There could be a hacker working their way into your backup server right
now, not because your firewall failed, but because nobody ever even bothered
to change the password on the box.
Today, Prasanna and I sit down with Mike Saylor, uh, to talk about backup
security best practices, the stuff that most teams skip, mainly because
backups are invisible until they're not.
Uh, we're talking about things like default passwords on backup hardware,
service accounts that nobody's looking at, uh, admin logins at 2:00 in the
morning, and why passkeys beat MFA.
There's a real story in here about a red teamer who broke into a company through
their backup system and walked out the front door with the domain controller.
If this is your first time watching or listening to me, I'm
W. Curtis Preston, aka Mr. Backup.
I've been obsessing about backup, recovery, and now cyber
recovery for over 30 years.
If that's your bag, then I'm your guy.
You're not gonna find anyone that cares about this topic more than me.
Ever since 1993 when I had to tell my boss that there were no backups of
the database that we had just lost.
Now I've written five O'Reilly books, a blog, and a podcast.
Here we turn unappreciated admins into cyber recovery heroes.
This is the Backup Wrap Up.
Hey, welcome to the Backup Wrap Up.
I'm your host, Debbie Curtis Preston, and today I have my two besties with me.
We've got Prasanna, getting more gray hair every day, and Mike,
my fellow gray-haired enthusiast.
How's it going, Mike?
It's going great.
Thanks for having me, and good to catch up with you guys
Yeah,
have a question, Curtis
What's that?
Is it better to have natural gray or is it better to dye your hair?
That's always been, like, the constant debate, and I think men typically
don't dye versus women, right?
I'm just going.
All
That's probably generalization
Prasanna.
Two little stories on, to answer that question.
clearly I've gone with natural, clearly.
and there was a minute there where I tried, some, like the kind that
is just supposed to subtly dye your hair, before I went completely gray.
And I did it, and my wife didn't even notice.
So I was like, then, what's even the point?" And then the other thing was
I was talking to her one day and I was like, my wife is Filipino for those
that don't know, and I said, one good thing about Filipino, you guys, like
your hair like stays black forever."
And she looked at me and she goes, know we dye it, right?"
It's like, "No, I had no idea."
Oh, Curtis.
typical dude.
Anyway.
All right.
So we are back to our, series, of, g- basically working through our new book,
that, Mike and I came out with, which is Learning Ransomware Response and Recovery.
For those of you watching on YouTube, you can see a giant version
of that over my shoulder there.
And, if you're not checking us out on YouTube, you should
definitely check out our channel.
And of course, we also have the shorts version.
we do 30 second to a minute and a half short clips, which are doing really well.
and we get a lot of, get a lot of, commentary on them.
sometimes, not good, but sometimes people have no problem with, expressing
their opinion, to a random stranger on the internet because they're generally
people that don't, know who we are.
And, so they're just, they just see me making a random claim and, and then
they wanna argue with me, which is fine.
You want discussion?
Yeah
yeah, more interaction, And, any comment, even if the comment is, "You're a
freaking idiot," it builds engagement.
So comments are good.
but today,
co-host has amazing hair
yeah.
Yeah, I-- we did
You talking about me?
Yeah.
sorry
We did get a, we did get a comment about your hair is gorgeous.
and I knew he was talking about you.
but, speaking of the book, there is a, there's a quote in there from one of our
podcast guests, which was Duane Lafleur.
Duane is a, he's a red team person, right?
he hacks companies on purpose for, as requested by the companies.
I once again will mention the movie Sneakers.
If you haven't seen it, go watch it.
it's not, obviously it- it's movies, but it does a pretty good job
of showing what, red teaming is.
And, and there's a few late great actors in there, specifically, Robert Redford.
y-
IP
great just, yeah.
but, it, Duane's, Duane talked about how he loved backups, except
not for the reason I love backups.
And that was he loved them because, one of the things that we talk about a lot
is that backups, because of what they are, where, you're either invisible
or you're in trouble, because of what they are, they often go, ignored from
a cybersecurity perspective, right?
For a couple of reasons.
One is nobody wants to, get their hands in there because once you
start sticking around in the backups, somebody might ask you actually
to be the backup person, right?
