What Stops a Cyberattack? Lessons From Real Incidents

The full conversation from the webinar above, lightly edited for readability. Timestamps mark each section.

0:00 · Welcome & Introductions

Jenn: What stops a cyberattack? Lessons from real incidents. It’s been a few months since we’ve held a webinar here at Macro. Technical Account Manager and my webinar bestie Nick Frangopoulos and I are thrilled to have Solutions Engineer Roman Soto from Blackpoint joining us for our first one back. To celebrate kicking things off again, you might have noticed that we’re offering the first 50 people who stay for the live webinar a $20 card they can use for lunch or a treat. Those who qualify will get their card in the next few days. Our other offer is equally delicious: for anyone here today not taking advantage of Blackpoint, we’re offering a free 180-day historical scan for signs of suspicious activity in your Microsoft 365 environment. Nicholas can help you get that set up.

Nicholas: Absolutely.

0:54 · Why Macro Partnered With Blackpoint

Jenn: This is our first webinar with a partner at Macro. We’re always evaluating the tools and tech we use to keep our clients safe and on, and we recently made the switch to Blackpoint as our 24/7 detection and response solution. Many of our clients don’t even realize Blackpoint is helping protect them. That’s because Blackpoint’s security operations center, or SOC for short, as they say in the biz, is quietly running in the background powering the service we provide. If you’re a Macro client joining us today, you’re likely wondering if your service with us includes Blackpoint. Great question: ask your account manager after today’s call. And if you just happened upon our webinar because you’re concerned about your current security stack and team, make sure you reach out to Nicholas.

1:47 · What We’ll Cover

Jenn: Here’s what we’re going to cover today. Today’s webinar was actually inspired by Blackpoint’s Inside the SOC webinar, which happens the first Tuesday of every month. Is that right, Roman?

Roman: Yes, ma’am.

Jenn: It’s when they break down the very latest threats, and it’s geared toward people who are way smarter than me: the cybersecurity specialists. Say that three times fast. So today we’re going to go through two very real incidents from a business perspective. This way we can all understand how they happen, how they’re stopped, and how to reduce your risk. We’ll open the floor to a Q&A at the end, so if you have any questions, add them using the Q&A feature. All right, let’s get into it.

Nicholas: Sounds good, Jenn.

2:36 · Incident 1: The Fake “Verify You’re Human” Prompt

Jenn: I want you to picture that you hit that unexpected “verify you’re human” prompt. You know the one I’m talking about. You usually have to select all the pictures with buses in them, and I usually have to go through that about four times, which tells me I need to make an appointment with my optometrist. Or there’s that occasion when you get a Teams message from someone who seems to be from IT support. Everything looks legit, but maybe something feels off. Worst case, you ignore your gut and then the worst case happens. The issue doesn’t really come down to carelessness. It’s how convincingly attackers exploit familiar workflows: browsing, signing in, messaging, remote support. It’s scary, and it’s happening to even the most cautious employees. Both of these incidents happened this month to Blackpoint clients, and I’m going to throw it over to Roman so he can take us through each of them.

Roman: Thanks, Jenn. What we’re seeing today is a transition, an evolution, in what we expect when we think of a cyberattack. Usually we’d think: I go to some malicious website, and oh no, it’s riddled with a virus, and now something pops up on my screen saying “I have control of your device” or “I have control of your browser, you can’t do anything.” Hackers, or adversaries, learned from that the same way we learned to prevent it. What we’re starting to see now is more sophisticated attacks: something that looks like a routine check, to Jenn’s point. We’re verifying “I’m a human, I want to access that website,” going through whatever we need to for our day-to-day job. But when it looks like I verified via a CAPTCHA, looking through all those buses or bikes or trains just to confirm, we start to see a Windows Run command kick off from there. We’re being asked by some “admin,” really an adversary, to paste something into that terminal or Run box and hit Enter so they can move forward. Realistically, what they’re looking for is the ability to run those steps and get backdoor access into either that session or that device overall. Nick, I wonder if that’s the same exposure you’ve seen in the conversations you’re having day to day. I know that’s part of the trends we’re talking about today, but that resonates with you, right?

