Lately I’ve been dealing with a lot of ransomware cases. And often our team runs into issues with the IT staff from the victim organization.

Jul 18, 2021 · 9:39 PM UTC

33
260
56
1,306
Whether they’re embarrassed or afraid of being shown up or for whatever other reason, they’re uncooperative or in some cases actively working against our investigation.
2
6
1
252
So on a recent case, during our engagement kick-off call, I laid it out like this. “We’re going to investigate and figure out where this started. And it will be an unpatched system, or somebody clicking a link, or somebody just being unlucky with a web site they visited.”
3
14
3
263
“And NONE of that is YOUR FAULT. All organizations are vulnerable, because I have yet to meet an org whose security budget exceeds their attack surface.”
4
22
3
377
“You are not the assholes here. The assholes are the ones who took that vulnerability and used it to drop ransomware all over your network. Just because you forgot and left your door unlocked doesn’t make it right for somebody to come in and trash your place.”
4
15
1
303
“We are the good people. The ones who are trying to figure out what happened and make things better. This is a team effort that is going to require everybody’s help. Nobody is to blame, we are all just trying to fix this mess we find ourselves in.”
2
6
254
Later in the engagement, several people from all levels in the IT staff said they appreciated those words and the timing and it helped them move on from the initial FUD stage of the incident and be more productive. Your mileage, as always, may vary.
16
13
580
Load newest
Replying to @hal_pomeranz
This applies to pen-tests and developers too. I guess the root cause is often a really bad “blame culture” in a lot of workplaces.
4
Replying to @hal_pomeranz
@threaderapp unroll please
Replying to @hal_pomeranz
So much yes! You helped them get past fear and into solving the problem. Leave egos behind, let go of blame, and solve the problem. Then do it again tomorrow
Replying to @hal_pomeranz
My management approach is to let go 10% of the IT staff every year based on their performance and delivery. It keeps the team on their toes.
1
Replying to @hal_pomeranz
$TRACE is a sure catch Definately worth an investment especially after going through their usecases and what they have to offer. Go check it out🤞 t.me/tracenetwork
Replying to @hal_pomeranz
Yes, apply basic psychology and game theory and don't punish the victim, make sure they know you care and aren't there to laugh. Similar to rape.
This tweet is unavailable
Yes. Our report is typically going to include pointers for making things better going forward. This is where we can (kindly) point out the gaps our investigation has discovered.
6