And so there's that, and then because of that, it's often the junior person.
So you have the junior person running backups, and the junior person is the one
who knows the least about cybersecurity.
And today we're gonna talk about things that you need to be doing to
your backup system, and specifically we're gonna talk about accounts
today that are around all the time.
We're gonna talk about service accounts, we're gonna talk about passwords.
And he talked about, where he was able to penetrate a system, a company via their
backup system because what he did was he used some lackadaisical security to, take
control of the backup system and then used that control to restore, the backup
server to a, com- the storage completely outside of the company's, firewall.
It was a backup of the domain controller that he restored to outside of this,
their world where he then had complete control over that server and he was able
to extract all kinds of information.
And this is the kind of thing that we talk about a lot in the book where
it's like your backup server, only does it need to be protected because
you need it for recovery when you get hit from, a ransomware, but also
because it is an exfiltration Source, a potential exfiltration source.
And so there are unfortunately a lot of default passwords.
This is one of the things we're gonna talk about.
There's a lot of default passwords that are in, especially I'm
gonna say backup hardware.
there are some default passwords in some of the backup software, but
I think it's less of a, a problem.
But, so that's what we're gonna talk about in this episode.
Prasanna, it sounded like you, you had
I had a question.
Yeah.
I know you were just talking about default passwords, but I don't think
it applies only for the backup space.
I don't know if you've seen all the issues people have had with network
routers being compromised, being used as botnets for attacks in other places
or as resident, residential proxies.
But all of this stems from, people not changing the default password
when they buy a router, right?
You go buy a wireless access point and you are like, "Oh, I'll just
leave the defaults as it is."
Yeah, agreed
Everything that we're gonna say in this episode would also apply to any other
network or storage infrastructure, except that this podcast isn't called
The Network Schnetwork, it's called The Backup Wrap-Up, and so we're
gonna focus on the backup systems.
But yeah, Prasanna, you're completely, correct that, that there are a lot of,
default passwords out there, especially on network equipment that, the good news
is, at least with network equipment, there are people that actually want to
be network admins, and so they actually study it, and they tend to be, they often
tend to be cybersecurity leaning, and so they tend to be a little better at
doing this, although clearly not perfect.
Or have been doing it for a longer amount of time than the backup admins have been
Mike, the first thing I wanna talk about is this idea of service accounts.
and w- that they're invisible, that they're this thing that's
happening and it's a thing that you can then use to, to, attack things.
You wanna talk about what service accounts are?
About the service accounts Yeah the funny thing about service accounts a lot of
times when we red team an organization even the security services that you're
running are susceptible to compromise So a lot of times we take advantage of
like the antimalware service account or like a Qualys vulnerability scanner It's
a service account that's got privileges it's not protected they're assuming the
endpoint is protected And so when you compromise that account now you have
privilege across all of the endpoints where that agent or service is deployed
it is often overlooked and it's overlooked for a couple of reasons One typically
when you deploy a technology that requires a service account you give it privilege
cause you want it to work shortest path to getting things operational we don't have
to troubleshoot restricted access Just give it all the access and it'll work And
then we'll we'll pull the access back as needed but they forget that part or often
it's overlooked or we ran out of time or we ran out of budget or we've got this
other fire that came up we need to go put out and it just gets pushed off the plate
Mike,
and yeah it's very
and Mike, just real quickly, could you help y- listeners who may not
know, like what is a service account?
Because maybe not everyone is familiar with that aspect
they take a couple of different flavors The the probably the most common one
is just it's just a it's like another user account on the network So there's
mikecompanycom and then there's backupagentcompanycom so it's another
user account in the network and you just you have to know the credentials to log
into it and use it Sometimes that's just filed away somewhere in a password vault
or somebody's desk and you don't have to log into it because once it's running it
just runs until you need to make a change
and some of those accounts, Mike, some of those accounts, if they're created
by the backup software itself, they could indeed have like default passwords
that the backup software, put in there.
