Speaker:

You found the backup wrap up your go-to podcast for all things

Speaker:

backup recovery and cyber recovery.

Speaker:

In this episode, we cover something that should be required listening for

Speaker:

anybody responsible for protecting business data, the 10 essential features.

Speaker:

Every backup system needs.

Speaker:

There's way too many companies that think they have backups when they really don't.

Speaker:

And by the way, when I say backup system, I mean the overall system,

Speaker:

not just a computer system.

Speaker:

Because many times, um, you know, backups are actually SaaS based

Speaker:

and things like that, right?

Speaker:

Remember, no one cares if you can backup only if you can restore.

Speaker:

Let's make sure that your backup system has at least these 10 things

Speaker:

that you need to get started.

Speaker:

By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr.

Speaker:

Backup, and I've been passionate about backup and recovery for over 30 years.

Speaker:

Ever since I had to tell my boss there were no backups of the production

Speaker:

database that we had just lost.

Speaker:

I don't want that to happen to you, and that's why I do this.

Speaker:

On this podcast, we turn unappreciated backup admins into cyber recovery heroes.

Speaker:

This is the backup wrap up.

Speaker:

Welcome to the show.

Speaker:

Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy

Speaker:

who remembers to wear this shirt that I'm supposed to be wearing.

Speaker:

Prasanna, Molly, how's it going?

Speaker:

Prana?

Speaker:

Oh my gosh.

Speaker:

Are you in my head?

Speaker:

I literally was just thinking about that as I was looking.

Speaker:

I was like, why does he

Speaker:

I'm in your head.

Speaker:

I'm in your head.

Speaker:

Yeah, I, I, um, I, you know what?

Speaker:

I'm not even sure I know where the shirt is.

Speaker:

Oh,

Speaker:

Um, I dunno if you know this, I can be a little bit disorganized sometimes.

Speaker:

You really?

Speaker:

I know that comes as a great surprise.

Speaker:

But, um, we went through all this thing to get the shirts

Speaker:

Uh, by the way, for the listeners, I was asking Curtis for four years

Speaker:

Yeah,

Speaker:

to get swag to print

Speaker:

Yeah, we finally got his shirt.

Speaker:

And he's wearing it.

Speaker:

Both of us need to put our mic in a different place though, so that you're,

Speaker:

see

Speaker:

so that you don't cover up the Yeah.

Speaker:

Um, by the way, no one has, no one has reached out to me for swag.

Speaker:

Listeners, if you want t-shirts, if you want something, please reach

Speaker:

out to Curtis and let him know because I would like some more swag.

Speaker:

Yeah.

Speaker:

Do a backup, wrap up socks.

Speaker:

Yes.

Speaker:

Actually I should say merch, not swag.

Speaker:

Yeah.

Speaker:

Merch.

Speaker:

Yeah.

Speaker:

Swag is, yeah, merch is, you gotta buy it.

Speaker:

Yes.

Speaker:

the difference.

Speaker:

We're not giving away free stuff over here, people.

Speaker:

Um, all right.

Speaker:

We're gonna cover a lot in this episode, so we're gonna cover it pretty high level.

Speaker:

Uh, but we're gonna talk about the 10 backup.

Speaker:

Things that every business needs,

Speaker:

Could we

Speaker:

right?

Speaker:

facts?

Speaker:

What

Speaker:

Fast facts.

Speaker:

fast facts?

Speaker:

Yeah, fast facts.

Speaker:

The 10 backup things that every, uh, business needs.

Speaker:

And the first one.

Speaker:

3, 2, 1. The 3, 2, 1 rule, which we've already, which, yeah, which we covered

Speaker:

in the last episode, which is now really the 3, 2, 1, 1 0 rule, right?

Speaker:

Three copies of your backup, two different media, one of which is somewhere else,

Speaker:

one of which is immutable and zero errors because you did validation, uh, which

Speaker:

actually is gonna be another one of our, another one of our things, right?

Speaker:

So if, if your backups don't conform at least to the 3, 2, 1 rule, then

Speaker:

you know they're not really backups.

Speaker:

Yeah, exactly right.

Speaker:

Um, so the, the next thing is, uh, scheduled backups.

Speaker:

So why, why does that matter?

Speaker:

Prasanna?

Speaker:

Well, if you aren't doing frequent backups or scheduled backups, then

Speaker:

you're probably avoiding or skipping or don't have a backup you can

Speaker:

restore from, and you're probably not meeting the needs of the business.

Speaker:

So you wanted a

Speaker:

schedule.

Speaker:

You don't wanna have to go push a button, right?

