The Backup Wrap-Up

W. Curtis Preston (Mr. Backup)

Formerly known as "Restore it All," The Backup Wrap-up podcast turns unappreciated backup admins into cyber recovery heroes. After a brief analysis of backup-related news, each episode dives deep into one topic that you can use to better protect your organization from data loss, be it from accidents, disasters, or ransomware.

The Backup Wrap-up is hosted by W. Curtis Preston (Mr. Backup) and his co-host Prasanna Malaiyandi. Curtis' passion for backups began over 30 years ago when his employer, a $35B bank, lost its purchasing database – and the backups he was in charge of were worthless. After miraculously not being fired, he resolved to learn everything he could about a topic most people try to get away from. His co-host, Prasanna, saw similar tragedies from the vendor side of the house and also wanted to do whatever he could to stop that from happening to others.

A particular focus lately has been the scourge of ransomware that is plaguing IT organizations across the globe. That's why in addition to backup and disaster recovery, we also touch on information security techniques you can use to protect your backup systems from ransomware. If you'd like to go from being unappreciated to being a cyber recovery hero, this is the podcast for you.

Play

Open in

31 episodes
weekly
Avg 40 min
English

Episodes 31

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Yesterday · 43 min
How to Prevent Credential Theft Before It Owns Your Network
Credential theft is how one stolen laptop turns into a full-blown breach. In this episode, Prasanna and I sit down with Dr. Mike Saylor to walk through how it happens and how to stop it. Mike opens with a story that should make every IT person wince. A credit union employee had a logged-in laptop at a coffee shop, turned around, and it was gone. BitLocker didn’t help, because the machine was unlocked. The attackers harvested local credentials, learned how the credit union’s business processes worked, and then phished other employees from the inside while posing as the person who lost the laptop. From there we get into how attackers think. Their first move is reconnaissance: what do I have, what’s it worth, and how do I keep access before somebody wipes it? Mike explains why the victim has about 30 minutes to respond, why a fear-based culture makes that window worse, and why you need a documented stolen-laptop playbook before you need it. We also cover the stuff that makes credential theft so easy. Shared local admin passwords. Predictable new-user passwords with an exclamation point on the end (yes, really). Service accounts whose passwords never change. Default SNMP strings. Mike explains Kerberoasting in plain English and shares new research on how an unprotected printer can lead to a complete network takeover. Then we talk about how to prevent credential theft. That means LAPS or a similar tool for unique local admin passwords, just-in-time credentials that expire on their own, tiered administration, and separate user and admin accounts for every admin. Mike tells the story of a database admin who deleted something in production because her test and production credentials were the same. We finish with alerting: what to alert on, why you’ll get a flood of false positives at first, and why my new freezer sensor proves the point. If you manage credentials for anyone, this one’s worth your time. Chapters 00:00 - Intro 01:49 - Welcome, Prasanna, and too many Reacher books 03:37 - Dr. Mike Saylor joins 04:07 - The stolen credit union laptop 05:42 - Reconnaissance and persistence: what attackers do first 08:31 - Privileged credentials that never change 10:36 - The 30-minute window after a stolen laptop 13:19 - Security culture and automated incident response 15:06 - Shared local admin passwords 17:23 - Predictable default passwords 18:20 - What attackers harvest: everything 19:01 - Kerberoasting explained 24:01 - Default credentials and the printer problem 25:22 - When the proof of concept becomes production 26:46 - The Brocade Silkworm story 28:07 - LAPS and just-in-time credentials 30:30 - Tiered administration and separate admin accounts 35:00 - Alerting on authentication events 36:10 - Expect false positives (and my freezer) 39:16 - Alert fatigue vs. alert annoyance 41:27 - Wrap-up
- Transcript
November 2 · 38 min
Network Segmentation Best Practices: Shrink Your Ransomware Blast Radius
Network segmentation best practices can be the difference between ransomware taking out one laptop and ransomware taking out your whole company. Prasanna, my co-author Dr. Mike Saylor, and I talk about how to stop running a flat network, what VLANs and microsegmentation actually do, and where you should start. Mike and I wrote Learning Ransomware Response and Recovery around one basic idea: assume breach. You’re probably going to get hit, so the real question is how big the blast radius will be. Is it a plop, or does it take out the whole building? We start with the old hard, crunchy exterior and soft, chewy interior model, and why so many billion-dollar organizations still run flat networks. Spoiler: laziness, budget, and management decisions all play a part. Mike explains VLANs with a hotel key card analogy that will make sense to those who aren’t network people. Then we take it a step further into microsegmentation, where access is based on what you’re there to do instead of where you’re plugged in. Then we talk about: Get buy-in from on high. Inventory everything. Tag your workloads and build policy around those tags. Start with your crown jewels and work your way out. That means the stuff with tight RTOs and RPOs, plus the stuff you really don’t want ending up on the internet. Roll it out in phases instead of trying to rebuild everything in a day. Document every single rule, or the next guy will tear it all down and go flat again. We also talk about why IT shouldn’t be the one deciding what’s critical (that’s what a business impact analysis is for) and how to wall off your backup network. You’ll also hear about the night before Y2K when the security team blocked my NetBackup ports one too many times and I lost it. And Mike explains how he used network segmentation to win an argument with a teenager. If you’re a backup person who’s never had to