1 00:00:00,099 --> 00:00:03,789 You found the backup wrap up your go-to podcast for all things 2 00:00:03,789 --> 00:00:06,189 backup recovery and cyber recovery. 3 00:00:06,789 --> 00:00:11,290 We got some feedback from somebody from our last episode, the the 10 4 00:00:11,290 --> 00:00:12,969 things that every Backup System needs. 5 00:00:13,449 --> 00:00:17,829 He pointed out that we missed a few critical, uh, security features. 6 00:00:18,189 --> 00:00:21,849 So persona and I are taking a deeper dive into what makes 7 00:00:21,849 --> 00:00:23,829 an immutable backup system. 8 00:00:24,459 --> 00:00:28,989 If you're concerned about ransomware and um, I hope you are, then these 9 00:00:28,989 --> 00:00:31,210 security measures are now mandatory. 10 00:00:31,669 --> 00:00:37,159 Let's talk about how to actually protect your backup infrastructure from the 11 00:00:37,159 --> 00:00:38,960 biggest threat you're probably facing. 12 00:00:39,650 --> 00:00:44,120 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. Backup. 13 00:00:44,240 --> 00:00:47,299 I've been passionate about backup and cyber recovery. 14 00:00:47,374 --> 00:00:51,754 For over 30 years, ever since I had to tell my boss that there were no backups 15 00:00:51,754 --> 00:00:53,525 of that database that we had just lost. 16 00:00:54,004 --> 00:00:56,944 I don't want that to happen to you, and that's why I do this. 17 00:00:57,245 --> 00:01:01,805 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 18 00:01:02,105 --> 00:01:04,114 This is the backup wrap up. 19 00:01:18,836 --> 00:01:19,766 Welcome to the show. 20 00:01:20,366 --> 00:01:23,366 Hi, I am w Curtis Preston, AKA mischief backup. 21 00:01:23,366 --> 00:01:27,356 And I have with me a guy who suddenly seems to be asking, when do I get my 22 00:01:27,356 --> 00:01:29,696 name on the cover of a book persona. 23 00:01:29,846 --> 00:01:30,686 Molly Andi. 24 00:01:30,686 --> 00:01:31,166 How's it going? 25 00:01:31,166 --> 00:01:31,556 Persona? 26 00:01:31,646 --> 00:01:36,746 I am good, Curtis, I noticed in the background are a whole bunch 27 00:01:36,746 --> 00:01:38,611 of more books up there than normal. 28 00:01:39,631 --> 00:01:39,921 Yeah. 29 00:01:40,766 --> 00:01:43,321 Well, it's just, uh, well, I think they were just covered up before. 30 00:01:44,201 --> 00:01:44,741 Um, 31 00:01:44,816 --> 00:01:45,176 another 32 00:01:45,251 --> 00:01:45,431 is, 33 00:01:46,346 --> 00:01:46,706 that was 34 00:01:46,931 --> 00:01:50,681 oh, well I had the cover, I had the, uh, you know what I was, 35 00:01:51,521 --> 00:01:52,571 it's funny that you say that. 36 00:01:52,871 --> 00:01:57,341 I was, uh, prep, I'm doing a video actually for O'Reilly skills, 37 00:01:57,581 --> 00:01:57,661 Hmm. 38 00:01:57,851 --> 00:01:59,411 is, uh, kind of very exciting. 39 00:01:59,411 --> 00:02:02,351 My first time doing a video for them, for their, it's their 40 00:02:02,351 --> 00:02:04,181 learning platform and, um. 41 00:02:05,246 --> 00:02:08,456 Oddly enough, we'll be talking about backup, but um, I was trying 42 00:02:08,456 --> 00:02:12,506 to make it like, you know, look more, um, aesthetically pleasing. 43 00:02:12,506 --> 00:02:18,746 And so I have the lovely picture of my wife and, uh, that is our baby. 44 00:02:18,746 --> 00:02:23,006 If you can imagine this, this is, here's a picture for you. 45 00:02:23,606 --> 00:02:25,646 That is me from 46 00:02:25,826 --> 00:02:26,396 so for 47 00:02:26,696 --> 00:02:27,231 years ago. 48 00:02:27,626 --> 00:02:32,936 for folks who may not be aware, we have YouTube videos of this podcast. 49 00:02:32,936 --> 00:02:33,206 So in 50 00:02:33,401 --> 00:02:33,621 So. 51 00:02:33,716 --> 00:02:36,176 listening to us on your favorite pod catcher, you can 52 00:02:36,176 --> 00:02:38,186 also watch our smiling faces. 53 00:02:38,186 --> 00:02:39,896 You can see Curtis's background. 54 00:02:40,166 --> 00:02:43,166 You could see the picture of what he looked like 30 plus years, 30 years ago. 55 00:02:43,286 --> 00:02:43,436 Oh, 56 00:02:44,231 --> 00:02:44,681 Yeah. 57 00:02:44,831 --> 00:02:45,281 Yeah. 58 00:02:46,121 --> 00:02:48,731 Uh, that was our baby and interesting, that was our first baby. 59 00:02:48,731 --> 00:02:48,851 Um, um. 60 00:02:50,996 --> 00:02:52,646 Photo session with the baby. 61 00:02:52,916 --> 00:02:56,576 And uh, she was screaming as we were heading into the thing and, 62 00:02:56,606 --> 00:02:58,766 uh, we were like, she's hungry. 63 00:02:58,766 --> 00:03:02,336 So we fed her and then she fell asleep and she is out cold 64 00:03:02,336 --> 00:03:03,836 in that, in that photo shoot. 65 00:03:05,036 --> 00:03:06,806 Anyway, that baby's now 31. 66 00:03:06,806 --> 00:03:06,866 Um, 67 00:03:07,496 --> 00:03:09,206 So check us out on YouTube. 68 00:03:09,441 --> 00:03:09,731 yeah. 69 00:03:09,866 --> 00:03:11,066 up is the name of the channel. 70 00:03:11,066 --> 00:03:12,626 Subscribe, leave comments. 71 00:03:13,376 --> 00:03:14,066 all the rest. 72 00:03:14,111 --> 00:03:14,771 Absolutely. 73 00:03:15,191 --> 00:03:20,891 And by the way, this episode and the next episode are based on feedback 74 00:03:20,891 --> 00:03:27,311 that we got from our last, um, podcast, which was 10 things that 75 00:03:27,311 --> 00:03:29,441 every backup system needs to have. 76 00:03:29,831 --> 00:03:35,291 And, um, you know, they, they felt that I had, I had left off a few and I disagree. 77 00:03:35,411 --> 00:03:37,241 These were like table stakes, right? 78 00:03:37,241 --> 00:03:38,681 So, just a, a real quick. 79 00:03:38,981 --> 00:03:39,281 Thing. 80 00:03:39,281 --> 00:03:41,231 You know, these are like, if you don't have these, you don't 81 00:03:41,231 --> 00:03:42,581 even, don't even talk to me. 82 00:03:42,611 --> 00:03:44,201 Don't even tell me you have a backup system. 83 00:03:44,201 --> 00:03:44,351 Right. 84 00:03:44,351 --> 00:03:44,471 So we. 85 00:03:44,711 --> 00:03:46,241 in case, so then they can learn what 86 00:03:46,241 --> 00:03:46,631 What? 87 00:03:46,691 --> 00:03:47,021 doing. 88 00:03:47,081 --> 00:03:49,901 Oh, yeah, no, I'm saying if you're not already doing this. 89 00:03:50,171 --> 00:03:50,411 Yeah. 90 00:03:50,501 --> 00:03:50,681 Okay. 91 00:03:50,696 --> 00:03:52,421 I, I, I see, I see your point there. 92 00:03:52,451 --> 00:03:57,131 Okay, so here's a quick list of a recap of last, uh, the last episode. 93 00:03:57,521 --> 00:04:01,511 So we talked about 3, 2, 1 rule, which is now the 3, 2 1, 1 0 rule. 94 00:04:01,571 --> 00:04:04,961 Three copies of your data, two media types, one of them off the site, one 95 00:04:04,961 --> 00:04:07,061 of them immutable with zero errors. 