Do you know how hard Russian hackers are trying to get your info?
And a good MFA system is often all that stands in their way.
Today, Prasanna, Dr. Mike Saylor, and I dig into multi-factor
authentication and why old school MFA really isn't enough anymore.
We talk about how bad guys steal your session tokens and wear you down
with fake MFA requests, and why even better than MFA is FIDO2 and passkeys.
We cover a Google Workspace attack that ran undetected for over a
year, and hand you some simple steps that you can be doing right now.
If you're still letting important accounts sit there with no MFA, uh, I got a
name for that, and it's not a nice one.
If this is your first time watching or listening to me, I'm W.
Curtis Preston, AKA Mr. Backup, and I've been obsessing over backup recovery, and
now cyber recovery, for over 30 years.
If that's your bag, then I'm your guy.
You're not gonna find anyone that cares about this topic more than me.
Ever since 1993, when a database died and I didn't have any backups.
Uh, that was not a good day.
Now I've written five O'Reilly books, a blog, and a podcast.
Here we turn unappreciated admins into cyber recovery heroes.
This is the Backup Wrap Up
Hi, and welcome to the Backup Wrap Up.
I'm your host W. Curtis Preston, and today I have with me, my two best friends.
First off, let me just talk about the guy that's currently cooking
in his seat, Dr. Mike Saylor.
How… What's the temperature over there today, Mike?
today it's, I think it's close to just over 100.
we're, we're just getting ready and excited for tomorrow's 106
Ouch
just, that's just, and I shared with you, before the call, it's
also really hot here in, Oceanside.
It's 85, which is, for us is just really high.
I've never tried to cook an egg on my head, but tomorrow I might
And speaking of super hot, how's it going, Prasanna?
I'm good, Curtis.
Nice to see you again, Mike, and I hope you are not planning to
go anywhere outside tomorrow.
Just, like, stay indoors all day long
I've gotta drive to Houston.
I'll be on the road all day
At least air conditioning.
Yes, air-conditioned road travel
quick, completely unrelated story of driving to Houston.
I once had a, situation where I had a, I was flying American Airlines
and I was flying in and out of Houston, but via DFW of course, 'cause
that was American Airlines, right?
And I found myself in Dallas and I, tried to get American to say, "Hey, h- how about
I just hop on the second leg, instead of going all the way to, driving all the
way to Houston just to get on a plane just to come right back where I am at?"
And they go, "No, you gotta do it. You gotta do it or otherwise you're gonna pay
$755 or whatever." So I drove to Houston, and one mile south, or one mile shy of the
Houston Airport, I got a speeding ticket
Oh.
the time,
I really thought where this, this was gonna go is that you got off
the plane in Dallas and went, "Wow, this weather sucks." And then you
got to Houston and you went, "Oh, well maybe Dallas wasn't so bad."
Yeah, the, what I remember at the time was the, trooper, I don't know,
the, the, the cop, told me that, at the time Texas and California
didn't, share, computers or whatever.
And so he said, "You need to surrender your driver's license." And I was
like, "I'm going to the plane." I really don't remember the end of that
story, but I remember the cop took my license, and, somehow I got home.
so gotta love Texas.
anyway, and American Airlines for putting me in that position, and
me for speeding, but whatever.
It's not my fault.
Of course not,
Uh-huh.
Uh-huh
speaking of not my fault, we're gonna start, we're gonna talk about, we're
gonna talk about MFA, multi-factor authentication, and, I thought
you'd start, Prasanna, with a story that we covered not that long ago.
do you wanna talk about that?
Yeah.
So this was, I wanna say it was probably a month ago, maybe two months ago, where,
a bad actor was detected and shut down.
But what ended up happening is there was a software package that was used
mainly, I think, in medical and some of, like, the academics instances
called REDCap, and it basically is a database that allows you to do things.
Anyway, what ended up happening is there were vulnerable, vulnerable versions
of that database out there running, and people, bad actors were able to exploit
it and attack the older REDCap instances.
