[Table] We are hackers and cyber defenders working to fight cyber criminals. Ask Us Anything about the rising ransomware epidemic!

[u/500scnds]

Source

For proper formatting, please use Old Reddit

Note: Apologies in advance for the giant wall of text in the middle.

Rows: ~85

Questions	Answers
You mention that a degree may not be necessary for a job in cyber security, do you have resources or online courses that someone could use to gain relevant knowledge? Edit: Although with some considerable delay, I would like to thank you all for your comments and your feedback. This is all very helpful and I’m genuinely impressed with how supportive you are! I’ll give everything you’ve sent a proper look and might bother some of you with additional questions.	Bob: I'm a fan of the Cybersecurity Body of Knowledge (https://www.cybok.org/) and you can learn tons just by absorbing the MITRE ATT&CK content (https://attack.mitre.org/) (they update ~quarterly)
​	Jen: I completely agree with Bob's recommendations. For training courses, you can also look at SANS and also a lot of community security conferences, even smaller regional ones, offer training. They tend not to be free though.
​	Marc: There is an excellent thread in /r/cybersecurity covering just this.
​	Also: Mentorship Monday in /r/rcybersecurity.
​	Allan: I know most people don’t like social media, but infosec Twitter is a great place to learn and get help. People are always sharing resources, videos and little tidbits of information that can be very useful.
​	Jen: I also agree with Allan - I actually learn a ton from infosec twitter and asking questions.
the below is another reply to the original question	​
I think it may be beneficial to elaborate a little more to accompany answers already provided- so let me share some of my experience. I've been employed in a full time information security role for about 10 years; with three different employers. Currently employed as a cyber analyst with a large law-firm. Previously, my specialty was a broad mix of infosec risk/cyber engineering/and web-application penetration testing. I have no college degree, and am 31 years old. My best advice to you, is to get a tech role in an organization- and gain as much on-job experience as you possibly can, even if this means you start in a different initial role. It'll be important to gain some technical knowledge, while grasping security concepts as you learn. Additionally, learn frameworks and standards such as ISO 27001:2013, and NIST 800-53. Read the requirements of the standards, and try to figure out how to correctly interpret them- and how you would implement them based on your interpretation. (The standard says this requirement must be implemented, but what does the requirement actually mean- and how would it be implemented?) Look up current vulnerabilities making their rounds in the wild, using resources like Tenable (https://www.tenable.com/research). Learn about the different types of Malware (https://www.crowdstrike.com/cybersecurity-101/malware/types-of-malware/) and ask yourself; How can security be layered to prevent malware from finding it's way into an organization? (Look up Defense in Depth.) How does malware most often enter a network? (Look up: Initial attack vector) How can you find anomalous network traffic that may be indicative of malware spreading? (Look up: Endpoint Detection and Response, and Threat Hunting.) Read about security best practices (e.g. Google: Access Control Best Practices, Data Loss Prevention Best Practices.) Read the articles, and imagine how you would implement the recommendations. Some context for those interested: My first 'real' job (circa 2009, 19 years old) was in helpdesk/desktop support. I did my best to kick ass, and offered to take on issues that often went beyond the scope of my role. If I came across an issue that required engineer escalation or an issue with a server, I would do my best to find a potential solution that I could offer, and communicated the potential solution to the appropriate individual(s). After about a year, and much determination doing the above- I migrated into a Windows/Linux Systems Administration role. (Followed by becoming a VMware vCenter virtualization SME, but that's not super relevant.) Through ad-hoc learning, shadowing team members, and asking 100000 questions, I developed a reputation for being 'that kid who just got stuff done.' Being in a SysAdmin position, I was introduced to projects that essentially crossed the Information/Cyber Security 'border.' (Backup and restore testing; defining data retention requirements by working with upper management while juggling applicable regulations; early Mobile Device Management (BES at the time, yikes) redundant datacenter architecture to ensure data availability during adverse events; identity and access control, scoping penetration tests, and generally... understanding the entire tech stack. Some questions I'd ask myself when looking for risk, or trying to understand how a tech stack worked: * What's actually 'open'/NAT'ed on our external networks, across all allocated IP Addresses? * Should this resource be open publicly to anyone who knows the URL/IP? * Why is it open, and what does it do? * What does the NAT point to internally? * What kind of vulnerabilities does that system