96 00:04:07,391 --> 00:04:09,281 We talked about automated backups, right? 97 00:04:09,581 --> 00:04:11,471 If you're having to do your backups manually, that is. 98 00:04:12,231 --> 00:04:13,701 That is not really a backup system. 99 00:04:14,241 --> 00:04:15,441 We talk about recovery testing. 100 00:04:15,441 --> 00:04:18,351 If you haven't tested your backups by trying to recover, then you 101 00:04:18,351 --> 00:04:20,631 don't really have backups defined. 102 00:04:20,631 --> 00:04:21,831 RTO and RPO. 103 00:04:21,831 --> 00:04:24,021 Recovery time objective, recovery point, objective. 104 00:04:24,321 --> 00:04:27,861 Um, and then also, and we're gonna dive a little deeper on this one. 105 00:04:28,641 --> 00:04:31,641 Isolating your backup system from a security perspective. 106 00:04:32,001 --> 00:04:33,831 Uh, backing up your SaaS data. 107 00:04:34,131 --> 00:04:37,761 Look at documentation and runbooks of your system. 108 00:04:38,211 --> 00:04:40,191 Uh, defined retention policies. 109 00:04:40,601 --> 00:04:41,801 Monitoring and alerting. 110 00:04:41,801 --> 00:04:44,621 Make sure that somebody is constantly looking at your backup system. 111 00:04:44,741 --> 00:04:47,681 And then finally, a listed endpoint, device protection. 112 00:04:47,856 --> 00:04:48,216 And 113 00:04:48,281 --> 00:04:49,151 And the thing is, 114 00:04:49,206 --> 00:04:49,386 has 115 00:04:49,451 --> 00:04:49,871 go ahead. 116 00:04:50,286 --> 00:04:54,426 and he is going to go become an auction person who does like the biddings. 117 00:04:56,921 --> 00:04:58,931 So you, so funny. 118 00:04:59,261 --> 00:05:06,731 Um, so you know, the, uh, when you think about the things that. 119 00:05:07,046 --> 00:05:11,276 A modern backup system, and again, for those that haven't listened to us before. 120 00:05:11,951 --> 00:05:16,241 When I say backup, I mean that in the broadest possible sense, right? 121 00:05:16,271 --> 00:05:19,151 So some people see DR and backup as two different things. 122 00:05:19,211 --> 00:05:24,431 I do not, I just see them as two different, um, like ways 123 00:05:24,431 --> 00:05:26,231 in which the backup is used. 124 00:05:26,291 --> 00:05:29,291 Anything that is storing the data for the purposes of recovery 125 00:05:29,291 --> 00:05:30,791 is a backup, in my opinion. 126 00:05:31,271 --> 00:05:34,031 Um, as long as it meets the definitions of the, the things 127 00:05:34,031 --> 00:05:34,811 that we talked about, right? 128 00:05:34,811 --> 00:05:36,461 If it meets the 3, 2, 1, 1 0. 129 00:05:36,861 --> 00:05:41,616 Um, for example, snapshots that are not copied somewhere, don't meet the 130 00:05:41,621 --> 00:05:45,861 definition of backup, but snapshots that have been copied somewhere, uh, and 131 00:05:45,861 --> 00:05:48,681 are being monitored and are, you know, scheduled and all this stuff, I think 132 00:05:48,681 --> 00:05:51,801 they can meet a, the, you know, they can meet a definition of backup, right? 133 00:05:52,251 --> 00:05:57,831 But if you look at, and we talked about this the last episode, the 134 00:05:57,831 --> 00:06:03,111 number one reason that we are restoring these days is not hardware failure. 135 00:06:03,111 --> 00:06:04,581 And it's not even like. 136 00:06:05,726 --> 00:06:06,536 Fat fingering. 137 00:06:06,536 --> 00:06:10,076 It's not I deleted a file or I corrupted a file. 138 00:06:10,286 --> 00:06:12,026 You know, by, by hand. 139 00:06:12,536 --> 00:06:14,996 I would say that the number one reason people are restoring 140 00:06:14,996 --> 00:06:16,826 these days is ransomware. 141 00:06:17,186 --> 00:06:19,346 Um, what do you think about that claim? 142 00:06:19,481 --> 00:06:20,051 agree. 143 00:06:20,051 --> 00:06:24,101 And there's so much monetary 144 00:06:26,111 --> 00:06:26,351 right? 145 00:06:26,351 --> 00:06:29,141 Just from an organization like we've talked about, companies that have 146 00:06:29,321 --> 00:06:29,441 I. 147 00:06:29,561 --> 00:06:34,121 like bust because they were not able to recover from a ransomware attack. 148 00:06:34,121 --> 00:06:37,161 In fact, I think, was it? 149 00:06:37,931 --> 00:06:43,931 Jaguar Land Rover is currently still trying to recover from an attack. 150 00:06:44,231 --> 00:06:44,441 I 151 00:06:44,621 --> 00:06:44,981 Yeah, 152 00:06:44,981 --> 00:06:49,331 Ashi Brewing Company is trying to recover from an attack. 153 00:06:50,801 --> 00:06:51,161 the, and 154 00:06:51,191 --> 00:06:51,971 it's crazy. 155 00:06:52,031 --> 00:06:52,301 Yeah. 156 00:06:52,631 --> 00:06:53,356 and months, trying to recover 157 00:06:54,626 --> 00:06:55,016 Yeah. 158 00:06:55,616 --> 00:06:59,156 Um, and, and that's pretty much the, the number one reason we're re we're 159 00:06:59,156 --> 00:07:03,116 reaching for a backup tape or, or, or disc or whatever it is that you're, 160 00:07:03,176 --> 00:07:05,336 you know, I, I, I dated myself there. 161 00:07:05,666 --> 00:07:08,876 Uh, most people are not using tape as their primary protection mechanism. 162 00:07:09,056 --> 00:07:13,616 So some of them may have tape as a secondary protection mechanism, especially 163 00:07:13,976 --> 00:07:15,926 I'd say if they're a smaller organization. 164 00:07:15,926 --> 00:07:19,526 The reason why I say that is when you start talking about petabytes 165 00:07:19,526 --> 00:07:21,656 and exabytes, for example. 166 00:07:22,166 --> 00:07:23,516 Tape is feasible. 167 00:07:23,816 --> 00:07:28,796 It's just that getting the, that amount of data regularly copied to tape, 168 00:07:28,826 --> 00:07:32,576 um, can be well is, uh, difficult. 169 00:07:32,636 --> 00:07:32,906 Right. 170 00:07:33,086 --> 00:07:33,266 Okay. 171 00:07:33,266 --> 00:07:36,146 It's not, not that it can't be done, uh, it's that it's 172 00:07:36,146 --> 00:07:37,496 definitely, uh, more challenging. 173 00:07:37,496 --> 00:07:40,746 But if you actually, just to go back to my comment about the smaller company. 174 00:07:40,956 --> 00:07:45,906 I just saw an article that, a new company whose name I wish, and I'll, 175 00:07:45,936 --> 00:07:52,407 I'll insert it here, A new company named Simply . they're actually selling LTO 10 176 00:07:52,677 --> 00:07:59,067 tape drives they're USBC made directly to plug into, let's say a MacBook right now. 177 00:07:59,197 --> 00:08:00,869 The tape drives are $12,000. 