Default to Deny: Why Network Security Is Shifting to "Zero Trust" ⛔ Ep. 167 ThreatLocker

0:00 JACK: Hello, hello!

0:00 Today is a great day, isn’t it?

0:02 In this episode I’m gonna gush about ThreatLocker.

0:04 Why?

0:05 Well, currently they’re my biggest sponsor,

0:07 which makes them my favorite sponsor.

0:09 But what I’m saying is that this whole

0:12 episode is brought to you by ThreatLocker.

0:14 But don’t worry, I found some pretty great stories

0:17 from them that I think you’ll find interesting and educational.

0:23 So, let’s go.

0:25 (INTRO): [INTRO MUSIC] These are true stories

0:26 from the dark side of the internet.

0:31 I’m Jack Rhysider.

0:37 This is Darknet Diaries.

0:44 [INTRO MUSIC ENDS] JACK: Do you want to mention your name or company name,

0:52 or do you want to keep that out?

0:54 GUEST: No, I’ll keep that out.

0:56 I’ll keep that out.

0:57 Just— I guess that’s just to do with the fact

0:59 that we don’t want people to know what we use.

1:02 JACK: Yeah, I feel the same way.

1:03 Everyone’s asking me like, what do you— what’s your privacy stack?

1:06 I’m like, if I tell you, now you know exactly how to target me.

1:09 GUEST: Yeah, exactly, exactly.

1:10 JACK: Okay, so, the first question was who are you and what do you do?

1:13 GUEST: Yeah, I can generalize.

1:15 So, I’m the group head of IT operations for a manufacturing company,

1:23 and I look after the operational running of the IT across the business.

1:29 We’re a thousand-employee business operating across seventeen

1:33 different sites in the UK and Europe.

1:36 I look after the security, cloud,

1:40 operations infrastructure, servers, client support, etc.

1:44 JACK: Okay, you get the picture.

1:45 This guy manages a huge network with a thousand employees,

1:48 which probably means there’s like,

1:49 ten thousand computers that are all up and operating.

1:52 Picture a factory.

1:53 No; picture lots of factories spread all over Europe.

1:57 GUEST: Yeah, we have distribution centers, offices, and big manufacturing sites.

2:03 JACK: So, how’s the network holding up?

2:06 Have you had any problems?

2:08 GUEST: I mean, right now we’re in a good place.

2:11 [Music] If you rewind back five years ago, we were in a very bad place.

2:14 JACK: What happened?

2:16 GUEST: Well, unfortunately for me, I was actually on my way on holiday.

2:20 So, I was in the process of driving

2:23 the family down to the south coast of the UK, and I got a phone call.

2:28 I remember the exact words one of my technicians said;

2:31 I don’t mean to worry you, but something worrying is happening.

2:36 I was like, okay, calm down and explain exactly what’s happening.

2:41 He was like, I’ve just had a ticket

2:45 in where somebody’s tried to go to some files,

2:48 and all the files are all renamed.

2:50 I was like, what do they say?

2:53 He was like, they all end in the word .kanti.

2:56 I was like, oh no.

2:57 JACK: Yikes.

2:58 Kanti is a type of ransomware.

3:00 Well, it’s kind of more than that, actually.

3:03 It’s practically a full company that’s in the business of ransomware.

3:06 They’re Russian-based, and they build the ransomware,

3:08 but then they have sort of an affiliate

3:10 program that someone could use their ransomware, go infect a company,

3:13 and then that person would get a cut

3:14 of the money if the company pays the ransom.

3:17 It’s devastating and brutal to be hit with it,

3:19 and this doesn’t sound good at all.

3:22 GUEST: So, I had to make phone calls.

3:24 I continued to drive the rest of the three hours remaining

3:28 of my six-hour drive because I had my whole family with me,

3:32 drop them off, and then turn around and drive six hours back,

3:35 making furious phone calls the whole way.

3:37 JACK: Really?

3:37 GUEST: Yeah.

3:37 JACK: Oh my gosh.

3:39 Is there a protocol?

3:41 Is there a go-to, a run-book or something that like— okay,

3:46 if ransomware comes in, here’s the button we hit.

3:48 We gotta turn the network off as fast

3:50 as we can or something to keep it from spreading.

3:53 Do you have a procedure in place?

3:55 GUEST: We do now.

3:58 JACK: [Laughs] GUEST: We didn’t then.

4:00 [Music] A number of the people in my team had experienced situations like

4:05 this kind of, but not on the scale that we got hit on this.

4:10 I know five years ago— it was a long time ago and a lot of things have changed,

4:14 and a lot of things— people are more aware of what

4:18 to do and to have those sort of playbooks in place.

4:21 We had an element of ‘what do we do?’,

4:24 and the first thing we reached to was let’s turn everything off.

4:27 But too much turmoil was going on.

4:29 We were making too many calls and trying to deal with everything.

4:32 I just remember at one point my senior infrastructure engineer just

4:34 told everybody to shut up and give him five minutes to think,

4:38 because everybody was just asking too many questions and we

4:41 were trying to work out how we respond to this.

4:44 JACK: Yeah, yeah, I imagine it’s a really hard time to focus.

4:50 So, how bad did it spread, or how bad did it knock you out?

4:55 GUEST: [Music] Well,

4:57 in the space of fifteen minutes it encrypted all 250 servers,

5:04 and like I said, it hit about 350 endpoints as well.

5:09 JACK: So, the 250 servers, were those all Windows servers?

5:12 GUEST: Yes.

5:13 JACK: Okay, so, your whole infrastructure is down.

5:16 GUEST: Yep.

5:17 JACK: Geez.

5:17 I mean, that sounds like business is gonna stop.

5:20 GUEST: Yeah, and it did.

5:22 It stopped at that very moment in time, and we assembled a team.

5:26 I had a very nervous six-hour drive back, making loads of calls to everybody,

5:31 trying to work out what’s going on, work out which way to go.

5:35 I had to get people to sites.

5:37 This was on a Friday evening, afternoon,

5:39 around about quarter past four that it happened,

5:43 which is quite a common tactic used because

5:46 people are just switching off on a Friday afternoon.

5:49 We pretty much just had to just turn everything

5:52 off and then work out where we go from there,

5:54 give ourselves some head space to think, ‘cause it was just too quick.

5:57 We just couldn’t react to a fifteen-minute window.

5:59 JACK: A lot of CISOs, CEOs, they reach out and they say,

6:03 I would like to be a guest on your show.

6:06 I always say, well, only if we’re gonna talk about the worst day of your life.

6:10 GUEST: [Laughs] JACK: ‘Cause that’s the kind of stuff I’m interested in.