And then what they did is they just kind of waited around and saw people logging
in, and they somehow got credentials for the Google Workspace admin and kind
of then used that to log into Google Workspace as the admin and then set
up forwarding rules to forward pretty much all emails in the company or
in the institution to a random email address, and it was unmonitored, and
I think it was running for quite a while before they realized that it was
like over a year.
Yeah
yeah.
so this was a multi- multi-stage, it was a three-stage attack, right?
So the initial identification of the, vulnerable versions, which were
running in parallel with the newer versions, which is just bad, right?
and then, g- the credentials, and then using those credentials to log
into Gmail, and then using that to then do something else, which was
essentially exfiltration, right?
So is that, does that make it a four-stage?
I think that makes it a four-stage attack.
That is very, studious.
would that be the-
Yeah.
Could we also talk about the fact that they also made it such that if someone
tried to upgrade the RedCap instances, it would just redeploy the malware again
and just keep running over and over, and so you could never really fix it?
Good times.
are you impressed, Mike, with that, with that attack?
No.
it's, it's c- common progression of an attack and common creativity.
you know, they were, they were lucky because they found these vulnerable
systems that were out there and, and they were out there intentionally.
They, wanted these older systems out there to ensure usability and
accessibility from, you know, you know, the lowest common denominator.
so yeah, I'm not, not so impressed.
the same, same playbook that most, most bad guys are gonna follow, the,
the, the attack, you know, methodology.
just, they've, they've, they found a vulnerable system
and they took advantage of it
It's like going in and finding Windows XP systems out there.
Come on, if you're running Windows XP at this ti- date, right?
Yep.
some of the server versions, yeah
Could be, what was it?
Yeah, Windows XP.
But, that, that's really old, Windows XP.
Meantime, the compromise is less than 10 minutes if you plug it into the internet
I remember when, when, the, one of the most commonly exploited versions of
Windows Server was Windows Server 2000.
And, and I remember that we discovered this in 2013, and I remember saying
that it's a teenager at this point.
It's time for it to move out.
but, all right.
So old version's bad, but, let's talk about, Mike,
What does this have to do with MFA?
we're getting to the MFA.
So Mike, let's talk about, first why MFA is so important, right?
this is another story.
That story is if they simply had implemented MFA for their
Gmail instance, which by the way, I believe Gmail now requires.
Google Workspace
Google Workspace, requires MFA now, right?
I am… Every time I've set up, even if you don't do like the full MFA,
it's gonna require, you to v- verify who you are, all over the place.
But let's, Mike, I'd like to talk about the concept of social
engineering, which is a very common way that, the, the bad guys are using
phishing, to get, to get credentials.
So you want, you wanna talk about that?
What, what did we talk about that?
There's a lot of different ways.
So it's just, it's understanding your, your victim.
so doing your homework.
So, if you're gonna attack a particular organization or group or system
or you're gonna go research them.
what are their hobbies?
What, what does their social media footprint look like?
What does their credit look like?
What is, what kind of car do they drive?
Where do their kids go to school?
you're gonna find something out of all your research that
is common human interaction.
like, "Hey, my kid goes to school with your kid, and they gave me your email to
see if they could have a play date," or, "Timmy left his lunchbox," or something.
You know, that's, that's kind of, no, no pun intended, but elementary, but
that's, that's how you get people's first response, and that's really what you're
looking for, is that first response.
And in some cases, your social engineering, attack, y- you're
only, you only get one response, so sometimes you gotta be pretty good.
But at the same time, you know, statistically speaking, if your,
your target audience is large enough, statistically you've got
about a 20% or better success rate.
So if I send out a million email… Well, if I send out 10,000 emails, you know,
20% of 10,000 is still a good number.
I just need one, right?
In an organization, I just need one person to click on something that's gonna either
give me, harvest their credentials, or they are going to willingly give it to me.
Like, "Curtis, this is Mike from the IT department.
we have a new help desk, i- interface.
below is the link to automatically submit tickets or, or check on the
status of a, of, of a, of a help call.
here's our new 800 number.
it's gonna be great.