Nicholas: Yeah, absolutely. What stands out to me, Roman, is how ordinary the starting point for something like that can be. Somebody’s researching something for work, or visiting a site they have a legitimate reason to use, and a familiar-looking verification prompt appears. The example here involves people just doing their everyday work, doing something they’d probably do even at home.

6:00 · How the ClickFix Kill Chain Unfolds

Roman: Exactly. That brings us to the next slide, going over what that story looks like for most folks. I’m a true American: I learn everything from a story. Tell me the beginning, middle and end. When we see something like this as a step-by-step process, the main thing is walking through that kill chain so we understand it. It helps with detection, response, and how to prevent it in the future. Like we talked about, it starts with a trusted site that could be quietly compromised, and what we’re looking at is ads. It’s not the bygone internet we all knew, where there weren’t too many ads focused on driving traffic or engagement somewhere else. Now it could just be a sponsored ad on the side banner while we’re going through a wiki page, learning the lore of a GitHub repository or a video game. As they click that, they’re asked for that verification at the same point. The employee then runs the command they’re given, based on whatever that ad or adversary is asking. That’s how the attacker gains access to their passwords or username, because of the session they’re hijacking at that same time. The problem exists between keyboard and chair. No matter how much we lock down the internal network, some of us, just in the speed of things, can get caught in the lurch. It’s tough.

Nicholas: Absolutely. And that gives us the business problem. A person follows what looks like a routine instruction, and now the attacker can end up with remote access, saved passwords, or access to an existing signed-in session. That access can let them look around, take information, or use someone’s identity to reach further into the environment. From an operations perspective, we have to think about what happens after that first mistake. Training matters. I always preach “train again.” But we also need protection that can catch the activity and help with containment. So, Roman, once someone runs that command, what are you looking for that tells you this needs attention? And what does the response timeline look like?

Roman: Typically, from the end user’s side, that’s the scary part: if we’re going through this timeline, they’re none the wiser for the most part. They’re getting something based on clicks, ClickFix, accessing these websites. The only thing they see is a Run command kicking off, and they think maybe that’s expected based on this website, or just the new internet, the new norm. From an admin’s perspective, what could get kicked off on the back end via logs? You would hope to see that explorer.exe is kicking off a PowerShell prompt because of that Windows Run. So there are symptoms, traits an IT admin can see, but that goes in lockstep with how fast these events are actually happening. Like we’re seeing here, where one happened over the span of four minutes.

9:09 · Real Incident: Four Minutes in a Healthcare Environment

Jenn: So this actually happened, Roman. This happened with one of your clients. I love this slide because this actually happened, and this happens all the time. What’s impressive here is the response time, but I’ll let you go through it. I just love the real stories.

Roman: Exactly. It’s good and bad at the same time. It’s interesting to see that this is happening out in the wild. The main thing to know is that it’s not a matter of if any of these events are going to happen; it’s a matter of when. We’ve been saying that for the past year, two or three, at least from the Blackpoint perspective, at least the last four, once we had ITDR and really started to see a lot of these social engineering threats. What we’re seeing here is based on a healthcare environment. Talking about the speed of going through that day-to-day: they need to access something from their non-persistent station. The device isn’t going to get impacted; it’s going to be that user account that’s authenticated across the board in that industry, with access to your patients’ data or any external information connected at the same time. With this attack that we experienced in October, the user pasted that Run command based on what was guided from that prompt, and we start to see the actual malware detection. The main thing is the log comes in within an average of about 20 seconds to two minutes. This lends credence to how, from the MDR perspective, we’re able to respond within two minutes, meaning isolating the device and then resetting that user’s credentials, revoking any session tokens, limiting further contamination of the environment. So when the SOC calls that MSP (typically we work in lockstep with Macro Technology Group as that powered arm) or that end client, we’re saying: everything was taken care of, but this is what occurred, and here’s the incident report. Did you review it via email? If not, we can talk about it over the phone. And again, the user didn’t see any of that lateral movement. It had to be observed behind the scenes, because they’d already made it past the initial gate of prevention.

Jenn: So you’re all going as superheroes for Halloween, right, Roman?

Roman: Yes, ma’am. Nothing as crazy as the marketing from other cybersecurity vendors, with superheroes or vigilantes or villains. I got my kids into the MCU recently, so that’s something we’re actually looking forward to.

Jenn: Love it.