Speaker:

It should run automatically based on what you and the business have decided.

Speaker:

Yeah, if you're not doing scheduled backups, you're not really doing backups.

Speaker:

Right.

Speaker:

Um, you know, you're, you're gonna, you're gonna have, you're

Speaker:

gonna have to remember to do them.

Speaker:

And so they should, they should just run right.

Speaker:

Get, get humans out of the system as much as possible.

Speaker:

So if you're not doing regularly scheduled backups, then again, I, I, I

Speaker:

don't, I don't even know why we're here.

Speaker:

Well, I, I think it's also important, automated is another key word there,

Speaker:

Yeah.

Speaker:

right?

Speaker:

It should not be because I, for instance, do scheduled backups of my

Speaker:

personal data, but it's me doing that manually every day or every month.

Speaker:

That, that's actually a really good point, right?

Speaker:

I'm glad you brought that up.

Speaker:

It needs to be automatically scheduled backups right.

Speaker:

Um, and, uh, yeah, this should happen.

Speaker:

And when we talk about, um, uh, another thing that we need to be doing all the

Speaker:

time, that is a little thing called, uh, recovery testing or backup testing,

Speaker:

backup testing, or recovery testing.

Speaker:

I guess the only reason, the only reason we back up is so we can restore.

Speaker:

No, I, you know, I, I used to say a lot.

Speaker:

No one cares if you can back up.

Speaker:

They only care if you can restore.

Speaker:

Yep, and you need to make sure you're doing your recovery testing

Speaker:

because you don't know if that backup is going to be successfully

Speaker:

restored when you actually need it.

Speaker:

The only way you know ahead of time is you have to do your testing.

Speaker:

You might have forgotten to do part of an application backup.

Speaker:

You might have forgotten a piece of your infrastructure.

Speaker:

You need to back up as well in order to successfully restore down the road.

Speaker:

The only way you know is you do the testing ahead of time.

Speaker:

Yeah, exactly.

Speaker:

And um, you know, I can think, I can think back in the day when, um, I

Speaker:

remember I was at a, uh, a large, uh.

Speaker:

Cell phone manufacturing company, and we'd been bagging it for months.

Speaker:

And then we went to go do a recovery test.

Speaker:

Uh, we found out that the tape drives, uh, they weren't so good at reading,

Speaker:

they just, they just knew how to write.

Speaker:

Um, you know, you can't, unless you do the, the recovery testing,

Speaker:

you're not gonna find that stuff out.

Speaker:

Right.

Speaker:

There's just, we, we could, we could, we could spend.

Speaker:

Hours and hours and hours telling you stories of bad things that happened.

Speaker:

When you don't do testing, you're, you're only going to find out, uh,

Speaker:

you know the, what's wrong, right?

Speaker:

think you did talk about this a few episodes ago, but your about

Speaker:

how there was a new compression

Speaker:

Yeah.

Speaker:

The compression feature.

Speaker:

Yeah.

Speaker:

We didn't, yeah.

Speaker:

never tested it, and your

Speaker:

Yeah.

Speaker:

from tape was slow.

Speaker:

Yeah, it was ultra slow and ultimately we found out that it actually

Speaker:

wouldn't even work because of the way that the feature, uh, worked.

Speaker:

It was, it was assumptions made, um, that, that were just not true.

Speaker:

yeah,

Speaker:

It was a really bad design, but, uh, again, you're not gonna know that stuff

Speaker:

until you actually do, uh, testing.

Speaker:

So the next one is going back to what I talked about earlier about why you

Speaker:

needed sort of automated schedules, backup schedules, is you need to

Speaker:

also define your recovery objectives.

Speaker:

Yeah.

Speaker:

And do you wanna talk a little bit about that?

Speaker:

Because I know people forget about this or they think, oh, as a backup

Speaker:

admin, I'm responsible for this.

Speaker:

But I think it's important to sort of like really talk about this.

Speaker:

Yeah, this is one of those things where you cannot, you, you really

Speaker:

cannot design a backup system.

Speaker:

Without recovery objectives, right.

Speaker:

I mean, you can, right?

Speaker:

You can just, you can define, you know, but, but it's like, um, you,

Speaker:

you, you really have to define the recovery objectives upfront.

Speaker:

And if you don't define them upfront and you don't agree to them upfront, then you

Speaker:

can't properly design the backup system.

Speaker:

You.

Speaker:

And, and, and so you end up sort of just doing what we always do, which is

Speaker:

like, oh, we're gonna do, we're gonna do it and we're gonna recover every day.