We're looking forward to improving service and, and solving your problems faster."
Mike, don't give people ideas, Mike
this is the old- this is one of the oldest ones, the help desk one.
But, you know, click here or, open this attachment to, to, for your
chance at winning one of 20 Starbucks gift cards for being the first one to
write a review on the IT department service, you know, level of service.
and you do.
And so, you know, maybe I've got a… Next, next thing that happens
is I've gotta enter my email address and log into the network.
Like, "Please verify your credentials so we know it's you and not, not your
kids or your neighbor." So it's, you know, email phishing is getting a user
to interact with the email in order to either automatically harvest or, prompt
them to provide, credentials because it looks legitimate or, or it appeals to
their humanity or, you know, I want my kid's lunchbox back or whatever it is
I remember one time, and, to this day I don't know if this was a successful
phishing attack or if this was a successful test of my ability to, or
inability to recognize a phishing attack.
When I worked at a former employer, they, they had some sort of incident
where we were given free, we were gonna get free credit monitoring for a while.
And right at that moment is when I got a, a contact from, "Hey, we're gonna,
sign up for your free credit monitoring.
All we need is what?
Your name, your birth date and your Social Security number." And I found
out that it was not, the company indeed that was contacting me.
But it was s- it was so expertly timed that I fell for it.
And to this day, I don't know if, I gave all my, the three pieces of
information that they want all in one go, or if it was just, them testing,
You… But here's a, here's a question for you, Curtis, and also Mike.
At this point, don't you just assume everyone has it out there?
Like, that information's just out there anyway?
Yeah, I kind of joke that I, I, I protect myself from identity
theft by maintaining bad credit.
I mean, you're- you've got access to my stuff, you just don't wanna use it
I like that.
by the way, it's technically not on topic, but I have all my
credit reports locked, right?
And that, I think that's a life, thing that everybody else should have, is
that, in the rare instances where you're actually opening new credit, you can
unlock it for 24 hours, do the thing, and, in fact, most of them allow you,
actually can just y- one of the choices is unlock for 24 hours just for that
situation, and that would at least stop those people, if they get access to that.
Just a note to my US listeners, all three credit reporting agencies
are required by law to allow you to freeze your credit report for free.
So I the, I can't recommend this strongly enough.
It's not technically related to the, um, to this situation, but
it's just something that a lot of people don't realize is there.
You log into Experian, Equifax, and transunion.com you know, get a
login if you don't already have one, log in, and then look for freeze.
You may have to look around for it.
Honestly, some of them really hide it.
But it is there, it's required by law, and then freeze it.
It does mean that when you apply for credit, you will get you will
get initially told, "Hey, you need to go unfreeze your report."
It's a minor inconvenience for the, hopefully, infrequent action of
you actually applying for new credit.
And this is a big identity theft thing that you can do.
I'd love to hear, for those of you are, that are from other countries, I'd
love to hear in the YouTube comments, uh, what you do in your country.
But so you just freeze it and it stays frozen.
And then some of them, and I prefer these, actually allow you to do a temporary
unfreeze, uh, or thaw, if you will.
I actually use the word a lock my c- uh, credit, uh, they actually have a credit
lock, and they will charge you for it.
It does exactly the same thing as a freeze.
And, and by the way, when you're logging into these pages, they all want you to
pay for a membership, but they all, they just immediately throw that in your face.
Just close that out to, These companies are already making enough off of you.
You don't need to, uh, sign up for a membership.
Um, signing up for a credit monitoring service, that's
an entirely different thing.
But anyway, so freeze your credit reports unless you are applying for credit.
And again, I'd love to hear comments from other listeners from other countries
and yeah, I agree, Prasanna, you just assume that all that stuff's out there.
but for the record, I do still have my Facebook birthday and my real birthday.
I don't wanna make it easy for them.
so all right.
So that, there's, so basically 'cause social engineering is just a, a
variety of tactics, as you said, to get people to, either directly give
you the information you're looking for or to get, or to, basically just
open the door in some way to develop a relationship in some way so that you
can then at some point eventually get the, the thing that you're looking for.