178 00:08:01,045 --> 00:08:03,295 but losing valuable data, 179 00:08:03,955 --> 00:08:06,355 Yeah, yeah, yeah. 180 00:08:07,165 --> 00:08:10,795 So if you're, if you have, if you have the, the money to, to do that, 181 00:08:10,795 --> 00:08:15,145 I'm just saying that the, the tape technology does continue to be, um, 182 00:08:16,195 --> 00:08:16,615 um. 183 00:08:17,605 --> 00:08:24,865 So let's talk about, uh, four more things that I think that you need to look into 184 00:08:24,865 --> 00:08:31,405 if you want to basically modernize your backup system from a security standpoint. 185 00:08:31,405 --> 00:08:31,915 Okay? 186 00:08:33,115 --> 00:08:36,595 And the first one, and, and we, we touched on it already in the last 187 00:08:36,595 --> 00:08:39,325 episode, and you know, I talked about segregating your backups. 188 00:08:40,060 --> 00:08:46,180 And, but I don't think we really dove deep on modernizing the authentication 189 00:08:46,180 --> 00:08:51,790 mechanism Historically, how did you log into a backup system? 190 00:08:52,575 --> 00:08:53,380 Username, password. 191 00:08:54,130 --> 00:08:54,610 Yeah. 192 00:08:55,270 --> 00:08:56,200 What's, what's wrong with that? 193 00:08:56,290 --> 00:08:58,060 hopefully you at least had a username and password. 194 00:08:59,260 --> 00:08:59,650 Yes. 195 00:08:59,650 --> 00:09:00,940 Hopefully you did have that. 196 00:09:00,970 --> 00:09:03,530 Uh, well actually if we go back in the day, back in the day. 197 00:09:04,240 --> 00:09:08,710 Um, the, the software ran like in user space. 198 00:09:08,710 --> 00:09:13,930 You didn't have a separate authentication login, so you were only as good as 199 00:09:14,290 --> 00:09:16,090 whatever thing you were logging into. 200 00:09:16,390 --> 00:09:19,870 Uh, and generally it ran its root, um, good times. 201 00:09:21,310 --> 00:09:21,820 So, yeah. 202 00:09:21,910 --> 00:09:27,670 So at least in the last, like, say 15, 20 years, username and password was the 203 00:09:27,670 --> 00:09:29,215 way, what, what's the problem with that? 204 00:09:29,725 --> 00:09:33,655 Uh, you have users trying to manage passwords independently. 205 00:09:33,955 --> 00:09:35,515 Passwords get stolen. 206 00:09:35,515 --> 00:09:37,285 Passwords don't get rotated. 207 00:09:37,615 --> 00:09:40,105 People will pick the easiest password to remember 208 00:09:41,275 --> 00:09:46,435 Yes, like backup password with a, but we put dollar signs for the s's. 209 00:09:46,435 --> 00:09:47,485 They'll never guess that. 210 00:09:48,085 --> 00:09:50,365 Um, yeah, you know what it is? 211 00:09:50,365 --> 00:09:52,555 It's, it's pa, it's a backup password. 212 00:09:52,555 --> 00:09:53,965 So we just, we put password. 213 00:09:53,990 --> 00:09:54,600 backwards. 214 00:09:54,790 --> 00:09:55,270 backwards. 215 00:09:55,720 --> 00:09:56,170 Yeah. 216 00:09:56,290 --> 00:09:56,680 Yeah. 217 00:09:57,370 --> 00:09:58,540 They'll never guess that either. 218 00:09:58,900 --> 00:10:01,570 Um, and so, yeah, so that's the problem really. 219 00:10:01,630 --> 00:10:07,740 Is it, is it, is it your one stolen or, uh, you know, guessed 220 00:10:07,930 --> 00:10:13,630 password away from, um, having your entire backup system thwarted. 221 00:10:13,720 --> 00:10:16,120 You know, when you, when you listen to the stories that I tell back 222 00:10:16,120 --> 00:10:19,450 in the thing, the backup system is like the one system that is, that 223 00:10:19,450 --> 00:10:21,460 is connected to everything, right? 224 00:10:21,460 --> 00:10:23,120 And which is why it needs to be. 225 00:10:23,910 --> 00:10:25,470 More secure than anything else. 226 00:10:25,470 --> 00:10:25,830 Right? 227 00:10:25,950 --> 00:10:29,430 And so the idea that you could just log into a backup system with a username 228 00:10:29,430 --> 00:10:34,320 and password with no additional authentication at this point, uh, 229 00:10:34,320 --> 00:10:36,510 is absolutely insanity, right? 230 00:10:37,020 --> 00:10:42,930 So, um, there are two things that we can do, uh, to, to, to thwart that. 231 00:10:43,050 --> 00:10:45,360 The first thing that you should absolutely be doing is some sort of 232 00:10:45,360 --> 00:10:46,650 password management system, right? 233 00:10:46,650 --> 00:10:50,070 So that you have, so that your password is on all of the different 234 00:10:50,070 --> 00:10:51,570 pieces of your backup infrastructure. 235 00:10:51,570 --> 00:10:54,660 Your password is unique, not just one password logged in everywhere. 236 00:10:54,825 --> 00:10:54,915 Yep. 237 00:10:54,960 --> 00:10:55,320 Right? 238 00:10:55,620 --> 00:11:01,170 Uh, but then there are two things that we can do to, or do you, are you doing 239 00:11:01,170 --> 00:11:02,880 a, but before you even get to the two? 240 00:11:03,030 --> 00:11:05,100 before you get to the two things, 241 00:11:06,120 --> 00:11:06,510 Yeah. 242 00:11:06,570 --> 00:11:09,720 about local passwords, you talked about password managers, A lot 243 00:11:09,720 --> 00:11:14,490 of enterprises, companies, it's organizations, they use active 244 00:11:14,490 --> 00:11:16,170 directory or other things like that. 245 00:11:16,500 --> 00:11:16,770 And so 246 00:11:16,770 --> 00:11:17,130 Yeah, 247 00:11:17,340 --> 00:11:18,780 to you is yes, we said 248 00:11:18,930 --> 00:11:20,820 typing in a username and password. 249 00:11:21,690 --> 00:11:23,490 As the only way of authenticating is bad. 250 00:11:23,880 --> 00:11:27,090 Uh, you said using a password manager is better. 251 00:11:27,805 --> 00:11:28,095 Yeah. 252 00:11:28,475 --> 00:11:28,895 Mm-hmm. 253 00:11:29,130 --> 00:11:33,990 talk about the two things is do you see things like active directory 254 00:11:34,020 --> 00:11:37,260 or Entra ID or whatever they now call all these things, right. 255 00:11:37,260 --> 00:11:37,960 I can never keep up with 256 00:11:38,010 --> 00:11:42,090 Yeah, it's, it's, it's intra id, but, which is a weird name and 257 00:11:42,090 --> 00:11:43,260 I preferred active directory. 258 00:11:43,260 --> 00:11:44,460 But anyway, yeah. 259 00:11:44,460 --> 00:11:44,910 So, 260 00:11:45,240 --> 00:11:45,990 as part of 261 00:11:46,020 --> 00:11:47,910 yeah, great question. 262 00:11:47,940 --> 00:11:51,090 Um, I think we covered this a little bit in the last episode, 263 00:11:51,420 --> 00:11:57,840 but the, um, I. I see it as another way to hack the backup system. 264 00:11:58,170 --> 00:12:01,920 So if you're gonna use active directory, this should be in a separate domain. 265 00:12:02,190 --> 00:12:08,550 There shouldn't be a way to hack the active directory or interest system in the 266 00:12:08,550 --> 00:12:13,800 primary domain, and then somehow use that as a way to get into the backup domain. 