Speaker:

We're gonna bring, you know, gonna back up every day.

Speaker:

We're gonna, we're gonna send it off site and we're gonna do the thing.

Speaker:

And then you go to do the restore and then you, you, you, you go to do, um,

Speaker:

the restore it and, and it works, but it fails from a perception standpoint.

Speaker:

And that's because if you don't have recovery objectives.

Speaker:

The, the recovery objectives that are in the mind of the bosses are going

Speaker:

to be very different than the recovery objectives that are in your mind.

Speaker:

You're like, Hey, this was awesome.

Speaker:

The restore happened.

Speaker:

Uh, it, you know, it, it only took, uh, eight hours and, you

Speaker:

know, and, and it, and it succeeded and we restored all the data.

Speaker:

And you're like, you're feeling, you know, hunky dory and then the bosses

Speaker:

are chewing you out because they thought it was gonna take an hour.

Speaker:

Yeah.

Speaker:

And I think one other thing I want to touch on is as a backup

Speaker:

admin, I the one who's coming up with these recovery objectives, or

Speaker:

New.

Speaker:

Yeah, good point.

Speaker:

Yeah.

Speaker:

The, it needs to come from the business, right?

Speaker:

Any of this, these SLAs, recovery objectives, need

Speaker:

to start with the business.

Speaker:

We want, we, we don't wanna lose any data and we don't wanna lose any time, right?

Speaker:

So that's, that's where we always start, right?

Speaker:

A RTO and an RPO of of zero.

Speaker:

That's recovery time objective and, and recovery point objective of zero.

Speaker:

And then you need to walk that back based on, okay, you can have an RTO and RPO of

Speaker:

zero, it's gonna cost you $50 billion.

Speaker:

Uh, and then, you know, and then they walk it back, right?

Speaker:

So you, again, you, this is about setting expectations.

Speaker:

And also using those, those objectives to both define and design the backup

Speaker:

system, but also to pay for it,

Speaker:

Yeah,

Speaker:

right?

Speaker:

Because, um, you know, it, it, uh,

Speaker:

it's really hard to get money for backups.

Speaker:

and we talked about this I think like three episodes ago.

Speaker:

Yes, we did.

Speaker:

Yes, we did.

Speaker:

Um, so the next is about isolating, uh, you know, backups

Speaker:

from a security perspective.

Speaker:

And we did just talk about this with the 3 2, 1, 1 0 episode.

Speaker:

We talked about immutable backups.

Speaker:

Uh, there there is a term that we didn't talk about, which is another

Speaker:

really important term when we talk about, uh, isolating backups.

Speaker:

You know what that term is, right?

Speaker:

The

Speaker:

least privilege.

Speaker:

Access

Speaker:

No,

Speaker:

patch management.

Speaker:

no.

Speaker:

MFA.

Speaker:

Keeping back up secure.

Speaker:

Oh

Speaker:

I know it there.

Speaker:

There's like eight, 800 things you could be choosing.

Speaker:

Air gap.

Speaker:

Yeah.

Speaker:

But of course, and, and again and again, air gap backups, we can't really

Speaker:

have air gap backups it in the truest sense, uh, because that technically

Speaker:

means that it's offline and it's, it's, there is literally a gap of air.

Speaker:

There is no connectivity from A to B.

Speaker:

Uh, you can't really have that with modern backup and recovery design,

Speaker:

but you can just have, you can.

Speaker:

Approximate it as much as you can.

Speaker:

Right?

Speaker:

Again, just realize that from a cyber cybersecurity perspective, um, that

Speaker:

the threat actors are immediately gonna go after your backups, right?

Speaker:

And so you gotta separate them.

Speaker:

I.

Speaker:

So I was also thinking when you brought up this, uh, topic, was

Speaker:

thinking from sort of separating out, I know we talked about, active

Speaker:

directory, so sort of having something separate from a backup perspective

Speaker:

Yep.

Speaker:

as network isolation if needed.

Speaker:

So you're isolating your backup traffic from your production

Speaker:

traffic, just keeping it isolated, walled off from everything else.

Speaker:

So if something happens on your production network, it's not easy

Speaker:

to get into your backup network.

Speaker:

Yeah, and the thing you mentioned earlier, uh, and your incorrect

Speaker:

answer to my question, it's, um, least, least privilege, right?

Speaker:

Using the concept of least privilege, give, giving each person the, the,

Speaker:

the absolute least, least amount of privilege that they need in order to

Speaker:

do their job in the backup system.

Speaker:

Uh, and then isolating it, uh, as much as you can.

Speaker:

Uh, encrypting backups also, right?

