Security Confidential S7 E9 Greg Edwards

Manoj Tandon: Hello everyone, this is Manoj Tandon, your host of Dark Rhino Security Confidential. Today we are honored to have Greg Edwards join us. Greg is the CEO of CryptoStopper, a ransomware protection service that automatically detects and stops active ransomware attacks. He has been a technology entrepreneur since 1998, which makes me feel young. That’s great. He has founded many businesses, including Axis Backup, a backup and disaster recovery company for the insurance industry that he founded a few years before CryptoStopper. He is a skilled person in disaster recovery, cloud computing, and network security, just to name a couple of things. We’re honored to have him on the show. Thank you for being here, Greg.

Greg Edwards: Thanks for having me.

Manoj Tandon: It’s fantastic to have another entrepreneur on here. We get them from time to time, and they’re always interesting characters. I can’t say that I’ve had one person that’s been boring.

Greg Edwards: Well good, we want to start with that.

Manoj Tandon: Yeah, we want to keep the audience entertained for sure. “Edutainment” is a thing, and we’re trying to go down that path. So give us a little bit about your background. How did you get into starting your own businesses? Because you’ve done a couple of them. What was that journey for you?

Greg Edwards: Yeah, so I think I was born an entrepreneur. I mean, I was detailing cars and hiring my buddies to do the hard work when I was about 12. I formally started the first company when I was 24 and really had no idea what I was doing, but I actually still own that company today. I absentee-own a managed services business that I still own today. So yeah, I think it started at a very young age.

Manoj Tandon: In your journey as an entrepreneur, are there some guidances you can give in terms of anyone that’s contemplating it? Is there any reality check you want to throw out there?

Greg Edwards: Well, I mean, some of it is just the standard: it’s not easy. It is a ton of hard work; you’ve got to be able to buckle down. But I think probably the number one thing that I just did natively and didn’t recognize in myself even was taking action and not being afraid to take that first step. At 24, I did that unknowingly, not even realizing that other people wouldn’t do that. So whether it’s bringing a product to market or going out on your own and starting a services business, take that first step. Go get the first client or release rev one and go get someone testing it in the real world.

Manoj Tandon: So, what about the fear of failure?

Greg Edwards: Again, that’s something that I fortunately or unfortunately didn’t have. I didn’t ever have a fear of failure. Now, I’ve grown into that with age, and I think that because I’m a “fail fast” kind of entrepreneur, I go, iterate, and try the next thing. Make sure that it’s working, and if you fail, you’ve got to learn from it. But you can’t be afraid of failure.

Manoj Tandon: I’m glad that you answered it. I couldn’t have teed that up any better. That was the answer I think I wanted everybody to hear: that failure is not necessarily a bad thing if you’re going down the entrepreneurship road. In fact, it’s almost necessary to become really successful.

Greg Edwards: Absolutely. Early on, failure wasn’t even a thought. That wasn’t even an option. Now I view failure as a positive thing. There are failures that certainly still happen, but you’ve got to learn from those and take it for what it is. If you never try anything, you’ll never fail. But don’t be that person.

Manoj Tandon: Yeah, that won’t be a very interesting life, will it? Before we move into some hardcore cybersecurity topics here, on the subject of entrepreneurship, do you think that this is something that could be taught in school?

Greg Edwards: Absolutely. I think there is an element, like in sports, of talent for sure, but entrepreneurship is something that can be taught. I think talking through dealing with fear and dealing with failure are the biggest things. Anyone can come up with lots of ideas; it’s a matter of implementing and not fearing that failure to go do it. Then you have to be able to execute. There’s a big difference between entrepreneurs who go start something and get it from zero to one and entrepreneurs who get it from zero to ten million. Those are very different skill sets. I’m the zero-to-ten-million guy, but not the ten-million-to-twenty-five-million guy. I’m ready to turn it over to someone else at that point.

Manoj Tandon: And it’s important to know that, but that is where all the innovation happens.

Greg Edwards: Yeah, absolutely. After that, you’re getting it to operational effectiveness, which is great, but it becomes an analytical exercise.

Manoj Tandon: I guess that was the point in asking the question, because at the university level we see a lot of the curriculums for entrepreneurship programs based on analytical, objective things, which is important—how do you analyze the market, gauge yourself against the competition—but what you spoke about, that fear of failure and taking the first step, that’s where the real magic is. I think at the university level a lot of entrepreneurship programs have come out of MBA programs.

Greg Edwards: Yes, they have.

Manoj Tandon: Very different skill sets.

Greg Edwards: Related, but very different skill sets between an MBA program and an entrepreneurship program.

Manoj Tandon: I couldn’t agree with you more. So, with that being said, let’s talk about CryptoStopper. How did this company come about? What’s the backstory here?

