You found the backup wrap up your go-to podcast for all things
Speaker:backup recovery and cyber recovery.
Speaker:In this episode, we cover something that should be required listening for
Speaker:anybody responsible for protecting business data, the 10 essential features.
Speaker:Every backup system needs.
Speaker:There's way too many companies that think they have backups when they really don't.
Speaker:And by the way, when I say backup system, I mean the overall system,
Speaker:not just a computer system.
Speaker:Because many times, um, you know, backups are actually SaaS based
Speaker:and things like that, right?
Speaker:Remember, no one cares if you can backup only if you can restore.
Speaker:Let's make sure that your backup system has at least these 10 things
Speaker:that you need to get started.
Speaker:By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr.
Speaker:Backup, and I've been passionate about backup and recovery for over 30 years.
Speaker:Ever since I had to tell my boss there were no backups of the production
Speaker:database that we had just lost.
Speaker:I don't want that to happen to you, and that's why I do this.
Speaker:On this podcast, we turn unappreciated backup admins into cyber recovery heroes.
Speaker:This is the backup wrap up.
Speaker:Welcome to the show.
Speaker:Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy
Speaker:who remembers to wear this shirt that I'm supposed to be wearing.
Speaker:Prasanna, Molly, how's it going?
Speaker:Prana?
Speaker:Oh my gosh.
Speaker:Are you in my head?
Speaker:I literally was just thinking about that as I was looking.
Speaker:I was like, why does he
Speaker:I'm in your head.
Speaker:I'm in your head.
Speaker:Yeah, I, I, um, I, you know what?
Speaker:I'm not even sure I know where the shirt is.
Speaker:Oh,
Speaker:Um, I dunno if you know this, I can be a little bit disorganized sometimes.
Speaker:You really?
Speaker:I know that comes as a great surprise.
Speaker:But, um, we went through all this thing to get the shirts
Speaker:Uh, by the way, for the listeners, I was asking Curtis for four years
Speaker:Yeah,
Speaker:to get swag to print
Speaker:Yeah, we finally got his shirt.
Speaker:And he's wearing it.
Speaker:Both of us need to put our mic in a different place though, so that you're,
Speaker:see
Speaker:so that you don't cover up the Yeah.
Speaker:Um, by the way, no one has, no one has reached out to me for swag.
Speaker:Listeners, if you want t-shirts, if you want something, please reach
Speaker:out to Curtis and let him know because I would like some more swag.
Speaker:Yeah.
Speaker:Do a backup, wrap up socks.
Speaker:Yes.
Speaker:Actually I should say merch, not swag.
Speaker:Yeah.
Speaker:Merch.
Speaker:Yeah.
Speaker:Swag is, yeah, merch is, you gotta buy it.
Speaker:Yes.
Speaker:the difference.
Speaker:We're not giving away free stuff over here, people.
Speaker:Um, all right.
Speaker:We're gonna cover a lot in this episode, so we're gonna cover it pretty high level.
Speaker:Uh, but we're gonna talk about the 10 backup.
Speaker:Things that every business needs,
Speaker:Could we
Speaker:right?
Speaker:facts?
Speaker:What
Speaker:Fast facts.
Speaker:fast facts?
Speaker:Yeah, fast facts.
Speaker:The 10 backup things that every, uh, business needs.
Speaker:And the first one.
Speaker:3, 2, 1. The 3, 2, 1 rule, which we've already, which, yeah, which we covered
Speaker:in the last episode, which is now really the 3, 2, 1, 1 0 rule, right?
Speaker:Three copies of your backup, two different media, one of which is somewhere else,
Speaker:one of which is immutable and zero errors because you did validation, uh, which
Speaker:actually is gonna be another one of our, another one of our things, right?
Speaker:So if, if your backups don't conform at least to the 3, 2, 1 rule, then
Speaker:you know they're not really backups.
Speaker:Yeah, exactly right.
Speaker:Um, so the, the next thing is, uh, scheduled backups.
Speaker:So why, why does that matter?
Speaker:Prasanna?
Speaker:Well, if you aren't doing frequent backups or scheduled backups, then
Speaker:you're probably avoiding or skipping or don't have a backup you can
Speaker:restore from, and you're probably not meeting the needs of the business.
Speaker:So you wanted a
Speaker:schedule.
Speaker:You don't wanna have to go push a button, right?