Speaker:

Uh, in case somebody gets to them from via some other source.

Speaker:

Because remember, backups, they're not only used as a way to, uh, to restore,

Speaker:

but, uh, a threat actor can use them as a way to exfiltrate data from your

Speaker:

environment, which is, uh, very, very bad.

Speaker:

So the next one.

Speaker:

Yay.

Speaker:

My turn is SaaS backups.

Speaker:

Right.

Speaker:

Make sure that

Speaker:

SAS needs backups.

Speaker:

Huh?

Speaker:

No.

Speaker:

If you haven't listened to our last episode, you should go

Speaker:

listen to that on 3 2 1 1 0.

Speaker:

Yeah.

Speaker:

SaaS needs backups, so make sure you are backing up your SaaS applications.

Speaker:

Don't just trust the vendor that they are going to be doing your backups or

Speaker:

Yeah.

Speaker:

backup.

Speaker:

Because again, if you, if you just listened to our previous episode,

Speaker:

they're not backing up your data.

Speaker:

There.

Speaker:

There are some vendors, uh, Microsoft 365, uh, Salesforce that do offer a

Speaker:

backup service that you pay extra for.

Speaker:

That is different.

Speaker:

And, and I don't want to criticize any of those specifically, um, because I don't,

Speaker:

I don't know anything about the specific.

Speaker:

The specifics of those products.

Speaker:

What I will say is just me personally, I would rather have the data on a third

Speaker:

party service rather than as part of the, you know, that And can you think of

Speaker:

a company of why I might feel that way?

Speaker:

I

Speaker:

The company,

Speaker:

of a story of a cloud event that we covered

Speaker:

there were many cloud events we covered.

Speaker:

I am just

Speaker:

specifically where the vendor had the copy of the data.

Speaker:

Co-located with the data

Speaker:

Oh yes.

Speaker:

OVH.

Speaker:

OVH.

Speaker:

Yeah.

Speaker:

Yeah.

Speaker:

right.

Speaker:

know, go look.

Speaker:

You know this, this was a company that had made a number of very bad

Speaker:

decisions, and since they were.

Speaker:

Bad at making, they would argue that, look, we were doing a budget

Speaker:

service and this is, we made budget decisions based on the fact that it

Speaker:

was a budget service and I don't care.

Speaker:

Right.

Speaker:

My point is they made a number of bad design decisions, and

Speaker:

though they made, also made bad design decisions on the backup.

Speaker:

And so that's where I was like, if it's a company that messes up, you want a

Speaker:

backup that's from somebody that didn't mess up, and so that's why I would rather

Speaker:

have the backup be with another company.

Speaker:

Yep.

Speaker:

Um, yeah, let's talk about documentation.

Speaker:

No, no one likes documentation,

Speaker:

No one likes documentation, right?

Speaker:

Um, and, and the big thing here, I mean, you, you need to, you need to.

Speaker:

Be able to describe how the different parts work.

Speaker:

The real, the real thing here is the concept of runbook, right?

Speaker:

And that that should be part of your disaster recovery plan, which is

Speaker:

part of your cyber recovery plan.

Speaker:

Um, part of your incident recovery plan.

Speaker:

Uh, that, that a person, again, this is a high bar to set, but a person

Speaker:

that is technical and understands.

Speaker:

What buttons are right, um, should be able to follow your

Speaker:

runbook and do and do the thing.

Speaker:

Yeah.

Speaker:

shouldn't need the backup person or the DR person to be the one running the recovery.

Speaker:

It should be somebody that, that is competent should be able to look at it.

Speaker:

Uh, and also there should be.

Speaker:

Uh, some sort of, um, identity management system that would allow this person

Speaker:

to then get into the, the places that they need to get into as well.

Speaker:

I was thinking about the hurricane that hit a tropical island.

Speaker:

Yeah.

Speaker:

Story.

Speaker:

And in that story, go back and listen to the episodes.

Speaker:

Basically, hurricane hit an island wiped out the connectivity to the mainland.

Speaker:

They needed to restore the data, but all the active directory and

Speaker:

identity systems were in the mainland, so they couldn't restore the data.

Speaker:

to fly people from the mainland back to the island in order to be able to

Speaker:

actually do the restore and great story, go back and listen to the episode.

Speaker:

The interesting thing though, Curtis,

Speaker:

I thought what they did was actually they had to get connectivity back to the, I

Speaker:

thought that's what they did, so that the

Speaker:

but I think they had to actually do,

Speaker:

I, well, I know they, I know they flew people.