267 00:12:14,250 --> 00:12:17,025 Uh, so at a minimum, there should be a separate. 268 00:12:17,600 --> 00:12:22,160 Username and password, or perhaps if you, you know, if you really want a, a 269 00:12:22,160 --> 00:12:27,740 separate inter ID system for the backup system, there's nothing wrong with that. 270 00:12:27,740 --> 00:12:32,510 It's just most people aren't gonna go to that cost and management to do that. 271 00:12:32,990 --> 00:12:36,200 Um, and you, and it's difficult to do that without also connecting 272 00:12:36,200 --> 00:12:37,370 it to your primary environment. 273 00:12:37,370 --> 00:12:40,730 But I do think it should be separated as much as possible. 274 00:12:41,090 --> 00:12:44,750 So then we're, we're logging in with, with a local username and password. 275 00:12:45,140 --> 00:12:45,680 Um. 276 00:12:46,135 --> 00:12:51,985 And, uh, but if that's all we're doing, then this is a problem, right? 277 00:12:51,985 --> 00:12:53,995 And there are two things that we can do. 278 00:12:54,445 --> 00:12:58,405 Uh, one is sort of now starting to be the old school way, but it's 279 00:12:58,405 --> 00:13:00,415 still probably the primary way. 280 00:13:00,865 --> 00:13:01,990 Uh, and what would that be? 281 00:13:02,520 --> 00:13:04,350 Multi-factor authentication. 282 00:13:04,870 --> 00:13:07,010 Yes, A-K-A-M-F-A. 283 00:13:08,130 --> 00:13:11,520 Um, some people call it two FA, but it's really multifactor authentication. 284 00:13:11,550 --> 00:13:13,380 'cause there could be, there could be different ways. 285 00:13:13,890 --> 00:13:18,120 And why does, why does MFA, uh, help here? 286 00:13:18,615 --> 00:13:21,885 Because if someone knows your password, unless they have 287 00:13:21,885 --> 00:13:24,015 your other factor, they can't 288 00:13:24,120 --> 00:13:24,450 Right, 289 00:13:24,675 --> 00:13:25,725 into your backup system. 290 00:13:26,580 --> 00:13:26,940 right. 291 00:13:26,940 --> 00:13:27,000 Um, 292 00:13:27,795 --> 00:13:27,975 So 293 00:13:28,050 --> 00:13:29,070 and that is, 294 00:13:29,085 --> 00:13:30,615 something you have, right? 295 00:13:30,900 --> 00:13:31,230 yeah. 296 00:13:31,440 --> 00:13:31,800 Yeah. 297 00:13:31,830 --> 00:13:36,030 And most systems, most MFA systems, at least. 298 00:13:36,645 --> 00:13:38,535 You know, good, better, best. 299 00:13:38,895 --> 00:13:39,375 Good. 300 00:13:39,525 --> 00:13:39,855 Better? 301 00:13:39,855 --> 00:13:40,095 Yeah. 302 00:13:40,095 --> 00:13:40,305 Good. 303 00:13:40,305 --> 00:13:40,485 Better. 304 00:13:40,965 --> 00:13:41,835 So, yeah. 305 00:13:41,925 --> 00:13:43,965 So good is modern. 306 00:13:43,965 --> 00:13:45,375 SMS authentication. 307 00:13:45,405 --> 00:13:46,695 We come back to that in a minute. 308 00:13:46,965 --> 00:13:51,705 Better Is MFA, uh, based on like an app or something? 309 00:13:51,975 --> 00:13:55,725 And then best would be a token based, physical token based, right? 310 00:13:56,115 --> 00:13:57,735 Um, why, why do I say? 311 00:13:57,735 --> 00:13:59,145 'cause you and I have had this conversation. 312 00:13:59,145 --> 00:14:02,775 Why do I say modern SMS authentication is at least good. 313 00:14:04,800 --> 00:14:06,060 because it's, 314 00:14:07,200 --> 00:14:08,580 Yeah, it's difficult to say it right? 315 00:14:09,750 --> 00:14:10,020 well, 316 00:14:10,320 --> 00:14:10,770 Yeah, 317 00:14:10,890 --> 00:14:12,210 modern SMS is. 318 00:14:13,320 --> 00:14:14,790 It's better than nothing. 319 00:14:15,210 --> 00:14:16,500 it's better than nothing. 320 00:14:17,610 --> 00:14:21,735 if you look at all of sort of the sim swap attacks and other things that 321 00:14:21,735 --> 00:14:24,255 have happened, it's not bulletproof. 322 00:14:25,195 --> 00:14:25,485 Yeah. 323 00:14:25,515 --> 00:14:27,150 It's not bulletproof at all. 324 00:14:27,180 --> 00:14:27,570 Right. 325 00:14:27,600 --> 00:14:32,205 But the modern, modern SMS, like. 326 00:14:33,060 --> 00:14:37,620 It's, it's a lot harder with, with current hardware, it's a lot harder to 327 00:14:37,620 --> 00:14:44,700 like steal someone's identity that way unless they physically stole your phone 328 00:14:44,700 --> 00:14:48,840 and then you don't have a password and, you know, so the sim swap I think used 329 00:14:48,840 --> 00:14:54,090 to be, I, I, by the way, if, if somebody knows better than me, and again, I'm 330 00:14:54,090 --> 00:14:57,120 not saying this is the way to do it, I'm just saying it's better than nothing. 331 00:14:57,270 --> 00:15:00,120 And I am not putting email on this list at all. 332 00:15:00,135 --> 00:15:00,435 Yep. 333 00:15:00,615 --> 00:15:01,035 Right. 334 00:15:01,155 --> 00:15:02,685 I'm saying, please don't use email. 335 00:15:02,955 --> 00:15:07,870 SMS is still better than nothing, but you should aim for better than that. 336 00:15:07,905 --> 00:15:10,130 Can I make a comment though, even about SMS, 337 00:15:10,320 --> 00:15:10,520 free. 338 00:15:11,120 --> 00:15:11,410 Yeah. 339 00:15:11,685 --> 00:15:14,505 so you're, we're just benching unless they steal your phone. 340 00:15:15,900 --> 00:15:16,190 Yeah. 341 00:15:16,755 --> 00:15:21,105 systems these days allow, like, on my iPhone and I have a Mac, 342 00:15:21,670 --> 00:15:22,090 Mm-hmm. 343 00:15:22,155 --> 00:15:24,645 me to receive my SMSs on my Mac 344 00:15:25,430 --> 00:15:25,720 Yeah. 345 00:15:26,385 --> 00:15:28,065 and then in Safari 346 00:15:28,250 --> 00:15:29,370 authenticated into the Mac. 347 00:15:29,505 --> 00:15:29,925 yes. 348 00:15:30,045 --> 00:15:35,325 But then in Safari it auto-fills that SMS based on receiving it in iMessage. 349 00:15:37,860 --> 00:15:43,440 So I'm saying if someone has access to your laptop, right, that it is 350 00:15:43,440 --> 00:15:47,940 possible because it's linked, or if they for some reason have access 351 00:15:47,940 --> 00:15:50,730 to your, uh, apple account, even 352 00:15:51,000 --> 00:15:51,060 Yeah. 353 00:15:51,360 --> 00:15:56,700 IMEs or having an SMS may, it's still better than nothing, but 354 00:15:56,910 --> 00:15:57,450 Yeah. 355 00:15:57,510 --> 00:15:58,620 Which is, which is where I, 356 00:15:58,860 --> 00:15:59,070 Ty bitty. 357 00:15:59,730 --> 00:16:02,190 I still think it's, I think it's way better than nothing. 358 00:16:02,195 --> 00:16:05,460 I don't, I think there are edge cases, but, and you know, and, and if someone's 359 00:16:05,460 --> 00:16:08,130 determined to hack you, this is definitely not the, not the way to do it. 360 00:16:08,130 --> 00:16:08,370 Right. 