think much about the network, this one’s for you. Chapters: 00:00 – Intro 01:26 – Welcome, Prasanna and Dr. Mike Saylor 02:41 – My first client with firewalls on the inside 04:43 – Assume breach and the blast radius 06:24 – Grenades, house locks, and panic rooms 08:41 – What a flat network looks like 09:42 – Why so many companies still run flat networks 10:18 – VLANs explained with a hotel analogy 13:22 – Going further with microsegmentation 14:51 – The management overhead problem 15:15 – Why undocumented segmentation falls apart 18:45 – Leadership buy-in and starting with inventory 20:07 – Rolling it out in phases 21:16 – Tags, policy, and allow rules 22:56 – Default deny (and Mike says “it depends”) 24:00 – Start with your crown jewels 28:18 – Why IT shouldn’t decide what’s critical 30:38 – The night I lost my mind over segmentation 33:00 – Monitor traffic and wall off your backup network 34:35 – Final thoughts, home networks, and the chicken coop 36:04 – Mike’s teenager gets her own segment
- Transcript
October 26 · 48 min
Application Whitelisting Best Practices: The Silver Bullet Nobody Uses
Application whitelisting best practices can stop malware your antivirus never sees coming, but almost nobody follows them. Dr. Mike Saylor joins Prasanna and me to talk about why, and what it really takes to build an approved software list that sticks. We start with SocGholish, a fake browser update campaign that’s been around since 2018. Every download is built just for the victim, so pattern-based tools can’t spot it. That’s exactly the kind of threat an approved software list shuts down. Then we get into the hard part. You have to inventory every application in your environment, figure out who needs what, decide who pays for it, and build a process for exceptions. Mike explains why politics and overhead keep most companies from doing it. He also explains why shadow IT means your procurement process probably isn’t catching what you think it is. We compare whitelisting with the simpler option of not letting users install software at all. We also talk about AppLocker, EDR policies, Office macros, MDM for mobile devices, and blocking executables in temp directories. Prasanna asks whether AI can take some of the friction out of software approvals, and Mike gives him a one-word answer. I also share a tip that makes the inventory step a lot less painful: run your whitelisting tool in audit-only mode first and let it build the list for you. We wrap up with the good, better, best versions of this control. I tell a story about an old boss, Perl, and a bank policy that ended with him getting fired. And there’s a reminder that you will always need support from the top. Someone will always think they’re the exception, and senior management has to be willing to tell them they’re not. If you’ve ever wondered whether locking down software installs is worth the fight, this episode is for you. Chapters: 00:00:00 – Intro 00:01:30 – Welcome, Prasanna and Dr. Mike Saylor 00:02:37 – SocGholish and fake browser updates 00:04:57 – How often do companies really whitelist? 00:05:18 – Inventory, licensing, and exceptions 00:07:08 – Shadow IT and the $30 NDA 00:10:08 – Who actually does this 00:11:01 – Politics and overhead 00:12:12 – Just don’t let users install software 00:14:37 – AppLocker and EDR policies 00:15:47 – Can AI reduce the friction? 00:17:08 – Layered responses to a single threat 00:18:47 – Office macros and click-through users 00:20:49 – Is whitelisting a silver bullet? 00:21:29 – Signatures and the ideal whitelisting process 00:25:41 – Mobile devices and MDM 00:28:44 – Temp directories and executables 00:31:55 – How do you learn what you don’t know? 00:33:19 – Audit mode as your inventory 00:35:05 – AI agents, integrations, and CoSnitch 00:38:07 – Good, better, best 00:40:33 – The Perl story 00:43:21 – Final thoughts
- Transcript
October 19 · 44 min
Building an Incident Response Team (Before You Need One)
Building an incident response team is something you do before the incident, not during it. Prasanna, Dr. Mike Saylor, and I walk through who needs to be on that team, why each person matters, and how to get them lined up now so nobody’s scrambling when ransomware hits. We’re back after a few weeks off, and we came back with a topic I care a lot about. When I cracked a rim on my Tesla, I didn’t watch YouTube videos and grab a wrench. I called a team of people who know tires. Your cyber incident deserves the same treatment. Mike puts it plainly: you don’t want to be recruiting people when the house is on fire. We cover the core roles. There’s the incident commander, who keeps the business off the backs of the people putting out the fire. There are the subject matter experts on the tech side. And there’s the executive sponsor, who makes the calls you’re not allowed to make. We talk about why legal, compliance, PR, and finance need a seat at the table. We also explain why “there is no evidence customer data was accessed” is a very different sentence from “customer data was not accessed.” (Looking at you, LastPass.) Then we get into the outside help: your cyber insurance carrier, a third-party incident response firm with a retainer already signed, law enforcement, and your vendors. Mike explains what the FBI will and won’t do for you. He covers why you can’t just pay a ransom to anyone on the OFAC list, and why calling Bob on a Sunday is not a plan. If your current incident response plan is “we’ll figure it out,” this episode is for you. Listen in, then go write down some names. Chapters: 00:00 Cold open 01:30 We’re back (and Gemini let me down) 03:27 Why you need a team, not YouTube University 04:29 Know your team before the house is on fire 07:43 Fire crews, training, and the USS Constellation 09:27 Incident response is a business problem 12:02 Core roles: leaders and subject matter experts 14:14 Executive sponsors and who comes back first 16:09 Asset lists, owners, and pre-authorization 17:11 Incident commander vs. incident leads 20:00 Legal, compliance, and attorney-client privilege 22:59 PR and the LastPass problem 24:47 Finance and cyber insurance 27:07 Third-party incident response teams and retainers 32:06 Bringing in law enforcement 33:48 Sanctions, Bitcoin, and paying the ransom 38:05 Vendors who answer the phone on a weekend 39:34 Write it down and name your deputies 40:20 Tabletop exercises 43:06 Wrap-up