I can think of another, of a story that I saw Kevin Mitnick telling once where
he talked about, he, they had a way where they would in, they would find a person
of note in an, in, in an environment, and they would invite them to speak at
a conference, a non-existent conference.
and then they would say, we just need to do a quick Zoom interview with you prior
to the thing to talk about, whatever." And they give them a Zoom link, and it's
a bad Zoom link, and that link downloaded the, the, the dropper, to do the bad
thing, and then took them to Zoom.
so the person had no idea that anything had just happened, and they just, at
that point, they were just at, they were completely controlling their computer.
So yeah,
Yeah,
engineering, yeah.
What's that?
it's kinda like a s-spoof in the middle.
Yeah
bank, bank, bank account logins are the same way.
the most, the, the cl- the most recent one that I've seen that's pretty clever
is, you know, when, when you get a, a phishing email and you wanna report it
as phishing, know, there's the button at the top that says, "Report as phishing."
Yeah
Well, bad guys are sending phishing emails with the report
phishing button in the email.
So you, you know it's bad, it looks bad.
I'm gonna click the mu- button to report it as bad, but clicking that button is
the trigger for the malware in the email.
Oh, man
Yeah
Tell you what, man, that, that's just not good.
hang on.
Let me pull up my, All right.
let's talk about, Fido2, right?
do you wanna talk about what Fido Fast Identity Online
Well, there you go.
It's kinda like the one-time password stuff, but it's a little more permanent.
so strong, a, a good, a good FIDO, profile, and I think there's, there's
different versions of FIDO out now too.
in fact, I think it's called FIDO2.
the, the idea though is something more than, you know, just your
username and password, but also something outside of just an email
or a text message you would get.
Could you give examples, Mike?
Like based on what you just said, like what would that potentially encompass
Well, so traditional MFAs, you know, an SMS message or a
one-time password or, an email.
FIDO is, is true encrypted token.
you can install it on a, on your laptop or your phone, but it has to be paired,
so it's public and private keys.
So it's got a… Your, your public key's out there, so if I wanted to have a
communication with Prasanna, in order to encrypt that, you would get my public
key, I would get your public key, and then our private keys would match those up.
and those, those private keys are on our device.
so it's, it's kind of an old school asymmetric encryption approach that
they've just kind of put a new name on it and attached it to a new way
of talking and encrypting our stuff.
But it's, it's really re- it's, it's designed to be transactional instead
of like normal email communication.
It's, it's a, it's assigned to a authentication or a purchase or,
it's more transactional
When we get to the actual, action points or, acti- when we get to the actual ac-
action items, it's gonna be really simple.
So we just need to drive home the point here of why this is such a big deal.
and I think the ArcGIS story is another scary one where there was
an entire year that went by where they had control of something, and
that all started with what, Mike?
Well, the, the, the Flax Typhoon, and, and I think that's the, the case
we're talking about here, is actually the, the name of But the, the initial
identification of this particular attack was because of their botnet.
and so looking for vulnerable systems, looking for a way in, Flax Typhoon is
primarily a, an espionage campaign, s- so it's not so much access as it
is true information and, and, and more specifically government-level information.
So, pretty confident that Flax Typhoon is run by the Chinese government.
targets were primarily government organizations,
Taiwan, Asia, America, Canada.
the, the,
the initial compromise was VPNs and firewalls, vulnerabilities, web servers.
and then from there, that compromise allowed them to based on tools and
s- and software available to them, so living off the land, type of attack.
So, you know, PowerShell, Python, Sysinternals, RDP,
from one machine to the next.
one of the things that makes me smile about this, this particular campaign is,
is all of the fun cyber threat acronyms and, and code words, like Juicy Potato.
so,
Sweet potato
so, so many of the tools and, and techniques in, in, in Flax Typhoon were,
were pretty kind of… I, I don't know who came up with the words or the code names.
Mimikatz has been around for a while.
That's a good credential harvesting.