361 00:16:08,760 --> 00:16:13,020 So better I would say is, is some sort of OTP one-time password generator. 362 00:16:13,230 --> 00:16:15,100 Um, I like Authy. 363 00:16:15,120 --> 00:16:17,310 Google Authenticator is the most popular. 364 00:16:17,700 --> 00:16:20,880 The thing I like about Authy is that you can back up the configuration and easily 365 00:16:20,880 --> 00:16:23,880 move it to another device if you, um. 366 00:16:24,540 --> 00:16:28,110 Uh, by the way, I almost, when I, and, but by the, the problem with 367 00:16:28,110 --> 00:16:30,810 Google Authenticator is actually what happened to me not that long ago. 368 00:16:30,990 --> 00:16:35,655 I dropped my phone in the water and I. Didn't do the right things. 369 00:16:35,655 --> 00:16:39,135 And so the waterproof phone, uh, died. 370 00:16:39,165 --> 00:16:43,665 And I needed to, I needed to move all my OTPs over to another device. 371 00:16:44,295 --> 00:16:47,025 And with Google Authenticator, you need to do that live. 372 00:16:47,055 --> 00:16:49,665 You, you can't, you, you have to move it. 373 00:16:49,665 --> 00:16:50,025 Right. 374 00:16:50,415 --> 00:16:53,535 And so that's when that happened to me the last time. 375 00:16:53,535 --> 00:16:55,125 That's when I started looking at aie. 376 00:16:55,545 --> 00:16:59,325 And so I liked that, but I, I don't do it often, and so I couldn't 377 00:16:59,325 --> 00:17:00,855 remember what Auie was asking for. 378 00:17:00,855 --> 00:17:01,035 Right. 379 00:17:01,035 --> 00:17:02,745 It was like, it, it just, it just. 380 00:17:03,075 --> 00:17:06,825 It used a, it used a weird phrase that I didn't understand what it 381 00:17:06,825 --> 00:17:09,825 was asking for, and then I remember eventually I remembered, oh, it's just 382 00:17:09,825 --> 00:17:13,785 the password for Authe that I stored my password management system for the 383 00:17:13,785 --> 00:17:14,800 backup, because if I didn't have that. 384 00:17:15,225 --> 00:17:15,515 they 385 00:17:15,675 --> 00:17:18,315 That password, I would've been starting from scratch again. 386 00:17:18,975 --> 00:17:26,775 So, so that's better, uh, because you need both, you need the phone, um, and you need 387 00:17:26,805 --> 00:17:28,905 to be able to authenticate into the phone. 388 00:17:28,995 --> 00:17:29,295 Right. 389 00:17:29,295 --> 00:17:31,635 By the way, au no longer runs on the laptop. 390 00:17:31,755 --> 00:17:31,835 Hmm. 391 00:17:32,085 --> 00:17:37,425 Um, uh, I don't think Google Authenticator does either. 392 00:17:37,935 --> 00:17:42,025 Um, I could be wrong there, but, what was the third option? 393 00:17:42,025 --> 00:17:45,865 I was, so we talked about SMS good, but not really that good. 394 00:17:46,105 --> 00:17:47,125 Uh, OTP. 395 00:17:47,130 --> 00:17:48,775 Oh, by the way, that's funny. 396 00:17:49,315 --> 00:17:49,885 Look at that. 397 00:17:50,155 --> 00:17:51,025 Did you see that pop up? 398 00:17:51,340 --> 00:17:52,690 the thumbs 399 00:17:52,915 --> 00:17:53,815 That's really funny. 400 00:17:53,815 --> 00:17:55,555 I, I didn't even know that was a feature. 401 00:17:55,855 --> 00:18:00,325 Um, anyway, so what was, what's the, what's the third option that we could do? 402 00:18:00,910 --> 00:18:01,540 tokens. 403 00:18:02,245 --> 00:18:02,575 Yeah. 404 00:18:02,605 --> 00:18:06,985 Physical tokens and companies that are truly, uh, concerned, 405 00:18:07,495 --> 00:18:08,815 uh, of network of security. 406 00:18:08,815 --> 00:18:09,565 This is what they do. 407 00:18:09,640 --> 00:18:09,910 Yep. 408 00:18:09,955 --> 00:18:10,255 Right. 409 00:18:10,795 --> 00:18:15,895 Um, and this is something like, uh, UB key, um, the, what are the, what's 410 00:18:15,895 --> 00:18:18,475 the big, the, uh, like RSA, right? 411 00:18:18,535 --> 00:18:19,855 Uh, these are, these are. 412 00:18:20,395 --> 00:18:23,755 One-time password generators, but they're, they're physical. 413 00:18:23,935 --> 00:18:28,195 Also, by the way, there are, there are commercial solutions like, uh, 414 00:18:28,195 --> 00:18:32,705 Symantec VIP for example, my, my bank requires me to use Symantec 415 00:18:32,725 --> 00:18:34,165 VIP to be able to log into. 416 00:18:34,465 --> 00:18:43,135 So MFA is a better way to at least, uh, make it harder for people to get in. 417 00:18:43,135 --> 00:18:45,355 But what is the challenge with MFA? 418 00:18:46,930 --> 00:18:50,350 The problem with MFA is, I don't know about you, Curtis, but every 419 00:18:50,350 --> 00:18:53,980 time you log into something, you get an MFA notification, 420 00:18:54,140 --> 00:18:54,250 Yeah. 421 00:18:54,370 --> 00:18:59,035 and over time someone could mistakenly authorize. 422 00:19:00,310 --> 00:19:02,290 A request, which 423 00:19:02,500 --> 00:19:02,800 Yep. 424 00:19:02,980 --> 00:19:07,960 I think it was the Okta hack, where it was sort of MFA fatigue, which someone was 425 00:19:08,080 --> 00:19:08,440 Yep. 426 00:19:08,500 --> 00:19:09,640 keep getting these requests. 427 00:19:09,880 --> 00:19:10,990 Okay, I'm just gonna accept it. 428 00:19:12,010 --> 00:19:12,880 Yeah, it, yeah. 429 00:19:12,880 --> 00:19:15,610 Which is why yeah, which is why it's not foolproof, right? 430 00:19:15,850 --> 00:19:18,670 Because it's, it still depends on people, 431 00:19:19,690 --> 00:19:20,590 who is the weakest link, 432 00:19:20,590 --> 00:19:21,310 so. 433 00:19:22,195 --> 00:19:23,485 You are the weakest link. 434 00:19:23,965 --> 00:19:27,085 Um, we, we are, humans are always the weakest link in 435 00:19:27,085 --> 00:19:28,615 any, in any security system. 436 00:19:29,125 --> 00:19:35,545 So the next thing and um, which is really the, um, I think going 437 00:19:35,545 --> 00:19:41,305 to become the standard as we move forward is, um, uh, pass keys and 438 00:19:41,305 --> 00:19:45,505 pass keys are, um, you know, they're, they're based on this concept called 439 00:19:45,505 --> 00:19:49,045 Fido, which is fast identity online. 440 00:19:49,525 --> 00:19:51,055 Um, and so. 441 00:19:51,925 --> 00:19:52,675 It's an alliance. 442 00:19:52,675 --> 00:19:53,035 Yeah. 443 00:19:53,095 --> 00:19:58,195 And so basically, you, you, a a a system, a passkey system is 444 00:19:58,195 --> 00:19:59,995 referred to as being Fido compliant. 