- Transcript
September 21 · 38 min
Endpoint Hardening: Closing Windows Before Somebody Climbs In
Endpoint hardening is the unglamorous work of closing the windows and locking the doors before somebody comes along and jiggles the handle. Prasanna, Dr. Mike Saylor and I walk through what that actually looks like: secure builds and golden images, which services to shut off, which ones to uninstall so a bad guy can't just switch them back on, USB lockdown, full disk encryption, BIOS and UEFI, and the phone in your pocket that logs onto your corporate Wi-Fi every morning. Mike opens with the analogy he uses in the book. Bad guys casing your organization are doing what a burglar does walking down your street — checking every door, every window, every garage. An unpatched box screaming its version number to the internet is a broken window with a sign on it. Then we get practical. Your receptionist's computer is running a web server she will never use. Your new Dell shipped with Xbox Game Bar running by default. Mike's point is that turning those off isn't enough, because an attacker living off the land will just turn them back on. Uninstall the thing. We also get into the argument nobody wins: locking down USB ports. Prasanna makes the end-user case, Mike makes the red team case, and we land on data leakage controls as the middle ground. Then Mike explains how he gets into a laptop that's suspended instead of logged off, and why your encrypted drive doesn't help you in that state. If you've been told you should harden your endpoints and nobody ever handed you the list, this one's for you. Start with one image, the lowest common denominator, and build from there. Don't let perfect be the enemy of good. CHAPTERS 00:00 Your receptionist's computer is running a web server 01:39 Welcome, with Prasanna and Dr. Mike Saylor 03:52 The house analogy: broken windows and unlocked doors 06:22 Do you just have to be safer than your neighbor? 08:49 Assume breach, and close the windows anyway 09:52 Secure builds and golden images 13:37 One image for everyone, or one per role? 14:39 Level one hardening: turning off what nobody uses 16:20 Xbox Game Bar, and why disabling isn't enough 19:07 The USB lockdown fight 22:46 BIOS, UEFI, and malware that survives a reimage 26:35 Full disk encryption only works if you log off 29:42 Physical access trumps everything 30:07 Port scans, Nmap, and banner grabbing 31:50 Building your hardening checklist 33:14 The endpoint in your pocket
- Transcript
September 14 · 39 min
Least Privilege Best Practices: Where to Start
Least privilege best practices start with one uncomfortable question: does this person actually need this access? A hospital in Portugal answered yes for everybody, gave every employee doctor-level access to patient records, and got hit with a 400,000 euro GDPR fine. The court's read was that they hadn't even attempted the concept. Mike Saylor, Prasanna, and I get into what least privilege really means, then move straight to the part nobody wants to talk about: where you start when everybody already has domain admin. Mike lays out three approaches, from "turn everything off and see who screams" to a real analysis of job roles. We talk about why role-based administration is the vehicle that gets you there, and why role sprawl will eat you alive if you build a custom role for every human in the building. From there we get into segregation of duties, which accounting figured out decades before IT did. Your admin account should not be the account you use to check Gmail. That leads into non-repudiation, su versus sudo, and why logs have to leave the box and land in a SIEM before somebody edits them. The last third is action items. Inventory your privileged accounts, your service accounts, your support accounts, and the fire call accounts you break glass for. Track more than the name and the privilege level: who owns it, why it exists, when the password changed, when it expires. And if you run backups, split your roles apart. Editing backup configs, running backups, and doing restores should not be the same permission. Somebody quietly shortening retention is invisible to the person watching last night's job reports. A restore never trips an alarm at all. If your admins fight you on any of this, Mike has a thought about that too. 00:00 The hospital where the janitor could read your chart 04:26 The 400,000 euro fine, and the failed appeal 07:50 What least privilege actually means 08:54 Three ways to start when everyone has too much 11:17 Access that follows people as jobs change 12:57 Role-based administration is the vehicle 16:13 Role sprawl and the 80/20 rule 18:26 Segregation of duties, borrowed from accounting 20:28 Back when everybody had root: su and sudo 21:59 Non-repudiation and getting logs into a SIEM 25:31 Inventory privileged, service, and fire call accounts 27:41 The three backup roles you should separate 32:39 What your account inventory should track 35:31 Expiring accounts nobody uses 36:42 When admins push back, be concerned
- Transcript
September 7 · 33 min
Password Length vs Complexity: Why Longer Always Wins
Password length vs complexity isn't a close call. Dr. Mike Saylor joins Curtis and Prasanna to explain why the capital letter, the number, and the special character your bank demands do less for you than simply adding characters. Mike walks through the rainbow table project — an operation that has spent years computing password hashes nonstop and will sell you 20 terabytes of the results. Nobody cracks your password. They look it up. The catch, and the whole reason this episode matters, is that the project has only reached ten characters after all that work. The three also cover why some LastPass customers had their vaults drained and others didn't, where the 16-character recommendation comes from, how to build a passphrase you'll remember, whether forced password rotation accomplishes anything, and what happened when Mike rolled out fingerprint-locked laptops to fifty field employees. Get the book: Learning Ransomware Response and Recovery at stopransomware.com
- Transcript
August 31 · 33 min
RDP Security Best Practices Every Admin Ignores Until It's Too Late