Anybody that hears Mimikatz knows it's, it's associated with,
with malware and cyber attacks.
But the privilege escalation tool that they used was called Juicy Potato.
and some of the web shells, like one of the web shells was called, China Chopper.
just so just some, some fun acronyms and, and, and terminology.
But, was actually big problem
at some, point, didn't they get access to an administrator, like
login again that, that again didn't seem to have any MFA on it?
they did, and some of those systems were like IoT devices, like cameras.
So if you remember back in the day, I'm talking, man, had to have
been almost 10 years ago or more, the Mirai, the Mirai, botnet.
Got it.
Yep
And so in Flax Typhoon, they w- their botnet was called Raptor Train.
and so the Raptor Train using the Mirai-type virus compromised hundreds of
thousands of IoT devices in this campaign.
And so that was cameras, routers, switches, network storage devices.
so that Mirai, i- you remember back, it, it, in that case, M- the Mirai
botnet was successful because some of the credentials for those devices were
hard-coded on the chips, and the, the manufacturer of those chips didn't care.
They're like, "I just produce chips.
It goes in something, I have no control over that." so very similarly, this
attack group and their botnet, were able to leverage hard-coded credentials to
get access to the device, and in some cases, it was root level device, access.
And
Oof
other cases, it got them on the device where they were then able to deploy
Mimikatz or use some of these other, available tools to, to harvest credentials
The way I would put all of that together is that the, the bad actors have a,
a seemingly infinite number of ways that they can harvest credentials.
We talked about phishing, we talked about using old versions of
software that have vulnerabilities, and we talked about just, botnets.
th- they just have a seemingly… and d- I think we pr- we've probably
just scratched the surface, Mike?
Of, a seemingly infinite,
Well, it is seemingly infinite, because we don't do… We don't
think like they do, and they do this 24 hours a day, seven days a week.
we only do it 8:00 to 5:00, Monday through Friday, a lot,
as, as a normal user, right?
and probably not the full eight hours.
We're, we're doing other stuff, or just not focused.
But yes, it is seemingly un- unending, and, and ever-evolving
ways of harvesting our credentials
Prasanna
have a question for you now.
Sure
So we've talked about all these scary ways that they're always gonna be
ahead of us, that we're never gonna be able to catch up because we don't have
the time or effort or expertise to be focused on securing things all the time.
S- so like, do we just like sort of call it quits, unplug
ourselves from the internet, and just go back to sticks and fire
that,
out in the-
that's a great question, Prasanna, but that is the only way to
have a truly system, right?
I think my point, and Mike, feel free to enhance this point, but my
point is you have to assume that the bad guys are going to get someone's
credentials in your environment.
And so the idea, this is the whole point of MFA, right?
The whole idea of MFA is that, that th- there is a seemingly limitless number
of ways, you know, that the bad guys can get, the other is, the, the purchasing
of the, the dumps, the credential dumps that are available online, right?
th- there's so many ways for them to get access to credentials that you are
committing, I'll say this again, you are committing professional malfeasance
if you are allowing access to important accounts without MFA turned on, right?
you're noticing this, and we're gonna go a little bit, it's, we're gonna
talk about phishing resistant MFA.
But you've noticed this happen in your personal life, Prasanna?
can you think of what's happened to you over the last, I wanna say
10 years with things like your bank, with things like Gmail, with
Oh, yeah, everything, yeah, everything's going multi-factor authentication, right?
It's you log in, it sends something, because now you also have phones, right?
And so everything gets sent to your phone where it's like, "Hey, did you try to log
in on this laptop? Accept or deny from your phone or some other device," right?
And so you see this happening because it's becoming easier, I guess.
Do you, do you think it's becoming easier to enforce MFA versus before?
Like I remember when I was working and you'd sort of walk around
with the little key fob, right?
With the rotating code, and that you always had to have it in order
to be able to log in, and if for some reason it wasn't there or
the battery died, you're screwed.
I think MFA has made it a little easier.