445 00:20:00,385 --> 00:20:08,245 And the thing is that the, there is no known way to thwart a Fido compliant, 446 00:20:08,605 --> 00:20:11,335 um, authentication system yet. 447 00:20:11,845 --> 00:20:16,405 Um, and so what, what, how is that, don't why you get, I'm just saying 448 00:20:16,405 --> 00:20:17,965 that is the claim that's being made. 449 00:20:18,175 --> 00:20:23,965 So I think even for PAs keys, I think there's good and, 450 00:20:24,355 --> 00:20:25,465 or sorry, better and best. 451 00:20:27,140 --> 00:20:27,445 All right. 452 00:20:27,565 --> 00:20:30,320 Oh, so you're saying there are better ways to have PAs keys? 453 00:20:30,460 --> 00:20:31,060 Yes. 454 00:20:31,540 --> 00:20:31,960 As an 455 00:20:32,010 --> 00:20:32,300 Okay. 456 00:20:32,530 --> 00:20:33,070 passkey, 457 00:20:33,170 --> 00:20:33,460 Yeah. 458 00:20:33,490 --> 00:20:34,930 people aren't aware of pass keys, right? 459 00:20:34,960 --> 00:20:40,270 Passkey store a certificate on your device that then can be used 460 00:20:40,480 --> 00:20:42,910 from just that one website, right? 461 00:20:42,910 --> 00:20:43,840 So it's linked to that. 462 00:20:43,840 --> 00:20:45,730 And to verify your identity, 463 00:20:46,180 --> 00:20:46,530 Right. 464 00:20:47,140 --> 00:20:47,650 And. 465 00:20:48,760 --> 00:20:52,510 Ideally, it should only be linked to that one particular device. 466 00:20:52,990 --> 00:20:58,120 However, you can imagine, that leads to awful user experience If in every 467 00:20:58,120 --> 00:20:59,980 single device I needed to log in. 468 00:21:00,580 --> 00:21:04,330 And so companies like Apple, what they do is they use iCloud key 469 00:21:04,330 --> 00:21:07,720 chain to actually synchronize pass keys amongst your devices, 470 00:21:08,465 --> 00:21:08,755 Yeah. 471 00:21:09,190 --> 00:21:09,430 right? 472 00:21:09,430 --> 00:21:14,860 Which sort of defeats some of the protection in term in order to 473 00:21:14,860 --> 00:21:16,450 provide a better user experience. 474 00:21:17,065 --> 00:21:18,145 So that's why I call 475 00:21:18,500 --> 00:21:18,620 Y 476 00:21:19,495 --> 00:21:20,185 versus the 477 00:21:20,185 --> 00:21:20,395 Yeah, 478 00:21:20,485 --> 00:21:24,985 approach for pass keys, which is it's always restricted to a particular device. 479 00:21:25,195 --> 00:21:28,285 So if someone, for instance, got your pass key off of your device, 480 00:21:28,285 --> 00:21:31,375 somehow exfiltrated it, they're not able to replay it, and other 481 00:21:31,375 --> 00:21:33,235 things like that, that would be my 482 00:21:33,235 --> 00:21:33,835 yeah. 483 00:21:33,835 --> 00:21:34,075 say. 484 00:21:35,215 --> 00:21:35,515 Yeah. 485 00:21:35,515 --> 00:21:36,685 I, I, um. 486 00:21:37,180 --> 00:21:40,390 I think we should, I think we could very, we could, we could get 487 00:21:40,390 --> 00:21:44,170 a passkey expert on here and we could talk about these concerns. 488 00:21:44,230 --> 00:21:51,970 Um, I think that there, I I, I'm, I'm not concerned as much about 489 00:21:51,970 --> 00:21:53,770 that, uh, at the, at the moment. 490 00:21:53,830 --> 00:21:59,230 Uh, I am, uh, the, the, my main concern, like you said, like u 491 00:21:59,260 --> 00:22:03,580 usability as the thing, so I've been, I've been working forward 492 00:22:03,580 --> 00:22:05,680 with, uh, using my password manager. 493 00:22:07,075 --> 00:22:12,265 To store pass keys, right, and it's my user experience interesting is different. 494 00:22:12,835 --> 00:22:18,625 My password manager requires me to put in my one password, my like 495 00:22:18,625 --> 00:22:22,585 global password for the password inventory every time I use a passkey, 496 00:22:23,005 --> 00:22:24,445 which is way less convenient. 497 00:22:24,895 --> 00:22:30,925 Than when I use it to put in a password and it's, it's, it was more secure. 498 00:22:31,015 --> 00:22:32,215 It's also more annoying. 499 00:22:32,605 --> 00:22:37,765 Um, but yeah, so, but the, but the point is that you that look into 500 00:22:37,765 --> 00:22:41,035 a passkey based system, that is definitely the way moving forward. 501 00:22:41,515 --> 00:22:45,445 I think you, you had, you state some, some valid concerns about that and, 502 00:22:45,505 --> 00:22:49,705 um, and perhaps we, well, there's no, perhaps I'm sure that we could do an 503 00:22:49,705 --> 00:22:55,885 episode just on passkeys and on bad passkey implementations, um, that we 504 00:22:55,885 --> 00:22:57,175 could do what we could do in the future. 505 00:22:58,945 --> 00:23:07,645 Um, okay, so speaking of, um, TLAs, right? 506 00:23:08,125 --> 00:23:08,695 Um. 507 00:23:09,490 --> 00:23:12,760 Uh, the next thing is we want to make sure, and I think you should do 508 00:23:12,760 --> 00:23:15,790 this everywhere, but you absolutely need to do it on your backup 509 00:23:15,790 --> 00:23:20,050 system, and that is to disable the ransomware deployment protocol. 510 00:23:21,040 --> 00:23:22,120 Are you gonna patent that? 511 00:23:22,540 --> 00:23:24,700 Sorry, copyright that phrase. 512 00:23:24,955 --> 00:23:27,715 I, I don't, I, I don't, I, I don't think I coined it. 513 00:23:27,715 --> 00:23:30,835 I think I borrowed it from somebody else, so I don't think I could do that. 514 00:23:31,105 --> 00:23:34,645 But yeah, so we're talking about RDP, which is actually the remote desktop 515 00:23:34,645 --> 00:23:38,125 protocol, which is the way a lot of people, and then it is built into 516 00:23:38,605 --> 00:23:41,095 so many operating systems, right? 517 00:23:41,155 --> 00:23:46,285 Um, and it's enabled by default and, uh, it does allow for remote 518 00:23:46,285 --> 00:23:51,025 management, but it also absolutely allows for deploying, uh, ransomware. 519 00:23:51,880 --> 00:23:55,525 because someone can easily access, there's a bunch of flaws with RDP 520 00:23:56,770 --> 00:24:00,160 that may not always be patched, and once someone's in, they basically 521 00:24:00,160 --> 00:24:01,360 have full access to your system. 522 00:24:02,440 --> 00:24:02,890 Yeah. 523 00:24:03,310 --> 00:24:07,960 And um, you know, and of course --some might say, well, what, how, 524 00:24:07,960 --> 00:24:09,760 how am I gonna remotely access thing? 525 00:24:09,910 --> 00:24:13,000 There are other ways to remotely access the system, which are much more secure. 526 00:24:13,450 --> 00:24:13,870 Right. 527 00:24:14,080 --> 00:24:16,535 I would look at some sort of SaaS based. 528 00:24:17,380 --> 00:24:21,250 A system that has a completely different user, you know, authentication so 529 00:24:21,250 --> 00:24:25,390 that you can authenticate again, go you, you, you use pass keys to 530 00:24:25,390 --> 00:24:28,570 authenticate to that system, which then has remote access to the system. 