Certainly and that lead that leads it to the next type and that's more of an
agentbased software So you install a piece of software on the computer it has its own
credentials and you authenticate it back to a console like your backup console your
antivirus console and it just it runs on that that endpoint with those credentials
and often back to the initial comment often it's a privileged privileged account
Yeah, because if you think about backups, in order for backups to do their job,
they have to have superuser access.
They have to be able to access all files in order to both, first to be able to
res- to back them up, but also, just as importantly, to be able to restore them.
You have to have write-level access to all the accounts, and that does bring me back.
I'll pick on, what back in the day was my favorite product was NetBackup,
and, they had a tool called BPGP.
they did, I do, I did find out they definitely eventually, got rid of this
tool, but, it was originally called BPCP.
BP was the Backup Plus, the original name of the product.
And if you were on the backup server, you could use BPCP to read or write any
file transfer from any file from any client where that daemon, was running.
and so it ju- it just made it really easy.
even with the software, with most backup software products, you can use
the software to back up a file, then restore it locally, but BPCP made it
possible to just do it in one step.
and that just gives you an idea of the kind of thing that
you could do if you have this.
Certainly and if I could add two two comments real quick One since you brought
it up is it pronounced demon or daemon
I say demon,
I say Damon.
you do you're backup guy
Yeah
yeah, it is spelled daemon.
I don't know.
by the way, it's also pronounced L- Linux, based on the fact that it came from Linus
I will never pronounce it
I will never pronounce it that way either, but it is based on the name
of the guy who wrote it initially, whose name is pronounced Linus.
whatever.
Anyway,
the last thing I'll add the last thing I'll add on default passwords there
there's another problem or a a a variation of the default password situation and
that's coincidental password So maybe the password has been changed but
it's the same password that's used for a lot of other things So this admin
account password is the same as that admin password But then also when you
get to managed service providers so maybe you outsource IT management that
IT management company may be using the same backup password for your
environment that as the same password they're using at another company's
environment
my head to think of that
world very similarly bad guys are looking for the shortest path with the least
with the most value So if I'm gonna steal if I know to look for backups
and that's where all the data is gonna look at managed service providers cause
that's where all the passwords are
Yeah.
So if I compromise one managed service provider I likely have
access to many client environments
a thing, this was several years ago, but there was a dentist
Post office, yeah
that they hacked the MSP, and as a result they were able to hack,
hundreds of dentists around the country
That's right
So for the service account, Mike's, because when it gets deployed to
your environment, you're going to have multiple agents deployed across
all of these systems in order to be able to back up and restore them.
Are each of these service accounts across all of the individual machines
uniquely protect- or do they have unique passwords, or is it typically
a single service account which might be local to a particular machine might
share a common password with another service account on a different machine?
Typically and I would say typically putting that in the 90 percentile range
the passwords are the same I think there are some highly regulated and
possibly highly more secure environments where you could assign unique passwords
but that's definitely the exception
more management, more complexity, all the rest of that
For sure
For
so it's bad enough if we, are able to compromise a single account.
what then, let's talk about privilege escalation, Mike.
what is privilege escalation and what could someone do, once they achieve that?
So privilege escalation is taking whatever access you you're able to gain
at whatever level normal user guest super user admin global admin and get to that
next level and sometimes we talk about privilege escalation but sometimes you can
actually justify demotion for a particular objective so maybe I wanna pretend I'm
Curtis So I'm global admin I have that ability I can now give myself access to
a a demoted account like Curtis normal user in order to use Curtis's identity
to achieve whatever but the promotion part or the escalation part is I am
Curtis and I wanna be an admin so I'm using Curtis's local permissions on his
computer or his network permissions to find and recon is always the first phase
Find those service accounts find those accounts that have default passwords
and then escalate to that and that whether that's straight to admin or an
administrative privileged account or some series of stepping stones to get there
the thing from a backup perspective that I want people to understand is that almost
every backup software product that I worked with has the idea of a pre and a
post script, So if you can put a script in the appropriate place, the backup
software will run that script as the privileged account that backup runs at.
So if you basically create a script, it creates a user that gives you the
permission that you want, the backup, and put it in the right place, backup will
then use that, will run that script for you, and then you can put in the script
to clean up, behind yourself, right?