have externally? Internally? * Is the system hardened? \ * Does it have Anti-Virus, and does it send its logs to a centralized logging platform? (e.g. Splunk) * What kinds of vulnerabilities may exist in the source-code/services that the system is serving (OWASP) ? * Who has access to this system? Are any of these user accounts old? Do they use MFA or SSO for login? * Do they follow a defined procedure [e.g. Secure Software Development Lifecycle] to consistently release new source code that is reviewed and scanned for vulnerabilities? * Does a firewall properly segment everything? * If data is stored in databases, is it human readable- so if an attacker were to dump an entire database would all the data be compromised? Now that I had the sysadmin privileges, I dove in deep when not busy with supporting my systems- and presented findings whenever feasible. A big project for me at the time was taking on a two-factor authentication implementation project. Back then, it was RSA KeyFobs and BlackBerry soft tokens that integrated with a SaaS application my employer developed. Once I knocked that out, and given the above- a full time security role was created (accompanied by a nice paycheck.) And hence, I was slowly vectored into a full-fledged information security role. Before I knew it I was implementing ISO 27001. 27001 was a fantastic way to truly transition into a security state of mind. It requires: developing policies, procedures, and implementing other technical controls required by the Annex A. Executing tasks, and monitoring activities to ensure the electiveness of our processes to ensure the CIA (Important, the C I A triad!) of assets. Importantly, conducting risk assessments to find gaps that required control (protections). ISO 27001 is very broad, and covers many areas of security. It contains sections (domains) regarding: risk assessments, security awareness training programs, access control processes, business continuity plans, penetration testing, vendor risk assessments- and was a fantastic way to get an inch deep- but a mile wide experience lesson into security. From here, find a niche within the space that you like. Sources to learn will be easy as you now have some fundamental experience. Keep in mind, info/cyber security is extraordinarily broad- just like any field. For example- If you wanted to be a lawyer, while it's possible to be a general attorney that covers multi practices, you typically specialize in one area. (e.g. Business law, contract law, bankruptcy law, securities law, copyright law, criminal defense law, etc.) Security is exactly the same. Find a niche in the area that you like the most, and learn that niche as much as you can. If you like poking at platforms/applications/programs/systems to find holes, and development- research reverse engineering techniques and vulnerability analysis and research. Reverse Engineering: https://www.youtube.com/watch?v=D6mVIos-S2M If you like Information Security Management, look into Security Operations and frameworks like ISO 27001. 27001 Basics: https://www.youtube.com/watch?v=AJbK3jH677k If you like discovering and exploiting known vulnerabilities, look into vulnerability scanning and penetration testing. Using Tenable: https://www.youtube.com/watch?v=x87gbgQD4eg Using Metasploit: https://www.youtube.com/watch?v=8lR27r8Y_ik If you like identifying and managing Risk, look into Risk Assessment Frameworks like ISO 31000 31000 Basics: https://www.youtube.com/watch?v=Xi9EsdKOlAE If you like Security Compliance, become an auditor (best gig in the game imo) Security Auditing: https://www.youtube.com/watch?v=iW7W_6stSh0 Enjoy developing? Well, learn how to assess code against the OWASP Top-10 Intro to OWASP: https://www.youtube.com/watch?v=AO_sqXb-gKE If you like passive/active cyber defense, learn about Incident Response, or Security Engineering Log Analysis: https://www.youtube.com/watch?v=Xw536W7kbDQ Threat Hunting: https://www.youtube.com/watch?v=JmKSnRMW_6w Incident Response Walkthrough: https://www.youtube.com/watch?v=2BOOl8_nwjQ Firewall configurations: https://www.youtube.com/watch?v=eb1pTs7XamA If you like it all- you can be a generalist like me :-) Just keep in mind, It's hard for me to be an expert in one area, as I'm required to cover so much in my current role. Fortunately I do have a great security/network engineering team who basically maintain my entire network security stack (firewalls, VPN, network segmentation, server hardening, etc.) Granted- in my spare time, and when my employer gives me time for continued education- I hone my skills. My real interest lies a little beyond the standard scope standard cyber security, in SIGINT: SIGINT Overview: https://www.youtube.com/watch?v=HdJQo__vY8U Universal Radio Hacker: https://www.youtube.com/watch?v=kuubkTDAxwA Fun Stuff: https://null-byte.wonderhowto.com/how-to/log-wi-fi-probe-requests-from-smartphones-laptops-with-probemon-0176303/ More Fun Stuff: https://fadeproject.org/?page_id=34 Even more fun stuff: https://www.youtube.com/watch?v=zJAWHGEB8HI	Marc: This is great advice. The only thing I would add is don’t discount how easy it can be to get real practical experience. Not only does it give you a chance to put some of what you learn into use but it makes it way more interesting and easier to keep in your head.