Speaker:

I just, I think in order for it to work at all, I think they had to get, they

Speaker:

used satellite connectivity to get access to the internet so that they could then.

Speaker:

Access that, the, the thing on the mainline, I thought that's what happened.

Speaker:

It's been a while since I

Speaker:

a copy of the active directory

Speaker:

did.

Speaker:

They,

Speaker:

or

Speaker:

that's highly possible.

Speaker:

Maybe I should go listen to the My own, my own

Speaker:

But

Speaker:

episode.

Speaker:

is where

Speaker:

I.

Speaker:

important that there are certain scenarios that local backup folks who are managing

Speaker:

the site may not be able to handle.

Speaker:

And so it is okay if needed to bring in specialists to

Speaker:

deal with certain scenarios.

Speaker:

Which again is why you want to have documented procedures and runbooks

Speaker:

so that those specialists can, uh, can follow them and get stuff done.

Speaker:

So next on our list is retention policies.

Speaker:

What are retention policies, Curtis, and why do, like, don't

Speaker:

we just keep data forever?

Speaker:

Come on.

Speaker:

Storage is cheap.

Speaker:

I have been at clients that kept data forever.

Speaker:

In fact, I remember one, it was a financial firm in, uh, New York City

Speaker:

and they had a forever data retention policy, and they were very proud in

Speaker:

talking about the number of features and ways in which things had to be

Speaker:

added to, uh, Veritas net backup.

Speaker:

Just because of them.

Speaker:

They were very ex.

Speaker:

you should be proud of.

Speaker:

Yeah.

Speaker:

Right.

Speaker:

Uh, d data retention should not be too short.

Speaker:

I, I've, I've seen that, that's, I've seen on that end, uh, you

Speaker:

know, the, the crazy end of forever.

Speaker:

I also knew one of the friends of the pod, uh, Stuart Little,

Speaker:

uh, he worked at a company where, uh, he was, they were a client of

Speaker:

mine and the boss there had this.

Speaker:

Like total opposite opinion, which was two weeks.

Speaker:

His retention period for all backups was two weeks.

Speaker:

This hurt my little backup heart, right?

Speaker:

Because I can think of so many scenarios where two weeks is not enough, but he,

Speaker:

he was just very adamant to not, um, have backups subject to like e-discovery

Speaker:

Yeah,

Speaker:

and so.

Speaker:

sense,

Speaker:

Yeah, it makes sense that that was why, but I, I just

Speaker:

felt two weeks was excessive.

Speaker:

So somewhere between two weeks and infinity, you should be defining

Speaker:

what your retention periods are.

Speaker:

But I think one thing to mention is not all your data has to

Speaker:

have the same retention period.

Speaker:

there's two things we need to talk about here.

Speaker:

That's one of 'em, right?

Speaker:

Why?

Speaker:

Why don't, why didn't it have all the anger retention?

Speaker:

Because some data you don't want to keep for long period of times, other data for

Speaker:

compliance reasons or other purposes, you have to keep for a long period of time.

Speaker:

It doesn't make sense to keep all the data for the longest period of time.

Speaker:

You have to keep data for.

Speaker:

Right.

Speaker:

And, and all data's not created equal.

Speaker:

You don't back it up at the same frequency.

Speaker:

You don't back it up at the same retention.

Speaker:

Uh, there are, there is data that is.

Speaker:

Uh, of, of high risk, sorry.

Speaker:

There is data of high risk in terms of high risk of

Speaker:

lawsuits and things like that.

Speaker:

Uh, the longer you keep data, the more data that you might be

Speaker:

required to, uh, provide in some sort of, uh, e-discovery situation.

Speaker:

it's also just cost too, right?

Speaker:

kept everything forever, your costs are going to skyrocket

Speaker:

from a backup perspective.

Speaker:

Yes.

Speaker:

I don't care what method you're using to store your data,

Speaker:

you're paying by the gigabyte.

Speaker:

In some way, shape, or form, right?

Speaker:

And so if you store everything, then, then, you know, um, your, your,

Speaker:

your costs are gonna be significant.

Speaker:

Uh, so that, that's one thing that you need to keep in mind is that not

Speaker:

all data needs to be, uh, stored the same amount of time, and you should

Speaker:

be, do you know, you should be doing it based on the, the data type and the

Speaker:

risks and all of these things, right?

Speaker:

The other is that you should not be deciding this, just like recovery times.

Speaker:

Uh, you should not be deciding retention periods.

Speaker:

This, this should absolutely not be a decision that, that the backup

Speaker:

person is making, and it, it, it shouldn't be a technical person at all.

