 00:40:58,960 When I hear things on the news about, oh, yeah, there's attackers. 615 00:40:59,060 --> 00:41:00,040 They came from Russia. 616 00:41:03,180 --> 00:41:07,240 Listen, we all know that it's not easy to track things like these attacks back. 617 00:41:07,360 --> 00:41:09,380 Especially if you're not doing logging and things like that. 618 00:41:09,520 --> 00:41:12,360 So, I always think that that's interesting stuff. 619 00:41:12,780 --> 00:41:17,440 But, what they were able to do is they essentially, they're kind of guessing, right? 620 00:41:17,500 --> 00:41:24,800 But, based on the high kit malware, they said it's likely the Axiom group was the people who put that there. 621 00:41:24,940 --> 00:41:27,020 Just based on the fact that it was there. 622 00:41:27,120 --> 00:41:29,280 It doesn't really, they don't know that for sure. 623 00:41:29,460 --> 00:41:31,580 Someone else could have been using that malware, of course. 624 00:41:33,160 --> 00:41:35,820 But, they attributed back to that in the report. 625 00:41:36,360 --> 00:41:48,700 And then, they also said that this other group, because they were involved with the WellPoint and Anthem breaches. 626 00:41:48,940 --> 00:41:53,420 And they attributed it back to them as well. 627 00:41:53,520 --> 00:41:54,380 They said likely there. 628 00:41:54,380 --> 00:41:55,500 They're working together. 629 00:41:56,900 --> 00:42:02,080 So, they essentially said, hey, we think these two groups were probably working together. 630 00:42:02,460 --> 00:42:07,520 And, you know, there's tiebacks of those groups back to nation states. 631 00:42:07,700 --> 00:42:12,400 So, that's when they start kind of saying, okay, you know, we think it might be China, you know. 632 00:42:17,200 --> 00:42:24,200 So, in, I think, somewhere, 2015 time frame, the president of China was going to come over. 633 00:42:24,240 --> 00:42:24,360 And he said, hey, we think these two groups were probably working together. 634 00:42:24,360 --> 00:42:24,560 And he said, hey, we think these two groups were probably working together. 635 00:42:24,560 --> 00:42:25,600 And, you know, they're going to visit with Obama. 636 00:42:27,640 --> 00:42:30,020 And there's a little bit of tension about this, right? 637 00:42:30,080 --> 00:42:33,240 Because at this point, you know, they're saying, oh, it was China. 638 00:42:33,400 --> 00:42:34,080 It was China. 639 00:42:34,180 --> 00:42:34,480 It was the nation. 640 00:42:34,660 --> 00:42:36,820 You know, it was China's government that hacked us. 641 00:42:38,420 --> 00:42:39,920 Whether or not that was true, we don't know. 642 00:42:41,260 --> 00:42:43,500 But, so, there's a lot of pressure and a lot of tension. 643 00:42:44,020 --> 00:42:47,200 So, China says, oh, we found them. 644 00:42:47,240 --> 00:42:48,220 And we arrested them. 645 00:42:49,260 --> 00:42:49,840 Don't worry. 646 00:42:50,160 --> 00:42:51,220 We took care of it. 647 00:42:53,500 --> 00:42:54,340 And, you know, they're saying, oh, it was China. 648 00:42:54,340 --> 00:43:02,280 But the truth is, China's known for throwing people in prison for doing things that maybe 649 00:43:02,280 --> 00:43:07,560 they did or didn't do. Or maybe they did something else and they said, well, let's just blame this 650 00:43:07,560 --> 00:43:17,240 on them so that the U.S. is happy. So anyway, it's interesting. So the report continues. We 651 00:43:17,240 --> 00:43:21,440 talked about the findings. But it goes on to make recommendations, of course, like any good 652 00:43:21,440 --> 00:43:28,520 report should. I know this is like a ridiculously small or complex slide. And it's meant to be 653 00:43:28,520 --> 00:43:36,720 because I honestly the stuff in