So this is just something you need to be aware of.
You should be looking for these scripts, that you should be checking if there
aren't any of these scripts, you should be looking to make sure that
they don't magically appear, right?
and then also if you are using these scripts, you should make sure that
the, that they don't, change on you
Do you know, Curtis or Mike, if any of these backup systems actually look
to see if a script has been changed, like outside… I'm just imagining
a case that someone goes, like a script is defined, a pre-script.
They go behind the scenes to the file system.
They change the script.
They haven't changed the name of it, right?
But is there any backup software that actually does like a verification
to ensure that like a script has not changed between when the admin
actually configured it versus now?
Yeah.
I, I don't, I certainly don't know of any that do that.
But I tell you what, we've got a lot of listeners, and a lot
of them are vendor, people.
So I… If you're aware of a product that does do that, that checks the
scripts that, you know, that… It would be… What would be really nice
is to make sure that the first time a new script is run, it, we send up
some authentication and say, "Hey, is this what you intended to do?" and you
do four eyes, authentication, which is where you have to have two people,
to authenticate That would be nice.
It would also be nice to do what you're suggesting, which is, checking
to make sure that the script that we're running is the same as this.
You could do that by fingerprinting and all that kind of stuff.
But, so this is just something to look into.
and then, let's talk about… What?
Go ahead.
real real quick on that I yeah I'm not familiar with a backup solution that does
that but there are thirdparty tools that do file integrity monitoring so they'll
look for changes in the hash changes in the configuration Tripwire used to do that
I don't know what they're called today But then a lot of security monitoring
tools you can point at an object whether that's a file or a folder or metadata and
it'll alert you when something changes
because all those, the, the ones that I'm aware of, the, would put the script
in a particular predictable place.
and, and so you could monitor for that.
So let's talk about something that I talk a lot about, Mike, and that
is this idea that the backup system should not share any, credentials with
the production environment, right?
that we don't put it in the, Active Directory domain, for example.
why is that the case?
Well which it just it goes back to that idea or the concept of putting as many
layers of security and obfuscation and really just extra effort as you can to
not only deter and potentially hinder but also give you time to identify when
weird things are happening So for example if you've got your backup your backup
system on a separate network like a like a management network so all your servers
you'd have two two network interfaces one for production and one for backup and
management all day long your production network interface is just super busy
and it's dynamic there's just tons of activity and you that's needle in a hayst
needle in a haystack looking for bad actors But on your management interface
that's like you can baseline that You know exactly what's going on there when to
expect backups what bandwidth looks like connections and all those things So much
less dynamic traffic on that interface and much easier to identify when weird things
are happening So there's that then on the Active Directory side let's just take the
example that you brought up where a bad guy was able to to get a copy of a domain
controller then the domain controller has all the privileged accounts and some of
those are you just have to have like your global admin and Office 365 exchange admin
All those things are in your normal Active Directory and they need to be but some of
these others like your backup admin maybe your your cybersecurity tools some of
those other things recovery accounts So if someone does compromise your
domain you've got this other interface with separate credentials that you
might be able to re reacquire some of those servers or part of your network
Yeah, I li- I like that separate network.
I've always been a fan of the separate network, for backup traffic, more
so back when that really meant that the backup system could get
a predictable amount of bandwidth.
But now, And what's really nice about it now is that we can do this, this is
part of infrastructure as code, right?
That you can just literally, as you're creating your VMs, in the cloud, you
can create them this way, and you say, "All backup traffic goes through
this, port, and production traffic goes through that port." Prasanna,
actually see that in production today, Mike?
oh,
I wonder if a lot of this like sort of… 'Cause I know like ideally,
it is best practice to have like separate management network, backup
network, and production network.
But that's also like time-consuming to set up and manage over time and everything
else, And also in the world of virtual machines where it could be easier,
but it's also still a bit of a pain.
And so are you actually seeing people continue to have these like
isolated networks that they use?