Speaker:

This, this is a business discussion based on, uh, compliance, based on

Speaker:

legal liabilities, based on costs.

Speaker:

These are all business decisions that should not be

Speaker:

coming from the backup admin.

Speaker:

It should be coming from, uh, you know, the people with the purse strings.

Speaker:

Yes, but if you're being told, go back up this data and it doesn't have a retention

Speaker:

period, I think it is up to the backup, a admin to say, Hey, I don't see information

Speaker:

I need in order to be able to do my job.

Speaker:

Can you please tell me what the retention period is for this data?

Speaker:

Right.

Speaker:

Yeah.

Speaker:

I would, I would say in the absence of being given that I would, I would

Speaker:

set the retention period to like seven years and then go back to them and say,

Speaker:

Hey, I've set this for seven years.

Speaker:

You might want to, you know, let me know.

Speaker:

No,

Speaker:

You know, something less than that.

Speaker:

Right.

Speaker:

Uh, the next is, and again, some people when we talk about 3, 2, 1,

Speaker:

1 0, and I say, well, you know, this is sort of what defines a backup.

Speaker:

Other people feel that without what we're about to talk about, again,

Speaker:

you don't have backups, and that is monitoring and alerting, right?

Speaker:

So.

Speaker:

If you're not, you know, we talked about you should have a, a regular

Speaker:

backup schedule, you should have defined recovery objectives.

Speaker:

You should also have a system through which you know that the backups are doing

Speaker:

the things that they're supposed to do.

Speaker:

I

Speaker:

Right?

Speaker:

Curtis a months ago.

Speaker:

It should be fine running

Speaker:

Yeah.

Speaker:

right.

Speaker:

This is definitely not set it and forget it.

Speaker:

I will say that.

Speaker:

Right.

Speaker:

Um, I I will, I'll tell, I'll tell a funny story.

Speaker:

Um, we.

Speaker:

Back before you, you know, it was a lot hard.

Speaker:

It, it was, it was just hard to get centralized backup reporting back when

Speaker:

I was doing this like 30 years ago.

Speaker:

And we actually wrote Custom Pearl Code that went and grabbed a bunch of

Speaker:

backup statuses, um, and created a web based, uh, reporting system for, in

Speaker:

this case it was net backup and, um.

Speaker:

Again, I'm just gonna say this is, mind you, this was a long time ago.

Speaker:

in the day.

Speaker:

Uh, and, and I, and I, I did what I was told, but they asked, uh, for a,

Speaker:

what we called management view feature.

Speaker:

And so that was if you went and you, you like pushed this button,

Speaker:

all the backups, uh, went green.

Speaker:

So, so in case management was stuck, so we had like the regular view,

Speaker:

which is our view, and it would show you like each, each backup.

Speaker:

And then there were like, it was like a week of little green boxes,

Speaker:

and then you, you could see the red boxes and then, you know, you could

Speaker:

see that, you know, there were, there was red or green after the red.

Speaker:

And, um, but yeah, they, they, they asked for a feature where you could

Speaker:

push a button and, uh, it made it look all better for, for management.

Speaker:

Oh boy.

Speaker:

and so that, that's, that's monitoring and then also alerting is like,

Speaker:

you know, backup failures, things like a, a, a good modern system.

Speaker:

You should be able to define your recovery objectives, and then it

Speaker:

should tell you if you're unable to meet your recovery objectives, right?

Speaker:

If you're unable to be, if you say you have a a four hour RTO.

Speaker:

But you're not even able to complete backups within four hours.

Speaker:

This is a problem.

Speaker:

If you say you have a four hour RPO and you're not backing up at least

Speaker:

every four hours, then you're gonna have, you're not compliant to the, the

Speaker:

objectives that you have specified.

Speaker:

Also from a monitoring and alerting perspective, one of

Speaker:

the things with ransomware

Speaker:

mm-hmm.

Speaker:

in encrypts data.

Speaker:

When it

Speaker:

Yep.

Speaker:

encrypts data, you're gonna end up with larger backups than normal.

Speaker:

Yep.

Speaker:

you have monitoring and alerting in place, maybe it could detect

Speaker:

anomalies and say, Hey, by the way,

Speaker:

Yes.

Speaker:

all of a sudden your 10 gigabyte backup turned out to be one terabyte.

Speaker:

What's going on?

Speaker:

Yep.

Speaker:

Uh, and, and the other thing also it that, that's a great, that's

Speaker:

a great, uh, recommendation.

Speaker:

The other also is of course, that you're running out of storage,

Speaker:

Yeah.

Speaker:

right.