the report, most of it the recommendations are political type 654 00:43:37,960 --> 00:43:44,120 recommendations about CIOs and how you should hire them and make them accountable and make sure 655 00:43:44,120 --> 00:43:51,040 that they're competent. So I thought I highlighted a few words, you know, in there in 656 00:43:51,040 --> 00:43:51,420 this. 657 00:43:51,440 --> 00:43:55,380 I thought that was interesting because they really did point a 658 00:43:55,380 --> 00:43:59,180 lot of it back to, you know, the upper management, which is good 659 00:43:59,180 --> 00:44:01,400 and that's why I put that disclaimer out there at the 660 00:44:01,400 --> 00:44:07,260 beginning because, you know, we all know that it's, most of the 661 00:44:07,260 --> 00:44:10,760 decisions are above our pay grade. But they also recommended 662 00:44:10,760 --> 00:44:15,540 a zero trust model, you know. To them that was a new concept 663 00:44:15,540 --> 00:44:20,640 but we know it's not. Accountability, that was a big, 664 00:44:21,060 --> 00:44:24,540 that's a big piece of it, right? Which, you know, I thought it was 665 00:44:24,540 --> 00:44:29,400 funny that it was in the report because, you know, there really 666 00:44:29,400 --> 00:44:32,120 wasn't much accountability, which is the sad part because a 667 00:44:32,120 --> 00:44:34,440 lot of people were affected by this. A lot of people are still 668 00:44:34,440 --> 00:44:39,600 affected by it. I mean, if you had a clearance, had your SF-86 669 00:44:39,600 --> 00:44:43,640 stolen, you know, a lot of people are looking over their 670 00:44:43,640 --> 00:44:46,680 shoulders. You know, you have to travel abroad, travel to 671 00:44:46,680 --> 00:44:49,260 China, you know, and you were affected, you're going to be 672 00:44:49,260 --> 00:44:50,200 looking over your shoulder. 673 00:44:50,640 --> 00:44:55,000 And be a little bit paranoid. And how do you fix that? You 674 00:44:55,000 --> 00:44:59,280 don't. I mean, it's just, it's just out there, right? So it's, 675 00:44:59,320 --> 00:45:01,800 you know, it's sad that no one was really, really held 676 00:45:01,800 --> 00:45:06,660 accountable for the, what I think is the gross negligence. 677 00:45:11,240 --> 00:45:13,540 But those are the recommendations that were in the 678 00:45:13,540 --> 00:45:18,460 report. These are kind of my recommendations of how not to 679 00:45:18,460 --> 00:45:19,640 become the next OPM. 680 00:45:20,640 --> 00:45:24,280 First of all, you have to know the value of your data, okay? You 681 00:45:24,280 --> 00:45:28,420 know, if you're hired into a company and, you know, your upper 682 00:45:28,420 --> 00:45:33,780 management that's not in IT, in security says, yeah, we need you 683 00:45:33,780 --> 00:45:36,520 to do this job, right? You know, the first thing you need to say 684 00:45:36,520 --> 00:45:39,280 is, okay, well, what kind of data are you holding? What, you 685 00:45:39,280 --> 00:45:43,260 know, what, you know, what information do we need to secure? 686 00:45:43,720 --> 00:45:47,180 And based on that, that's how you kind of start prioritizing 687 00:45:47,180 --> 00:45:50,620 things, right? Of course, you have to know the value of your 688 00:45:50,640 --> 00:45:52,720 data. Of course, there's different regulations like PCI 689 00:45:52,720 --> 00:45:58,260 and HIPAA and things like that. Regardless of those, you really 690 00:45:58,260 --> 00:46:03,660 have to know the information that you're securing and 691 00:46:03,660 --> 00:46:07,840 prioritize based on, you know, based on how that is, what 692 00:46:07,840 --> 00:46:10,020 you're going to put in place and where you put those controls in 693 00:46:10,020 --> 00:46:14,060 place. But