Speaker:It should run automatically based on what you and the business have decided.
Speaker:Yeah, if you're not doing scheduled backups, you're not really doing backups.
Speaker:Right.
Speaker:Um, you know, you're, you're gonna, you're gonna have, you're
Speaker:gonna have to remember to do them.
Speaker:And so they should, they should just run right.
Speaker:Get, get humans out of the system as much as possible.
Speaker:So if you're not doing regularly scheduled backups, then again, I, I, I
Speaker:don't, I don't even know why we're here.
Speaker:Well, I, I think it's also important, automated is another key word there,
Speaker:Yeah.
Speaker:right?
Speaker:It should not be because I, for instance, do scheduled backups of my
Speaker:personal data, but it's me doing that manually every day or every month.
Speaker:That, that's actually a really good point, right?
Speaker:I'm glad you brought that up.
Speaker:It needs to be automatically scheduled backups right.
Speaker:Um, and, uh, yeah, this should happen.
Speaker:And when we talk about, um, uh, another thing that we need to be doing all the
Speaker:time, that is a little thing called, uh, recovery testing or backup testing,
Speaker:backup testing, or recovery testing.
Speaker:I guess the only reason, the only reason we back up is so we can restore.
Speaker:No, I, you know, I, I used to say a lot.
Speaker:No one cares if you can back up.
Speaker:They only care if you can restore.
Speaker:Yep, and you need to make sure you're doing your recovery testing
Speaker:because you don't know if that backup is going to be successfully
Speaker:restored when you actually need it.
Speaker:The only way you know ahead of time is you have to do your testing.
Speaker:You might have forgotten to do part of an application backup.
Speaker:You might have forgotten a piece of your infrastructure.
Speaker:You need to back up as well in order to successfully restore down the road.
Speaker:The only way you know is you do the testing ahead of time.
Speaker:Yeah, exactly.
Speaker:And um, you know, I can think, I can think back in the day when, um, I
Speaker:remember I was at a, uh, a large, uh.
Speaker:Cell phone manufacturing company, and we'd been bagging it for months.
Speaker:And then we went to go do a recovery test.
Speaker:Uh, we found out that the tape drives, uh, they weren't so good at reading,
Speaker:they just, they just knew how to write.
Speaker:Um, you know, you can't, unless you do the, the recovery testing,
Speaker:you're not gonna find that stuff out.
Speaker:Right.
Speaker:There's just, we, we could, we could, we could spend.
Speaker:Hours and hours and hours telling you stories of bad things that happened.
Speaker:When you don't do testing, you're, you're only going to find out, uh,
Speaker:you know the, what's wrong, right?
Speaker:think you did talk about this a few episodes ago, but your about
Speaker:how there was a new compression
Speaker:Yeah.
Speaker:The compression feature.
Speaker:Yeah.
Speaker:We didn't, yeah.
Speaker:never tested it, and your
Speaker:Yeah.
Speaker:from tape was slow.
Speaker:Yeah, it was ultra slow and ultimately we found out that it actually
Speaker:wouldn't even work because of the way that the feature, uh, worked.
Speaker:It was, it was assumptions made, um, that, that were just not true.
Speaker:yeah,
Speaker:It was a really bad design, but, uh, again, you're not gonna know that stuff
Speaker:until you actually do, uh, testing.
Speaker:So the next one is going back to what I talked about earlier about why you
Speaker:needed sort of automated schedules, backup schedules, is you need to
Speaker:also define your recovery objectives.
Speaker:Yeah.
Speaker:And do you wanna talk a little bit about that?
Speaker:Because I know people forget about this or they think, oh, as a backup
Speaker:admin, I'm responsible for this.
Speaker:But I think it's important to sort of like really talk about this.
Speaker:Yeah, this is one of those things where you cannot, you, you really
Speaker:cannot design a backup system.
Speaker:Without recovery objectives, right.
Speaker:I mean, you can, right?
Speaker:You can just, you can define, you know, but, but it's like, um, you,
Speaker:you, you really have to define the recovery objectives upfront.
Speaker:And if you don't define them upfront and you don't agree to them upfront, then you
Speaker:can't properly design the backup system.
Speaker:You.
Speaker:And, and, and so you end up sort of just doing what we always do, which is
Speaker:like, oh, we're gonna do, we're gonna do it and we're gonna recover every day.