Speaker:

This is a problem.

Speaker:

Right.

Speaker:

And I'll also say that a lot of.

Speaker:

Reporting systems.

Speaker:

They're really good on reporting what happened.

Speaker:

They're not so good sometimes at reporting what didn't happen.

Speaker:

There needs to be some aspect of your reporting system so that

Speaker:

you can check the total inventory against the total backup inventory.

Speaker:

Again, a compliance check to see that every, uh, system, uh, is

Speaker:

automatically included in the backups.

Speaker:

Yep.

Speaker:

and how are we doing on time?

Speaker:

I think

Speaker:

Yeah, yeah.

Speaker:

We're good.

Speaker:

Yeah.

Speaker:

VMware and other

Speaker:

Yes,

Speaker:

make that easier because they do provide that inventory to the backup system

Speaker:

yes,

Speaker:

But

Speaker:

yes,

Speaker:

when you have physical systems, when you have SaaS applications,

Speaker:

other things like that, it may be a little bit more difficult.

Speaker:

absolutely.

Speaker:

And so wrapping this up, we have endpoint, uh, device protection.

Speaker:

A lot of times on this podcast or what a lot of people think about,

Speaker:

it's like their database applications or virtualization environment.

Speaker:

But have a lot of endpoints out there that you need to be protecting as well.

Speaker:

And Curtis, I know you've brought up sort of cybersecurity.

Speaker:

Do you want to talk about some of the issues that come up in endpoints?

Speaker:

Yeah, well the, you know, basically you have this incredibly powerful thing

Speaker:

in your hand that has access, right?

Speaker:

And, and also.

Speaker:

When we talk about things like, uh, biometric access and all

Speaker:

that sort of stuff, right?

Speaker:

You, you have all of that.

Speaker:

Everything is relying on this device, right?

Speaker:

And also perhaps your laptop.

Speaker:

those

Speaker:

Oh, thank for the thank you.

Speaker:

Uh, and then also your laptop.

Speaker:

Like my laptop has touch, ID built into it, right?

Speaker:

Um, so it's an incredibly powerful device, but, and also it's a device.

Speaker:

Upon which we rely so much.

Speaker:

Right?

Speaker:

And so you need a system through which you can recover that device if it

Speaker:

goes, uh, if things go poorly, right?

Speaker:

And whether it's, it's, it's, it's hacked.

Speaker:

Um, it, or you just drop it, you know, in a sink somewhere, right?

Speaker:

Shut up.

Speaker:

I know.

Speaker:

Shut up, shut up.

Speaker:

I know what you're talking about.

Speaker:

Um, and, um.

Speaker:

If you do something stupid, you know what?

Speaker:

You know, when I cracked, when I cracked my screen, uh, several years ago, I went,

Speaker:

I went and got it repaired and, and then while walking to my car from the screen

Speaker:

repair place, I, I tripped and I literally fell onto my phone and I cracked the

Speaker:

screen again and I just had to go back.

Speaker:

Um,

Speaker:

Curtis.

Speaker:

Hmm.

Speaker:

yeah, that sucks.

Speaker:

Um, but anyway.

Speaker:

The question you should ask yourself as to whether or not you need to

Speaker:

do endpoint backup as whether or not your endpoint has data on it.

Speaker:

Right?

Speaker:

Data that only resides there, right?

Speaker:

If you're, if you're using, if you're using an iPhone or an Android.

Speaker:

And that's what we're talking about from an endpoint perspective.

Speaker:

And you're just using Google Photos or, uh, you know, iPhoto, and that's what

Speaker:

we're talking about that is generally synchronized up to the cloud, right?

Speaker:

Yeah.

Speaker:

Um, but if you're using a third party app to do photos of your job sites,

Speaker:

because there are third party apps that do photos of your job sites.

Speaker:

Where, where are those photos are?

Speaker:

Are they only on the phone?

Speaker:

Are they synchronized up to the cloud?

Speaker:

Uh, is there a system by which you can find out that all of the,

Speaker:

that synchronization is working

Speaker:

Yeah.

Speaker:

you don't find out too late that these really important job site

Speaker:

photos were only on Steve's phone and now Steve's phone just got ran

Speaker:

over by a truck because Steve got ran over by a truck and, uh, poor Steve.

Speaker:

Yes.

Speaker:

Poor Steve.

Speaker:

Right.

Speaker:

So that's the question.

Speaker:

If you have endpoint devices where data is being created on those endpoint

Speaker:

devices as opposed to just using them.

Speaker:

So 99% of what I do, al almost a hundred percent of what I do really is

Speaker:

In

Speaker:

I'm using a, some cloud service.