regardless, you got to start with the basics. I mean, 694 00:46:14,060 --> 00:46:16,140 like we said in the report, they weren't doing encryption, 695 00:46:16,460 --> 00:46:20,620 okay? Encryption is not a new concept, people. It's a new 696 00:46:20,640 --> 00:46:23,340 concept. You know, it's just ridiculous that they weren't 697 00:46:23,340 --> 00:46:26,880 encrypting their databases at all. They likely weren't even 698 00:46:26,880 --> 00:46:29,100 encrypting, I'm sure they weren't encrypting the traffic 699 00:46:29,100 --> 00:46:33,440 over the network, but whatever. They just, you know, had the 700 00:46:33,440 --> 00:46:36,940 keys to the front door anyway, so they went in and stole it. So 701 00:46:37,760 --> 00:46:41,300 just, you know, it's information that they needed to 702 00:46:41,300 --> 00:46:45,900 secure. Two-factor authentication, again, that's 703 00:46:45,900 --> 00:46:49,920 pretty simple. You know, that's something that's not a new 704 00:46:49,920 --> 00:46:50,620 concept. You know, it's not a new concept. It's not a new 705 00:46:50,640 --> 00:46:54,000 concept. That's really important for, especially VPN 706 00:46:54,000 --> 00:46:59,720 type access. You have a contractor giving them access to 707 00:46:59,720 --> 00:47:05,020 their network. First of all, something I didn't add in here, 708 00:47:05,140 --> 00:47:10,140 but you need to evaluate your contractors. If you're letting 709 00:47:10,140 --> 00:47:13,740 contractors into your network, to your databases, you need to 710 00:47:13,740 --> 00:47:17,920 evaluate their security, too. Don't just assume that they're 711 00:47:17,920 --> 00:47:20,620 doing the right thing, okay? You need to just say, you know, 712 00:47:20,640 --> 00:47:25,300 hey, you want to connect to our network, we need to know what 713 00:47:25,300 --> 00:47:27,440 kind of thing, what you're doing for security, and we're going to 714 00:47:27,440 --> 00:47:32,120 do our own audit on your network before you connect, okay? So 715 00:47:32,120 --> 00:47:35,720 that's an important thing. Visibility. Visibility is key. 716 00:47:35,940 --> 00:47:41,400 So, of course, we defend our networks. We put firewalls and 717 00:47:41,400 --> 00:47:44,800 intrusion prevention and, you know, things like that in place. 718 00:47:45,180 --> 00:47:48,980 But we all know that eventually we're going to be compromised, 719 00:47:49,100 --> 00:47:50,620 regardless, okay? That's one of the things that we're going to 720 00:47:50,620 --> 00:47:54,340 do. It's no longer, you know, if you will, it's when you'll be 721 00:47:54,340 --> 00:47:59,100 compromised, okay? So having visibility in your network, east 722 00:47:59,100 --> 00:48:02,740 and west traffic, not just north-south, okay? We know if 723 00:48:02,740 --> 00:48:08,000 something calls us out to a C2 over our edge IPS, we might see 724 00:48:08,000 --> 00:48:11,500 that. But what about the traffic when they're traversing in your 725 00:48:11,500 --> 00:48:14,600 network? Once your system gets compromised, the first thing 726 00:48:14,600 --> 00:48:16,900 that they're going to do is they're going to pivot, and 727 00:48:16,900 --> 00:48:19,500 they're going to start moving laterally across the network, 728 00:48:19,680 --> 00:48:20,600 pulling out data, and then they're going to be compromised. 