6:13 Would you say that this was the worst

6:15 day of your life as far as career-wise goes?

6:17 GUEST: I say that to everybody I talk to about it,

6:19 which I don’t actually like talking about it,

6:21 ‘cause taking myself back to that day,

6:24 that sinking feeling in your stomach, it is absolutely the worst,

6:29 stressful— the most stressful situation I’ve

6:32 been through in my career, hands down.

6:34 I think I did twenty-seven days straight after that.

6:36 JACK: Yeah, I mean, you’ve gotta even worry if

6:39 your job is on the line here as well,

6:41 ‘cause if you’re the one in charge of this sort

6:44 of stuff and now this is what happened… GUEST: Yeah.

6:46 JACK: There are people blaming you.

6:48 GUEST: Well, I mean, that’s the first thing that comes into your head.

6:50 Well, after you’ve tried to work out how to deal with everything.

6:53 You think, am I gonna get blamed for this?

6:56 [Music] But then very quickly after that, you realize you’ve just

6:59 gotta focus on actually doing what you are paid to do,

7:03 because ultimately, hackers and people that are trying to attack

7:07 you are trying to attack you all the time, and it’s a constant battle.

7:13 JACK: Okay, so, you drive back frantically.

7:16 You arrive late night Friday.

7:17 Do you go right to the office in the night?

7:20 GUEST: Yep.

7:22 JACK: Wow.

7:22 Then— so, okay— so, there’s a lot of people out there,

7:27 armchair experts that are just like, well, you just restore it from backup.

7:31 What’s the big deal?

7:32 GUEST: I mean, the problem with that is

7:35 you don’t know whether they’re in the backups.

7:37 You don’t know whether they were already in the— in your environment

7:40 and they were just waiting for the right time to push the button,

7:44 which we already believe they were.

7:46 So, what we focused on was stopping everything and then working out how.

7:51 How did they get in?

7:53 Where did they come from?

7:55 What method did they use to actually spread and initiate the attack?

7:59 JACK: Ah, good point.

8:00 It’s like trying to set up dominoes when your cat is on the table.

8:04 You want to get rid of the threat in the network before beginning to restore it.

8:07 If you restore and the thing just re-infects you, that’s a waste of effort,

8:11 and maybe it’ll show them where your backups are kept and affect those, too.

8:13 GUEST: So, once we worked that out,

8:15 we then established a process to be able to check our backups,

8:19 check each VM as we brought them back online.

8:23 We established a protocol for rebuilding machines.

8:25 We printed signs off at the doors of every office and told

8:30 people where to go with their machines so that we could rebuild them.

8:34 We kind of employed the whole red, amber, green process.

8:37 JACK: What’s the red, amber, green process?

8:39 GUEST: So, every laptop, until it’s checked, is considered red,

8:42 then it goes into amber as it’s being worked on, and green,

8:46 it’s good to go back to the user.

8:47 Pretty simple, but it keeps it easy to manage because you’ve got a small

8:51 team— and I have a team of— there was ten of us at the time,

8:55 and you were managing the throughput of upwards

8:59 of six hundred laptop users at multiple sites.

9:03 So, you need a process to check in, check out everything.

9:06 JACK: Yeah, I mean, their devices were toast,

9:10 and you were just re-imaging them from a fresh image, right?

9:13 GUEST: Yeah, but we had lost our imaging service.

9:15 JACK: Oh, geez.

9:17 Yeah.

9:17 GUEST: So, we had to rebuild them manually for a while until the process,

9:21 the team that were dealing— my sort

9:23 of sub-team that were dealing with the servers

9:26 were to the point where they were bringing the imaging servers back up.

9:30 Then you’ve got users wanting to know

9:32 what’s going on, you’ve got middle management,

9:35 senior management, board of directors.

9:37 Everybody wants to know what’s going

9:40 on, and that completely flusters the situation.

9:43 So, you can’t understand— you can’t get a clear

9:46 head to actually focus on the task at hand.

9:48 JACK: Yeah, I imagine there’s a bunch of emotions to manage

9:53 in this, which is stuff I don’t think anyone talks about, right?

9:56 You look at the CISSP manual and they don’t explain,

9:59 okay, well, you’re in the middle of a breach situation.

10:02 Here are the emotions you’re dealing with and how

10:05 to detect them and what to do about them.

10:07 GUEST: Oh, there’s definitely moments where you kind of just sit

10:12 there and you feel like maybe you can’t actually do this.

10:17 Maybe you can’t get it back.

10:19 There’s an element of shaky hand syndrome,

10:23 and anybody can claim to be cool and calm

10:25 until they’re actually in the trenches with this situation,

10:28 and it can really— there was a lot of team fighting

10:32 and arguments and falling out and people popping under the pressure.

10:36 It was a hell of a ride.

10:38 JACK: When you say ‘popping’, what was some of the stuff you’re thinking?

10:41 GUEST: Well, I had a team member walk out because

10:44 he didn’t agree with a certain methodology to fix one thing,

10:47 and another team member fall out with another team member,

10:50 and arguments happening on meetings while we were trying to work out what’s

10:53 the best methodology to bring something back

10:56 online or to grant somebody some slight access.

11:01 ‘Cause we— I turned around to the business and said, look,

11:04 I can get us back from backups in this— in about five days.

11:08 But if you really want the best solution, give me three weeks,

11:12 and we will build it back how it should have been done in the first place.

11:16 JACK: Phew, what a proposal for leadership to decide on, huh?

11:19 Business is down.

11:20 There is no manufacturing happening, no shipping,

11:22 no revenue coming in, and the question is do

11:25 we get business back up as fast as we can,

11:29 or, because those old systems are end-of-life and need to be replaced badly,

11:33 take advantage of this outage and upgrade

11:36 everything properly and build for the future?

11:38 Of course, this incident is all that the business leadership can focus on.

11:42 All other meetings and projects are canceled until business can come back up.

11:47 [To Guest] Okay, so, what path— what did they choose,

11:50 five days, three weeks, or something…?

11:52 GUEST: Three weeks.

11:52 JACK: Really?

11:53 They wanted the whole thing…?

11:54 I mean, that’s an ambitious thing to say

11:57 I’ll redo the entire infrastructure properly this time.

12:00 Three weeks, they didn’t mind being down for three weeks?

12:04 GUEST: Well, sort of what I did was make sure

12:07 that certain services came up as reasonably quickly as possible.

12:11 So, e-mail communications,

12:13 and then focused on a major system here or a major system there,

12:19 and slowly brought everything back on.