Speaker:We're gonna bring, you know, gonna back up every day.
Speaker:We're gonna, we're gonna send it off site and we're gonna do the thing.
Speaker:And then you go to do the restore and then you, you, you, you go to do, um,
Speaker:the restore it and, and it works, but it fails from a perception standpoint.
Speaker:And that's because if you don't have recovery objectives.
Speaker:The, the recovery objectives that are in the mind of the bosses are going
Speaker:to be very different than the recovery objectives that are in your mind.
Speaker:You're like, Hey, this was awesome.
Speaker:The restore happened.
Speaker:Uh, it, you know, it, it only took, uh, eight hours and, you
Speaker:know, and, and it, and it succeeded and we restored all the data.
Speaker:And you're like, you're feeling, you know, hunky dory and then the bosses
Speaker:are chewing you out because they thought it was gonna take an hour.
Speaker:Yeah.
Speaker:And I think one other thing I want to touch on is as a backup
Speaker:admin, I the one who's coming up with these recovery objectives, or
Speaker:New.
Speaker:Yeah, good point.
Speaker:Yeah.
Speaker:The, it needs to come from the business, right?
Speaker:Any of this, these SLAs, recovery objectives, need
Speaker:to start with the business.
Speaker:We want, we, we don't wanna lose any data and we don't wanna lose any time, right?
Speaker:So that's, that's where we always start, right?
Speaker:A RTO and an RPO of of zero.
Speaker:That's recovery time objective and, and recovery point objective of zero.
Speaker:And then you need to walk that back based on, okay, you can have an RTO and RPO of
Speaker:zero, it's gonna cost you $50 billion.
Speaker:Uh, and then, you know, and then they walk it back, right?
Speaker:So you, again, you, this is about setting expectations.
Speaker:And also using those, those objectives to both define and design the backup
Speaker:system, but also to pay for it,
Speaker:Yeah,
Speaker:right?
Speaker:Because, um, you know, it, it, uh,
Speaker:it's really hard to get money for backups.
Speaker:and we talked about this I think like three episodes ago.
Speaker:Yes, we did.
Speaker:Yes, we did.
Speaker:Um, so the next is about isolating, uh, you know, backups
Speaker:from a security perspective.
Speaker:And we did just talk about this with the 3 2, 1, 1 0 episode.
Speaker:We talked about immutable backups.
Speaker:Uh, there there is a term that we didn't talk about, which is another
Speaker:really important term when we talk about, uh, isolating backups.
Speaker:You know what that term is, right?
Speaker:The
Speaker:least privilege.
Speaker:Access
Speaker:No,
Speaker:patch management.
Speaker:no.
Speaker:MFA.
Speaker:Keeping back up secure.
Speaker:Oh
Speaker:I know it there.
Speaker:There's like eight, 800 things you could be choosing.
Speaker:Air gap.
Speaker:Yeah.
Speaker:But of course, and, and again and again, air gap backups, we can't really
Speaker:have air gap backups it in the truest sense, uh, because that technically
Speaker:means that it's offline and it's, it's, there is literally a gap of air.
Speaker:There is no connectivity from A to B.
Speaker:Uh, you can't really have that with modern backup and recovery design,
Speaker:but you can just have, you can.
Speaker:Approximate it as much as you can.
Speaker:Right?
Speaker:Again, just realize that from a cyber cybersecurity perspective, um, that
Speaker:the threat actors are immediately gonna go after your backups, right?
Speaker:And so you gotta separate them.
Speaker:I.
Speaker:So I was also thinking when you brought up this, uh, topic, was
Speaker:thinking from sort of separating out, I know we talked about, active
Speaker:directory, so sort of having something separate from a backup perspective
Speaker:Yep.
Speaker:as network isolation if needed.
Speaker:So you're isolating your backup traffic from your production
Speaker:traffic, just keeping it isolated, walled off from everything else.
Speaker:So if something happens on your production network, it's not easy
Speaker:to get into your backup network.
Speaker:Yeah, and the thing you mentioned earlier, uh, and your incorrect
Speaker:answer to my question, it's, um, least, least privilege, right?
Speaker:Using the concept of least privilege, give, giving each person the, the,
Speaker:the absolute least, least amount of privilege that they need in order to
Speaker:do their job in the backup system.
Speaker:Uh, and then isolating it, uh, as much as you can.
Speaker:Uh, encrypting backups also, right?