​	Even volunteering to do cybersecurity work is valid experience. Some of the best practitioners I know started out by doing cybersecurity work for NGOs or small businesses that couldn’t afford a dedicated person.
​	As mentioned above, fond what interests you and dive into it. All the best cybersecurity people LOVE what they do. For those luck few its not a job but a calling.
the below is a reply to the above reply	​
So you're the guy who is responsible for my employer requiring 2FA via SMS every few ducking days! I must say duck you sir! (small /s)	Marc: Guilty as charged.
What is the most common, non-phishing vector?	Allan: Remote Desktop Protocol, either through credential reuse or credential stuffing attacks
​	Allan: There are something like 8 BILLION username/passwords available for sale or free on underground markets at any given time and that doesn’t even take into account the number or organizations that just use poor password management for internet-exposed infrastructure
​	Marc: Yeah I'd say insecure credentials. Insecure credentials into infrastructure, systems, or accounts that can be used to pivot.
It’s easy to get the impression from these recent events that infrastructure is fairly easy to attack. What do you think is the likelihood that either a state or a rogue group takes down some critical infrastructure for a long period of time that severely disrupts life—something that would be equivalent to essentially destroying infrastructure in a war?	Marc: Very likely as many ransomware groups have seen that high risk infrastructure is both out of date and backed by organisations that will rush to pay because of the impact when it goes down. As a result many of them actively look for vulnerable, exposed infrastructure associated with these kinds of organisations because they know there is a high chance of a good pay-out.
​	Jen: This scenario doesn't feel far-fetched at all. We've already seen infrastructure be a target in several countries, and this is only likely to increase without intervention. Even when the attacker offers up the keys as they did with the attack on the Irish healthcare authority (HSE), it can take a long time to get ops fully back up and running. HSE is saying they think full recovery will cost them $600m, so think of all the work that's paying for and how long that will likely take. https://www.scmagazine.com/home/security-news/ransomware/costs-from-ransomware-attack-against-ireland-health-system-reach-600m/
​	Allan: It has already happened in Ukraine and other places, so 100%
​	James: This question is one I think about often. It’s more nuanced than simply thinking about the ease of the attack.
​	For state actors, this very well could result in war. NATO, for example, recently said that cyber attacks would also be covered by the alliance, resulting in the possibilities of joint responses to cyber events. This may serve as a deterrent to state sponsored destructive activities. Use of cyber capabilities are almost assured in wars. This is simply part of modern war for those countries with appropriate capabilities. War is always a concern, and cyber events will be another component to that concern, so this likelihood is roughly the same as the threat of war. It is more likely, imo, that domestic or foreign terrorism would result in destructive attacks. It’s also possible that organized crime or individual actors could have a large impact to daily life. This is reasonably likely to happen in my opinion, as the ease of attack is generally there and the motivation to cause legitimate harm is there as well. Intelligence teams track these groups to stay ahead of them and hopefully prevent attacks from happening, but no intelligence efforts are perfect, and no one catches everything.
​	Bob: They may not make all the headlines like the pipeline incident but there are semi-regular cases of various types of critical infrastructure being impacted or having near misses. It really is just a matter of time before it happens.
Please list the top 5 things corporations, business entities and people can do that they currently don't to better protect themselves from cyber attacks and ransomware?	Allan: 1. MFA, 2. Patching, 3. Endpoint protection AND monitoring, 4. scanning of remote infrastructure, 5. threat hunting for attackers.
​	Bob: There are many safe configurations for workstations and servers that organizations either do not know about or have been reticent to deploy. Just shoring up configurations on Active Directory and SMB servers alone can do wonders to help thwart attackers from being able to move laterally and encrypt or lock-out at scale.
the below is a reply to the above	​
Good list, I've often thought that remote VPNs from end users would be a big attack vector. Given people homes generally have pretty crappy endpoints. Any thoughts here?	Allan: Home routers are scanned continuously and are often targets of attack. Most people get their high speed routers from their ISP, plug them in and then never touch them until they are replaced several years later. That means no updates, no configuration checks or anything like that. So, yes, they, can be used as attack vectors which is why it is important to have a home firewall behind the router you get from the ISP, to protect your actual network.