12:21 But, you know, by getting those— some

12:24 of those primary services back up and running,

12:27 I was able to then get the head space

12:29 to concentrate on the other eighty percent of the business.

12:32 The business accepted that there would be some interruption

12:34 in that process and they wouldn’t necessarily get everything back.

12:37 So, a good example was we didn’t turn Wi-Fi

12:40 back on until the very end of the three weeks.

12:43 So, nobody had Wi-Fi.

12:45 That was to stop rogue devices turning up and undoing all our hard work.

12:49 What if there was still something running

12:51 on a laptop that we hadn’t got to or identified?

12:54 Internet was shut down at every single site,

12:57 and then we only— we kinda had a board where you

13:01 had every site and all the services and sort of, again,

13:04 the red, amber, green of when we were ready to start bringing stuff back on.

13:07 JACK: Oh yeah, that’s gotta be the moment of truth, you know?

13:10 When you flip the switch on and bring the network back up,

13:14 are you sure every device got cleaned up?

13:16 Because Kanti is notorious for spreading quick,

13:18 so if you bring the Wi-Fi up and there’s just one device that’s still infected,

13:23 it will try to spread all over again.

13:25 They really need a solution that could give them visibility and, crucially,

13:30 be able to stop this from spreading again.

13:33 GUEST: [Music] We brought Malwarebytes,

13:35 the enterprise platform version of Malwarebytes,

13:37 and paid quite a lot of money for it, and— but quite quickly found that it

13:41 wasn’t really doing the job that we’d hoped.

13:44 It was good as a helper,

13:46 as an assistant to keep— to check machines for being clean, servers and whatnot,

13:52 but it didn’t really do every— it was more of in the traditional

13:57 sense of a signature-based scanning tool more than it was anything else,

14:01 and it found some registry entries and things.

14:03 So, then we started looking— well, what do we actually need to put in place?

14:06 We need an endpoint solution, an actual proper EDR,

14:10 but we don’t feel like that’s good enough or gonna protect us 100%.

14:15 So, we probably need something that’s gonna do application control,

14:20 as in application white-listing.

14:21 So, I reached out to a bunch of suppliers whilst

14:25 the sort of end— tail end of that three weeks,

14:27 and was like, can you find me something that does this?

14:30 One supplier actually said, oh,

14:32 we use ThreatLocker in our environment ourselves.

14:36 So, I jumped on a call and had a demo,

14:38 looked at the software, and was like, that’s amazing.

14:41 I need that right now.

14:44 That’s where we discovered ThreatLocker.

14:46 JACK: So, what was amazing about it to you?

14:49 GUEST: It stopped everything from running if you didn’t allow it to run.

14:52 It’s as black and white as that.

14:54 JACK: Hm, it stops everything from running?

14:56 Okay, let’s think about that.

14:58 You know the difference between a router and a firewall?

15:01 They’re both network devices.

15:02 They look at the packet coming in or the data

15:05 going in, and then decide where it needs to go, and then send that along.

15:09 At their core they’re very similar, but there’s a big difference.

15:12 A router really, really,

15:14 really wants to get all the packets to pass through it and on their way.

15:19 But a firewall really, really, wants to stop every packet from going through it.

15:25 See, by default, a router permits

15:27 everything while a firewall will deny everything,

15:30 which means the firewall acts as a security guard,

15:34 stopping everything it doesn’t like.

15:36 But the router acts like a public park.

15:39 Just, anyone can come and go.

15:41 So, you have to poke holes in the firewall

15:43 if you want anything to get through it.

15:45 So, the question is,

15:46 when you go to run an app or a game or anything on your computer,

15:50 should it act like a router and just permit anything you try to open,

15:53 or should it act like a firewall and say,

15:55 hold on, buddy, you need a permission slip to open that?

15:59 Traditionally, all our computers just do what

16:00 we tell them to do, which makes sense.

16:02 Open app.

16:03 Okay, done.

16:03 Because when you need to use an app, you obviously need to use it.

16:07 But the thing is, malware is tricky.

16:09 It’s sneaky.

16:10 It’s hiding.

16:11 It’s being quiet.

16:12 But it’s also opening and running and doing

16:15 stuff without us seeing all secretly in the background.

16:19 So, what ThreatLocker does is it says, okay,

16:21 let’s start by blocking every app from opening and running,

16:24 but if you the user wants to open something, just ask and we’ll let you open it.

16:29 We just want to block apps that you didn’t

16:31 try to open or apps that you don’t actually need.

16:34 GUEST: We figured in the world where we

16:37 had just been absolutely burnt to high hell,

16:40 we need to stop everything running unless, of course,

16:42 we allow it; every single device, server, client.

16:45 We needed to know that it was not gonna

16:47 run anything that we did not want it to run,

16:50 and our supplier was using it in their own environment,

16:53 which is always a very good sign if the person trying

16:56 to sell you it is also the person that is using it.

16:59 We were like, yep, how quickly can you get me the installers?

17:04 JACK: So, when you get ThreatLocker,

17:06 it goes through a learning period where it just listens and allows everything,

17:09 and from there you get a sense of what apps everyone in the business is using.

17:12 So, you add those apps to the allow list so business can continue,

17:16 and then switch it over to secure mode,

17:18 where if your app isn’t on the allowed list,

17:20 now it’s going to be stopped from running.

17:22 GUEST: It just says no,

17:23 and it comes up and says it’s been blocked by ThreatLocker.

17:26 You can request it, and then when you request it,

17:29 we have a portal where we can just say yes or no.

17:33 Then you— there’s a lot of tinkering with the— how you set up the policy,

17:38 but we pretty much just say no to everything.

17:41 JACK: So, how annoying is this to the users?

17:44 You imagine some people are just like, ugh,

17:47 you can’t run anything on this laptop; this is stupid.

17:51 Do people complain a lot about it or are they okay with it?

17:55 GUEST: Maybe they did originally.

17:58 JACK: I think even if they did complain,

18:00 you’ve got such an easy card to pull out.

18:03 You could just be like, okay, back in 2020, let me tell you what happened.

18:08 We cannot afford to have three weeks of outage again,

18:12 because this is very serious stuff.

18:15 GUEST: I’ve used that so many times.

18:17 I turn around to the users and go, you can’t have this piece of software.

18:21 They’ll be like, why?

18:23 I was like, because it’s open source.

18:25 It allows plugins.

18:26 We don’t know whether it will be safe, and it could be exploited.

18:30 I’d say, do you want to be the reason that this company gets hit again?

18:34 And just put it on them.

18:36 Where if they escalate it to their director,

18:38 okay, then I’ll say to the director, do you want to be the person who

18:42 authorized this software that takes the business down?