Speaker:Uh, in case somebody gets to them from via some other source.
Speaker:Because remember, backups, they're not only used as a way to, uh, to restore,
Speaker:but, uh, a threat actor can use them as a way to exfiltrate data from your
Speaker:environment, which is, uh, very, very bad.
Speaker:So the next one.
Speaker:Yay.
Speaker:My turn is SaaS backups.
Speaker:Right.
Speaker:Make sure that
Speaker:SAS needs backups.
Speaker:Huh?
Speaker:No.
Speaker:If you haven't listened to our last episode, you should go
Speaker:listen to that on 3 2 1 1 0.
Speaker:Yeah.
Speaker:SaaS needs backups, so make sure you are backing up your SaaS applications.
Speaker:Don't just trust the vendor that they are going to be doing your backups or
Speaker:Yeah.
Speaker:backup.
Speaker:Because again, if you, if you just listened to our previous episode,
Speaker:they're not backing up your data.
Speaker:There.
Speaker:There are some vendors, uh, Microsoft 365, uh, Salesforce that do offer a
Speaker:backup service that you pay extra for.
Speaker:That is different.
Speaker:And, and I don't want to criticize any of those specifically, um, because I don't,
Speaker:I don't know anything about the specific.
Speaker:The specifics of those products.
Speaker:What I will say is just me personally, I would rather have the data on a third
Speaker:party service rather than as part of the, you know, that And can you think of
Speaker:a company of why I might feel that way?
Speaker:I
Speaker:The company,
Speaker:of a story of a cloud event that we covered
Speaker:there were many cloud events we covered.
Speaker:I am just
Speaker:specifically where the vendor had the copy of the data.
Speaker:Co-located with the data
Speaker:Oh yes.
Speaker:OVH.
Speaker:OVH.
Speaker:Yeah.
Speaker:Yeah.
Speaker:right.
Speaker:know, go look.
Speaker:You know this, this was a company that had made a number of very bad
Speaker:decisions, and since they were.
Speaker:Bad at making, they would argue that, look, we were doing a budget
Speaker:service and this is, we made budget decisions based on the fact that it
Speaker:was a budget service and I don't care.
Speaker:Right.
Speaker:My point is they made a number of bad design decisions, and
Speaker:though they made, also made bad design decisions on the backup.
Speaker:And so that's where I was like, if it's a company that messes up, you want a
Speaker:backup that's from somebody that didn't mess up, and so that's why I would rather
Speaker:have the backup be with another company.
Speaker:Yep.
Speaker:Um, yeah, let's talk about documentation.
Speaker:No, no one likes documentation,
Speaker:No one likes documentation, right?
Speaker:Um, and, and the big thing here, I mean, you, you need to, you need to.
Speaker:Be able to describe how the different parts work.
Speaker:The real, the real thing here is the concept of runbook, right?
Speaker:And that that should be part of your disaster recovery plan, which is
Speaker:part of your cyber recovery plan.
Speaker:Um, part of your incident recovery plan.
Speaker:Uh, that, that a person, again, this is a high bar to set, but a person
Speaker:that is technical and understands.
Speaker:What buttons are right, um, should be able to follow your
Speaker:runbook and do and do the thing.
Speaker:Yeah.
Speaker:shouldn't need the backup person or the DR person to be the one running the recovery.
Speaker:It should be somebody that, that is competent should be able to look at it.
Speaker:Uh, and also there should be.
Speaker:Uh, some sort of, um, identity management system that would allow this person
Speaker:to then get into the, the places that they need to get into as well.
Speaker:I was thinking about the hurricane that hit a tropical island.
Speaker:Yeah.
Speaker:Story.
Speaker:And in that story, go back and listen to the episodes.
Speaker:Basically, hurricane hit an island wiped out the connectivity to the mainland.
Speaker:They needed to restore the data, but all the active directory and
Speaker:identity systems were in the mainland, so they couldn't restore the data.
Speaker:to fly people from the mainland back to the island in order to be able to
Speaker:actually do the restore and great story, go back and listen to the episode.
Speaker:The interesting thing though, Curtis,
Speaker:I thought what they did was actually they had to get connectivity back to the, I
Speaker:thought that's what they did, so that the
Speaker:but I think they had to actually do,
Speaker:I, well, I know they, I know they flew people.