And so kind of over the last 10 years, like you're saying, yeah, I think
back then there was nothing, and now it's sort of become commonplace
now I think the difference bet- between back then and now is that we always
have this other thing on us now, right?
We always have our s- we should always have our smartphone with us,
Where's your phone, Curtis?
my phone is right here, sir. Thank you very
Okay.
and by the way my life is, I can't go anywhere without my phone.
My car runs from my phone, so as soon as I step… And which is perfect for me,
'cause I, I got serious, By the way, I've officially been diagnosed with ADHD now,
'cause I had to wait 60 years to find out, "Yeah, Curtis, you got ADHD." So the
fact that I can't leave the house without a phone, I get in my car, that means
I always have my phone with me, right?
'Cause otherwise I definitely would be the guy that's 40 miles away
and going, "Oh, crap, I left my phone back at my house," right?
but yeah, we have that device with us, and now we have a number of
pieces of software, commercial ones like the Symantec VIP, tool.
I know that a couple of my different vendors require that.
or, free versions from Google or Authy or, pr- Mike, you mentioned you use a- another
tool that, you mentioned that I think on, I don't know, a few recordings ago.
You use a, a, a completely different tool.
I don't remember what it was.
It doesn't matter.
But yeah, there are a number of tools.
and yes, there are also the truly secure ones are the, those things that, you
know, the, like the YubiKey, right?
The, that, that is a truly secure, one-time password thing that,
that isn't… the only downside to the phone is potentially somebody
could hack your phone, right?
So if you're seeing this happen in your personal life, and you're in your
professional life, and you're in and you care at all about cybersecurity, if
you've got important accounts that are just sitting there waiting for you to
just log in with no, other authentication, then again, professional malfeasance.
I don't wanna, call you nasty names, but don't know what el- I don't
know what else to say at that point.
Mike, let's talk a little bit about… I know this is something you've
talked about before multiple times.
We talk about this idea of killing the trust button, right?
this is something you talk a lot about.
You w- you wanna talk about that?
Sure.
I think a lot of organizations and a lot of systems and networks have
this inherent trust out in the world that, you know, we need to be able
to, we, we need to be accessible.
we want, Well, and, and there's a couple of reasons for that.
One is just making it easy so that I don't have to go do
custom rules or manage something.
and so that.
Well then, there's also a level of skill required for, in a lot of
cases, for implementing changes that, could filter or restrict access.
So it- it's just easy to, to leave the door open or the doors
unlocked or, or have fewer layers.
I see it a lot where organizations call and say, "Hey, I've got this problem.
I think someone's trying to get me- to me from Germany." I said, "Okay.
Well, we can look into that, but in the, in the meantime, do you guys care
about people from Germany hitting your network?" "No." Well, just block Germany.
Well, that's an easy problem.
It's solved.
then, you know, all right, so there's, there's website traffic,
there's network traffic, there's VPN traffic, there's cloud.
all of those things, and this goes back to, you know, how do
we, how do we better protect ourselves, whether it's MFA or not?
And, and it's, it's really about understanding the risk to us, us as
an individual, us as a, a company, then what kind of things can we put in
place to mitigate those risks, right?
So if, if we're concerned about people stealing our, our users'
credentials, what can we do to reduce the likelihood of that happening?
Well, we could really focus in on who should have the ability to log in.
So even if Curtis's were compromised, if he's logging in
from Germany, it won't work, right?
Right
Well then, all right, so we implement MFA so that… You know, Curtis figures
that out, so he compromises a, a machine in, in the US to log in from
the US, and now the credentials work, but he's being challenged with MFA.
he steals, he steals Prasanna's MFA token by phishing it, sending him a phishing m-
email that gets him to go to a website.
because he's already trusted in his browser, the website
scrapes that MFA token.
Now I have all three things, U- ID, password, MFA.
But I can configure my system to only allow one login, no concurrent logins.
Definitely no logins across, know, land speed travel distances.
so there's… I mean, there's tons of things you can do
You've
to mitigate all of this
before, right?
Right.