18:45 People back off really quick when you say that.

18:48 JACK: Yeah.

18:49 Okay, so, since getting ThreatLocker, any big security incidents?

18:56 GUEST: No, but I don’t like saying that ‘cause I don’t like tempting fate.

19:00 JACK: Yeah, exactly, right?

19:02 GUEST: But no, we haven’t had anything.

19:05 JACK: I hear you sighing like… GUEST: Yeah, I know, I don’t like saying it.

19:13 JACK: [Music] Ransomware is the most successful

19:19 business model cyber criminals have ever invented.

19:22 The people infecting us with ransomware are making tens if

19:25 not hundreds of millions of dollars by hacking into a company,

19:28 locking up their data, and holding it for ransom.

19:30 It’s on the rise, even.

19:32 Just last month I heard it’s more ugly than ever.

19:35 It’s also one of the most disruptive types of cyber-attacks.

19:38 When a company gets hit with it, it becomes a huge deal.

19:41 Companies have gone out of business from ransomware.

19:44 So, I wanted to talk with someone

19:46 who defends companies from this type of attack.

19:49 HUNTER: My name is Hunter Clark.

19:51 I’m one of the cybersecurity engineers at Ark Technology Consultants.

19:55 My main focus is around endpoint security and how we can

19:59 help organizations implement some

20:01 of those zero-trust principles in their organization.

20:05 JACK: Ark is an MSSP, which is a managed security service provider,

20:08 which means they take care of a bunch of people’s networks.

20:11 A lot of businesses don’t have a cybersecurity team to keep their network safe,

20:14 so they hire an MSSP who can keep an eye on everything and help keep it secure.

20:18 One of the networks he was put in charge of securing was a hospital.

20:22 HUNTER: Yeah, there’s a lot of servers in the environment

20:26 that run applications that are critical that— like imaging software,

20:32 solutions that the doctors leverage to diagnose patients.

20:37 A lot of it runs on servers.

20:40 So, those are typically what we try to secure.

20:43 JACK: So, he took a look at this hospital’s network,

20:45 and it didn’t have very sophisticated security tools.

20:48 So, him and his team brought in ThreatLocker,

20:51 installed it on all the servers and computers,

20:53 and went through the learning process of what apps are normal in the network,

20:56 and then locked it down so no new apps could run.

20:59 Along with that, they installed an EDR,

21:01 an endpoint detection and response tool, to monitor for suspicious activity.

21:05 Then they suggested adding multi-factor authentication or MFA

21:08 on all the internet-facing portals and computers, but the hospital said no.

21:13 HUNTER: They didn’t have the budget for implementing MFA.

21:15 They didn’t want to have to train users on how

21:17 to use it and doctors complaining about having to use MFA,

21:20 so they did not have MFA.

21:22 JACK: Okay, well, if they don’t have the budget, they don’t have the budget.

21:24 You do what you do to protect them with what you’ve got.

21:28 But late one night, something happened.

21:31 HUNTER: [Music] The incident originated obviously in the middle of the night,

21:36 as all incidents do.

21:38 But we got a call from the EDR/MDR solution

21:42 that we were using that there was someone in the environment.

21:47 This was something that people should consider,

21:50 is that not all MDR solutions are created equal.

21:54 Some of them will pull the fire alarm but not help you put out the fire, right?

21:59 So, they’ll let you know something’s going on but not necessarily step

22:02 in to stop it until they’re able to get ahold of you.

22:06 In this case, it happened at 3:00 a.m.

22:10 and they’re— we receive the detections that something’s

22:14 going on and were able to then, early the next day, 5:00 a.m., 6:00 a.m.,

22:19 whenever we got up, start investigating what had actually happened.

22:23 That was whenever— as part of that investigation

22:26 we started looking into ThreatLocker logs to see,

22:29 okay, what actually— what did the threat actor try to do?

22:33 What user account was likely compromised?

22:35 Seeing the threat actor bounce around the different servers.

22:39 That’s whenever we saw that ThreatLocker had blocked

22:42 the solutions that the threat actor had planned on leveraging,

22:46 such as AnyDesk and rclone.

22:48 JACK: Someone got into the network, gained access to a Windows server,

22:52 tried to infect it with ransomware, but ThreatLocker denied it.

22:55 Nice.

22:56 Okay, but how did they get in?

22:58 HUNTER: The threat actor had bought credentials off the dark web for a domain

23:04 administrator account for the environment and was

23:07 able to just remote in through the VPN,

23:10 and had full domain admin rights across the environment.

23:14 JACK: Ah, that darn VPN!

23:15 I mean, VPNs are great.

23:17 It allows you to connect securely into a company from home or on the go.

23:21 They are essential, even.

23:22 But they also are exposed to the internet.

23:24 They’re a portal into a company’s network.

23:26 But that’s something that should be super

23:28 secure since it is out on the internet.

23:30 But in this case, all that was needed to get

23:33 into this hospital’s VPN was a username and password,

23:35 which happened to be for sale on the dark web.

23:39 How wild is that?

23:40 A username and password is not good enough to keep people out anymore.

23:43 HUNTER: One of the questions that came up

23:45 was would MFA have prevented this event from happening?

23:47 It was a pretty clear yes that if MFA would have been implemented,

23:51 then at least that initial access, they would— the threat actor would have had

23:54 to find a different way in than through the VPN.

23:57 JACK: Anyway, this is why there’s defense in depth.

24:00 You want layered security so that there are

24:02 multiple places that should have stopped this attacker,

24:05 and they were lucky that they had ThreatLocker to stop this.

24:09 But this attacker was clever and motivated,

24:12 and even though they were stopped, they weren’t done yet.

24:17 HUNTER: [Music] This hospital system used to be

24:19 made up of multiple different hospital locations.

24:22 A few of them had been sold off, but they still needed to maintain VPN

24:27 tunnels between the sites because of certain

24:31 application dependencies that the hospitals hadn’t had

24:34 time to build in their own environment.

24:37 So, because of those VPN connections,

24:40 to the threat actor it looked like it was just one network, right?

24:43 It probably looked to them like it was just one big connected network.

24:47 But really, they ended up bouncing to a different hospital system that was

24:51 not a customer of ours that obviously

24:53 did not have ThreatLocker in the environment,

24:56 then was able to deploy what they needed on those devices.

24:59 JACK: Oh no, they bounced from this hospital to another hospital

25:02 that was connected internally and were able to do damage there.

25:06 HUNTER: The threat actor ultimately reached out later that week saying,

25:10 hey, we compromised your environment.

25:13 We have terabytes of data.