Speaker:I just, I think in order for it to work at all, I think they had to get, they
Speaker:used satellite connectivity to get access to the internet so that they could then.
Speaker:Access that, the, the thing on the mainline, I thought that's what happened.
Speaker:It's been a while since I
Speaker:a copy of the active directory
Speaker:did.
Speaker:They,
Speaker:or
Speaker:that's highly possible.
Speaker:Maybe I should go listen to the My own, my own
Speaker:But
Speaker:episode.
Speaker:is where
Speaker:I.
Speaker:important that there are certain scenarios that local backup folks who are managing
Speaker:the site may not be able to handle.
Speaker:And so it is okay if needed to bring in specialists to
Speaker:deal with certain scenarios.
Speaker:Which again is why you want to have documented procedures and runbooks
Speaker:so that those specialists can, uh, can follow them and get stuff done.
Speaker:So next on our list is retention policies.
Speaker:What are retention policies, Curtis, and why do, like, don't
Speaker:we just keep data forever?
Speaker:Come on.
Speaker:Storage is cheap.
Speaker:I have been at clients that kept data forever.
Speaker:In fact, I remember one, it was a financial firm in, uh, New York City
Speaker:and they had a forever data retention policy, and they were very proud in
Speaker:talking about the number of features and ways in which things had to be
Speaker:added to, uh, Veritas net backup.
Speaker:Just because of them.
Speaker:They were very ex.
Speaker:you should be proud of.
Speaker:Yeah.
Speaker:Right.
Speaker:Uh, d data retention should not be too short.
Speaker:I, I've, I've seen that, that's, I've seen on that end, uh, you
Speaker:know, the, the crazy end of forever.
Speaker:I also knew one of the friends of the pod, uh, Stuart Little,
Speaker:uh, he worked at a company where, uh, he was, they were a client of
Speaker:mine and the boss there had this.
Speaker:Like total opposite opinion, which was two weeks.
Speaker:His retention period for all backups was two weeks.
Speaker:This hurt my little backup heart, right?
Speaker:Because I can think of so many scenarios where two weeks is not enough, but he,
Speaker:he was just very adamant to not, um, have backups subject to like e-discovery
Speaker:Yeah,
Speaker:and so.
Speaker:sense,
Speaker:Yeah, it makes sense that that was why, but I, I just
Speaker:felt two weeks was excessive.
Speaker:So somewhere between two weeks and infinity, you should be defining
Speaker:what your retention periods are.
Speaker:But I think one thing to mention is not all your data has to
Speaker:have the same retention period.
Speaker:there's two things we need to talk about here.
Speaker:That's one of 'em, right?
Speaker:Why?
Speaker:Why don't, why didn't it have all the anger retention?
Speaker:Because some data you don't want to keep for long period of times, other data for
Speaker:compliance reasons or other purposes, you have to keep for a long period of time.
Speaker:It doesn't make sense to keep all the data for the longest period of time.
Speaker:You have to keep data for.
Speaker:Right.
Speaker:And, and all data's not created equal.
Speaker:You don't back it up at the same frequency.
Speaker:You don't back it up at the same retention.
Speaker:Uh, there are, there is data that is.
Speaker:Uh, of, of high risk, sorry.
Speaker:There is data of high risk in terms of high risk of
Speaker:lawsuits and things like that.
Speaker:Uh, the longer you keep data, the more data that you might be
Speaker:required to, uh, provide in some sort of, uh, e-discovery situation.
Speaker:it's also just cost too, right?
Speaker:kept everything forever, your costs are going to skyrocket
Speaker:from a backup perspective.
Speaker:Yes.
Speaker:I don't care what method you're using to store your data,
Speaker:you're paying by the gigabyte.
Speaker:In some way, shape, or form, right?
Speaker:And so if you store everything, then, then, you know, um, your, your,
Speaker:your costs are gonna be significant.
Speaker:Uh, so that, that's one thing that you need to keep in mind is that not
Speaker:all data needs to be, uh, stored the same amount of time, and you should
Speaker:be, do you know, you should be doing it based on the, the data type and the
Speaker:risks and all of these things, right?
Speaker:The other is that you should not be deciding this, just like recovery times.
Speaker:Uh, you should not be deciding retention periods.
Speaker:This, this should absolutely not be a decision that, that the backup
Speaker:person is making, and it, it, it shouldn't be a technical person at all.