Greg Edwards: Yeah, so I started an offsite backup and disaster recovery company in 2007. We started seeing the rise of ransomware as far back as 2012. That’s really when Bitcoin started to take off. If you look at the rise of ransomware, it completely coincided with cryptocurrency becoming available and mainstream. We were seeing ransomware attacks nonstop in the offsite backup business. We specialized in insurance agencies, and during Hurricane Sandy we did nine simultaneous recoveries on the East Coast.

Manoj Tandon: Wow. Was that because their data centers went down, or because of ransomware?

Greg Edwards: So, we were their data center. These were on-site servers back before the cloud was what it is today. Then we had one weekend where we did thirteen simultaneous recoveries because of one ransomware strain. I was seeing this happen in real time and knew probably in the 2014–2015 timeframe that this was going to become a serious problem. I exited from the offsite backup company in 2016 with no real intent of developing our own software, but with the intent of starting an MSSP to protect companies and put in the right tools. We were using advanced EDR and AlienVault before most people had even heard of EDR or SIEMs, and ransomware attacks were still happening. So we built a PowerShell script. The very first version of CryptoStopper was a PowerShell script. One of my engineers who is still with me today came to me and said, “Why don’t I try this idea?” He built a PowerShell script that would deploy bait files, monitor them, and stop an active attack. It took about nine seconds, which was way too long. Over time, we developed that into an actual application. We built a Windows-native driver to collect information and build what we call the PET algorithm—Post-Execution Termination—to watch for an actively running ransomware attack and kill it.

Manoj Tandon: And this was before WannaCry became a thing?

Greg Edwards: Yeah, it was about that timeframe. We had developed the PowerShell script before that, but it was all happening around 2017.

Manoj Tandon: Going back to Axis Backup, how did you prevent your backups from getting infected? We’ve seen that happen quite a bit.

Greg Edwards: It was really just good hygiene. Good cybersecurity practices and the way we implemented things. For every one of our clients, we did a white-glove setup of their initial backup and required them to set an encryption key that wasn’t used in their existing system. Having passwords that weren’t the same across the entire network—that was craziness in 2010. Even today there are Oracle databases out there with default passwords in place. So our offsite backups were encrypted with passwords that were different from their local admin credentials.

Manoj Tandon: Why is it that companies, even today, struggle with getting a great disaster recovery program in place?

Greg Edwards: It’s hard because it takes time. Actually, with the right tools, it’s not that hard, but IT teams are often too reactive and don’t have someone holding them accountable to test their DR. At Axis Backup, we would do a week-long test where we’d send everybody home. This was before remote work became mainstream. We’d say, “The office has been destroyed. Now what?” We’d actually test recovering everything remotely. Testing DR isn’t about tabletop exercises. It’s about actual recovery. What is your real RTO number? Not what you think it is, but what it actually takes.

Manoj Tandon: I think this is where the executive team has to get on board and understand how critical that exercise is.

Greg Edwards: Absolutely. You have to go with the assumption that there will be an attack. The fact that it hasn’t happened yet is just providence. We both know that putting in layered security and defense-in-depth are the right things to do, but even then you can’t guarantee 100% protection. You’re just making yourself a harder target.

Manoj Tandon: CEOs really need to understand that risk instead of sticking their heads in the sand.

Greg Edwards: And there’s often an IT communication problem. Infosec people are speaking a language the decision-makers don’t understand. They need to summarize complex topics into digestible chunks. If the CEO doesn’t dig in and the IT department isn’t communicating properly, it becomes a mess.

Manoj Tandon: Even if you have a phenomenal disaster recovery program, your data could still be out there. You still have brand issues, privacy concerns, fines, and legal actions.

Greg Edwards: Exactly. That’s why I started CryptoStopper. Once we developed the initial PowerShell version, we started using it within our own environments. Then it made sense to sell it to MSSPs and MSPs so they could use it. Rather than depending entirely on disaster recovery, you can depend on CryptoStopper to stop the attack. We built that PET algorithm to recognize ransomware running and kill it in less than a second so it doesn’t take the network down or allow data exfiltration. It turns a full-blown disaster into a security incident.

Manoj Tandon: Walk us through the anatomy of a ransomware attack.

Greg Edwards: The most common vector is still email—a link or an attachment. The user interacts with it, which starts the ransomware attack. Then the ransomware enumerates the network, looks for shares and files, and starts attacking data folders. Whether it encrypts and then exfiltrates or just encrypts immediately, it begins destroying the network, often without anyone even realizing it’s happening.

Manoj Tandon: At what point does it phone home? When would a SIEM or SOC notice this?