531 00:24:28,570 --> 00:24:29,560 I think that's the way to do it. 532 00:24:29,740 --> 00:24:35,110 I also think like using a Bastion host or VPN and only allow people inside 533 00:24:35,110 --> 00:24:37,930 the network to connect via RDP also 534 00:24:38,110 --> 00:24:38,350 Yeah. 535 00:24:38,590 --> 00:24:40,480 way you could potentially do that. 536 00:24:40,955 --> 00:24:42,010 No, I don't like that. 537 00:24:43,360 --> 00:24:44,260 Sorry, if required. 538 00:24:44,305 --> 00:24:45,085 I understand the, 539 00:24:45,130 --> 00:24:45,730 the systems 540 00:24:45,835 --> 00:24:47,605 by the way, what's a bastion host? 541 00:24:47,620 --> 00:24:51,970 this is kind of like a jumping point that you can use to connect from external 542 00:24:51,970 --> 00:24:55,690 systems, very secure, and then from there you can get access to other things. 543 00:24:56,635 --> 00:24:56,995 Yeah. 544 00:24:56,995 --> 00:24:59,665 I, I, I, uh, I get it. 545 00:24:59,725 --> 00:25:05,695 Um, I just, I, I, my preference, my preference would be to put 546 00:25:05,815 --> 00:25:08,155 this very important, very. 547 00:25:09,265 --> 00:25:13,615 Scary backdoor in the hands of a company that this is what they do for a living 548 00:25:13,885 --> 00:25:19,525 rather than a bastion host that I create and manage, uh, and possibly misconfigure. 549 00:25:19,705 --> 00:25:22,795 like restricting it to VPN and never allowing RDP outside. 550 00:25:23,875 --> 00:25:26,845 I, yeah, I just think you should turn off RDP period. 551 00:25:27,295 --> 00:25:30,685 I just think it's so dangerous that you should turn it off and then use 552 00:25:30,685 --> 00:25:35,155 something other than RDP as your way of, of managing remote hosts. 553 00:25:35,875 --> 00:25:37,315 Um, so. 554 00:25:37,630 --> 00:25:40,450 ways to set up RDP, by the way that most people don't use. 555 00:25:41,500 --> 00:25:41,980 That is true. 556 00:25:42,280 --> 00:25:42,610 Yeah. 557 00:25:42,910 --> 00:25:44,620 So again, good, better, best. 558 00:25:45,010 --> 00:25:51,070 Uh, good is, um, I'd say the, the basically, uh, VPN, you 559 00:25:51,070 --> 00:25:52,810 know, and a bastion host, right? 560 00:25:53,170 --> 00:25:57,280 The better, I think would be a sa, a SaaS based platform best, perhaps 561 00:25:57,280 --> 00:26:02,260 maybe an actual hardware based, remote management system that is based on, 562 00:26:02,320 --> 00:26:03,970 you know, hardware that you plug in. 563 00:26:03,970 --> 00:26:07,570 It's probably also more expensive and more difficult to manage, et cetera. 564 00:26:07,630 --> 00:26:07,960 Right. 565 00:26:08,650 --> 00:26:11,410 Um, just like everything else in our good, better, best, uh, thing. 566 00:26:12,610 --> 00:26:17,240 So the next is, uh, a little thing that we like to call RBAC. 567 00:26:17,260 --> 00:26:18,010 What is that? 568 00:26:18,795 --> 00:26:19,285 RBAC. 569 00:26:19,310 --> 00:26:20,760 Ah, good old RBAC. 570 00:26:20,780 --> 00:26:23,540 This is role-based access control, right? 571 00:26:23,540 --> 00:26:24,005 So making sure. 572 00:26:24,770 --> 00:26:27,770 That you are not giving it. 573 00:26:27,920 --> 00:26:33,470 It kind of goes hand in hand with your least privileged access, 574 00:26:34,285 --> 00:26:34,735 Yes. 575 00:26:34,765 --> 00:26:35,215 Yes. 576 00:26:35,215 --> 00:26:36,775 It 100% does that. 577 00:26:36,775 --> 00:26:36,985 Yeah. 578 00:26:37,130 --> 00:26:40,190 not assigning individual users right? 579 00:26:40,190 --> 00:26:45,050 You're doing things more methodically based on groups, and you are giving 580 00:26:45,050 --> 00:26:48,590 them access only to what they need rather than everything at the company. 581 00:26:49,630 --> 00:26:49,840 Yeah. 582 00:26:49,840 --> 00:26:54,940 The thing that you really need to understand is that the person that has all 583 00:26:54,940 --> 00:27:01,360 power in the backup system is literally the most powerful person in the company 584 00:27:01,360 --> 00:27:04,510 from a data destruction standpoint, right? 585 00:27:04,810 --> 00:27:07,630 Because they can overwrite everything in the data center. 586 00:27:07,900 --> 00:27:10,600 They can overwrite all the configuration in the backup system, 587 00:27:10,810 --> 00:27:12,400 and they can delete all the backups. 588 00:27:12,640 --> 00:27:12,940 Yep. 589 00:27:13,240 --> 00:27:18,970 It is an incredibly powerful position that we often give to the most junior people, 590 00:27:19,450 --> 00:27:22,630 With great power comes great responsibility. 591 00:27:23,305 --> 00:27:24,085 Exactly. 592 00:27:24,865 --> 00:27:25,615 Exactly. 593 00:27:25,855 --> 00:27:32,065 So, um, so yeah, so it is just, this is, um, so role based auth, role based 594 00:27:32,065 --> 00:27:37,735 administration, uh, basically says we're gonna give this role to this person. 595 00:27:37,795 --> 00:27:41,755 And so, for example, you could give somebody the ability to run the backups. 596 00:27:42,370 --> 00:27:44,200 But not configure the backups. 597 00:27:44,410 --> 00:27:47,860 Or they can configure the backups but not do restores. 598 00:27:47,860 --> 00:27:48,100 Right? 599 00:27:48,100 --> 00:27:51,190 Or they can do backups, but not restores, restores, but not backups, right? 600 00:27:51,670 --> 00:27:57,220 So, um, each of those is, um, a different level of trust. 601 00:27:57,610 --> 00:28:02,050 And if you can divide, if you can do division of powers and you can, uh, 602 00:28:02,110 --> 00:28:05,920 you know, this obviously is only gonna work in a, in a large company, but 603 00:28:05,920 --> 00:28:07,780 what you could do, you could also do. 604 00:28:08,455 --> 00:28:15,115 You could create a separate role just for restorers and, uh, you could require, 605 00:28:15,385 --> 00:28:17,875 uh, four eyes authentication for that. 606 00:28:17,875 --> 00:28:18,355 What is that? 607 00:28:18,505 --> 00:28:21,565 Yeah, four eyes is two. 608 00:28:21,625 --> 00:28:27,475 Two eyes, so it's two people in order to be able to do some 609 00:28:27,475 --> 00:28:29,815 action that may be destructive or 610 00:28:30,145 --> 00:28:30,385 Yeah. 611 00:28:30,385 --> 00:28:31,225 It's not like Curtis. 612 00:28:31,375 --> 00:28:32,785 It's not like Curtis with glasses. 613 00:28:32,815 --> 00:28:34,615 It's not, it's not four eyes like that. 614 00:28:34,915 --> 00:28:35,365 It's two. 615 00:28:35,395 --> 00:28:38,905 It's two people authenticating for certain actions, like destructive 616 00:28:38,905 --> 00:28:42,235 restores, changing the backup configuration for example. 617 00:28:42,235 --> 00:28:44,995 Why would, why would we wanna protect changing the backup configuration? 