Nicholas: Roman, what stands out to me here is that someone acted on the alert and isolated the device. In this case you observed no lateral movement, meaning you didn’t see the attacker spreading to other systems, but there was still some follow-up work to do, including rebuilding the device and resetting user credentials. Containment is an important step, even though it doesn’t mean the cleanup is finished.

12:13 · The Clearest Warning Sign

Nicholas: With that, I want to get into our next slide and bring it back to the person sitting at the keyboard. What’s the clearest warning sign that this “verify you’re human” prompt is asking them to do something they shouldn’t?

Roman: In general, nothing outside of a direct phone call, via Zoom or Teams, will prompt you to copy a command and paste it into a Windows Run box or open a command-line terminal to fix whatever you’re running into. That’s always the largest, most glaring issue: never copy anything and paste it anywhere. We’ve gotten a little complacent overall as users of digital workplaces, where we can access everything from our phones, and that locks everything down outside of a certificate being accepted on an iPad, iPhone or Android device. When we think about going back onto an actual system, macOS or PC, that’s what we’re expecting. We’re looking for those signs. If they ask you to copy and paste this somewhere right out of the gate, that’s a red flag.

Nicholas: That’s something people can actually remember. A real CAPTCHA stays in your browser. That’s a better way of putting it. If it asks you to open Run or PowerShell and execute something, stop there. I like how specific that is. “Be careful online” leaves a lot for someone to figure out; this gives them a clear moment to pause.

14:04 · The Layers That Back Up Training

Nicholas: We also have to account for a busy workday when someone misses that warning sign. That’s why training needs backup from the technology and the people monitoring it. So, Roman, walk us through the other layers. If someone doesn’t follow the instructions, what helps catch and contain it?

Roman: Of course. Outside of general security awareness training, to your point, Nick, we can only educate so much. There’s only so much data we can ingest. I like to describe myself as a chalice: you fill me up and a little bit spills out. The best way to prepare for that is following the principle of least privilege, hardening either the devices users are accessing or hardening the cloud posture, the environment, with something like conditional access policies, so that it prevents those users from being able to run a Windows command or access a terminal in the first place. Then, from an endpoint protection perspective, tried and true: having an AV or next-generation antivirus for the known bad. If we don’t know our history, we’re doomed to repeat it. And having that additional layer, which we’ll touch on later, defense in depth, is paramount. Employees can only be as intelligent as they can be in that moment, so following what we can do from the cloud user down to the endpoint, all of that gets buttoned up in today’s age by having either a platform or a dedicated human team monitoring the environment 24/7, following the sun.

Jenn: I feel like least privilege was created for somebody like me, because I’m the one always complaining in the Teams environment: why can’t I share this, why can’t I share this? And it’s usually with an external vendor. Because I now work for a cybersecurity company, I’m a lot smarter. But then you also have people like me who are people pleasers, so if somebody asks me to run a command… I’m really glad you brought that up, as Nicholas pointed out earlier, because I am the person who will do the thing. That’s why the layers are important for people like me.

Roman: Exactly. 100%.

Nicholas: And just touching on the business goal: you want to contain what’s affected while keeping the disruption as focused as possible. That’s why the human judgment behind the tools actually matters.

16:33 · Incident 2: Teams Impersonation

Nicholas: With that being said, I want to get into our next example. Jenn, you touched on it: being asked to do something. We’re talking Teams impersonation now, a scenario based on activity that you at Blackpoint have actually observed. Picture the employee’s experience. Their inbox suddenly fills with junk. They’re frustrated, and then someone appears in Teams offering to fix the exact problem they’re having. You can see why that feels helpful. It arrives in a tool they use every day, from someone claiming to be someone they normally trust. That’s the part I’d want leaders to pay attention to: the attacker is taking advantage of a familiar working relationship. So, Roman, how does that conversation turn into access to the employee’s computer?

Roman: That’s the most important part. The first thing you see here, and the most glaring, is the external element. In the speed of acquisitions, or companies being built up almost overnight depending on the infrastructure, say through infrastructure as a service, we might not initially have all the policies in place for Entra and Teams to say “I only want these users to have that communication.” So we start to see more external communication that isn’t federated, or that we don’t understand where it’s coming from. Think of the old internet before we had all the routing and switching devices that create subnets and VLANs for controlling that traffic. With a Teams impersonation, it could start with an adversary spraying and praying emails into your inbox: “you have to respond to this, you have to respond to this.” We can try to prioritize that with Copilot, but at the long and short of it there are still going to be 100 emails in that inbox no matter what. That’s where you might get the Teams message from somebody in “IT support” saying, “Oh man, it looks like you got all this spam. Can you grant me access so I can take a look at what’s in the environment, maybe via remote access?” That’s where they use it as the initial threat vector.