Greg Edwards: It depends on the variant. It may not phone home immediately. It could simply set a time bomb to start Friday night at 6 p.m. If it’s a living-off-the-land attack, it usually does need to phone home. But those command-and-control domains are constantly changing, so a SIEM isn’t necessarily going to catch them as known indicators of compromise.

Manoj Tandon: One thing we’ve done is place a completely Cyrillic-configured system on the network as a kind of honeypot. It’s interesting how activity subsides because attackers originating from that region don’t want to risk targeting Russian systems.

Greg Edwards: That’s fascinating. I’ve never heard of anyone doing that intentionally, but it makes sense. It’s not illegal for Russian citizens to attack non-Russian companies, so they avoid anything that could look domestic.

Manoj Tandon: Going back to CryptoStopper, it sounds like you’re preventing encryption before the exfiltration can really take place.

Greg Edwards: Exactly. We’re adding more explicit exfiltration prevention in future releases, but almost all exfiltration encrypts the files first, and we catch that before it goes out.

Manoj Tandon: Is CryptoStopper running as a process or a kernel modification?

Greg Edwards: Both. There’s a kernel driver collecting information and taking action, and then another layer analyzing the data from the kernel.

Manoj Tandon: So attackers can’t just kill the CryptoStopper process?

Greg Edwards: Correct. We’ve prepared for that from the beginning. It’s a constant cat-and-mouse game. We think like hackers. We’ve written our own safe ransomware variants and attack simulators so we understand how attackers are trying to get around us.

Manoj Tandon: Sounds like zone defense in football: let them make the catch but don’t let them score.

Greg Edwards: Exactly. We’re on the damage-control side, not prevention. Once ransomware is running, we step in and stop it.

Manoj Tandon: How much damage usually happens before CryptoStopper stops the process?

Greg Edwards: Typically one or two files on the low end, maybe a dozen on the high end before we kick in, and we’re talking less than a second.

Manoj Tandon: Are those files recoverable?

Greg Edwards: We still rely on traditional backup and recovery for that. Again, it’s about damage mitigation.

Manoj Tandon: Where do you fit into a layered security architecture?

Greg Edwards: Right alongside advanced EDR and SIEM. I’m a huge proponent of both. CryptoStopper is an add-on layer. We’re not designed to detect a data breach or identify dwell time. We’re designed to recognize malicious file changes and kill the process.

Manoj Tandon: There’s a stat that Fortune 1000 companies average around sixty cybersecurity tools, and there’s a lot of vendor anxiety. Is vendor consolidation a good thing?

Greg Edwards: Long term, yes. But right now, cybersecurity problems are so varied that innovation comes from startups like CryptoStopper, not giant legacy vendors. We’re about ten years into the cryptocurrency-driven cybercrime era, and industries take time to mature. I think eventually you’ll see consolidation from sixty tools down to maybe thirty, but we’re not at the “single silver bullet” stage and may never get there.

Manoj Tandon: What’s the biggest impediment to companies acquiring CryptoStopper?

Greg Edwards: Education. Understanding the difference between prevention and damage mitigation. Decision-makers often think every new tool is supposed to be a silver bullet, but CryptoStopper is one part of a layered defense strategy.

Manoj Tandon: Is your technology geared more toward enterprises, or is it affordable for mainstream companies?

Greg Edwards: It’s absolutely affordable for mainstream companies. We focus heavily on the SMB space through MSPs and MSSPs.

Manoj Tandon: Then you’re definitely on the right show because that’s most of our audience. I know we’re down to the last few minutes here, so I wanted to give the floor to you to plug anything you’d like.

Greg Edwards: Right now we’re at CompTIA in Chicago at the ChannelCon event, so definitely check that out. Then head to our website, GetCryptoStopper.com, and see what CryptoStopper can do for your organization. Also, connect with me on LinkedIn. Just search Greg Edwards at CryptoStopper. If there’s another Greg Edwards at CryptoStopper, we’ve got a problem.

Manoj Tandon: Do you have a ransomware group or CryptoStopper group on LinkedIn as well?

Greg Edwards: We actually don’t, but that’s a great idea and something we should definitely start.

Manoj Tandon: I think that would be interesting because ransomware is such a hot topic. It feels like there’s not a day that goes by without hearing about another attack.

Greg Edwards: The attacks are going to continue. It’s all about identifying the weakest link and easiest target. One piece of advice for companies is to make yourself the hardest target on your street.

Manoj Tandon: That’s sage advice. Greg, we’re out of time, but we really appreciate you being here. It’s been a pleasure. As you guys advance, please feel free to come back on the show and enlighten us further into this world of ransomware.

Greg Edwards: Thanks for having me. I’d love to come back.

Manoj Tandon: Sounds great. Take care.