729 00:48:20,620 --> 00:48:25,020 Okay? How do you see that if you do not have that visibility on 730 00:48:25,020 --> 00:48:28,500 your network? You know, I won't go into the technical details of 731 00:48:28,500 --> 00:48:30,820 it, but there's a lot of, you know, a lot of things that you 732 00:48:30,820 --> 00:48:33,520 can do. There's a lot of really good tools these days to be able 733 00:48:33,520 --> 00:48:38,180 to identify that information. So, and at the very least, know 734 00:48:38,180 --> 00:48:45,000 what's on your network, okay? Address the roadblocks. You 735 00:48:45,000 --> 00:48:49,100 know, this is kind of a political type thing, but we all 736 00:48:49,100 --> 00:48:50,600 have those roadblocks. And, you know, we all have those roadblocks 737 00:48:50,620 --> 00:48:55,940 in our, you know, in our environments as far as how do I 738 00:48:55,940 --> 00:48:59,820 get shit done, right? How do I convince my management that I 739 00:48:59,820 --> 00:49:05,400 need to put in place these security controls? So you really 740 00:49:05,400 --> 00:49:08,860 need to address that stuff. And a lot of it goes back to, you 741 00:49:08,860 --> 00:49:11,380 know, knowing the value of your data, okay? If you can go back 742 00:49:11,380 --> 00:49:15,020 to your management and say, okay, listen, this is the type of 743 00:49:15,020 --> 00:49:19,440 information that we need to protect, and this is why, okay? 744 00:49:19,500 --> 00:49:20,600 This is why we're a target. This is why we're a target. This is 745 00:49:20,620 --> 00:49:25,220 why we're a target. That goes a long way towards, you know, 746 00:49:25,220 --> 00:49:32,180 opening up those roadblocks. Plan for when you're, after you're 747 00:49:32,180 --> 00:49:36,100 compromised. Most of the time when we spend money on security 748 00:49:36,100 --> 00:49:40,140 controls and defense, it's defense, right? It's, it's, it's, 749 00:49:40,790 --> 00:49:44,960 we're defending our network. Most of the time that money, that 750 00:49:44,960 --> 00:49:49,180 bucket, the money we spend on after, you know, the remediation, 751 00:49:50,620 --> 00:49:53,560 the forensics, the type, that type of stuff is very low. And we 752 00:49:53,560 --> 00:49:56,600 usually don't think about it until after the fact. So, you 753 00:49:56,600 --> 00:50:00,540 know, my recommendation is, you know, as far as architecting 754 00:50:00,540 --> 00:50:04,340 your security solutions, think about that. Think about what 755 00:50:04,340 --> 00:50:08,600 would I do if I was compromised already and build and architect 756 00:50:08,600 --> 00:50:13,780 it from there. Accountability, that's the last thing on there. 757 00:50:13,840 --> 00:50:16,540 It's really kind of complicated, right? Because, you 758 00:50:16,540 --> 00:50:20,360 know, how do you hold people accountable for the fails? But 759 00:50:20,620 --> 00:50:23,120 the truth is, you have to. You know, it's, it's really 760 00:50:23,120 --> 00:50:28,700 challenging. It's a really challenging concept, but you have 761 00:50:28,700 --> 00:50:34,400 to hold people accountable for what they're responsible for. And 762 00:50:36,360 --> 00:50:37,680 that's, that's all I got. 763 00:50:45,680 --> 00:50:49,700 Damn, that was perfect timing. I can't believe that. 764 00:50:51,740 --> 00:50:55,840 Yes, actually, I have three or four questions, but let's start 765 00:50:55,840 --> 00:50:59,860 with you, by the way. So, first thing, concerning contractors, 766 00:51:00,710 --> 00:51:05,180 you said that the contractors should be securely aware, etc., 767 00:51:05,180 --> 00:51:11,220 etc. Do you think ISO 27000 is enough to make sure that the 768 00:51:11,220 --> 00:51:16,300 contractor is compliant? No, I mean, I think, I think you've 769 00:51:16,300 --> 00:51:19,780 got to start with requirements, guidelines, things like that. But 770 00:51:19,780 --> 00:51:20,600 the truth is, you know, I think, I think you've got to start with 771 00:51:23,720 --> 00:51:28,120 your, you know, treatments. A lot of people think it's 772 00:51:28,120 --> 00:51:29,000 readable, and