167: Threatlocker

24:37So because of those VPN connections to the threat actor, it looked like it was just one network, right? It probably looked to them like it was just one big connected network. But really, they ended up bouncing to a different hospital system that was not a customer of ours that actually did not have ThreatLocker. in the environment and was able to deploy what they needed on those devices. Oh no, they bounced from this hospital to another hospital that was connected internally and were able to do damage there. The threat actor ultimately reached out later that week saying, hey, we were compromised your environment, we have terabytes of data.

25:15And they wanted the hospital to pay hundreds of thousands of dollars in ransom to get it back. Whenever this happens, the company, if they have cyber insurance, they should read their cyber insurance because it probably says in there that if they're in the event of an incident, you need to call us because we have instant response companies that we trust that we want to have involved in this. So that's what happened. And as part of that cyber insurance, there's also usually some sort of will negotiate on your behalf with the threat actor to try to get that ransom cost dropped as much as possible.

25:49So with the knowledge that we had, ThreatLock was able to see where they're able, I know, to drop it by quite a bit. I can't I can't I don't know exactly the number it dropped, but I'd heard that it was they were able to negotiate pretty effectively because they knew what the threat actor actually had been able to get to. OK, so they they lowered the ransom and then they paid the ransom. Yeah, this hospital system did end up paying the ransom. them. The hospital was able to ask the threat actor, hey, how can we improve? How can we get better? What should we be doing? And the threat actor responded, saying that they quickly realized that ThreatLocker was on the Windows devices, so they knew that they wouldn't be able to use those for the purposes that they intended, and they began to pivot to other locations in the environment that did not have ThreatLocker.

26:49Tell us who you are and what do you do? So I'm Danny Jenkins. I'm CEO and co-founder of ThreatLocker. But what I do is really build solutions and educate the world on how denying by default is the best way to address security. And it doesn't have to be difficult. So you started ThreatLocker. How did all this get started for you? The first thing is I wanted to do something fun and I started doing some ethical hacking. I ended up doing more ransomware recoveries than ethical hacking, to be honest, because people were calling me and I wanted to make money. So they'd say, hey, I've been hit by ransomware.

27:21Can you help with this recovery? We paid a ransom. And there was this particular case in Australia, which was the first one I dealt with. It was an insurance broker, so about 50 employees insurance company. And I got called in by the MSP, managed IT company, to help with the recovery. And I came in and they'd paid this$22 ,000 ransom and they hadn't got their data back. So they got some keys, but the keys didn't work. They weren't decrypting the files. Their Exchange database was encrypted. Their SQL database was encrypted. Everything was encrypted and broken. And they'd asked me to come in. So we start trying to reverse engineer the code, see if the decryption keys are in the code, try to use low-level data recovery tools to get things from the disk that had been deleted or written over for encryption, or recovering from OST files, through email databases.

28:11We're trying everything we can to get this company back up and running. And during the recovery, the owner of the company called me and he got quite, first he got quite mad. He was like, when's this going to be done? I've been waiting two weeks and I still have my servers up and running. And he's getting quite mad. And I was like, look, you need to be realistic here. I'm trying to recover your files, but you have everything encrypted. You have no backups. you've paid a ransom you didn't get your data back and I don't know if it's going to be back and we're doing everything we can to make sure you can get your data back and it then turned into quite an emotional call and his voice started crackling he started almost crying down the phone and I got really awkward at that point because I really didn't know what to say and to me this was different because every other cyber I call it cyber attack I dealt with every other malware attack I dealt with because prior to 2014, most malware attacks were really just IT issues.

29:10It was, you know, you're getting adverts, someone sending email out from your server. It'd been an IT problem. IT needs to fix the server because we're sending spam emails. IT needs to fix the computer because it's getting pop-ups. The worst I'd seen before that was someone crying because I saw an inappropriate picture. And what I did was it suddenly hit home that this is a real problem and this guy's going to lose his entire business and he's close to retirement age because somebody decided to download a piece of software. And I didn't at that think, oh, I'm going to go and start a company to solve this.