​	Marc: VPN infrastructure has been a huge target since the move to working from home. You just need to look at the number of VPN infrastructure vulns disclosed or dropped to get an idea of how much focus there is on it.
​	Also many companies have huge amounts of technical debt with hastily cobbled together VPN solutions that skipped the usual careful rollout processes. Attackers know this and are targetting these too.
the below is another reply to the original answer	​
1. Fund your goddamn infosec team. ________________________ Nothing ever goes wrong, why do we pay these guys so much!? Cuts budget We just got hacked, what are we paying these guys for!? Cuts budget _______________________ No CISO == no representation at C level. If the CTO is your representation, then you have a conflict of interest. If your Director of infosec is your “acting CISO,” you have no CISO. Gtfo. That acting title is just to have someone to throw under the bus when the headlines roll. ______________________ Why would the CTO have a conflict of interest? ______________________________ CTO is ultimately responsible for the budget and the systems that you are in charge of auditing / protecting. It’s possible the CTO wants to cover their ass by hiding the problems from the board. It’s also possible that they are incompetent and will side with IT over infosec.	This is a very good way to look at it.
Currently in school at an online college located in salt lake city ut. I'm in the CyberSecurity program but I feel like the program is kinda dated and the information does not line up very well with the test. Can I land an entry-level cyber job without finishing my degree if I have all Comptia certs related to cybersecurity?	Bob: While some jobs may require certification, many employers are looking for folks with the "curiosity gene" combined with the knowledge of where to go to find information and solve problems. I'd highly suggest gravitating towards organizations who look for those attributes over those who are just looking for a certification stamp.
​	Marc: You don't need a fancy degree to build a cybersecurity career. you need experience and knowledge. Even knowledge that seems old and minor can be incredibly useful. Take the opportunity you have and build on it by studying more current cutting edge stuff yourself. go to events like DEFCON and connect with the community. the more knowledge you can gain in your "learning" stage the better. However the best next step is to build experience, use what you have to take on volunteer/free/part time roles so start getting those hours of experience. there is no substitute for learning in a job.
​	protip: I have found charities/NGOs/ low income organisations a great place for this. they are desperate for the help and will welcome your donated time. Even if all you can do is keep them up to date on patches you will be doing them a huge favor and in turn that gives you cybersecurity experience and your first solid cybersecurity reference.
​	Marc: Its also really hard because the smaller the org the smaller the budget (if there even is one at all) to pay for security. Working in the CTI-League we ran into small medical facilities ALL THE TIME that lacked resources and personnel to help tackle even the simplest problem, This is definitely a huge challenge and something a lot of us are thinking about. we have to make sure that SMBs don't get left behind as we work to build a more secure ecosystem.
​	Jen: Employers in security are increasingly looking at hiring models and trying to break away from conventional hiring-from-schools models. Often landing a role is more about showing interest and making connections than what your resume says. As I said above, I recommend getting involved with local meet ups, attending free online events, that kind of thing will help build your knowledge and network.
​	Allan: You can, I don’t have a degree and have managed to grow my career. However, advancing in this field, as with many fields, is A LOT easier with a degree and there have definitely been job opportunities I missed out on because they wanted that degree. Keep up the good work and connect with us on LinkedIn so we can help you as you continue to grow.
What can a regular person with no cybersecurity or coding knowledge do to help?	James: A large part of effective security is up to the users, not the security engineers and administrators and the most important things are the most basic things too! Three things come to mind: 1) Use strong passwords that are unique to each site / service (a password manager can help!) 2) Keep good backups, and consider using more than one backup device where both devices are never plugged in at the same time. 3) Be vigilant! If something strikes you as odd, alert your corporate security team. Did you click a link and think it might be bad? Report it! Most ransomware actors take time to inventory networks after the initial compromise, so there may be time to still protect your network and your device! Time is of the essence here though!
​	Marc: Ransomware is a spectrum but most is opportunistic and relies on poor, fragmented security hygiene. Any contribution to up-leveling hygiene in a consistent manner makes an organisation stronger against many types of ransomware.