I haven't seen any new ones A lot of the ones that are out there have been there
for a while mostly in telecom And y your backup strategy your management strategy's
gonna drive that architecture in the environments where I've seen the separate
interface their backup jobs were huge and even having the separate interface
and better bandwidth they still struggled with backup jobs completing before the
next business day so that was primarily the driver for the strategy for those
organizations is how do we make our backup strategy effective instead of thinking we
need a new strategy and then probably more recently today they're all mostly VLANs
instead of physical network interfaces
Yeah, that's a good point.
do you wanna, just cover what a VLAN is real quick for those
that are not familiar with that?
Yeah So a a VLAN is j it's a virtual network but it's run off of one appliance
And so if you think about a a switch with let's just 32 16 32 ports that you
would plug in your network cables to when you log into that that switch the
interface for that allows you to assign or create these virtual networks so that
network jack Ethernet jack one through six is VLAN one now you can create access
lists and restrictions whether it's computer in VLAN one cannot talk to any
other computers and vice versa so it's isolated but you can also restrict the
type of traffic we don't allow people in VLAN one to receive internet traffic we
restrict that both normal HTML and the encrypted 443 ports and those protocols
You can do a lot with VLANs from a a another layer of network management
and security And then a computer a a server again if you had two network
interfaces or even a virtual network interface now that we're talking about
virtual machines you can connect that one computer to one to many virtual networks
through through that VLaning switch
is a way we can segregate the traffic even though we only have one actual interface.
Right
about most consumer Wi-Fi devices or routers these days, right?
You have a guest network and you have your normal, right?
And that is a form of s- network segregation.
I'm sure they're using VLANs or something under the covers as well.
All right.
So let's just talk about, let's review, the basically the things that people
can do, to help with this problem.
and the first one I'm gonna talk about is the easy one, which is go look for and
change all the default passwords, right?
think about all of these backup, especially backup service accounts.
Prasanna, you mentioned network infrastructure.
I'd say storage infrastructure.
servers don't tend to have, 'cause unless it's a, an appliance
server that you bought, they don't tend to have default passwords.
Although I suppose like a, particular distribution might have that.
any other default passwords, Mike, that you can think of that people
should go be look, looking to change?
Just about anything comes with a default password whether it's blank or password
admin or the name of the product and there there may also be a support account so if
you need help you're gonna call a number or get on a website and they're gonna
be able to remote connect in using their support account My recommendation to all
of those support situations turn it off until you need help Don't just leave it
on cause those are just like home security systems you A contractor now it's not
even the company that installs it now they hire contractors that come out and
install your home security system and the default you know key or password is 1111
or what have you And you can put in your new code 1234 But unless you delete or
disable the original code it's still there
Yeah,
But it… One, one thing though.
So I have a sprawling enterprise network, right?
With a whole bunch of devices.
How am I supposed to figure out, what has default passwords and what doesn't?
is there a tool out there that can ki- that can look across my entire
network and they say, "Hey, this is the type of device you have.
Okay, let me try its default"?
A vulnerability scanner like like Nessus You can you can You There's an open source
version of Nessus it doesn't have all the bells and whistles but it's good enough
Yep.
Spell that, Mike
make sure you read the NESSUS Nessus make sure you read the manual or watch
some some YouTube videos before you run it cause it can it can be disruptive if
you don't configure it well But there are plugins for or switches to turn
on to test for default passwords and there's other So those are traditional
network devices like switches routers servers some software and then for OT
operational technology related hardware like SCADA devices and thermostats and
printers and smart boards there are other tools that are more current on
configurations and passwords for those
Yeah.
to go back to your support account, I can, give a shout-out to Rubrik here.
One of the things I know, and maybe there's other products that do this,
but I just know in, in the case of Rubrik, they're not able to connect
from the outside to the support account.
They require you to do an SSH tunnel.
the, the server is set up or the, the appliance is set up in such a way that
you can't connect to the outside on that account, and it would be… If
it's possible for you to do that, And by the way, if you guys are aware of
other backup software or backup hardware products that, that do that same
concept, I like that as well, that the account is set up in such a way that you
cannot connect to it from the outside.
the, I like that a lot.
another thing… Go ahead.