RDP security best practices come down to one rule most admins break on day one: that protocol has no business facing the internet. Dr. Mike Saylor and Prasanna Malaiyandi join me to break down why RDP earned the nickname Ransomware Deployment Protocol, who's out there scanning for your open port right now, and what to actually do about it. Here's the part that gets me. Every Windows box ships with this thing turned on. You didn't ask for it. Nobody handed you a manual. It's just there, running, waiting. Mike calls it a dollar store hammer — still a tool, still gets the job done, just not the one you'd pick if anybody gave you a budget. I call it a hack-me sign taped to your back. We get into how initial access brokers work, and it's less sophisticated than you'd hope. Somebody runs a Shodan query, gets a list of every exposed RDP service on the planet with IP addresses and device types, cross-references it against leaked credentials, packages the whole thing up, and sells it. Mike says the recon that used to take days now takes about 30 seconds with the AI tools floating around the dark net. Then there's the credentials-don't-even-matter problem. Default RDP traffic isn't encrypted internally. Mike walks through a routing table poisoning job where his team captured an admin's keystrokes going to a server. No login required. Just be in the middle. The back half is all fixes. Block the protocol and the port, not one or the other, because attackers will happily move to a different port. Check 3389 before you kill it — your database might be sitting on it. Enforce network level authentication. Put a VPN or a zero trust product in front, and Mike points out enterprise-grade stuff runs about six bucks a user now, so the "no budget" excuse is thinner than it used to be. Bastion hosts. Group policy. Monitoring at the endpoint, network, and firewall layers, with a governance layer on top so you know what's allowed before something breaks at 2am. Prasanna plays devil's advocate the whole way through and swears he isn't pro-RDP. Mike wears three hats and can't pick one. I have exactly one opinion and I'm not moving off it. CHAPTERS: 00:00 Windows ships with a back door 01:26 Welcome and my Facebook Marketplace weekend 03:18 Why RDP means Ransomware Deployment Protocol 04:46 What RDP actually does 05:51 Blue hat, red hat: Mike's split opinion 06:11 Does RDP deserve its bad reputation? 08:10 On by default, and you can't fully kill it 09:30 The back door nobody locks 11:52 Does the cloud secure RDP for you? 14:12 Who scans for exposed RDP, and how Shodan works 17:10 Initial access brokers explained 18:36 Vulnerabilities that skip credentials entirely 19:08 Unencrypted traffic and stolen keystrokes 20:38 The never-on-the-internet rule 20:59 The network survival stack: VPN and zero trust 23:22 Block the port and the service 24:17 Stopping lateral movement once they're inside 25:25 Network level authentication 27:50 Port 3389: check before you block it 29:44 Bastion hosts 30:26 Monitoring, auditing, and governance 31:19 Blue, red, and purple hats
- Transcript
August 24 · 41 min
Phishing Resistant MFA: Regular MFA Isn't Enough Anymore
Phishing resistant MFA is the difference between a bad guy getting one email address and a bad guy getting your entire company's inbox. On this episode, Prasanna, Dr. Mike Saylor, and I dig into why plain old multi-factor authentication isn't the finish line anymore; it's the starting line. We open with a real attack: a vulnerable REDCap database, stolen Google Workspace admin credentials, and email forwarding rules quietly running for over a year before anyone noticed. From there Mike breaks down how social engineering actually works (the research bad guys do on you before they ever send an email) and why "report as phishing" buttons have themselves become an attack vector. I share the story of the free credit monitoring scam that got me, and why freezing your credit reports is one of the best five-minute security moves you can make. Mike then walks through FIDO2 and passkeys, why they're built on old-school public/private key encryption, and why they're transactional instead of just another code sent to your phone. We cover the Flax Typhoon espionage campaign, the Raptor Train botnet, and how hard-coded credentials on IoT devices turned into root-level access for a foreign intelligence operation. Then Mike introduces "killing the trust button," which is phrase for the idea that most networks default to open, and every one of those defaults is a decision somebody made without thinking about the risk. We talk about blocking traffic by country, limiting concurrent logins, expiring MFA tokens, and why starting with your administrative accounts is the easiest place to build momentum. And yes, we talk about just asking an AI assistant like Copilot or Claude to walk you through turning this stuff on, because you probably already have these tools and don't know it. We close on why MFA by itself still isn't enough — session token theft, MFA exhaustion attacks, and the "remember this device" setting that undoes everything you just set up. If you're the person responsible for an environment with important accounts sitting there with no MFA, we've got a name for that, and it's not a nice one. Chapters: 0:00 – Cold Open 1:31 – Welcome to the Show 4:12 – The REDCap/Google Workspace Attack 8:38 – Social Engineering: How Attackers Do Their Homework 13:06 – Freeze Your Credit Reports 16:55 – What Is FIDO2? (Phishing Resistant MFA Explained) 18:58 – Flax Typhoon and the Raptor Train Botnet 24:43 – Professional Malfeasance: No More Excuses for Skipping MFA 28:05 – Killing the Trust Button 32:51 – Start With Your Administrative Accounts 36:36 – Why MFA Alone Isn't Enough: MFA Exhaustion 39:27 – Passkeys, Impossible Travel, and Final Takeaways
- Transcript
August 17 · 39 min
Backup Security Best Practices: Lessons From a Real Red Team Breach