It just takes time and effort and skill and an understanding, and all
of that is great on the technical side until you implement it and then you
get your users going, "Well, that's too difficult, and I don't like that."
And so now you've got the political fight, and a lot of technical people
will give up on the political fight.
It's just like, you know what?
as you were talking… Oh.
it's not worth losing my job over
As you were talking through that last point, Mike, I was just thinking in my
head, I'm like, "Why do all products and companies just do this by default?" And
you hit on it at the very end, right?
It's like users are gonna complain.
There's gonna be friction in their experience.
They're not gonna like it, and then you're gonna get so many support tickets.
You're gonna be like, "Whoa, whoa, whoa, what do we do?
Let's go back to the old way."
Yep.
And so it, it comes down to a balance of security and usability from a, a technical
and controls perspective, and then a personal administrative, it's do I wanna,
do I wanna fight this battle or do I wanna live to, you know, work another day?
'cause I mean, your time's, your time's limited in either way, in either case,
but would you rather be fired because you, you tried to do something good, or you
got fired because you didn't do something good and the, the company was compromised
and you were fired for that reason?
Yeah
there's… I mean, it's a struggle
I think a place to start, I, the- I've seen that.
I've seen that where, and I've seen it in backups, right?
I've seen it where you're trying to do the thing and you get the group that's like,
"Ah, I don't wanna do the thing," right?
Whatever, whether it's, in my case, in backups, I go all the way back to
when I was that oil and gas company and, I was just trying to enable
backups for the first time this really big Oracle database, right?
that was really important.
It had never been backed up, and it involved me doing a couple of things
that the DBA was fighting me on.
I, I, it's in, in, it- I can't fathom the idea of having a m- a
valid system that isn't backed up and anybody being okay with that.
But still, that would happen.
The same thing happens in cybersecurity, right?
Ca- do you think it would be easier to at least, and perhaps more important to
start with administrative accounts, right?
privileged accounts, right?
It's, at first off it's a smaller number, and possibly it's a different group
of people that will have some better understanding of the importance of this.
does that sound like a good idea?
Absolutely.
You can, you can log and alert on, privileged account use, whether
it's an admin or a service account.
and all of that stuff should be tracked, both successful and failed
login attempts for privileged accounts
Now, the things that you suggested earlier, th- those all sounded great,
but they sounded complicated, right?
it sounds easy to turn off Germany.
It turns out easy to turn off Russia.
but the, some of the o- other stuff, it sounded like it starts to get complicated.
So my question is, you're like, it's not complicated for you, Mike," but I'm just
saying for maybe the aver- person, is
It's really not
are there tools that can help this be easier to do?
There's tons of tools, but then you've gotta go learn a tool.
a lot of, a lot of these, capabilities are built into stuff
you probably already pay for.
So your normal Windows machine, Windows 11 as an example, you've got a
firewall, you've got Windows Defender.
All that stuff comes with the, your Windows license.
watch a YouTube video on how to configure it to protect you better.
You'll learn, you'll learn everything you need to know in, like, 15 minutes, and
Could you…
walk you through it.
If you're an administrator in Office 365 as an example, there are hundreds of hours
of training videos for free that walk you through all this stuff step by step.
And if you don't wanna watch a video, it's all lined out in a nice Microsoft
document that'll s- take you through it, step one through whatever with links.
you click the link, and it takes you right into your admin console,
the exact right spot to do it.
there are tools in Office 365 that allow you to test.
Like, I wanna turn this on, let me test it make sure I don't, you know,
break the, break the environment.
pick a user.
Start with, start with your admin account
Yeah
So, so the, here's my biggest thing, like given it's 2026 and we're in
the age of AI, like why don't you just go ask like Claude or Gemini
or take your pick of AI assistant
even, even, more succinctly with Microsoft, you know what?
Buy a Copilot license, it's like $100 a year, and tell Copilot now
that you're the licensed- you're the admin and you've got a Copilot
license, ask Copilot to help you.
It has the same privileges that you do and can see all that stuff
I had a mission critical system that went down yesterday, right
at the very inopportune time.