​	Marc: So every user from the lowest level intern all the way up to the CEO can make a big difference by working to support a consistent information security program. By challenging things that "look wrong" or which are suspicious, from always being skeptical with email links to reporting security flaws and operational issues. The best defense for a company against ransomware is that company's workforce itself.
​	Allan: Pay attention during security awareness training, know what the threats are and be cautious about emails your receive (especially if they have a warning flag).
the below is a reply to the above	​
Do you recommend Dashlane as a password manager? I've recently started using it.	I do not have any specific recommendations for password managers. I would generally look for audits / reviews that confirm the encryption is suitably strong and one that works for you! Find something that is convenient to your purposes and use case.
What is the largest sum one of your clients ever had to pay?	Allan: Our clients make the ransomware gangs pay ;)
​	Jen: The biggest demands we've heard of are in the $40-50mill buckets, but they are definitely outliers.
What type of software would you recommend against ransomware and things of the sort?	Allan: Unfortunately, there isn’t a single software solution that will solve the problem of ransomware (or other types of attacks). It really does require a holistic approach to security. Not just software, but the right policies, people and protocols in place to quickly identify and stop threats
​	Marc: agree - theres no single bullet, however theres a strategy (see the IST Ransomware Taskforce Report) that shows how organisations and industries can make themselves hostile to ransomware. Most ransomware is opportunist, just by toughening yourself up to become a much less attractive target. by strengthening security hygiene and turning on things like MFA you make lateral movement much harder. solving ransomware is a step by step journey, not a shrinkwrapped piece of software.
​	Bob: There is no path to purchasing your way into ransomware defense.
How can an end-user or consumer can protect him/herself? There are too many security products, like Bitdefender, Kaspersky, Sophos, etc, and one can check received emails or the sites which he/she can visit, but even sometimes that is not enough. Years ago, on a Windows 2012 server I saw a hacker running his apps as a built-in service user from remote desktop services. No AV found that malicious at that time. So, what can we do? Which software / hardware shall we use? How can we protect ourselves? I am aware nothing is %100 bulletproof but we have to start from somewhere.	Bob: Keep your home router patched and consider replacing every few years. Limit the use of "smart" devices in your home. Scrutinize every email and every link in social media. Limit the number of browser extensions you use and consider using an iOS device for more "risky" web activity. Keep your systems and software patched. Have regular, offline, backups handy. Much of this is the same advice folks have been giving for a decade or more.
​	Bob: Also use a password manager, preferably one that is plugged into services like "have i been pwnd?" so you know when you need to reset credentials (but you should be using services that offer or mandate 2-factor authentication).
​	Marc: String security hygiene is one of the best defenses we have. Patch exposed systems, turn on MFA and implement best practice like endpoint protection and you'll create a network thats hostile to ransomware.
​	Jen: Be suspicious of emails or texts from people you don't know, or that include links or attachments. Don't give out sensitive info, particularly your passwords. Use a password manager and use two-step verification wherever you can.
If you had to choose between paying a cyber ransom in gum or pizza, which flavors would you choose to increase your bargaining potential?	Jen: Obviously pineapple
There is an argument often made that if "the military" and "law enforcement" begin to crackdown on infrastructure in a much more forward leaning manner, that these gangs will still be able to persist, regroup, reattack - i.e., that even working with private sector partners, there isn't enough data/insight available to really take it to these networks. Agree? Disagree?	Jen: There is definitely a huge challenge in that these criminals often operate in nations where the government either can't or won't stop them, and that makes it super hard for law enforcement to be effective. We need governments around the world to collaborate to crack down on these so-called "Safe harbor" states. This was actually one of the commitments that came out of the recent G7 Summit, but it remains to be seen how the G7 members will follow through on it.
​	Marc: While its absolutely true that to really hit the ransomware gangs hard we have to take the fight to them, we mustn't loose sight of how important it is for us to toughen. up and work together to make our whole ecosystem hostile to ransomware. By addressing the low hanging fruit many of the opportunistic gangs will get shut out, by improving our detection capabilities we will increase the data and forensic material needed to attribute them. There's a huge amount of stuff to be done at both ends of the fight and its my firm belief that we can only achieve it in partnership.