Jenn: And I’m like, that’s so sweet, thanks so much.

Roman: Right. The fox in the henhouse type of workflow.

Nicholas: The detail that stands out, like you mentioned, is the remote access software. It can be legitimate. The problem is now who’s using it and whether we actually authorized that session. Once the attacker gets access, they can install additional tools to keep a way back in after the call ends. The conversation ending doesn’t necessarily end their access. So there are two practical questions for the business: how does an employee verify that the request really came from IT? And how do we distinguish our approved support tools from unauthorized ones? Roman, can you connect those questions to the controls that help stop this? And what does Blackpoint’s response time look like for a Teams impersonation attack?

Jenn: And also, Roman, do we need a safe word? Because one: pineapple. I’m going to go with pineapple.

Roman: Yes, ma’am, 100%. That way we can verify: are we talking the right lingo?

20:10 · Real Incident: 11 Minutes in an Industrial Environment

Roman: When we talk about how Blackpoint, working alongside Macro Technology Group, can assist with controls around this, it’s really detecting the sophisticated threat that’s more in lockstep with living-off-the-land attacks. You’ll see that terminology moving away from just malware or just ransomware toward living off the land, or adversary-in-the-middle attacks. Within that, we’re seeing the same timeline. This one, from a redacted perspective here in October, shows an industrial context and somewhat the same story. The main thing is they were sending all of these different contacts to this user to flood the zone, and from there try to gain access via a remote access trojan that would detonate to open a tunnel between that external actor and that user. The way you see it here, this timeline is about 11 minutes on average. It goes off of one side, leveraging the Blackpoint agent installed on devices, and also correlating with any NGAV: it could have been SentinelOne, CrowdStrike, Bitdefender, Sophos, to name a few. We take that context, so whenever we get alerts based on a browser session or an initial access threat vector, the NGAV, the next-generation antivirus, put a stop to it and closed that back door. But they’re already in there, hiding in the cupboard. What the SOC did from there is hunt for those admins, because of lateral visibility, east-west, north-south, to confirm any new admins. Are they kicking off different scheduled tasks? Do they have different privileges than they had 24 hours to 90 days ago? What you see here is that the analyst response isolates that device based on an IP command on that subnet, limiting further contamination or lateral movement, and then we start calling the customer. It can be either/or, where we call you first and then respond, but we’d rather shoot first and ask questions later. We’d rather have it and not need it than need it and not have it. And with that, we tracked that in this instance there was no suspicious activity on the Microsoft 365 account. This happened primarily on that one box, from which they were trying to gain access to others in the environment.

Nicholas: So again, the lateral movement you spoke to earlier.

23:00 · What Stops It: Verification, Controls and Application Control

Nicholas: Let’s take it now to what stops it. My starting point would be to make verification easy. If someone gets an unexpected request from IT, they should know how to check through a channel they already trust.

Jenn: Safe word. Pineapple.

Nicholas: I’d want the instruction to sound something like this: “Before you grant access, contact your real IT team through the support channel you normally use and confirm the request.” That’s an action someone can take even when they’re busy. If verification is confusing or takes too much effort, deadline pressure makes it easier to skip. Then we support that behavior with controls: review external chat access, limit support to approved tools, and put appropriate checks around account access. And we still need monitoring, because those controls work best when someone can investigate unusual activity. So, Roman, can you explain what application control adds here, particularly when the attacker is trying to use legitimate remote access software?