Speaker:This, this is a business discussion based on, uh, compliance, based on
Speaker:legal liabilities, based on costs.
Speaker:These are all business decisions that should not be
Speaker:coming from the backup admin.
Speaker:It should be coming from, uh, you know, the people with the purse strings.
Speaker:Yes, but if you're being told, go back up this data and it doesn't have a retention
Speaker:period, I think it is up to the backup, a admin to say, Hey, I don't see information
Speaker:I need in order to be able to do my job.
Speaker:Can you please tell me what the retention period is for this data?
Speaker:Right.
Speaker:Yeah.
Speaker:I would, I would say in the absence of being given that I would, I would
Speaker:set the retention period to like seven years and then go back to them and say,
Speaker:Hey, I've set this for seven years.
Speaker:You might want to, you know, let me know.
Speaker:No,
Speaker:You know, something less than that.
Speaker:Right.
Speaker:Uh, the next is, and again, some people when we talk about 3, 2, 1,
Speaker:1 0, and I say, well, you know, this is sort of what defines a backup.
Speaker:Other people feel that without what we're about to talk about, again,
Speaker:you don't have backups, and that is monitoring and alerting, right?
Speaker:So.
Speaker:If you're not, you know, we talked about you should have a, a regular
Speaker:backup schedule, you should have defined recovery objectives.
Speaker:You should also have a system through which you know that the backups are doing
Speaker:the things that they're supposed to do.
Speaker:I
Speaker:Right?
Speaker:Curtis a months ago.
Speaker:It should be fine running
Speaker:Yeah.
Speaker:right.
Speaker:This is definitely not set it and forget it.
Speaker:I will say that.
Speaker:Right.
Speaker:Um, I I will, I'll tell, I'll tell a funny story.
Speaker:Um, we.
Speaker:Back before you, you know, it was a lot hard.
Speaker:It, it was, it was just hard to get centralized backup reporting back when
Speaker:I was doing this like 30 years ago.
Speaker:And we actually wrote Custom Pearl Code that went and grabbed a bunch of
Speaker:backup statuses, um, and created a web based, uh, reporting system for, in
Speaker:this case it was net backup and, um.
Speaker:Again, I'm just gonna say this is, mind you, this was a long time ago.
Speaker:in the day.
Speaker:Uh, and, and I, and I, I did what I was told, but they asked, uh, for a,
Speaker:what we called management view feature.
Speaker:And so that was if you went and you, you like pushed this button,
Speaker:all the backups, uh, went green.
Speaker:So, so in case management was stuck, so we had like the regular view,
Speaker:which is our view, and it would show you like each, each backup.
Speaker:And then there were like, it was like a week of little green boxes,
Speaker:and then you, you could see the red boxes and then, you know, you could
Speaker:see that, you know, there were, there was red or green after the red.
Speaker:And, um, but yeah, they, they, they asked for a feature where you could
Speaker:push a button and, uh, it made it look all better for, for management.
Speaker:Oh boy.
Speaker:and so that, that's, that's monitoring and then also alerting is like,
Speaker:you know, backup failures, things like a, a, a good modern system.
Speaker:You should be able to define your recovery objectives, and then it
Speaker:should tell you if you're unable to meet your recovery objectives, right?
Speaker:If you're unable to be, if you say you have a a four hour RTO.
Speaker:But you're not even able to complete backups within four hours.
Speaker:This is a problem.
Speaker:If you say you have a four hour RPO and you're not backing up at least
Speaker:every four hours, then you're gonna have, you're not compliant to the, the
Speaker:objectives that you have specified.
Speaker:Also from a monitoring and alerting perspective, one of
Speaker:the things with ransomware
Speaker:mm-hmm.
Speaker:in encrypts data.
Speaker:When it
Speaker:Yep.
Speaker:encrypts data, you're gonna end up with larger backups than normal.
Speaker:Yep.
Speaker:you have monitoring and alerting in place, maybe it could detect
Speaker:anomalies and say, Hey, by the way,
Speaker:Yes.
Speaker:all of a sudden your 10 gigabyte backup turned out to be one terabyte.
Speaker:What's going on?
Speaker:Yep.
Speaker:Uh, and, and the other thing also it that, that's a great, that's
Speaker:a great, uh, recommendation.
Speaker:The other also is of course, that you're running out of storage,
Speaker:Yeah.
Speaker:right.