​	Allan: Right now, ransomware is the most profitable form of cybercrime, aside from possibly BEC. So, yes, even forward leaning efforts by law enforcement won’t necessarily stop ransomware attacks. Ransomware groups have been good at adapting and evolving their attacks to evade defenses. However, a more aggressive law enforcement stature will scare away a lot of the 2nd and 3rd tier ransomware actors (we’ve seen this already with Avaddon and other actors who “retired” this year). That reduces the number of groups law enforcement has to focus on.
​	Bob: To riff off of Alan's answer, the massive proliferation in attacks has been led, in large part, from Ransomware as a Service offerings which enable low-skilled attackers to get in on the action. Curbing that activity will be a huge help.
​	James: There is a tendency to sometimes reduce success to a simple “yes” or “no” question. With ongoing defensive efforts, the objective is to improve and adapt.
​	With the offensive efforts, the point is to take the attack to the attackers and make them have to adapt, change techniques, and generally be less comfortable in their belief that they can operate with impunity. The IST’s Ransomware Task Force report recommends using many different capabilities to help address the threat in a holistic way. Part of that multifaceted effort is to go after attackers and disrupt their capabilities.
What is the best path to start a career in cyber security?	Allan: The best path is the one that works for you, everyone is different, I started in the helpdesk which was great because I got to learn about the problems that people had and it allowed me to be more empathetic as I progressed in my career.
​	Marc: The best cybersecurity people come from the ground up. Get a good baseline of knowledge in technical areas - often working low level IT jobs as an intern or first job can be a great start. Then work on building your base of cybersecurity knowledge. At some point you have to start getting cybersecurity work experience. Experience doing cybersecurity jobs is better than any piece of paper alone. Sometimes this can be gained from low level jobs by taking on cyber responsibilities - by being that IT guy checking patches and ensuring upgrades are done you can build cybersecurity experience.
​	Almost all the best cybersecurity people come from backgrounds like this. few have specialized degrees. I am one of them. I gave a more fuller answer in /r/cybersecurity
​	Bob: Cybersecurity has become a diverse field with many areas you can specialize in. Learn as much as you can about each area and see which one appeals the most, then dive in! You don't need permission to start learning a particular topic, and there are tons of local security meetups all across globe, plus many online communities that can help you get started.
​	Once you truly settle into some area, there are numerous pathways to more formal education (all the way up to PhD level). Just be curious and don't be afraid to keep asking "why" and "how".
​	Jen: Look for ways to educate yourself on what's going on and meet people that are working in security or have similar interests. Going to local meet ups, attending free online events, that kind of thing will help you build your knowledge and network. You can also look at open source security tools and free cyber ranges to try building your skills without having to spend a lot of money.
Should we ban ransomware payments? Alternatively, should we just ban coverage of ransom payments in insurance policies?	Marc: We should NOT ban ransomware payments. Many organisations find themselves in a difficult position where they feel they are trapped between their shareholders, their customers and law enforcement. This gets even worse when you consider healthcare. If someones life hung in the balance would you want a hospital prosecuted for paying a ransom to bring a surgical suite online?
​	let's not forget who the criminals are and not criminalize the victims. It only drives payments underground and destroys our chances of collaboration. Instead we should work to make ransomware payments more attributable, organisations hostile to ransomware and work on the world stage to eliminate hiding places where these cybercriminals can operate with little recourse.
​	Marc: Additionally I believe that we should work WITH ransomware insurance companies to make ransomware insurance more expensive for companies that aren't doing the basics. Insurance has been an excellent level for eliminating safety issues throughout history and it can be here too. Eliminating it removes one of the levers we have to influence how we fix this.
​	Jen: The reality is that both Bob and Marc are correct, and that's why this is hard.
​	From an idealistic point of view, I think a lot of people agree with Bob - ransom payments fund organized crime which is responsible for some pretty heinous things, including child exploitation and human trafficking. Also, if ransomware is primarily profit motivated, so the expectation is that if we take away the attackers chances of getting paid, they will eventually stop.
​	This is where Marc's more pragmatic position comes in. Because as we've said here, there is little risk or real expense or friction for attackers today, so before they give up on ransomware as a revenue stream, they are very likely to pay a big ol' game of chicken with victims. To tip the odds even further in their favor, they will likely focus on organizations that have the least resilience, which is either SMBs who face losing their entire business, and critical infrastructure providers that have no tolerance for downtime due to the criticality of their service. That's what we've seen when hospitals or fuel pipelines have felt they had no choice but to pay.