What's that?
that thought and enhancing my previous comment about turning stuff off when you
don't need it that includes publicfacing services so if a vendor does need to SSH
or VPN in to address help you address a problem those services should only be
enabled and turned on when they're needed
Agreed.
not just all
Agreed.
Especially my favorite service, RDP, the, the
Ransomware Deployment Protocol.
Two two other things I'd like to add
sure
is one of the other situations that we run into a lot is backup admin is running
daytoday operations as backup admin So he's checking his email he's surfing the
internet and that's the admin account And so good best practice is Bob backup admin
has a b a normal Bob account that's not an admin and that's what he's doing daytoday
stuff in and then he's gotta log into Bob the backup admin to do backup admin stuff
Like
That's painful, Mike.
And then the last thing I'll mention because if this happened your your
red team example earlier would have been more difficult if not preventable
encrypt your backups and have different credentials for the decryption part
Yeah.
Agreed.
Now, in the case of this particular red team, he was able to actually take control
of the backup server, and so encryption doesn't help at that point, right?
he didn't steal backups, he stole the back- he stole the backup server, right?
and I think that's a mi a a common misconception for people that
think my data's encrypted it's only encrypted when you're not using it
Right
you can't work on encrypted data We're not that smart
yeah, by the
when you log in or authenticate to a system that's encrypted it becomes
unencrypted so that you can use it
By the way, along the same lines as, admin also, if your account, if
your admin account doesn't need to be named admin, change that, right?
Again, don't make it the default username and the default password, right?
admin?
yeah, admin, yeah, exactly.
and then we can also just talk about just hardening everything, but
especially the management plane and especially backup stuff, and that is
if you're not using either MFA or, pass keys on your, security infrastructure
and your backup infrastructure, it's time to do that, right?
Prasanna, you wanna remind us what MFA is and why we care?
Yeah.
MFA is multi-factor authentication.
So you see this everywhere, right?
It's like you log in using your password and it's "Please
touch your keypad," right?
The biometric sensor in order to know it's you or look at the face
ID so it knows it's you, and so this way you have multiple ways to
authenticate that it's just you.
It's not just the password you know, but it's also, who you are.
And so that's multi-factor authentication.
Passkey is, I don't know what I would call it.
It's like passwords on steroids because you don't really need to
know the password anymore, right?
It's the ability to tie a particular device to a particular website such that
you no longer necessarily need to use a password whenever you are accessing that.
It's tied… And once again, it uses sort of MFA or, biometrics
in order to do the initial establishing of the authentication.
But after that, it's automatic.
Yeah, so you
How'd I do?
yourself to the device and the device authe- authenticates itself.
Mike, just curious, one thing I've noticed lately has been random
companies that I interface with and they've done away with passwords,
but they've replaced it with, "We're going to email you a one-time code."
And I'm like, "This isn't better." w- your thoughts on that?
No I agree given enough reconnaissance and time bad guys are gonna figure that
out for that organization And if it also depends on whether are you emailing it to
my personal account Are you emailing it to my work account are you requiring me to
go set up a new account like that I don't use for anything else there's ways of
doing that and each one of them have pros and cons but long story short MFA really
needs to be a wwhat would be considered outofbounds communication so not normal so
like a an authenticator app on your phone is probably the better So you've gotta
Yeah
and set it up with layers also So my authenticator app requires a PIN to get
into the authenticator app in order to get the code to use as MFA to get into
whatever site But preempting all of that making sure that policy does not allow
me to bypass MFA because I now trust this device or remember me or any of those
other things that would then store an MFA token in a browser or on this computer to
be trusted again in the future MFA has to happen every time in order to be effective
again, Mike, I, I so often learn random stuff from you that, and this is the one
today, and that is I didn't know the, my, my particular authenticator app does not
require a pin, and I like that idea a lot.
I'm gonna go check to see if it supports it, and then perhaps
I just haven't turned it on.
Similar to back in the day when you talked about having a separate browser
for, or a separate browser session, and the way I did it was I take my accounts
that matter, and I run it on a completely different browser, and then I t- I use
Chrome as my, regular browser, and then I use a different browser for that stuff.
And I actually installed a Chrome plugin that if I go to any of those accounts that
matter, it says, "Hey, you're not supposed to be over here. You're supposed to be
over there in the other place," right?