Roman: Yes, sir, 100%. Application control, at least in the Blackpoint ecosystem, isn’t necessarily application whitelisting. We’re working off a curated blacklist of 90-plus applications that have been used in campaigns by hackers and adversaries, categorized by MITRE tactics and techniques. I’m throwing out a bunch of acronyms, buzzwords and keywords; I hope there’s a quiz at the end of this. We’re tracking the validity, the context, of those applications so we can confirm a true positive, as opposed to just going off a deny-by-default workflow, which can still be done. Think also about shadow IT, so that a fellow like Roman can continue going through his day, maybe leveraging a ScreenConnect instance, while a more malicious instance in the wild trying to connect to my device is stopped based on the file name, hash or certificate. The main thing is those hackers are using the same applications we’d use in regular day-to-day operations and taking advantage of them in bad faith. So it’s monitoring that telemetry, but also preventing it outright if we see anything malicious across the board.

25:14 · What’s at Stake: The Business Impact

Nicholas: Now I want to get into what’s at stake, the business impact, and step back from the attack mechanics for a minute. Both examples begin with ordinary work: browsing a website, responding to a message, or getting help with a computer problem. The consequences can reach much further than that one employee’s device. We’re talking about interrupted operations, exposed client information, recovery costs, and damage to trust. Take downtime in healthcare, for example. An outage can interrupt patient care and billing, which also affects revenue. Now bring that down to a smaller business. Imagine a dental practice that can’t operate for a week in a town where patients have other options. That’s a hypothetical example, but it makes the impact easier to picture. And then there’s reputation. Getting systems working again doesn’t automatically restore a customer’s confidence. That’s why I think the cost conversation needs to include the disruption we’re trying to avoid. It’s easy to put off spending on protection until the moment you urgently need it. So, Roman, when you look at these kinds of attacks, which early signal makes the biggest difference, and what changes for the business if nobody is watching?

Roman: That’s a good point. It also goes back to downtime. Take that example of a local dentist’s office: say there are six in that region, within that zip code. If that one dental office goes down in any way because of a cyberattack, I as a patient am saying, “Well, they’re not being aware of my time.” It becomes that conversation of understanding that security now is more of an operational expense, not a capital expense you’d pay in one lump sum, based on the history of paying for ransomware back in the day. We don’t have to do that. The main thing is paying month by month or year by year as a cost of doing business with the type of environments we’ve evolved to. I like to say we suffer from success, in a way, because of how easy we’ve made the digital experience for our users and business operations. With that, the costs fluctuate and need to adapt alongside it. When we think about the signs, the main thing for any dental or medical office is to go off an assumed-breach mentality: assume that it will happen and plan for it appropriately, based on any logs an IT admin might have. And if they’re inundated, have that larger conversation with resources in the area like Macro Technology Group about how we can provide that visibility and respond appropriately based on industry trends.

Nicholas: Last thing I wanted to chime in on: when we’re talking about reducing the impact, we’re also thinking about the business and the people connected to it. A dental office has protected health information. So it’s not just a hit to your reputation and the fact that you went down; now there may not be trust there from your patients.

28:53 · Prevent, Limit, Detect, Respond

Nicholas: Next I want to get into what reduces that risk. No single layer is really enough; I think that’s something we’ve hit on here. Here’s a useful way to organize the conversation: prevent, limit, detect, and respond. Each layer has a different job. First, prevention. You want to help people recognize suspicious requests and report them when something feels off. Then you want to limit what can happen if an attacker actually does get through. That includes appropriate permissions, approved applications, and controls around sign-ins and external communication. Next, detection. We need visibility into unusual activity on the device and in the user’s account, including outside business hours, 24/7/365. And finally, response. Someone needs the authority and ability to investigate and contain the problem before it spreads. These are all separate responsibilities, so it’s worth asking who owns each one in your environment. The answer should reflect the services and controls you actually have, rather than the assumption that every organization has the same coverage. Containing an incident also leaves recovery work to do, so we need to prepare for getting the business operating again with as little disruption as possible. Roman, where do you see gaps between those layers, and how do they allow an attack to keep progressing?

Roman: From what I’ve seen, Nick, we have all these robust tools in today’s day and age to prevent these threats. But the most important part I always like to think about is context: the understanding of why we need to prevent, based on these specific people or this specific industry. Why are we protecting it? That helps with the solution we’re using and lends credence to its importance. Same thing with how we’re limiting external attacks, or at least adding in that additional hardening layer, and then when we detect and respond, how we do that most effectively, understanding what it looks like if we didn’t stop it. Even if you stop a threat far left of boom, to Nick’s point, there’s some recovery after the fact, because you just feel icky. You feel gross after somebody impersonates a Teams message, or you had that ClickFix attack happen. It scars you in a way. The internet we have today is all about understanding the context: where the honeypot has moved. It used to be just the desktop, laptop, server and the internal network. Now I could be one of those threat vectors outside that network. So how do we secure that? Monitoring internal and external, making sure we have visibility into where our employees are going and where our teammates are at any given moment.