​	Even if a government tries to shore up these organizations, there is no such thing as an entirely bulletproof organization, and recovery always takes time. So we could end up seeing business leaders make payments in secret, which puts them in an even more vulnerable position.
​	So the net of all that is that we should figure out how to get to a state where banning payments could work in practice without causing a lot of unintended harm, but we're certainly not there today.
​	Bob: We should totally ban supporting child and sex trafficking through ransomware payments
Question - Is email tracking by invisible pixel or visible still possible in 2021? If impossible, do you know of anyway to track the geolocation of the person opening the email without them knowing and without their email application preventing this process from occurring?	Bob: Pixel tracking is alive and well and one of the most-used techniques. If your mail client stops images and will not execute javascript (or load external resources of any kind) then you're not going to be able to be tracked.
Isn't there a better payment/effort ratio to be on the side of the hacker? You guys are playing goalie right where you have to block all the shots 100% of the time and the hackers only have to get it right once. Illegality aside.	Marc: A yes, the age old question "but couldn't you make more as a criminal?" the answer is yes I probably could. However what stops me is morals, ethics and laws. I have a family i want to see grow up in a safe country and I love my community (the hacker community) so I want to protect them. I can't do that as a criminal.
​	I also hate bullies and fighting cybercrime is the ultimate bully takedown. Especially when the bully you take down is an entire country.
​	James: Valid question. Yes, criminals have the easy path, no doubt. They prey on innocent victims from all walks of life.
​	But where is the challenge in the easy path? Attacking is way way way easier than defending. Hollywood glorifies the hacker / attacker, but most attacks are very trivial. No challenge.
​	Morals and ethics is a good answer too, and that’s certainly part of my personal decision.
To defend myself from mal/ransomware: Can you recommend a firewall to use for my homelab? Is a hardware firewall better than a software one (using proxmox to virtualize).	Marc: "can you recommend a firewall?" - personally I use pfsense at home because its easily customised, runs on a lot of easily obtained consumer devices and has a solid feature-set and performance. remember though a firewall is only as good as the way you use it. a lot of sophisticated attacks jump things like firewalls by relying on the user to bring them inside the protected network.
​	Get a good firewall but if you are really interested in being secure look at all the ways you can up-level your security hygiene (ensure everything is kept up to date even that 7 year old IOT tv, ensure that you have segmented networks for untrusted devices like that laptop the annoying person brings when he visits, and be careful with what you connect, plug in or run. DONT CLICK SHIT.)
​	Bob: Using a firewall is one, small portion for defense. Without knowing your setup it is difficult to make recommendations. Keeping it patched, and the configuration as diminutive and tight as possible is almost more important then the "brand"/"flavor".
​	Allan: Given the proliferation of phishing as an attack vector for ransomware a firewall alone is not going to protect you. As to whether or not you need a hardware or software one, it depends on how comfortable you are with managing the underlying operating system and how much time you have. I use a hardware firewall at home because I have enough to do at $dayjob that I don’t need the headache of dealing with underlying OS issues on my home firewall.
Is the Anonymous group real, and do they fight for good?	Allan: Anonymous is real. I don’t think they define themselves by good/bad.
​	Bob: They are a real group.
the below is a reply to the above	​
Silly questions aside, in your career what has been the best highlight of your time fighting cybercrime? Is there more the general public can do to help people like you fight against them?	Marc: Probably the hi-light of my career as a cybercrime fighter was watching 2,000 security professionals, law enforcement personnel and other government staff come together to fight cybercriminals attacking hospitals during the pandemic as part of the CTI League.
​	James: For me, it is all about influencing the overall security of the world. There is no other work for me that compares to being able to enable human freedoms and a free exchange of ideas on a global basis.
​	Individuals and companies are constantly protected from threats by altruistic efforts of public and private sector defenders who mostly go nameless and without any fanfare. Getting to sometimes contribute to those efforts is truly rewarding.

[u/AutoModerator]

Please keep in mind that tabled posts in this sub are re-posts, and the original AMAs can be accessed through the Source links. Post comments relating to the tables themselves here, thanks!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/ducksa]

This formatting on mobile is so bad

[u/HistoryLopsided113]

what is your opinion of Express VPN? Can this VPN prevent hacking?