29:42What I said to the IT team and what I said to him and we managed to recover enough was you need to use application control. You need to block software by default. And he said to me, okay, well, I'm going to go and do that. And then the IT team told him that Danny's stupid. Don't listen to him. That's not viable. we can't do that. And I went out to prove him wrong. And I couldn't prove him wrong, the IT team. And that was really when the first time we said, well, let's try and build something to prove him wrong. And I kind of went back and forth on this idea quite a bit, because it wasn't an easy lift to build a solution for this.

30:20But we had to, it was really, in 2017, we had a product, we had a concept product. And I still wasn't sure this was the right thing to do, because we knew in order to make zero trust viable. And today, we've got 70 ,000 companies that use our product from small businesses right up to some of the biggest companies in the world, federal government, airports, banks, everything. But back then, I was like, if I need to make this so it's viable for everyone, I need to make it so we can deploy application control, we can block software by default, we can ring fence applications and make it so you can deploy it in hours and days, not months and years.

30:59and I wasn't sure that it was going to be viable without me hiring hundreds, well, I ended up hiring hundreds and hundreds of people. But I think in 2017, my mindset shifted because before 2017, I was thinking about building a business that 1 % of the world would sign up to. After 2017, I made the decision, we don't want 1 % of the world, we want to change the markets and 90 % of the world are using a zero trust approach. Okay, so you coded it at the beginning? You built it? Yeah, so I coded the first version, and there's four parts of ThreatLocker, if you like. There's a service, there's a driver, there's a portal, and there's an API.

31:44That's the four original components of ThreatLocker, and I wrote an entire version of it, and I wasn't so good at the driver stuff. I caused a lot of blue screens. So we ended up bringing, at the very beginning, the whole thing, and then I got somebody else to come and rewrite my driver code because, frankly, it just wasn't very good. And since then, that's probably been one of the best decisions we made. And today, of course, we've got 250 people in our R &D department. Back then, it was just me writing code and Sammy and John testing and deploying. Can you tell me about the first network you installed it on?

32:20Well, so I guess we obviously installed it on our own machines. I think the first network outside of our own that we installed Threat Locker on was actually my kids' school. And they had a problem as well. We were looking after our kids' school IT. We were getting very actively involved because we couldn't afford private school for our kids at the time. And we were getting essentially help with scholarships because we were helping them with the IT systems and everything else. And they were getting malware every single day. It was like a complete nightmare. And we pushed it out to them. Now, it was very difficult and somewhat unstable in many areas because there was things we didn't even think about and we were seeing a lot of noise.

33:02But they went from malware every day to never since. And still today, they're using the product. And my kids aren't in the school anymore, but our chief product officer's kids are actually in the school now. And their IT management went down from full time to a couple of hours a month because these systems became very stable, very easy. Deny all apps by default seems like a radical idea. Like to block everything seems like it's going to halt productivity. Radical depends on where you start. And if you start in a situation where my network is running smoothly and I'm very happy, you would never approach with that idea.

33:44you'd approach with the idea, we're going to learn what we have, we're going to review the list and remove the things from the list we don't want. Whereas if you start with the situation that I've been hit by ransomware, attackers are in my network, the alternative is you shut down the entire network. Or the plus side is you allow the network to run, but you only allow these trusted apps. And then every time someone wants something, they request it for the first time, we add it to the list. And it doesn't seem so extreme now because the alternative is the whole network shut down until we've reformatted every single computer and guaranteed that nothing's bad on it.

34:20So it really depends where you start. For 90 % of customers, they're starting from a clean slate. So they'll learn and they'll remove the things from the list they didn't know about. For the other side of the customers who are starting from, hey, we've already been hacked. It's not extreme to say, hey, everything's blocked until we've approved it. And it's also are not that difficult because most people think, well, what about all the software we don't know about? But the average user uses, you know, 10, 20, 30 apps on their machine. And it's Chrome, Zoom, Office, Firefox, and then they have an SAP system or whatever that may be.