Speaker:This is a problem.
Speaker:Right.
Speaker:And I'll also say that a lot of.
Speaker:Reporting systems.
Speaker:They're really good on reporting what happened.
Speaker:They're not so good sometimes at reporting what didn't happen.
Speaker:There needs to be some aspect of your reporting system so that
Speaker:you can check the total inventory against the total backup inventory.
Speaker:Again, a compliance check to see that every, uh, system, uh, is
Speaker:automatically included in the backups.
Speaker:Yep.
Speaker:and how are we doing on time?
Speaker:I think
Speaker:Yeah, yeah.
Speaker:We're good.
Speaker:Yeah.
Speaker:VMware and other
Speaker:Yes,
Speaker:make that easier because they do provide that inventory to the backup system
Speaker:yes,
Speaker:But
Speaker:yes,
Speaker:when you have physical systems, when you have SaaS applications,
Speaker:other things like that, it may be a little bit more difficult.
Speaker:absolutely.
Speaker:And so wrapping this up, we have endpoint, uh, device protection.
Speaker:A lot of times on this podcast or what a lot of people think about,
Speaker:it's like their database applications or virtualization environment.
Speaker:But have a lot of endpoints out there that you need to be protecting as well.
Speaker:And Curtis, I know you've brought up sort of cybersecurity.
Speaker:Do you want to talk about some of the issues that come up in endpoints?
Speaker:Yeah, well the, you know, basically you have this incredibly powerful thing
Speaker:in your hand that has access, right?
Speaker:And, and also.
Speaker:When we talk about things like, uh, biometric access and all
Speaker:that sort of stuff, right?
Speaker:You, you have all of that.
Speaker:Everything is relying on this device, right?
Speaker:And also perhaps your laptop.
Speaker:those
Speaker:Oh, thank for the thank you.
Speaker:Uh, and then also your laptop.
Speaker:Like my laptop has touch, ID built into it, right?
Speaker:Um, so it's an incredibly powerful device, but, and also it's a device.
Speaker:Upon which we rely so much.
Speaker:Right?
Speaker:And so you need a system through which you can recover that device if it
Speaker:goes, uh, if things go poorly, right?
Speaker:And whether it's, it's, it's, it's hacked.
Speaker:Um, it, or you just drop it, you know, in a sink somewhere, right?
Speaker:Shut up.
Speaker:I know.
Speaker:Shut up, shut up.
Speaker:I know what you're talking about.
Speaker:Um, and, um.
Speaker:If you do something stupid, you know what?
Speaker:You know, when I cracked, when I cracked my screen, uh, several years ago, I went,
Speaker:I went and got it repaired and, and then while walking to my car from the screen
Speaker:repair place, I, I tripped and I literally fell onto my phone and I cracked the
Speaker:screen again and I just had to go back.
Speaker:Um,
Speaker:Curtis.
Speaker:Hmm.
Speaker:yeah, that sucks.
Speaker:Um, but anyway.
Speaker:The question you should ask yourself as to whether or not you need to
Speaker:do endpoint backup as whether or not your endpoint has data on it.
Speaker:Right?
Speaker:Data that only resides there, right?
Speaker:If you're, if you're using, if you're using an iPhone or an Android.
Speaker:And that's what we're talking about from an endpoint perspective.
Speaker:And you're just using Google Photos or, uh, you know, iPhoto, and that's what
Speaker:we're talking about that is generally synchronized up to the cloud, right?
Speaker:Yeah.
Speaker:Um, but if you're using a third party app to do photos of your job sites,
Speaker:because there are third party apps that do photos of your job sites.
Speaker:Where, where are those photos are?
Speaker:Are they only on the phone?
Speaker:Are they synchronized up to the cloud?
Speaker:Uh, is there a system by which you can find out that all of the,
Speaker:that synchronization is working
Speaker:Yeah.
Speaker:you don't find out too late that these really important job site
Speaker:photos were only on Steve's phone and now Steve's phone just got ran
Speaker:over by a truck because Steve got ran over by a truck and, uh, poor Steve.
Speaker:Yes.
Speaker:Poor Steve.
Speaker:Right.
Speaker:So that's the question.
Speaker:If you have endpoint devices where data is being created on those endpoint
Speaker:devices as opposed to just using them.
Speaker:So 99% of what I do, al almost a hundred percent of what I do really is
Speaker:In
Speaker:I'm using a, some cloud service.