25:15 JACK: They wanted the hospital to pay hundreds

25:17 of thousands of dollars in ransom to get it back.

25:19 HUNTER: Whenever this happens, right, the company, if they have cyber insurance,

25:23 they should read their cyber insurance ‘cause it probably

25:26 says in there that in the event of an incident,

25:30 you need to call us because we have incident response companies that we trust,

25:33 that we want to have involved in this.

25:36 So, that’s what happened.

25:37 As part of that cyber insurance, there’s also usually some sort of ‘we’ll

25:42 negotiate on your behalf with the threat

25:44 actor to try to get that ransom call to drop as much as possible’.

25:49 So, with the knowledge that we had, that ThreatLocker was able to see,

25:52 we— they were able, I know, to drop it by quite a bit.

25:55 I can’t say— I don’t know exactly the number it dropped,

25:59 but I heard that it was— they were able to negotiate pretty effectively

26:03 because they knew what the threat actor actually had been able to get to.

26:06 JACK: Okay, so they lowered the ransom and then they paid the ransom?

26:11 HUNTER: [Music] Yeah, they— this hospital system did end up paying the ransom.

26:14 The hospital was able to ask the threat actor, hey, how can we improve?

26:19 How can we get better?

26:21 What should we be doing?

26:23 The threat actor responded saying that they quickly

26:27 realized that ThreatLocker was on the Windows devices,

26:30 so they knew that they wouldn’t be able

26:33 to use those for the purposes that they intended,

26:35 and they began to pivot to other locations

26:38 in the environment that did not have ThreatLocker.

26:40 JACK: Tell us who you are and what do you do.

26:51 DANNY: So, I’m Danny Jenkins.

26:53 I’m CEO and co-founder of ThreatLocker,

26:55 but what I do is really build solutions and educate the world

26:59 on how denying by default is the best way to address security,

27:03 and it doesn’t have to be difficult.

27:04 JACK: So, you started ThreatLocker.

27:06 How did all this get started for you?

27:08 DANNY: The first thing is I was— I wanted to do something fun,

27:12 and I started doing some ethical hacking.

27:14 I ended up doing more ransomware recoveries than ethical hacking, to be honest,

27:18 ‘cause people were calling me, and I wanted to make money.

27:19 So, they’d say, hey, I’ve been hit by ransomware.

27:21 Can you help with this recovery?

27:22 We paid a ransom.

27:23 There was this particular case in Australia,

27:24 which was the first one I dealt with.

27:26 It was an insurance broker, so about fifty employees— an insurance company.

27:30 I got called in by the MSP-managed IT company to help with the recovery.

27:36 I came in, and they paid the $22,000 ransom,

27:39 and they hadn’t got their data back.

27:41 So, they had got some keys, but the keys didn’t work.

27:45 They weren’t decrypting the files.

27:46 Their exchange database was encrypted.

27:48 Their SQL database was encrypted.

27:49 Everything was encrypted and broken.

27:51 They had asked me to come in.

27:54 So, we start trying to reverse-engineer the code,

27:56 see if the decryption keys are in the code.

27:59 We tried to use low-level data recovery tools to get things

28:03 from the disks that had been deleted or written over from encryption.

28:08 We’re recovering from— OST files for e-mail databases.

28:11 We’re trying everything we can to get this company back up and running.

28:15 During the recovery, the owner of the company called me,

28:19 and he got quite— first he got quite mad.

28:22 He was like, when is this gonna be done?

28:24 I’ve been waiting two weeks and I still don’t have my servers up and running.

28:27 He’s getting quite mad.

28:28 I was like, look, you need to be realistic here.

28:32 I am trying to recover your files, but you have everything encrypted.

28:36 You have no backups.

28:39 You’ve paid a ransom and you didn’t get your data back,

28:41 and this— I don’t know if it’s gonna be back.

28:44 We’re doing everything we can to make sure we can get your data back.

28:49 It then turned into quite an emotional call, and his voice started crackling.

28:53 He started almost crying down the phone,

28:55 and I got really awkward at that point because I really didn’t know what to say.

28:59 To me this was different because every other cyber— I’ll call it a cyber-attack—

29:03 I’ve dealt with, every other malware attack

29:05 I’ve dealt with— ‘cause prior to 2014,

29:07 most malware attacks were really just IT issues.

29:10 It was, you know, you’re getting adverts.

29:12 Someone’s sending e-mail out from your server.

29:14 It had been an IT problem.

29:15 IT needs to fix the server ‘cause we’re sending spam e-mails.

29:18 IT needs to fix the computer ‘cause it’s getting pop-ups.

29:20 The worst I had seen before that was

29:22 someone crying ‘cause they saw an inappropriate picture.

29:24 What I did was— it suddenly hit home

29:28 that this is a real problem and this guy’s gonna

29:31 lose his entire business— and he’s close to retirement

29:35 age— because somebody decided to download a piece of software.

29:38 I didn’t at that think, oh, I’m gonna go start a company to solve this.

29:42 What I said to the IT team and what I said to him after

29:45 we— and we managed to recover enough— was you need to use application control.

29:50 You need to block software by default.

29:53 He said to me, okay, well, I’m gonna go and do that.

29:57 Then the IT team told him that Danny’s stupid.

30:00 Don’t listen to him.

30:01 That’s not viable.

30:02 We can’t do that.

30:03 I went out to prove him wrong, and I couldn’t prove him wrong, the IT team.

30:08 That was really when— the first time we said,

30:10 well, let’s try and build something to prove him wrong.

30:13 I kinda went back and forth on this idea quite

30:16 a bit because it wasn’t an easy lift to build

30:19 a solution for this, but we had to— it was really—

30:23 in 2017 we had a product— we had a concept product,

30:27 and I still wasn’t sure this was the right thing to do,

30:29 because we knew in order to make zero-trust viable—

30:32 and today we got 70,000 companies that use our product,

30:34 from small businesses right up to some of the biggest companies in the world;

30:40 federal government, airports, banks, everything.

30:42 But back then, I was like,

30:43 if I need— I need to make this so it’s viable for everyone.

30:46 I need to make it so we can deploy application control.

30:49 We can block software by default.

30:52 We can ring-fence applications and make it so you can deploy in hours and days,

30:57 not months and years.

30:59 I wasn’t sure that it was gonna be viable without me hiring— well,

31:03 I ended up hiring hundreds and hundreds of people.

31:06 But I think in 2017 my mindset shifted,

31:09 because before 2017 I was thinking about building a business

31:13 that one percent of the world would sign up to.

31:17 After 2017 I made the decision; we don’t want one percent of the world.