34:57So it really doesn't take long, even when you're dealing with a response. I mean, you never want to be doing it from a response. But even when you're not in learning mode and you say, if you need something, hit request, we'll review it and we'll approval deny it. And it's still not the end of the world because that's a lot better than where you were, where old ransomware is actively running in our environment. The traditional way we would secure networks was kind of like a castle and moat type of system. Everyone inside the castle wall was trusted. They could go anywhere, do anything. And then you put up this giant gate and moat around the whole thing, keeping everyone out that you don't want in.

35:30But the problem with this is that if someone does sneak in, well, now they've got access to everything. There's nothing to stop them once they're in. If an employee turns rogue or clicks on a phishing link and gets infected, that employee's computer can go anywhere and do anything. So the new way people are securing networks today is called zero trust. And that simply means to verify everything. No longer is everyone on the inside trusted by default. They're now given the least amount of privileges to do what they need to do. And tools like ThreatLocker are great for implementing zero trust since you can see and lock down any and all activity in the network very easily and quickly.

36:04So in the world of zero trust, you essentially grant access where access is required. Everyone thinks it means no. It doesn't mean no. It means if you're the finance director and you need access to all of the financials, we're going to give you access to the financials because that's your job. If you need to be able to upload those financials to the internet, we're going to allow you to upload those financials to the internet because that's part of your job and requirements. So in the world of zero trust, it's not about no. It's about if you need it for your job, we will grant that permission.

36:31In the world of detection and response, you're saying if I detect an anomaly or something suspicious, I'm going to block and respond to that anomaly or something suspicious. But if we don't detect something suspicious, we're just going to allow it. So in the world of detection and response, everyone can access the financials. In the world of zero trust, only the people that need to. What is your mission or what's ThreatLock's mission or what are you trying to change in the world? So it's very simple. I want to change the way the world thinks about security from default allow to default deny. So rather than going into a computer and saying, I'm allowed access to everything until someone's decided it's bad for me to access this, which is how most security works right now on endpoints, I want to change it.

37:11So I go in and I need to access everything I need to do to my job and everything else is denied until somebody's decided and granted me that permission. That's our mission as a company. It's been our mission since the beginning. We attend over 1 ,000 trade shows. Well, ThreatLock has attended over 1 ,000 trade shows this year. We host Zero Trust World. And the reason we do this is education. I think I did 120 trips this year and I will do local events. We'll do Zero Trust World. I'll go to Black Hat, to RSA, to Gartner events. And it's about educating people why this is so important, but also how it's not difficult because people think it's going to take them months and years.

37:46And I've onboarded people in hours. I mean, ideally we want to do it over weeks so we can do a nice learning baseline, but it's very easy to do. It's very effective to do. And so my mission is to make sure people understand why this is so important. and then also educating them how it can be done. Yeah, so educate me, educate us. So you say deny by default. You could explain why that's so important or even pick another topic and say, this is what else is important to me. Okay, so deny by default is so important because think about this. If we go back and we've never, as a world, we've never been very good at stopping viruses.

38:23Let's face it, we go back to 2000, 2001, we had the love bug virus. It infected a third of the world's business computers. Now, that virus said, I love you, and emailed your friends and said, I love you. So it wasn't the end of the world. We had the blaster virus after that. All of these times we had antivirus. We were denying by exception. We were allowing by default and denying by exception. And we weren't very good at doing that. In 2007, 2008, we started seeing botnets, emails being sent out. Again, people were getting malware all the time. They were sending the spam emails. They were getting pop-ups.