Backup security best practices start with one uncomfortable truth: if you haven't checked your backup server for a default password, someone else might check it for you. In this episode, Prasanna and Mike Saylor join me to dig into how backup systems become the easiest way into your network — and the easiest way out for stolen data. We walk through the real story of a red teamer who used a backup server's weak credentials to restore a domain controller straight outside the company's firewall, then had the run of the place. From there we get into the stuff that actually gets skipped: service accounts nobody's watching because they're "always on" and mostly invisible, default passwords baked into backup hardware that never get changed, and why the backup admin — usually the newest, most junior person on the team — ends up holding the keys without the security training to know what they're holding. We talk about how to find every service account you've got, how to figure out which ones actually need the privileges they've been handed, and why "it's always been that way" is exactly how breaches happen. We close out on authentication: multi-factor authentication versus passkeys, why email one-time codes aren't the security win companies think they are, and why an authenticator app with its own PIN beats "remember this device" every time. Mike also shares a story about catching failed admin logins that turned out to be something a lot more human than a hacker — and why monitoring for those anomalies matters either way. If you manage backup infrastructure, run a security team, or just got handed the backup admin job because nobody else wanted it, this episode is your checklist. Backup security best practices aren't complicated — they're just consistently ignored, and that's exactly what attackers count on. Chapters: 00:00 – Cold open: the hacker on your backup server 01:34 – Welcome and episode setup 04:17 – The Duane Lafleur red team story 06:41 – Backup servers as an exfiltration risk 08:19 – Service accounts: the invisible attack surface 28:40 – Locking down the admin account 30:08 – MFA vs. passkeys for backup security
- Transcript
August 10 · 55 min
Building a Cybersecurity Culture in Your Company (Encore)
Building a cybersecurity culture in your company doesn't take a bigger budget — it takes a weekly habit. In this final episode of our encore series, returning guest snorkel42, a longtime Reddit voice in InfoSec, breaks down how he turned a company with zero dedicated security staff into one with a real security culture, just by committing to one small improvement every week instead of waiting on the next six-figure product. We picked this one to bring back because of how it performed with you — not just downloads, but how much of the episode people actually stuck around for. That combination told us this conversation landed, and a lot of you came back to it more than once. snorkel42 walks through where the term "security cadence" came from: a network engineering team, no InfoSec department, and a room full of unused tools nobody had the bandwidth to run. Instead of asking for more products, the team set a rule — one security change a week, no new vendor purchases allowed — for six months straight. What happened next is the real story: leadership noticed, and the team went from begging for resources to being handed them. From there we get into what it actually took to build that cybersecurity culture day to day — the early challenges, how the team picked what to tackle first, and how a scrappy internal habit turned into something leadership actively championed. We also cover MFA, including why not all MFA is created equal, the SIM jacking risk that undercuts SMS-based codes, and the push-notification fatigue tactics attackers use to wear users down until they hit "yes" out of exhaustion. snorkel42 closes with a piece of advice worth sitting with: stop chasing the latest zero-day and start building your cybersecurity culture around how attacks actually function, start to finish. Do that, and ransomware protection comes along for free. If you're the person in your company quietly carrying the security load, or you're trying to convince leadership that culture matters more than another line-item purchase, this one's for you. 00:00:00 — Cold open: you already own the tools you need 00:01:36 — Show intro and disclaimers 00:04:05 — Guest introduction: snorkel42's Reddit history and security cadence series 00:05:53 — Where the term "security cadence" came from 00:08:40 — Early challenges building the habit 00:44:57 — MFA, password security, and why not all MFA is equal 00:47:46 — SIM jacking and push-notification fatigue attacks 00:51:45 — Patching, WannaCry, and why chasing zero-days misses the point
- Transcript
August 3 · 49 min
Cybersecurity Best Practices for Individuals (Encore)
Cybersecurity best practices for individuals aren't complicated — they're just often ignored, and that's exactly what this encore episode digs into. This is a rerun of one of our most-engaged episodes, brought back not just because of how many people downloaded it, but because of how much of it people actually stuck around for. Curtis and Prasanna sat down with Mark Shriner, host of the SecureTalk podcast, for a wide-ranging conversation about what it actually takes to protect yourself online — no jargon, no scare tactics, just the stuff that works. Mark's path into cybersecurity started with a career pivot in 2017, and what he found was a field that goes a mile wide and a mile deep — everything from pen testing to encryption to endpoint protection. But the through-line of this conversation is that security isn't just an IT department problem anymore. It's everybody's problem, whether you're an executive with sensitive data or a parent trying to explain phishing to your kids. The conversation opens with a genuinely shocking data point: in a University of Michigan study, researchers dropped USB drives around campus, and 48% of them got plugged into a computer, some within minutes. That's the kind of thing that makes MFA (multi-factor authentication) feel less optional. Curtis shares his own MFA journey — from skeptic to evangelist — and the group breaks down why SMS-based authentication is riskier than people think, especially with SIM swapping attacks on the rise. From there, the conversation covers a lot of ground: the gift card scam that almost caught Mark's son on his third day of an internship, why "didn't expect it, don't click it" is one of the best pieces of advice you'll hear, and how phone-based social engineering is just as dangerous as email-based phishing. On the business side, Mark and Prasanna talk through device management, BYOD policies, and tools