31:21 We want to change the market so that ninety

31:23 percent of the world are using a zero-trust approach.

31:25 JACK: Okay, so, you coded it at the beginning?

31:29 You built it.

31:30 DANNY: Yep.

31:31 Yeah, so, I coded the first of it.

31:34 So, I coded the first version, and there’s four parts, if you like;

31:39 there’s a service, there’s a driver, there’s a portal, and there’s an API.

31:44 That’s the four original components of ThreatLocker.

31:47 I wrote an entire version of it, and I wasn’t so good at the driver stuff.

31:53 I caused a lot of blue screens.

31:54 So, we ended up bringing— at the very beginning I wrote the whole thing,

31:58 and then I got somebody else to come and rewrite my driver code because,

32:01 frankly, it just wasn’t very good.

32:03 Since then, that’s probably been one of the best decisions we made.

32:07 Today, of course, we’ve got 250 people in our R&D department,

32:11 but back then it was just me writing

32:13 code and Sammy and John testing and deploying.

32:16 JACK: Can you tell me about the first network you installed it on?

32:20 DANNY: Well, so, I guess the— we obviously installed it on our own machines.

32:24 I think the first network outside of our own

32:28 that we installed ThreatLocker on was actually my kids’ school.

32:31 They had a problem as well.

32:33 We were looking after our kids’ school IT.

32:35 It was— we were getting very actively involved ‘cause we

32:38 couldn’t afford private school for our kids at the time,

32:41 and we were getting essentially help with scholarships ‘cause we

32:43 were helping them with the IT systems and everything else.

32:48 They were getting malware every single day.

32:50 It was like, a complete nightmare.

32:52 We pushed it out to them.

32:54 That was very difficult and somewhat unstable in many

32:58 areas because it was things we didn’t even think about,

33:01 and we were seeing a lot of noise.

33:02 But they went from malware every day to never since,

33:06 and that— and still today they’re using the product.

33:10 My kids aren’t in the school anymore,

33:12 but our chief product officer’s kids are actually in the school now,

33:15 and their IT management went down from full time to a couple

33:19 of hours a month because they just— these systems became very stable, very easy.

33:24 JACK: Deny all apps by default seems like a radical idea.

33:30 To block everything seems like it’s gonna halt productivity.

33:33 DANNY: Radical depends on where you start, and if you start in a situation where

33:38 my network is running smoothly and I’m very happy,

33:42 you would never approach with that idea.

33:43 You would approach with the idea; we’re going to learn what we have.

33:46 We’re going to review the list and remove

33:48 the things from the list we don’t want.

33:51 Whereas if you start with the situation that I’ve been hit by ransomware,

33:55 attackers are in my network,

33:57 the alternative is you shut down the entire network,

34:00 or the plus side is you allow the network to run,

34:04 but you only allow these trusted apps.

34:06 Then every time someone wants something,

34:08 they request it for the first time, we add it to the list.

34:11 It doesn’t seem so extreme now because

34:14 the alternative is the whole network’s shut

34:16 down until we’ve reformatted every single computer

34:18 and guaranteed that nothing’s bad on it.

34:20 So, it really depends where you start.

34:23 For ninety percent of customers, they’re starting from a clean slate.

34:27 So, they’ll learn and they’ll remove the things

34:29 from the list they didn’t know about.

34:31 For the other side of the customers who are starting from, hey,

34:34 we’ve already been hacked, it’s not extreme to say,

34:37 hey, everything’s blocked until we’ve approved it.

34:39 It’s also not that difficult, because most people think,

34:41 oh, well, what about the software we don’t know about?

34:44 But the average user uses ten, twenty, thirty apps on their machine.

34:52 It’s Chrome, Zoom, Office, Firefox,

34:55 and then they have an SAP system or whatever that may be.

34:58 So, it really doesn’t take long, even when you’re dealing with a response,

35:01 and you never want to be doing it from a response.

35:03 But even when you’re not in learning mode,

35:05 you can say, if you need something, hit request.

35:06 We’ll review it and we’ll approve or deny it.

35:09 It’s still not the end of the world,

35:11 because that’s a lot better than where you were where,

35:13 oh, ransomware is actively running in our environment.

35:15 JACK: The traditional way we would secure networks

35:18 was kind of like a castle-and-moat type of system.

35:21 Everyone inside the castle wall was trusted.

35:23 They could go anywhere, do anything.

35:25 Then you put up this giant gate and moat around the whole thing,

35:28 keeping everyone out that you don’t want in.

35:30 But the problem with this is that if someone does sneak in, well,

35:34 now they’ve got access to everything.

35:35 There’s nothing to stop them once they’re in.

35:37 If an employee turns rogue or clicks on a phishing link and gets infected,

35:41 that employee’s computer can go anywhere and do anything.

35:44 So, the new way people are securing networks today is called zero-trust,

35:48 and that simply means to verify everything.

35:50 No longer is everyone on the inside trusted by default.

35:53 They’re now given the least amount of privileges to do what they need to do,

35:57 and tools like ThreatLocker are great

35:59 for implementing zero-trust since you can see

36:00 and lock down any and all activity in the network very easily and quickly.

36:04 DANNY: So, in the world of zero-trust,

36:06 you essentially grant access where access is required.

36:08 Everyone thinks it means no.

36:10 It doesn’t mean no.

36:11 It means if you’re the finance director

36:13 and you need access to all of the financials,

36:15 we’re going to give you access to the financials because that’s your job.

36:18 If you need to be able to upload those financials to the internet,

36:20 we’re going to allow you to upload those financials

36:22 to the internet because that’s part of your job and requirement.

36:25 So, in the world of zero-trust, it’s not about no.

36:27 It’s about, if you need it for your job, we will grant that permission.

36:30 In the world of detection and response, you’re saying,

36:33 if I detect an anomaly or something suspicious,

36:36 I’m going to block and respond to that anomaly or something suspicious.

36:40 But if we don’t detect something suspicious, we’re just going to allow it.

36:43 So, in the world of detection and response, everyone can access the financials.

36:46 In the world of zero-trust, only the people that need to.

36:50 JACK: What is your mission, or what’s ThreatLocker’s mission,

36:53 or what are you trying to change in the world?

36:55 DANNY: So, it’s very simple.

36:56 I want to change the way the world

36:58 thinks about security from default allow to default deny.

37:01 So, rather than going into a computer and saying,

37:03 I’m allowed access to everything until someone decided it’s bad for me

37:07 to access this, which is how most security works right now on endpoints,

37:10 I want to change it so I go in and I

37:12 need to access everything I need to do my job,

37:15 and everything else is denied until

37:17 somebody’s decided and granted me that permission.