You know what that was?
Your TV
Yeah.
My TV, stopped working just before we had invited a bunch of people over to
, watch the World Cup final, and I used AI.
I was like, I got three different pieces.
I got the Apple TV box, I got the soundbar, and it's going through the
soundbar up to the TV," and I hadn't used this particular TV in a while.
And, I d- just sat there, worked through.
I was like, "I got this,"… The- these are the brands of the
things I have, and Claude, just worked me through, fixing it, and
Yes, I've been replaced.
'Cause last time
I was d- done in a few minutes.
You b- By the
I helped you troubleshoot this, I remember.
I completely agree that, that is definitely, a, a great place to start.
because all of those phishing-resistant things that you talk about… And by
the way, d- let's just talk about, why isn't MFA by itself good enough?
Why can't we just turn on MFA?
And there are a bunch of reasons, right?
you talked about stealing session credentials.
That is a possibility, right?
other things are, the, the MFA exhaustion, right?
Which is something where, you just bombard the, you meaning the, the, the bad guy,
just bombard the person with so many inf- MFA requests that at some point they just
respond just to make it go away, which is a horrible response, but I think we
can agree that there's certain groups of people that would respond that way, right?
And that's why we have to add this extra logic behind MFA, to make
it more resistant to phishing.
there's still that, that usability and culture part behind it.
I mean, you talked about MFA exhaustion.
Do you have locking your house exhaustion?
Right?
You're gonna go back home because you forgot to lock the front door.
You care.
You have a responsibility.
MFA should, should be the same, if you're not requiring MFA every time they log in,
then you've diminished the value of it.
But then also on the back end, on the IT side, or the technical
side, there are controls for limiting the lifespan of MFA also.
So Mike's been logged in for 20 hours on the same MFA token.
That shouldn't l- you know, they should expire at some point,
The…
can configure that
Do you know if they, 'cause I know a lot of websites, right?
It's like you log into your bank and you enter and it's like, "Oh, remi-
reme- remember me for next time," so you don't get the MFA again.
Do you know, Mike, and that's like the exact opposite of
what you want, right, from MFA.
And so I guess the question I had is, Mike, in these tools that you were talking
about where you can set these policies, do you know if they also have that
ability to say, "Hey, by the way, never allow a user to say trust this device"?
Yeah, so that was a group policy you can push out.
So there's a couple things.
As a, as an IT administrator, I can restrict what browsers you can use.
I don't want you to use, Firefox, just as an example.
So you can only use Edge and Chrome, right?
So I-- there's, there… You can, you can push policies out like that, and
then within that policy and within MFA, you can, you can select never allow or
prohibit, you can prohibit users from saving, MFA credentials in browsers.
Yep.
And, and any other credentials.
You can prohibit them from saving credentials in, in the
Yeah
in general.
Yep.
My websites
Or credit, or payment
Explorer
Oops.
Netscape.
That's gave… Wow, you took us back there.
All right, MFA is really important.
and what… as long as we're talking about it, we'll just throw in passkeys is
actually, are actually better than MFA.
But, today we're talking about least have MFA, for goodness sakes.
And also, look into being more resistant to phishing, these extra
features that Mike talked about, to look for things like impossible travel.
how is he in both in San Diego and London all at the same time, right?
that's what they call impossible travel.
And why is he… i- if you can add some logic of like, why is he never
logs in at 3:00 in the morning.
Why is he logging in at 3:00 in the morning?
Perhaps, just add an extra level of security when weird things happen, right?
all right.
thanks, Prasanna and Mike, once again
It's always fun
Never enough time to say all I wanna say, but I'm glad I could contribute
Yeah, All right.
And thanks, to everyone out there listening.
you're why we do this.
That is a wrap
The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.
If you need backup or DR consulting, content generation, or expert witness
work, check out backupcentral.com.
You can also find links for my O'Reilly books on the same website.
Remember, this is an independent podcast, and any opinions that
you hear are those of the speaker and not necessarily an employer.
Thanks for listening