Speaker:To do the thing, like right now we're using a cloud service to record this data.
Speaker:The, this, this recording until I edit it, it only sits in this, um,
Speaker:you know, this little cloud service.
Speaker:It's not, I'll just tell you that right now.
Speaker:The, the, during the interim, if we would be like, uh, we
Speaker:would be like, uh, those guys.
Speaker:What were those guys?
Speaker:The, the, the storage container, uh, people, the life uncontained.
Speaker:Oh, yes.
Speaker:Yeah, we would be like dim, uh, we would lose, we, we would
Speaker:lose a couple of episodes.
Speaker:I think, uh, if, if squad cast decided to, to go tango uniform, but what I
Speaker:was saying was that I use this and then I'm gonna use, I'm gonna use uh
Speaker:uh, descrip, which is gonna pull this over to Descrip and it's gonna edit it.
Speaker:And that happens in the cloud.
Speaker:There is a cloud, there is a local copy of Descrip.
Speaker:It runs on my laptop, but that's just, um.
Speaker:Like a cash
Speaker:You it, it's a cash copy, right?
Speaker:So if that's the way you're dealing with stuff, then you don't really
Speaker:have to worry that much about endpoint device Pro, you know, backup.
Speaker:Yeah.
Speaker:You need to worry about it from a device protection and data protection
Speaker:standpoint to to access to those systems because they could be used
Speaker:to access the, your critical data.
Speaker:But you don't.
Speaker:If you're not creating data and storing data on that endpoint, then
Speaker:you don't have to worry about it.
Speaker:But if you are, then you should.
Speaker:Yeah.
Speaker:Well, and also everything you've mentioned I agree with only
Speaker:applies to backing up the data.
Speaker:It has nothing to do with endpoint device or detection and response EDR tools and
Speaker:right,
Speaker:right?
Speaker:right.
Speaker:That's
Speaker:Yeah.
Speaker:that you still probably need, even if you are using a hundred percent
Speaker:cloud services, because those endpoint devices are a gateway to your network.
Speaker:Yeah.
Speaker:So yeah, EDR tools, uh, which again, we discuss in the
Speaker:ransomware book, uh, learning, ransomware response and recovery.
Speaker:Those are, they're, they're the canary in the coal mine, right?
Speaker:They, you most likely will be getting ransomware via an endpoint.
Speaker:So having EDR on your is a great way to find that before it becomes a problem.
Speaker:So.
Speaker:I wonder what other countries use instead of canary in a coal mine.
Speaker:Are we the only country with coal mines?
Speaker:We're not the only country with coal mines.
Speaker:You just, maybe we don't have the, they, they don't have the,
Speaker:um, surely they also used canary.
Speaker:What is a canary?
Speaker:Why do we say canary in a coal mine?
Speaker:Do you, do you, do you know the etymology of that, right?
Speaker:miners used to take canaries in with them, and therefore, if oxygen was.
Speaker:Running out or whatever else.
Speaker:If there was an
Speaker:Yeah.
Speaker:they were about to pass out, then the canary would pass out first or die,
Speaker:Yeah.
Speaker:therefore they knew there wasn't enough oxygen, so then
Speaker:Time to get out.
Speaker:Exactly.
Speaker:Um, I just had a memory of, um, Zoolander when Zoolander, he was,
Speaker:he was, when he worked in the coal mines that he came out like one day.
Speaker:He goes, I think I got the black lung.
Speaker:Love, love that movie.
Speaker:Alright, well there you go.
Speaker:10 backup elements that you need to have in any company.
Speaker:Right?
Speaker:Let's just review 'em again, the 3, 2, 1 rule, the regular backup schedule,
Speaker:backup testing, and verification, defined recovery objectives.
Speaker:Backup security and isolation, SaaS backup, uh, documentation
Speaker:and runbooks, uh, retention policies, monitoring and alerting.
Speaker:And finally, endpoint backup.
Speaker:Uh, this is good.
Speaker:I like this episode.
Speaker:I like, you know, episodes with lists, fast facts.
Speaker:All right, thanks.
Speaker:Prasanna for being my canary in a co
Speaker:or bird brain being my bird brain.
Speaker:anytime, Curtis, for you.
Speaker:All right.
Speaker:And, uh, thanks to everyone listening, uh, that is a wrap.