Cytactic CEO on a hospital ransomware case where staff couldn't trust patient records, and why most CISOs never rehearse their worst day [Podcast, 33 min]
Source Reddit Cybersecurity
Discussion
This content is a podcast episode discussing a hospital ransomware incident where staff could not trust patient records, highlighting challenges in incident response and the importance of rehearsal for CISOs. It includes insights on rapid exploitation enabled by AI and the complexity of layered defenses. The episode also emphasizes the need for incident response exercises to consider scenarios where data and logs may be unreliable.
r/cybersecurity (opens in a new tab)u/PracticalAssist26000 points0 comments
Disclosure: my studio produced this episode of Responsible Disclosure, Zafran's podcast. Sharing it because a lot of it is about incident response in practice, and I've summarized it below so you can skip to what's relevant.
Nimrod Kozlovski has spent about twenty years across cyber law, VC, and crisis management, including running incidents at Fortune 500 companies. A few parts I think this sub would care about:
At 03:12 he walks through three incidents: stolen source code at a homeland security company, a crypto wallet takeover, and a hospital extortion where staff didn't know whether patient records had been altered.
At 13:03 and 16:21 he argues AI has cut the time from vulnerability to exploitation to minutes, and that attackers are chaining identity, permissions, and applications to get past layered defenses.
At 24:03 and 26:01 he gets into why most CISOs face their worst day with little rehearsal, and why tabletops matter when you're deciding on partial information.
Also a fun story at 09:21 about the DEF CON crowd deciding he was a fed.
For the IR people here: do your tabletops include injects where the data turns out to be wrong? The hospital case made me think most exercises assume you can trust your logs and records.
Links cited in the discussion
Also discussed in r/Information_Security