31:43 · Questions to Ask Your IT Team Next Week

Nicholas: That segues perfectly into our next slide: questions to ask your IT team next week. Jenn, I’ll pass it off to you.

Jenn: You bet. Before we get into the takeaways, this is an important takeaway: whether we’re protected by Blackpoint or not, whether we know we’re protected by Blackpoint or not, it bears checking and verifying with our team. Here are the questions you can take back. Would we know if this happened here? Who responds at 2 a.m.? Obviously, we know that we have Blackpoint helping us respond at 2 a.m., and our clients are backed by that level of protection, and certainly peace of mind. And then: how do we verify an IT request? For people like me, who are a little too trusting and people-pleasing, and for a lot of people who are just focused on getting their work done, who want to remove this distraction as quickly as possible and might take things at face value: what systems and protocols do you have in place when a request like this comes in? Does everyone know exactly what protocol to follow, especially when something feels off? Trust your gut, in all situations in life, I think.

33:18 · Three Things to Remember

Nicholas: Perfect segue into three things to remember. Here’s what I’d want everyone to take away from today’s conversation. First, familiar tools can be the way in. A website or workplace application can feel trustworthy and still become part of an attack, so awareness and verification matter. Second, one safeguard can’t carry the whole job. I talk ad nauseam on all of our webinars about training, training, training, but that’s just one piece of the equation. The controls around access, devices, and applications need to work together. Third, detection creates value. When someone can investigate and respond quickly, that response helps keep an isolated problem from becoming a much bigger disruption. If you remember those points, you’ve got a useful starting place for the conversation with your IT team.

Roman: And with that, we’re so efficient, just like how we respond in real time.

34:26 · Audience Q&A

Jenn: Let’s open the floor to some questions. I did see one come in. [34:26] If an employee pasted a command into the Run box right now, what would stop it? Is that blocked by policy, or does it depend on the user saying no? Roman?

Roman: The way I’ve seen that, Jenn, more often than not it’s confirming whether that user or device has the ability to use Windows Run, or has system permissions to run command lines. Usually, for most environments, nobody has that level of permission. But it’s always best to confirm via GPO, because outside of that, it’s something that would be visible through a monitoring solution or platform. With the Blackpoint agent, as an example, we’re looking at scheduled tasks and created processes with certain queries like whoami, netstat, traceroute or ipconfig, understanding that user and how they’re accessing the network at any given time. So the main thing is: are they able to use the Run dialog box, and can we check that via GPO?

Jenn: Don’t let me use it.

Roman: Exactly.

Jenn: Here’s a good one. [35:42] Can someone outside your company message your employees on Teams today? Do your people know how to verify it through a channel they already trust?

Roman: That’s tough. The most important part is setting up conditional access policies within any Entra environment. Usually that’s done by groups or users, based on their individual permissions or policies. The most important part, though, is blocking or limiting external Teams chats to that tenant. I know that’s tough for some partners or IT administrators who work with external team members on contract or on a temporary timeframe, but that would be one of the most important parts: blocking external communication, or leveraging CIS benchmarks for conditional access policies.

Jenn: [36:47] Ken asks: If I only have 15 employees, am I really a target, or is this overkill for me?

Roman: That’s a good question. I’ll give my context, Nick, and then you can add yours. I always like to think of it as not a matter of if, but when. We’re all part of the same internet, the same human society. So I always go off that assumed-breach mantra. Whether you only have 15 employees, they’re still going to be accessing that larger internet and the digital experience we’ve all cultivated over time, so it’s always best to have those layers no matter what. Something as robust as AWS monitoring, looking at headless systems and EC2 instances, might be overkill, to your point, Ken, but it’s always going off at least that defense structure Nick was talking about with those four layers.

Nicholas: If I could throw my two cents in on the business impact, I want to take it back a couple of slides to where I said everybody doesn’t need something until they need something. What may seem like overkill for you from a business perspective, you need to weigh against what an attack that brings your business to its knees would really cost you, not just in the short term but in the long term as well.