So I love it when I… I've been
Learn tidbits.
it when I learn st- stuff new.
th- this particular old dog, new tricks.
What was that, Mike?
similar to your plugin, on the company network, if you've-- if
you're diligent about making sure that your admins are using the admin
account only when they're doing admin stuff, you can monitor, like alert.
Every time an admin logs in, someone should know.
It gets logged, and then over time, you've got a baseline.
Like admins, 99% of the time, they're only logging into the admin account
Monday through Friday, eight to five, maybe Saturday to do some work.
But so if you can baseline that activity along with having
visibility into it, again, you can start to look for anomalies.
Someone, admin logged in at 2:00 a.m., we should call the admin
and see if that's really them.
And that's, if it's a one-off thing, then that's, that's easy to manage.
then on the audit or even incident response side, if you're looking
backwards about, in, in time for activity about an, an admin account, you
should be able to tie admin logged in.
is there a ticket associated with that?
was there a, a change in the backup system?
Was there a break fix, a new install, a new config?
Is there a ticket for that?
So that goes back to general controls and are we actually doing, these good,
am I following the change management or patch management policy or what have you?
so from an audit perspective, there's that.
then incident response also, if it's an admin and we're logging those activities,
that's gonna help us build the picture for how this happened and when it happened and
Yeah,
all that
and you can also, a very common thing to do is to prevent the ability to log in
directly as the, the admin account, right?
you can say, you can establish that.
You have to es- you have to start with establishing that as a policy, right?
And then there are technological things that you can do to simply
prevent a person from logging in, directly to the admin account.
They have to log in as themselves and then become the admin account.
and that even if you can't prevent it, you can, again,
like you said, monitor for that.
So if they, if somebody, if anybody does directly monitor into the admin
account, that's an event, right?
That you need to go research, which…
And maybe it's just your employee, it's 2:00 in the morning and they're half
asleep and they don't know what they're doing, but, maybe it's a, bad guy.
I had the opposite, situation go where we were seeing failed login attempts to
an admin account every Thursday morning.
And, we would escalate that to the client.
They would go look at it, they'd close the ticket, and, but
we wouldn't get any feedback.
But every Thursday morning, there were these failed admin account logins,
and it was because their admin was going through a tough patch and would
go get drunk every Wednesday night and come in Thursday morning and have
trouble remembering his password.
So eventually we heard the whole story, but, that's
Yeah, b- Curtis, one of the things you write, you talked about MFA
and passkeys at the beginning.
Yeah
Do you know of any backup systems that use passkeys?
I know that there are some that support it, yeah.
yeah.
and I think most… what some of them do is they outsource it to,
if you're gonna use an OTP, right?
You're gonna, you're gonna use something like Okta, right?
They're gonna use some sort of SSO, right?
Single sign-on package, and then they outsource it to that.
but I am aware of a handful that, that directly support passkeys, and this
is the thing, like if you're not, if you're not looking into passkeys now,
it's the best thing that's available, from a security perspective, from
a login pers- security perspective.
It's better than MFA.
if you're using MFA, we're actually gonna be doing, the, an upcoming
episode on we're gonna be talking about phishing-resistant MFA why that's a thing
and why you need it and, and what to do.
But again, you could just skip it and go straight to passkeys.
and that's a good thing.
right.
any final thoughts, Mike?
Be diligent, read the manual, change your passwords
There you go.
Prasanna
I got nothing, but I do miss our, podcast recordings, so looking
forward to the upcoming ones
Yeah.
It was, we took a little break there.
and, so hopefully the people are enjoying the, or did enjoy the, the
encore episodes that we put out.
There were some really good episodes in there, so I hope they enjoyed those.
and I'm glad that we're now, recording again.
all right, folks, thanks for listening.
You are why we do this.
That is a wrap
The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.
If you need backup or DR consulting, content generation, or expert witness
work, check out backupcentral.com.
You can also find links for my O'Reilly books on the same website.
Remember, this is an independent podcast, and any opinions that
you hear are those of the speaker and not necessarily an employer.
Thanks for listening