618 00:28:45,715 --> 00:28:51,625 Because a malicious actor or even a rogue admin can go and sort of be like, 619 00:28:51,625 --> 00:28:57,175 Hey, all those servers or whatever else, let's just check change the backup. 620 00:28:57,175 --> 00:29:01,495 So it's only running one day a week and the 621 00:29:01,495 --> 00:29:01,855 Yeah, 622 00:29:01,975 --> 00:29:03,685 is one copy. 623 00:29:04,675 --> 00:29:06,025 yeah, yeah, exactly. 624 00:29:06,175 --> 00:29:06,625 zero 625 00:29:07,525 --> 00:29:08,455 yeah, exactly. 626 00:29:08,825 --> 00:29:13,655 The final thing I'd like to suggest to potentially harden your backup system 627 00:29:14,105 --> 00:29:19,565 is to consider some type of service provider that this is their only role. 628 00:29:19,955 --> 00:29:24,245 Um, so this could, this could be a number of things, right? 629 00:29:24,245 --> 00:29:30,125 So one is you, this could be a an M-S-M-S-S-P, right? 630 00:29:30,485 --> 00:29:34,535 Um, a managed security service provider, like, um. 631 00:29:35,195 --> 00:29:40,835 Our good friend, Dr. Mike Saylor, uh, at, uh, black Swan Security and somebody 632 00:29:40,835 --> 00:29:45,995 who's going to actively make sure that your backup system is configured in the 633 00:29:45,995 --> 00:29:53,795 most secure way, all the way up to using a SaaS based data protection, so that, 634 00:29:53,885 --> 00:30:00,365 um, basically you put the security of the backups in the hands of, of a company 635 00:30:00,365 --> 00:30:02,045 who this is, this is what they do, 636 00:30:02,115 --> 00:30:02,265 But 637 00:30:02,435 --> 00:30:02,675 right. 638 00:30:02,685 --> 00:30:05,085 that they are a reliable, trusted 639 00:30:05,535 --> 00:30:08,385 company, not some random company off the side of the road. 640 00:30:08,595 --> 00:30:08,865 Yeah. 641 00:30:09,395 --> 00:30:09,755 Yeah. 642 00:30:09,815 --> 00:30:10,715 Trust but verify. 643 00:30:10,715 --> 00:30:11,315 Absolutely. 644 00:30:11,315 --> 00:30:11,615 Right. 645 00:30:12,005 --> 00:30:15,335 Um, and talk to them about, uh, what sort of penetration testing that they 646 00:30:15,335 --> 00:30:19,985 do and what, you know, how they conform to, um, you know, ask 'em if they 647 00:30:19,985 --> 00:30:23,495 have a passkey authentication and, and if they stare at you blankly, then 648 00:30:23,825 --> 00:30:24,935 maybe you should look somewhere else. 649 00:30:24,965 --> 00:30:25,295 Right. 650 00:30:25,865 --> 00:30:29,645 Um, talk to them about a lot of things like immutability 651 00:30:29,645 --> 00:30:30,755 and, you know, how, you know. 652 00:30:31,715 --> 00:30:33,785 Could, are you able to delete the backups? 653 00:30:33,785 --> 00:30:34,025 Right. 654 00:30:34,025 --> 00:30:36,155 You know, the, that whole thing we talked about in the last one, 655 00:30:36,155 --> 00:30:38,435 it, I'm, I stand by strongly. 656 00:30:38,435 --> 00:30:42,965 If you are able to delete the backups, then so can the bad guy, right? 657 00:30:42,965 --> 00:30:44,935 So, um, that's not something you want to do. 658 00:30:46,745 --> 00:30:50,795 All right, well, that's a quick list of some additional things in addition to the 659 00:30:50,795 --> 00:30:54,635 10 things that we talked about before, some additional things that you could do 660 00:30:54,635 --> 00:31:00,815 to take the, the specifically the security of the backup system up to the next level. 661 00:31:01,535 --> 00:31:03,585 Um, so thanks Prasanna. 662 00:31:03,605 --> 00:31:04,475 Thanks for having a chat. 663 00:31:04,730 --> 00:31:05,120 no, and 664 00:31:05,255 --> 00:31:07,595 Yeah, no, and thank you to the listeners who left their, 665 00:31:07,790 --> 00:31:08,210 This is 666 00:31:08,375 --> 00:31:11,435 this is why we do things, so please, if you want us to, 667 00:31:11,540 --> 00:31:11,870 you think 668 00:31:11,885 --> 00:31:15,035 if you think that we should be talking more about a specific topic. 669 00:31:15,170 --> 00:31:15,560 things, 670 00:31:15,740 --> 00:31:17,060 things, leave us a comment. 671 00:31:17,060 --> 00:31:18,590 We love to hear and we do respond. 672 00:31:19,070 --> 00:31:19,700 Absolutely. 673 00:31:19,910 --> 00:31:21,290 And we, and thank you very much. 674 00:31:21,290 --> 00:31:21,920 And thank you. 675 00:31:21,980 --> 00:31:25,940 Uh, you know, we have a new person who seems to have discovered our 676 00:31:25,940 --> 00:31:27,710 channel and is commenting a lot. 677 00:31:28,010 --> 00:31:33,980 Uh, and, uh, I, I app who, whoever you are, you don't have your real name. 678 00:31:34,010 --> 00:31:38,720 You have like CX something, some acronym, and so I don't know who you actually are. 679 00:31:39,095 --> 00:31:42,305 Uh, I do appreciate your comments, even if you disagree with stuff that, 680 00:31:42,545 --> 00:31:48,785 that, uh, we say, um, what I will say to everybody is don't be pushing your 681 00:31:48,785 --> 00:31:52,295 company's particular, um, product. 682 00:31:52,385 --> 00:31:52,775 Right. 683 00:31:52,835 --> 00:31:56,675 Uh, because I feel that I need to, um. 684 00:31:57,650 --> 00:31:59,570 I feel that I need to discuss that. 685 00:31:59,570 --> 00:32:03,440 If you're gonna make a claim about your company's product or the way 686 00:32:03,440 --> 00:32:07,430 your company does things, uh, we try, as you can see, hopefully. 687 00:32:07,430 --> 00:32:14,090 See, we try very much not to be pushing a particular product, uh, and more on the 688 00:32:14,480 --> 00:32:16,760 here's how to do things the right way. 689 00:32:17,180 --> 00:32:22,310 Um, and, uh, hopefully your product is able to do things the right way, right? 690 00:32:22,610 --> 00:32:24,890 Uh, and very rarely my opinion. 691 00:32:26,465 --> 00:32:30,905 The problem with your backup system is almost never software or hardware. 692 00:32:31,925 --> 00:32:35,195 It is almost always wetware, right? 693 00:32:35,525 --> 00:32:39,755 Um, the human is the weakest link, as we mentioned earlier, 694 00:32:39,965 --> 00:32:41,705 in every security chain. 695 00:32:42,065 --> 00:32:48,485 And, um, so while, yes, I'm sure some products have more interesting security 696 00:32:48,485 --> 00:32:51,080 features than others, um, you know. 697 00:32:52,010 --> 00:32:54,110 There's no, there's no perfect backup system. 698 00:32:54,410 --> 00:32:58,730 Um, and with a few exceptions, there's no really awful backup systems. 699 00:33:00,590 --> 00:33:02,630 So anyway, uh, thanks for listening folks. 700 00:33:02,780 --> 00:33:03,475 That is a wrap.