Speaker:

To do the thing, like right now we're using a cloud service to record this data.

Speaker:

The, this, this recording until I edit it, it only sits in this, um,

Speaker:

you know, this little cloud service.

Speaker:

It's not, I'll just tell you that right now.

Speaker:

The, the, during the interim, if we would be like, uh, we

Speaker:

would be like, uh, those guys.

Speaker:

What were those guys?

Speaker:

The, the, the storage container, uh, people, the life uncontained.

Speaker:

Oh, yes.

Speaker:

Yeah, we would be like dim, uh, we would lose, we, we would

Speaker:

lose a couple of episodes.

Speaker:

I think, uh, if, if squad cast decided to, to go tango uniform, but what I

Speaker:

was saying was that I use this and then I'm gonna use, I'm gonna use uh

Speaker:

uh, descrip, which is gonna pull this over to Descrip and it's gonna edit it.

Speaker:

And that happens in the cloud.

Speaker:

There is a cloud, there is a local copy of Descrip.

Speaker:

It runs on my laptop, but that's just, um.

Speaker:

Like a cash

Speaker:

You it, it's a cash copy, right?

Speaker:

So if that's the way you're dealing with stuff, then you don't really

Speaker:

have to worry that much about endpoint device Pro, you know, backup.

Speaker:

Yeah.

Speaker:

You need to worry about it from a device protection and data protection

Speaker:

standpoint to to access to those systems because they could be used

Speaker:

to access the, your critical data.

Speaker:

But you don't.

Speaker:

If you're not creating data and storing data on that endpoint, then

Speaker:

you don't have to worry about it.

Speaker:

But if you are, then you should.

Speaker:

Yeah.

Speaker:

Well, and also everything you've mentioned I agree with only

Speaker:

applies to backing up the data.

Speaker:

It has nothing to do with endpoint device or detection and response EDR tools and

Speaker:

right,

Speaker:

right?

Speaker:

right.

Speaker:

That's

Speaker:

Yeah.

Speaker:

that you still probably need, even if you are using a hundred percent

Speaker:

cloud services, because those endpoint devices are a gateway to your network.

Speaker:

Yeah.

Speaker:

So yeah, EDR tools, uh, which again, we discuss in the

Speaker:

ransomware book, uh, learning, ransomware response and recovery.

Speaker:

Those are, they're, they're the canary in the coal mine, right?

Speaker:

They, you most likely will be getting ransomware via an endpoint.

Speaker:

So having EDR on your is a great way to find that before it becomes a problem.

Speaker:

So.

Speaker:

I wonder what other countries use instead of canary in a coal mine.

Speaker:

Are we the only country with coal mines?

Speaker:

We're not the only country with coal mines.

Speaker:

You just, maybe we don't have the, they, they don't have the,

Speaker:

um, surely they also used canary.

Speaker:

What is a canary?

Speaker:

Why do we say canary in a coal mine?

Speaker:

Do you, do you, do you know the etymology of that, right?

Speaker:

miners used to take canaries in with them, and therefore, if oxygen was.

Speaker:

Running out or whatever else.

Speaker:

If there was an

Speaker:

Yeah.

Speaker:

they were about to pass out, then the canary would pass out first or die,

Speaker:

Yeah.

Speaker:

therefore they knew there wasn't enough oxygen, so then

Speaker:

Time to get out.

Speaker:

Exactly.

Speaker:

Um, I just had a memory of, um, Zoolander when Zoolander, he was,

Speaker:

he was, when he worked in the coal mines that he came out like one day.

Speaker:

He goes, I think I got the black lung.

Speaker:

Love, love that movie.

Speaker:

Alright, well there you go.

Speaker:

10 backup elements that you need to have in any company.

Speaker:

Right?

Speaker:

Let's just review 'em again, the 3, 2, 1 rule, the regular backup schedule,

Speaker:

backup testing, and verification, defined recovery objectives.

Speaker:

Backup security and isolation, SaaS backup, uh, documentation

Speaker:

and runbooks, uh, retention policies, monitoring and alerting.

Speaker:

And finally, endpoint backup.

Speaker:

Uh, this is good.

Speaker:

I like this episode.

Speaker:

I like, you know, episodes with lists, fast facts.

Speaker:

All right, thanks.

Speaker:

Prasanna for being my canary in a co

Speaker:

or bird brain being my bird brain.

Speaker:

anytime, Curtis, for you.

Speaker:

All right.

Speaker:

And, uh, thanks to everyone listening, uh, that is a wrap.