you're supposed to have ten fees and so on and so 773 00:51:29,000 --> 00:51:33,260 forth. Yeah, but the truth is, the truth is, if you don't sort 774 00:51:33,260 --> 00:51:34,360 structure, if you don't take into account everything, you know, 775 00:51:34,540 --> 00:51:37,280 what'sying, you know, how the company Kush junction works and 776 00:51:37,280 --> 00:51:37,640 stuff like that. And, you know, again, it's ok if you just get 777 00:51:37,640 --> 00:51:37,920 to higher level, just take things as they are. But you know, 778 00:51:37,920 --> 00:51:39,200 if you're just going to support the competition, I think it's 779 00:51:39,200 --> 00:51:40,000 because of that solid form of life experience that you have. So, 780 00:51:40,400 --> 00:51:45,180 again, I would be more than happy to support a company that has a 781 00:51:45,180 --> 00:51:50,580 missed example because that's probably the category where you keep 782 00:51:59,380 --> 00:52:06,320 Yeah. I mean that's another aspect that should have been on 783 00:52:06,320 --> 00:52:11,080 that slide, the recommendation slide, air gap. I mean when it 784 00:52:11,080 --> 00:52:17,640 comes to stuff like that, if your data is that important, that 785 00:52:17,640 --> 00:52:22,580 sensitive, you need to have an air gap network. So, yeah. 786 00:52:22,720 --> 00:52:35,760 Question. We got a question. You know, they didn't go into 787 00:52:35,760 --> 00:52:39,320 that. I would love to know. Actually I was hoping that he 788 00:52:39,900 --> 00:52:44,960 was here. I mean if you are, come tap on my shoulder over the 789 00:52:44,960 --> 00:52:47,140 village. I'll be across the way. What were you looking for? 790 00:52:47,560 --> 00:52:52,340 Huh? Who were you looking for? Like. No, he was talking about 791 00:52:52,340 --> 00:52:58,160 the opium contractors. Oh, those. Yeah. They didn't talk 792 00:52:58,160 --> 00:53:02,940 about that. But, yeah, I'd love to know as well. Any other, oh. 793 00:53:06,680 --> 00:53:10,220 Like I said, I wasn't going to go into the political aspect of 794 00:53:10,220 --> 00:53:17,620 it, but I'll give you my opinion. Yeah. Yeah. The accountability part of it, like, 795 00:53:17,640 --> 00:53:24,060 I said, that was just another big fail. Right? They were, yeah, 796 00:53:24,160 --> 00:53:34,500 exactly. Yeah. Yep. Exactly. Yeah, sure. 797 00:53:38,480 --> 00:53:45,880 So, we are in pointing at these things. Okay, so let's, my points, 798 00:53:45,880 --> 00:53:45,940 they are part of the reader should be the reader select of the 799 00:53:45,940 --> 00:53:46,320 sending the, somebalanças in the chat those days, certainly there 800 00:53:46,320 --> 00:53:52,720 is an interface that doesn't the distinction in nature when you are 801 00:53:52,720 --> 00:53:58,120 using the database. And certainly, it might be, we have now the 802 00:53:58,120 --> 00:54:00,480 boxes to this point. Yeah, yeah. 803 00:54:00,580 --> 00:54:04,380 Already the credentials of the administrators hurt drinking. And 804 00:54:04,380 --> 00:54:04,480 stuff crisp nicely. The audience gets the sense not to worry 805 00:54:05,220 --> 00:54:09,380 What's the point? It's true. It's true. But as far as doing the 806 00:54:09,380 --> 00:54:12,820 basics, they weren't even doing the basics. That was the point. 807 00:54:12,980 --> 00:54:18,000 Right? I mean, it's all, it all works together. Right? Two 808 00:54:18,000 --> 00:54:21,340 factor authentication, decryption. You're not doing the 809 00:54:21,340 --> 00:54:27,540 basics, then everything is going to fail. Anyone else? All right. 810 00:54:27,560 --> 00:54:31,820 Thanks, everyone. Ron Taylor, everyone. Thank you so much, 811 00:54:31,820 --> 00:54:32,020 Ron.