37:19 That’s our mission as a company.

37:20 It’s been our mission since the beginning.

37:22 We attend over a thousand trade shows— well,

37:25 ThreatLocker’s attended over a thousand trade shows this year.

37:27 We host Zero-Trust World.

37:28 The reason we do this is education.

37:30 I think I did 120 trips this year.

37:32 I will do local events, we’ll do Zero-Trust World,

37:35 I’ll go to Black Hat, to RSA, to Gartner events,

37:38 and it’s about educating people why this is so important,

37:41 but also how it’s not difficult,

37:43 ‘cause people think it’s going to take them months and years.

37:46 I’ve onboarded people in hours.

37:47 Ideally, we want to do it over a week so we can do a nice learning baseline,

37:52 but it’s very easy to do.

37:54 It’s very effective to do.

37:55 So, my mission is to make sure people understand why this is

37:59 so important and then also educate them how it can be done.

38:02 JACK: Yeah, so, educate me.

38:04 Educate us.

38:05 So, you say deny by default.

38:07 You could explain why that’s so important or even pick another

38:11 topic and say this is what else is important to me.

38:14 DANNY: Okay, so, deny by default is so important because think

38:17 about this; if we go back— and we’ve never— as a world,

38:21 we’ve never been very good at stopping viruses.

38:23 Let’s face it, we go back to 2000, 2001.

38:26 We have the Love Bug virus.

38:28 It infected a third of the world’s business commuters.

38:30 Now, that virus said ‘I love you’

38:32 and e-mailed your friends and said ‘I love you’,

38:34 so it wasn’t the end of the world.

38:35 We had the Blaster virus after that.

38:36 All of these times we had antivirus.

38:38 We were denying by exception.

38:40 We were allowing by default and denying by exception,

38:43 and we weren’t very good at doing that.

38:45 In 2007, 2008, we started seeing botnet e-mails being sent out.

38:48 Again, people were getting malware all the time.

38:51 They were sending the spam e-mails.

38:52 They were getting pop-ups.

38:53 But it was a problem, and it was an IT problem.

38:57 Switch to 2014; we start seeing malware

38:59 that actually encrypts files and takes down businesses.

39:03 Malware and software are the same thing.

39:06 Whether it’s— they’re literally written

39:08 in the same languages, work the same way.

39:11 The only difference is the intent at which it was created.

39:14 So, every piece of software you run on your computer,

39:17 whether it’s Angry Birds or a large e-tech

39:20 support app or Microsoft Office or Google Chrome

39:22 or— a piece of ransomware can see all

39:25 of the files that the user who runs it can see.

39:28 So, you don’t have to be an admin.

39:29 If you’re a finance director, if you’re in sales, it can see all of your files.

39:32 So, if you were to say I want to deny software

39:36 by default and only allow software that’s been approved by the company,

39:39 what you end up with is a situation where you’re no longer

39:43 just relying on is— am I going to detect the latest threat?

39:48 But you’re now saying I’m gonna block everything.

39:51 It doesn’t matter if I detect it,

39:52 because if the software isn’t approved by the business, it’s not allowed to run.

39:56 That is so efficient at stopping ransomware, malware,

39:59 but also things like Team Viewer and access tools,

40:01 which are often used by scammers to gain initial access to your network.

40:05 JACK: This is great.

40:06 Keep going.

40:06 Tell us more about how to secure a network.

40:08 DANNY: Every secure— or mostly,

40:10 most security attacks can be stopped with one or three methods.

40:12 The people, detection, and controls.

40:14 The first one is through people.

40:17 But the first example I’ll give you is phishing.

40:20 In the event that someone wants to phish you or someone in your company,

40:27 they’re going to send an e-mail to you or a text message, whatever it may be.

40:31 As a user, you have the power to stop that attack

40:34 immediately in its tracks by not clicking on the link,

40:36 not putting your credentials in.

40:38 The attack is gone if you don’t do that.

40:42 So, that’s method one.

40:43 The people don’t make the mistakes, don’t click on the phishing links,

40:47 don’t give somebody access to their machine.

40:49 The second method is to detect a threat, and this is where— we look at phishing;

40:55 this is where we’ll say, is this a known bad website?

40:59 Does it exhibit signs that it’s a phishing attack?

41:02 Again, detection is not a guarantee because

41:04 the website might have just been spun up.

41:07 Attackers will switch the website out, use techniques.

41:10 It’s brand-new.

41:10 You don’t know it’s a bad website.

41:12 But it’s a method.

41:13 If you manage to detect it and you can block that phishing link from being used,

41:17 the threat is neutralized.

41:18 The third way is the idea of controls.

41:21 Controls are where zero-trust really fits in, and this is the most simple way,

41:25 and this is where you say, well,

41:27 I’m gonna turn on things like dual-factor authentication,

41:29 I’m gonna turn on things like IP restriction so it

41:32 can only be accessed from one of our known IP addresses.

41:36 When you do this, it’s— you basically say that I accept

41:39 my user might click on the link and give the person,

41:42 the attacker, my password or their password.

41:44 I accept that my e-mail to security may not detect the phishing e-mail,

41:49 but I won’t accept that they can still get into my machine.

41:52 So, what I’m gonna do in addition to this is I’m gonna restrict which IP

41:55 addresses can log into my Microsoft Office tenant

41:58 to only the IP addresses of my devices.

42:00 I know I’m also gonna enforce dual-factor

42:02 authentication so the password by itself isn’t allowed.

42:05 They’re gonna have to have the user’s physical device.

42:07 As an IT or security professional,

42:09 this is the— the control is the only thing that you can actually control.

42:13 You can’t control— you can train your users, but users are gonna make mistakes.

42:16 People are gonna make mistakes all the time.

42:18 You can buy detection, but detection can’t tell the intent,

42:21 if it’s new or if it’s unknown,

42:24 but you can control whether— if it’s— if someone puts

42:27 their passwords in, will somebody be able to get into your system?

42:30 So, that’s the first example of where that’s really important.

42:34 The second example is when we think about malware.

42:37 I can put a antivirus on a machine and say,

42:40 if you download known malware, block this known malware from running.

42:43 Windows Defender comes shipped with every machine,

42:45 and sometimes it blocks the malware.

42:47 Sometimes it doesn’t.

42:48 I can tell my users to never download detachments.

42:50 Don’t open things that you don’t know where their source is.

42:53 If the user doesn’t do it, the threat is foiled.

42:56 But I cannot guarantee either of those two are gonna apply.

43:00 If I block un-trusted software by default,

43:03 if one and two fail, three is always going to be successful.