for spotting anomalous network behavior. And of course, backups get their due. Mark's advice for individuals is refreshingly simple: use a cloud-based backup service if you can, but if you can't or won't, at least use whatever's already available to you — Time Machine, an external drive, anything. The point isn't the perfect solution. It's action. Which is exactly how the episode got its name: by the end, everyone agreed the real takeaway was just do something. Don't do nothing. If you've been meaning to turn on MFA, start backing up your laptop, or just get a better handle on the basics, this is the episode to catch up on. Chapter markers: 00:00 Cold open 00:03 Meet Mark Shriner 00:10 How Mark got into cybersecurity 00:15 The University of Michigan USB drive study 00:16 Turning on MFA: Curtis's personal journey 00:19 SIM swapping and SMS authentication risks 00:23 Top security concerns for individuals 00:24 Backups, ransomware emails, and phishing basics 00:25 Being aware and pausing before you click 00:26 The gift card scam story 00:28 Phone-based scams and social engineering 00:31 Careful what you post online 00:31 Company-level MFA and security best practices 00:34 Device management and BYOD 00:35 DDI tools and data leak detection 00:43 Cybersecurity best practices for individuals: backup edition 00:45 Just do something — the summary that named the episode
- Transcript
July 27 · 55 min
Stopping Ransomware Lateral Movement Before It Spreads
Ransomware lateral movement is exactly what it sounds like — once an attacker's inside your network, they start crawling around looking for more to encrypt, and stopping that crawl is often the difference between a bad day and a catastrophe. In this encore episode, part four of our seven-episode series pulling the best of the archives back into your feed, W. Curtis Preston and Prasanna Malaiyandi sit down with networking expert Tom Hollingsworth to break down exactly how attackers move once they're in, and what you can actually do about it. This one's back because listeners didn't just download it — they stuck with it, and a fair number of you came back for a second listen. That kind of engagement told us this conversation was worth surfacing again, especially with ransomware attacks as common as they are right now. Tom walks through the fundamentals of network segmentation — VLANs, air gaps, and why a "flat" network (where everything can talk to everything) is a gift to any attacker who gets in. From there the conversation moves into Zero Trust Network Architecture, what it actually takes to implement it at scale, and why flipping the switch from "allow everything" to "deny by default" is both the right move and the one that generates a thousand help desk tickets on day one. There's a good stretch on how schools, stadiums, and hotels handle network isolation differently than a typical enterprise, plus a practical rundown of incident response — locking down external access, isolating infected segments, keeping communication running when your own network is down, and why every kill switch needs to actually be wired to something. If you've ever wondered how much of this is built into your existing networking gear versus something you have to buy separately, or you just want a clearer mental model for how ransomware spreads once it's past the perimeter, this is a great one to revisit. Chapter Markers: 00:00:00 - Intro and why ransomware lateral movement matters right now 00:01:25 - Welcome back, meet Tom Hollingsworth 00:04:06 - Why isolating the network is step one after a ransomware attack 00:06:07 - Networking basics: how ransomware exploits flat networks 00:09:31 - VLANs, air gaps, and network segmentation 00:14:12 - Zero Trust Network Architecture explained 00:19:02 - Managing zero trust at scale across teams 00:25:48 - Special cases: schools, stadiums, and hotels 00:34:31 - Blocking newly registered domains to stop command and control 00:38:01 - Incident response: locking down the network 00:42:12 - Keeping communication running during an attack 00:44:54 - A real-world story: isolating infected devices 00:50:01 - Building segmentation in from the start
- Transcript
July 20 · 36 min
Ransomware Response Checklist: Prevent It, Slow It, Survive It
This episode is built around a ransomware response checklist — a three-part Reddit series by a security specialist who goes by snorkel42, breaking down exactly how to prevent, contain, and recover from a ransomware attack. This is an encore episode, and it's back not just because a lot of people downloaded it originally, but because so many of you listened all the way through — some of you more than once. That kind of engagement told us this one was worth bringing back. Curtis Preston and Prasanna Malaiyandi dig into snorkel42's series, which breaks the whole problem into three parts: how to stop ransomware from getting in, how to slow it down if it does, and what to actually do once you've been hit. Curtis and Prasanna go section by section — covering phishing and dropper prevention, application whitelisting, blocking lateral movement between servers, locking down RDP and SSH, honeypot files for catching intruders in the act, and building a real incident response plan before you ever need one. They also get into the messier parts most people don't talk about — what it's actually like to negotiate for a decryption key, why getting your data back isn't the end of the story, and why a ransomware attack is nothing like a normal disaster recovery scenario. Along the way, Curtis makes the case that most organizations already have the gaps this attacker needs — and that fixing them now is a lot cheaper than fixing them after the fact. Whether you're building your first incident response plan or just want to stress-test the one you've already got, this episode gives you a practical, section-by-section framework to work from. Chapter Markers: 00:00 – Encore intro & episode setup 00:01:37 – Show intro and banter 00:06:21 – Preventing the breach: phishing, droppers, and whitelisting 00:14:46 – Blocking lateral movement, RDP/SSH lockdown 00:20:28 – Detecting exfiltration and honeypot files 00:24:19 – What to do once you've been hit 00:25:58 – Building your incident response plan 00:30:43 – Decryption, ransom payments, and why it's not over yet