38:53But it was a problem, and it was an IT problem. We switch to 2014, we start seeing malware that actually encrypts files and takes down businesses. Malware and software are the same thing. Whether it's, they're literally written in the same languages, work the same way. The only difference is the intent at which it was created. So every piece of software you run on your computer, whether it's Angry Birds or Logitech support app or Microsoft Office or Google Chrome, or a piece of ransomware can see all of the files that the user who runs it can see. So you don't have to be an admin. If you're a finance director, if you're in sales, it can see all of your files.

39:32So if you were to say, I want to deny software by default and only allow software that's been approved by the company, what you end up with is a situation where you're no longer just relying on, am I going to detect the latest threat? But you're now saying, I'm going to block everything. It doesn't matter if I detect it because if the software isn't approved by the business, it's not allowed to run. And that is so efficient at stopping ransomware, malware, but also things like TeamViewer remote access tools, which are often used by scammers to gain initial access to your network. This is great.

40:06Keep going. Tell us more about how to secure a network. Every secure, or mostly, most security tech can be stopped with one of three methods. The people, detection, and controls. And the first one is through people. But the first example I'll give you is phishing. In the event that someone wants to phish you or someone in your company, they're going to send an email to you or a text message, whatever it may be. As a user, you have the power to stop that attack immediately in its tracks by not clicking on the link, not putting your credentials in. The attack is gone if you don't do that. So that's method one.

40:43The people don't make the mistakes, don't click on the phishing links, don't give somebody access to their machine. The second method is to detect a threat. And this is where we look at phishing. This is where we'll say, is this a known bad website? Does it exhibit signs that it's a phishing attack? And again, detection is not a guarantee because the website might just be spun up. Attackers will switch the website out, use techniques. It's brand new. You don't know it's a bad website. But it's a method. If you manage to detect it and you can block that phishing link from being used, the threat is neutralized.

41:18The third way is the idea of controls. And controls are where zero trust really fits in. And this is the most simple way. And this is where you say, well, I'm going to turn on things like dual-factor authentication. I'm going to turn on things like IP restrictions so it can only be accessed from one of our known IP addresses. And when you do this, you basically say that I accept my user might click on the link and give the person, the attacker, my password or their password. I accept that my emails of security may not detect the phishing email. But I won't accept that they can still get into my machine.

41:52So what I'm going to do in addition to this, I'm going to restrict which IP addresses can log into my Microsoft Office tenant to only the IP addresses of my devices. And I'm also going to enforce dual-factor authentication so the password by itself isn't allowed. They're going to have to have the user's physical device. As an IT or security professional, the controls are the only thing that you actually can control. You can't control, you can train new users, but users are going to make mistakes. People are going to make mistakes all the time. You can buy detection, but detection can't tell the intent if it's new, if it's unknown.

42:23But you can control whether if someone puts their passwords in, will somebody be able to get into your system? So that's the first example of where that's really important. The second example is when we think about malware. I can put an antivirus on a machine and say, if you download GNOME malware, block this GNOME malware from running. and Windows Defender comes shipped with every machine and sometimes it blocks the malware, sometimes it doesn't. I can tell my users to never download attachments, don't open things that you don't know where their source is. And if the user doesn't do it, the threat is foiled.

42:56But I cannot guarantee either of those two are going to apply. If I block untrusted software by default, if one and two fail, three is always going to be successful. And this is where security has to be. And if we go back to even the 80s and the 90s, we didn't used to have firewalls on our network. We didn't used to have firewalls on our computers. Windows didn't have a firewall built in until Windows XP. And we'd get constant malware, and then Microsoft would patch it, and then we'd get malware again, and Microsoft would patch it. Microsoft released a firewall on the computer, and suddenly malware from the user dialing up to the internet or connecting to a broadband connection vanished, and it became people downloading malware because they implemented a, We deny network traffic by default policy.