Roman: One of the largest examples, and this goes back to my time in general business sales, is Geek Squad protection. If I’m your Geek Squad technician, we’re going through what used to be a disk defrag or a cleanup of the device, but by the time we get it, it might just be gone, done for. Instead of having to buy that full system again, everything would be covered by that warranty. I use that example instead of broader insurance, because that’s case by case; Geek Squad protection was consistent.

Nicholas: I’m a big warranty guy. And that goes back to opex versus capex: do I want to spend all this money now, or do I want to spend this money because it’s just the cost of doing business at a certain point?

Jenn: I think we have time for one more, and I’m going to read this one. [39:15] Training and policies reduce the odds, but someone will eventually click. I was that person. I can tell you I am no longer that person; I am terrified to click on anything. When something pops up on my screen, I’m immediately messaging our IT team: can I click on this, is this real? A real takeaway for me is to not be scared to question, to ask, and to trust your gut in these situations, because I’d rather be safe than sorry. So, continuing on: What’s your plan for the first five minutes after that happens? Somebody clicks eventually. What happens in the first five?

Roman: I’ll go with my biased lens. In theory, for most one-man shops, one-lady shops, y’all shops (universally, I’m accepting of all), it could be that you’re getting that alert, and as soon as you get it, you’re boots on the ground. Maybe you were sleeping at 5:00 in the morning and haven’t even had your cup of coffee yet, but you still have to respond to this threat in real time. The realistic terms today are that you have vendors and partners like Macro Technology Group and Blackpoint with that follow-the-sun workflow. So when you’re sleeping at 5:00 and we need some sort of response within five minutes, that team is there with context to respond appropriately, whether that’s giving you the phone call and waiting to get that chain of communication established, and if we don’t, we still err on the side of caution so we can limit further contamination in the environment. On average, the first five minutes should just be: how do I respond to this threat I’ve detected? What’s the impact, the blast radius, so I understand the largest disruption in the environment and recover from there?

41:18 · Closing & the Free 180-Day Scan

Jenn: All right, I think we’re almost out of time. Look at us, wrapping up almost to the minute. Take us to the last slide there, Nicholas. A huge thank you to Roman for giving us the attacking side. Round of applause. And to you, Nick, for making business sense of it all. Just a reminder, we have the follow-up next steps here. If you’re not yet a Macro client that’s powered by Blackpoint, or if you’re curious to get started, they’ve agreed to extend a free 180-day historical scan of your Microsoft 365 environment. As we mentioned at the top of the hour, we’ve had a few clients take advantage of this offer, and they were surprised at the suspicious activity and vulnerabilities surfaced. As a matter of fact, from Blackpoint: one in five see a compromise. So I’m highly recommending you get in touch with Nicholas to take advantage of this.

Roman: If I could, I wanted to add some context to that historical scan for the attendees. With that scan, keep in mind it’s looking at the login and authentication logs for those users, tracking back for the past 180 days to see if there are any existing indicators of compromise in the environment. The main thing is having that visibility from the past, so that when you have a solution that secures going forward, it already understands the lay of the land and can be as efficient as possible. Those authentication logs, those event IDs that could have kicked off, created processes or services, so we can outline business email compromises that might already be there from suspicious inbox rules, or any other exfiltration attempts via Teams or SharePoint. You’d be surprised. To Jenn’s point, one in five. It’s unprecedented. Right now, think of standing in a circle with five people. Which one of you?

Jenn: You could be the one. There’s definitely someone else today that needs this. But don’t worry if you’ve missed any of today’s info. It will all be available in an email tomorrow, along with the recording of today’s session that you can share with your people. As for the lunch gift card, we’ll be going through everyone who attended today and verifying email addresses, and we’ll get those cards off to those who qualified. Thank you so much for joining us. Have a great day, everyone. We’re already looking forward to the next one.

Roman: Thank you for everything, Jenn. Thank you for bringing us all together, and thanks to everyone who joined today. Y’all have a good rest of your day. Keep your head above water as best you can.

Jenn: I think I’m going to go have some pineapple.

Roman: Yes, ma’am. I have a hankering for some pineapple. Have a great rest of your day, everybody. Take care.