- Transcript
July 13 · 43 min
How to Protect Backups from Ransomware (Encore)
How to protect backups from ransomware starts with a hard truth: attackers aren't just encrypting your data anymore, they're stealing it first — and no backup system on earth undoes an exfiltration. In this encore episode of The Backup Wrap-Up, Curtis and Prasanna dig into what real immutability looks like versus the marketing version, why root access quietly undermines most "immutable" storage claims, the difference between virtual and true physical air gaps, and the exact questions you should be firing at your backup vendor before you trust them with your last line of defense. This one's an encore for a reason — it was one of the most listened-to episodes in the show's history, with listeners sticking around for the full runtime and then some. That's the kind of signal that tells you it's worth a second run. Along the way, they cover S3 object lock and what actually happens if your account gets deleted or your credit card stops working, why compromised admin credentials are involved in the majority of attacks and what your vendor should be able to undo, and why bit rot — rare, but nasty when it's silent — still belongs on your checklist. If you manage backup or DR for a living, or you're just trying to figure out whether your current setup would actually hold up, this episode gives you a concrete list of questions to ask and red flags to watch for. Chapters: 00:00 – Cold Open: Ransomware Is After Your Backups 01:19 – Welcome & Banter 05:50 – Topic Setup: Protecting Backups from Ransomware 07:36 – The Extortion & Exfiltration Playbook 15:25 – What Is an Air Gap? 18:22 – Virtual Air Gaps 27:57 – Real (Physical) Air Gaps 28:12 – What Is Immutability, Really? 29:23 – Bit Rot 30:42 – Root Access & the Limits of Immutability 32:51 – S3 Object Lock 40:20 – Questions to Ask Your Backup Vendor 42:31 – What Happens If You Delete Your Account? 44:29 – Compromised Credentials & Worst-Case Scenarios 46:41 – Final Thoughts
- Transcript
July 6 · 46 min
What Is Data Deduplication? (Encore)
What is data deduplication, and why does Curtis call it the single most important development in backup over the last 30 years? In this encore episode, W. Curtis Preston and Prasanna Malaiyandi break down exactly how dedupe works, why it's not the same as compression, and why the fine print of your dedupe domain determines how much storage you actually save. This episode originally aired as part of the Backup to Basics series, and it's back because listeners couldn't get enough of it — not just downloads, but people who stuck around for the whole conversation, some more than once. That says something, because this isn't a surface-level explainer. Curtis and Prasanna get into fingerprints, dedupe indexes, and the real-world tradeoffs between file-level and block-level dedupe. You'll hear why Curtis argues that file-level dedupe isn't "real" dedupe at all, just single-instance storage wearing a costume. Then the conversation shifts to the split that shapes entire product categories: source-side dedupe versus target-side dedupe. Curtis walks through why source dedupe requires you to essentially replace your backup software, while target dedupe lets you bolt an appliance onto whatever you're already running. Prasanna pushes back on some of the assumptions along the way, which is exactly the kind of back-and-forth that made this episode stick with listeners the first time around. By the end, they even get into hybrid dedupe, a concept that splits the difference and confuses almost everyone the first time they hear about it. If you've ever wondered why your backup storage doesn't need to be 30 or 40 times the size of your production data, or you just want to finally understand what your backup vendor means when they throw around terms like "dedupe ratio," this is the episode that clears it up. Chapters: 00:00 – Intro 08:10 – What Is Data Deduplication? 12:24 – Dedupe vs. Compression 16:13 – Fingerprints and the Dedupe Index 16:52 – What's a Dedupe Domain? 19:48 – Is File-Level Dedupe Really Dedupe? 21:53 – Source Dedupe vs. Target Dedupe 28:20 – What Is Hybrid Dedupe?
- Transcript
June 22 · 34 min
The REDCap Attack that Phishing-Resistant MFA Could Have Stopped
Phishing-resistant MFA could have stopped a Chinese state-sponsored threat actor from spending over a year inside North American academic and medical research networks — and we're going to tell you exactly how it happened and what you need to do about it. A group called UNC5608, tracked by Google's Threat Intelligence Group (GTIG), exploited a vulnerability unique to REDCap — a research data platform that allows multiple software versions to run simultaneously. They got in via stolen admin credentials, planted custom malware called Infinite.red directly into REDCap's upgrade process, harvested credentials for over a year, then used those credentials to log into Google Workspace as a domain admin and create fake compliance rules to silently forward sensitive research emails — military strategy, geostrategic policy, advanced tech, specific pathogens — straight to Gmail accounts they controlled. And nobody noticed for a very long time. Prasanna and I break down the full attack chain, then walk through every prevention layer that could have stopped it: inventory management, patching, password hygiene, SSO, phishing-resistant MFA, passkeys, DBSC, context-aware access, compliance rule monitoring, credential separation across security domains, and logging. We also get into what backups can and can't do for you in a long-dwell-time attack like this — and why infrastructure-as-code and truly immutable golden images matter more than you might think. If you're running any kind of research platform, academic institution, or medical network — or honestly any organization that uses Google Workspace — this one's for you. Chapters: 00:00 — Intro: The attack that phishing-resistant MFA could have stopped 01:03 — Show intro & woodworking banter 03:26 — What is a living-off-the-land attack? 04:02 — Who is UNC5608 and who did they target? 05:08 — How REDCap's multi-version design was exploited 06:11 — Infinite.red malware and credential harvesting 09:01 — Google Workspace infiltration via fake compliance rules 10:18 — The keywords they were stealing: pathogens, military strategy, and more 11:50 — What could the victims have done differently? 12:42 — Inventory management, patching, and legacy version removal 14:00 — Why you can't trust application-level authentication alone — use SSO 15:18 — Phishing-resistant MFA and why it matters 16:00 — Passkeys, FIDO, and why there are zero known attacks against them 17:57 — Device-bound session credentials (DBSC) and context-aware access 19:38 — Monitor your compliance rules — have a compliance rule for the compliance rule 20:40 — Credential separation across security domains 23:00 — Get some logging — XDR, SIEM, and catching exfiltration in progress 24:00 — What can backups actually do in a long-dwell-time attack? 27:00 — Infrastructure-as-code and the right cyber recovery approach 28:58 — Protecting your golden images with immutable storage 31:59 — Wrap-up