43:40That's how all security should operate. Do you have any statistics that you can tell me that makes, that tells me that ThreatLocker is effective? I mean, when I go to the doctor and they give me medicine to prevent an illness, I don't know if it actually prevented the illness because I can't tell if I got ill and the medicine fixed it, right? So if ThreatLocker is here to prevent ransomware, how do I know it worked? so i will tell you um you know so i've got 70 000 roughly companies that um use that locker and i i think that the best 70 000 companies that use that locker from small businesses through msps right up to uh large um some of the biggest software companies banks financial companies hospitals airports in the world um so it really is a mass scale uh not a lot of them go through MSP.

44:33So if you take an MSP, they have 100 small businesses, they'll manage it. I have never had a customer with a ransomware case that wasn't ignoring obvious signs. So like we will send a report saying you have your machines in monitor only mode. And the bottom line is, and there's no such thing as unhackable. But the only way somebody, if you go out and you install network control and you close ports, and you stop untrusted software and you stop PowerShell accessing things, nothing's impossible, but it's almost impossible to get through that. And if I look at those 70 ,000 businesses, I'm tracking about 125 ransomware cases on them.

45:13And every single one of them has been pure, their machines were not secured. Or the other one we see is where they had open ports on their hypervisor and someone got in, they shut down the VMs and put them in safe mode or something like that. But if they followed the policies that they followed, we're going to stop on trusted software. We're going to close ports and only allow them to trusted devices. I have never seen a case where somebody gained access to a machine. ThreatLocker is hiring, but beware. They'll tell you in the interview that it's the hardest job you'll ever have. Yeah, I mean, every person that we hire, we make sure that they're aware this is going to be one of the hardest jobs I've ever had.

45:51And because I try and always say to our, I make sure everyone in the company knows we are not supporting a software product. We are supporting a hospital, an airport, a government agency, a local business. And when someone calls in and they're having a problem, and the thing is about what we're doing is we often, I would say 70 to 80 % of our support tickets have nothing to do with us. And the reason people call us first is because if you say, well, I've got an EDR and I've got a zero trust endpoint security product, and suddenly one piece of my dental software is not working. It's very, very easy for you to say, well, assume it's to do with zero trust.

46:30always. I've spent literally four hours proving and diagnosing and working with a competitor of ours on the EDR space to say, look, you have a problem here with your software. We'll uninstall ThreatLocker. We'll show them the issue is still happening. And then we'll actually go in with a vendor and say, you've got a problem with your software here. And because I think it's easy to assume that Zero Trust is the problem, but most of the time it isn't. But you've got this culture change which you're trying to change. So people have to know it's hard. But I think it's also incredibly rewarding. I think what we do is there's nothing better than a feeling that we just stopped a major ransomware attack.

47:09My door never gets closed. My phone is never turned off. And I always say to anyone, if you can't fix a customer issue and you can't get someone else to help you, go over to the development department, go over to your peers. But also, at the end of the day, if it's 2 a.m. in the morning and it's not working, come and call me. Like call me, call Sammy, who's our other co-founder and like call and say, hey, I've got a customer on the phone and they're saying that something's wrong and something's getting blocked and it shouldn't be and they don't understand it. I don't understand why and I can't find anyone else.

47:40It's like, well, let's see what's wrong because I think it's important for everyone to know that we're willing to take a phone call at 2 a.m. in the morning if it solves the customer issue. And how many phone calls do you get a month during your sleep? Probably six or seven. jeez I hope you get paid overtime for that yeah but I think it's we have a 24 hour I mean we have customers in Australia we have offices in Australia in Dubai, in Dublin we have staff in 11 different countries we have customers all over the world and I think it's more important that we solve the issue for the customer and that's the bottom line.

48:39Thank you so much to our guests and especially Danny Jenkins from ThreatLocker. To learn more about them or to get a free trial, visit ThreatLocker.com. This show is made by me, the real SQL shady, Jack Recider. Mixing by Proximity Sound and our theme music is by the mysterious Breakmaster Cylinder. I got tired of forgetting my password. So I just changed it to the word incorrect. And whenever I go and I type in the wrong one, the website always says, your password is incorrect. And I'm like, oh yeah, thanks for the reminder. This is Darknet Diaries.