Full Internet Disconnect And Out Of Band Recovery In Hour 1 | Mohana "Mo" Balakrishnan | EP #14

Mohana "Mo" Balakrishnan is CTO at Schools Insurance Authority and the former security architect at SonicWall.He started his career as a geophysicist in a tent in northern Canada at minus 60, pivoted to tech in London, and joined SonicWall at the bottom. Years later he was the architect at the keyboard when SonicWall's own systems were compromised through a zero day in its remote access product. He has also served as CISO at the University of the Pacific.This is the operator level reconstruction. The canary alert he waved off on a holiday, the decision to physically unplug the internet router, and the argument he made when everyone senior to him stayed quiet.What we cover in this EP:◼ The canary alert that fired on a holiday, why he told the user to just close the laptop, and what it actually was◼ Why the first move was cutting all internet access, and what that did to a fully remote workforce◼ The out of band stack they stood up in hours. Separate domain, separate Jira, separate workspace, because corporate email was suspect.◼ Rebuilding access one manual host to host firewall rule at a time instead of flipping the network back on◼ Why the microsegmentation project nobody would fund became a no brainer the week after(00:00) – Meet Mo Balakrishnan: geophysicist turned security architect(05:12) – What execs get wrong in the first hour of an incident(07:09) – SonicWall's 2021 breach: take us back to that moment(08:08) – The canary alert that fired on a holiday(09:06) – "Just close the laptop": a zero day in their own product(10:31) – Backups saved them, the engineering lab didn't(15:46) – Shutting it all down and unplugging the internet router(19:02) – Hour 12: leadership wants the company back online(20:30) – The out of band stack: separate Jira, workspace, domain(21:30) – Rebuilding access one manual firewall rule at a time(25:47) – Killing outbound internet to cut their command and control(29:09) – The playbook they didn't have, cyber insurance, and the FBI(36:39) – A communications battle, not a technical one(49:31) – Closing thought: why the prompt is the new perimeterGuest ⬇️Mohana "Mo" Balakrishnan: https://www.linkedin.com/in/mohana-b-24012016/Hosts ⬇️Yegor Sak: https://www.linkedin.com/in/yegor-sak-725330b2/Alex Paguis: https://www.linkedin.com/in/alex-paguis-53a21815/Powered by Control D