- Transcript
June 15 · 35 min
California Election Fraud? (Pt 2)
California election fraud claims are flooding social media — and most of them fall apart under basic scrutiny. In this follow-up episode, longtime San Diego County poll worker W. Curtis Preston tackles the wave of viral fraud allegations head-on, with sources so you can check his work yourself. Topics covered: the LA mayoral race "statistically impossible" surge for Nithya Raman, the AP reporting error that got blamed on fraud, claims that Spencer Pratt voters were having ballots rejected for signatures, the "gym membership card" voter ID myth, the Skid Row "paid to vote" controversy, and yes — the one claim that turned out to be true (a woman who actually did register her dog to vote). If you've seen these claims and wondered whether there's anything to them, this episode walks through the actual data, the actual law, and the actual outcomes — no spin, just the facts from someone counting the votes. Here are some sources: Los Angeles 2026 Mayor primary results: https://results.lavote.gov/#year=2026&election=4338 Donald Trump got 27% of City of LA vote in 2024: https://xtown.la/2024/12/16/a-city-country-divide-more-than-70-percent-of-los-angeles-voters-picked-kamala-harris-for-president/ There were 12,700 rejected ballots in all of LA county: https://perma.cc/E5Y9-NURQ Orange County woman registered her dog: https://www.foxla.com/news/costa-mesa-woman-dog-voter-fraud-sentencing Heritage Foundation Voter Fraud Database: https://electionfraud.heritage.org/search
- Transcript
June 8 · 24 min
California Election Counting Explained by an Actual Poll Worker
California election counting has confused — and frankly ticked off — a lot of people, and I get it. I'm W. Curtis Preston, I've worked every California election since the 2016 presidential primary, and I've managed the polls at multiple elections here in San Diego County. This episode, I'm going solo to explain exactly what's going on, why it takes so long, what the "red mirage" actually is, and why none of it is fraud. Sorry to disappoint some of you. If you've ever had a family member call you asking "what the hell is going on over there?" — this one's for you. I walk through the specific changes California made to election law, how our system compares to Florida's, why human nature is a big part of the problem, and what the chain of custody for every single ballot actually looks like from the inside. This isn't punditry. This is someone who has stood at those poll books, sealed those ballot cartons, and escorted those ballots to the DART team. Chapters: 0:00 – Introduction: What the hell is going on in California? 1:23 – Who I am and why I can speak to this 2:12 – How California election law changed six years ago 4:43 – The mail ballot window: postmark by 8 PM, received within 7 days 5:09 – Vote centers vs. the old precinct model 7:39 – California vs. Florida: why the laws produce such different results 9:09 – Why California voters wait until the last minute 14:12 – The red mirage explained: it's not fraud, it's math 15:31 – Signature verification: 80,000–100,000 per day in San Diego alone 16:35 – How computers count ballots — and the 1% manual audit that checks them 19:11 – Chain of custody: two people, sealed cartons, tracked numbers 20:17 – Debunking the "law enforcement can't observe" myth 21:24 – Dead people voting? Let's talk about what's actually happening 22:47 – Wrap-up
- Transcript
May 25 · 40 min
Stop 90% of Ransomware Attacks with Basic Cyber Hygiene
Basic cyber hygiene — patch management, password management, and MFA — is responsible for stopping roughly 90% of the ransomware attacks that could hit your organization. This episode is the overview: what those three things are, why they matter, and what happens when you skip them. WannaCry infected over 200,000 systems worldwide. A patch existed. People just hadn't applied it. Rackspace lost an entire business line — not because the attack was sophisticated, but because a workaround gave them false confidence and they delayed a critical patch. These aren't edge cases. They're the rule. Dr. Mike Saylor (Black Swan Cybersecurity) and Prasanna Malaiyandi join me to walk through the three pillars of basic cyber hygiene. We cover patch management first — and before you can even patch, you have to know what you have. Inventory is the starting point. Then we get into passwords: why reusing them is a numbers game the bad guys always win, and why a password manager isn't optional anymore. Finally, MFA — what it is, which forms are actually worth using, and why "remember this device" is quietly defeating the whole point. This is an overview episode. We're going deeper on each pillar in three follow-up episodes. But if you're not doing these three things today, stop reading this and go do them. There's no point talking about EDR, XDR, or any other three-letter security product if you haven't nailed the basics first. It's like researching a Roth IRA when you don't have a savings account. Chapters: 0:00 Intro 0:59 Welcome & Introductions 4:20 WannaCry: The Patch That Would Have Saved 200,000 Systems 7:33 Rackspace: When a Workaround Isn't Enough 12:12 Defining Basic Cyber Hygiene 14:53 Why These Three Things Stop 90% of Ransomware 17:54 Pillar 1: Patch Management 23:55 Pillar 2: Password Management 31:55 Pillar 3: MFA & Passkeys 37:34 Wrap-Up & What's Next
- Transcript

Showing 1–20 of 31 episodes