43:08 This is where security has to be.

43:10 If we think— go back to the— even the eighties and the nineties.

43:13 We didn’t used to have firewalls on our network.

43:15 We didn’t used to have firewalls on our computers.

43:17 Windows didn’t have a firewall built in until Windows XP.

43:21 We’d get constant malware, and then Microsoft would patch it,

43:23 and then we’d get malware again, and Microsoft would patch it.

43:26 Microsoft released the firewall on the computer,

43:27 and suddenly malware from the user dialing up

43:30 to the internet or connecting to a broadband connection vanished,

43:34 and it became people downloading malware

43:36 because they implemented a we-deny-network-traffic-by-default policy.

43:39 That’s how all security should operate.

43:43 JACK: Do you have any statistics that you can tell

43:46 me that makes— that tells me that ThreatLocker is effective?

43:50 When I go to the doctor and they

43:52 give me medicine to prevent an ailment— an illness,

43:55 I don’t know if it actually prevented the illness,

43:57 ‘cause I can’t tell if I got ill and the medicine fixed it, right?

44:01 So, if ThreatLocker is here to prevent ransomware, how do I know it worked?

44:07 DANNY: So, I will tell you.

44:10 So, I’ve got 70,000 roughly companies that use ThreatLocker,

44:14 and I think… JACK: Did you say 70,000?

44:18 DANNY: 70,000 companies that use ThreatLocker,

44:20 from small businesses through MSPs right up

44:22 to large— some of the biggest software companies,

44:26 banks, financial companies, hospitals, airports in the world.

44:29 So, it really is at mass scale.

44:30 Not a lot of them go through MSPs, so,

44:33 you take an MSP; they have a hundred small businesses.

44:36 They’ll manage it.

44:37 I have never had a customer

44:39 with a ransomware case that wasn’t ignoring obvious signs.

44:43 So, we’ll send a report out saying, you have your machines in monitor-only mode.

44:49 The bottom line is— and there’s no such thing as un-hackable,

44:53 but the only way somebody— if you go out and you install a network control

44:58 and you close ports and you stop un-trusted

45:01 software and you stop power shell accessing things,

45:03 it’s— nothing’s impossible, but it’s almost impossible to get through that.

45:09 If I look at those 70,000 businesses,

45:11 I’m tracking about 125 ransomware cases on them,

45:13 and every single one of them has been pure—

45:17 their machines were not secured or they— the other

45:20 one we see is where they didn’t— they had

45:23 open ports on their hypervisor and someone got in.

45:25 They shut down the VMs and put them in safe mode or something like that.

45:29 But if they followed the policies,

45:30 if they followed— we’re gonna stop un-trusted software,

45:32 we’re gonna close ports and only allow them to trust the devices,

45:35 I have never seen a case where somebody gained access to a machine.

45:38 JACK: ThreatLocker is hiring, but beware;

45:40 they’ll tell you in the interview that it’s the hardest job you’ll ever have.

45:43 DANNY: Yeah.

45:44 I mean, every person that we hire, we make sure that they’re aware this is gonna

45:47 be one of the hardest jobs they’ve ever had.

45:51 Because I try and always say to our— I make sure

45:55 everyone in the company knows we are not supporting a software product.

45:58 We are supporting a hospital, an airport, a government agency, a local business,

46:02 and when someone calls in and they’re having a problem—

46:06 and the thing is about what we’re doing is

46:08 we often— I would say seventy to eighty percent

46:11 of our support tickets have nothing to do with us.

46:14 The reason people call us first is because if you say, well,

46:17 I’ve got a EDR and I’ve got a zero-trust endpoint security product,

46:21 and suddenly one piece of my— my dental software is not working, it’s very,

46:25 very easy for you to say, well, I assume it’s to do with the zero-trust, always.

46:31 I’ve been literally four hours proving and diagnosing and working

46:36 with a competitor of ours on EDR space to say,

46:40 look, you have a problem here with your software.

46:43 We’ll uninstall ThreatLocker.

46:44 We’ll show them the issues still happening,

46:46 and then we’ll actually go in with a vendor and say,

46:48 you’ve got a problem with your software here.

46:51 Because I think it’s easy to assume that zero-trust is the problem,

46:54 but most of the time it isn’t.

46:56 But you’ve got this culture change which we’re trying to change.

46:59 So, people have to know it’s hard, but I think it’s also incredibly rewarding.

47:03 I think what we do is— there’s nothing better than

47:07 a feeling that we just stopped a major ransomware attack.

47:09 My door never gets closed.

47:10 My phone is never turned off, but— and I always say to anyone,

47:14 if you can’t fix the customer issue and you can’t get someone else to help you,

47:18 go over to the development part and go over to your peers.

47:20 But also when you— at the end of the day, if it’s 2:00 a.m.

47:24 in the morning and it’s not working, come and call me.

47:27 Call me, call Sammy, who’s our other co-founder, and call and say, hey,

47:31 I’ve got a customer on the phone and they’re saying

47:34 that something’s wrong and something’s getting blocked and it shouldn’t be,

47:37 and they don’t understand and I don’t understand why,

47:39 and I can’t find anyone else.

47:40 It’s like, well, let’s see what’s wrong,

47:42 because I think it’s important for everyone to know

47:45 that we’re willing to take a phone call at 2:00 a.m.

47:48 in the morning if it solves a customer issue.

47:50 JACK: How many phone calls do you get a month during your sleep?

47:54 DANNY: Probably six or seven.

47:56 JACK: Geez.

47:58 I hope you get paid overtime for that.

48:03 DANNY: Yeah, no.

48:04 But I think it’s— we have a twenty-four-hour— I mean,

48:09 we have customers in Australia.

48:11 Well, we have offices in Australia, in Dubai,

48:13 in Dublin, we have staff in eleven different countries.

48:17 We have customers all over the world.

48:20 I just— I think it’s more important that we solve the issue for the customer,

48:34 and that’s the bottom line.

48:39 (Outro): [Outro music] Thank you so much to our guests,

48:42 and especially Danny Jenkins from ThreatLocker.

48:43 To learn more about them or to get a free trial, visit threatlocker.com.

48:47 This show was made by me, the real SQL Shady, Jack Rhysider,

48:50 mixing by Proximity Sound,

48:51 and our theme music is by the mysterious Breakmaster Cylinder.

48:54 I got tired of forgetting my password,

48:56 so I just changed it to the word ‘incorrect’.

48:58 Whenever I go and I type in the wrong one,

49:01 the website always says, your password is incorrect.

49:05 I’m like, oh yeah, thanks for the reminder.

49:09 This is Darknet Diaries.