1 00:00:00,000 --> 00:00:03,750 You found the backup wrap up your go-to podcast for all things 2 00:00:03,750 --> 00:00:06,209 backup recovery and cyber recovery. 3 00:00:06,689 --> 00:00:10,470 In this episode, we cover something that should be required listening for 4 00:00:10,530 --> 00:00:16,530 anybody responsible for protecting business data, the 10 essential features. 5 00:00:16,729 --> 00:00:18,439 Every backup system needs. 6 00:00:18,830 --> 00:00:22,670 There's way too many companies that think they have backups when they really don't. 7 00:00:23,150 --> 00:00:26,420 And by the way, when I say backup system, I mean the overall system, 8 00:00:26,420 --> 00:00:27,799 not just a computer system. 9 00:00:27,799 --> 00:00:32,479 Because many times, um, you know, backups are actually SaaS based 10 00:00:32,479 --> 00:00:33,620 and things like that, right? 11 00:00:33,860 --> 00:00:37,940 Remember, no one cares if you can backup only if you can restore. 12 00:00:38,330 --> 00:00:42,019 Let's make sure that your backup system has at least these 10 things 13 00:00:42,019 --> 00:00:43,519 that you need to get started. 14 00:00:44,300 --> 00:00:48,140 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 15 00:00:48,140 --> 00:00:52,970 Backup, and I've been passionate about backup and recovery for over 30 years. 16 00:00:53,239 --> 00:00:57,290 Ever since I had to tell my boss there were no backups of the production 17 00:00:57,290 --> 00:00:58,760 database that we had just lost. 18 00:00:59,239 --> 00:01:02,179 I don't want that to happen to you, and that's why I do this. 19 00:01:02,569 --> 00:01:07,580 On this podcast, we turn unappreciated backup admins into cyber recovery heroes. 20 00:01:07,880 --> 00:01:09,949 This is the backup wrap up. 21 00:01:24,686 --> 00:01:25,526 Welcome to the show. 22 00:01:26,276 --> 00:01:30,296 Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy 23 00:01:30,296 --> 00:01:33,356 who remembers to wear this shirt that I'm supposed to be wearing. 24 00:01:33,546 --> 00:01:35,726 Prasanna, Molly, how's it going? 25 00:01:35,726 --> 00:01:35,756 Prana? 26 00:01:36,461 --> 00:01:37,061 Oh my gosh. 27 00:01:37,061 --> 00:01:38,171 Are you in my head? 28 00:01:38,171 --> 00:01:42,161 I literally was just thinking about that as I was looking. 29 00:01:42,161 --> 00:01:43,571 I was like, why does he 30 00:01:43,621 --> 00:01:44,401 I'm in your head. 31 00:01:45,341 --> 00:01:46,121 I'm in your head. 32 00:01:47,951 --> 00:01:50,771 Yeah, I, I, um, I, you know what? 33 00:01:50,921 --> 00:01:53,051 I'm not even sure I know where the shirt is. 34 00:01:53,386 --> 00:01:53,606 Oh, 35 00:01:53,891 --> 00:01:58,211 Um, I dunno if you know this, I can be a little bit disorganized sometimes. 36 00:01:58,806 --> 00:01:59,506 You really? 37 00:01:59,561 --> 00:02:02,291 I know that comes as a great surprise. 38 00:02:02,291 --> 00:02:05,921 But, um, we went through all this thing to get the shirts 39 00:02:06,881 --> 00:02:10,691 Uh, by the way, for the listeners, I was asking Curtis for four years 40 00:02:11,111 --> 00:02:11,591 Yeah, 41 00:02:11,831 --> 00:02:13,631 to get swag to print 42 00:02:13,721 --> 00:02:15,341 Yeah, we finally got his shirt. 43 00:02:16,091 --> 00:02:17,111 And he's wearing it. 44 00:02:17,771 --> 00:02:20,861 Both of us need to put our mic in a different place though, so that you're, 45 00:02:20,981 --> 00:02:21,131 see 46 00:02:21,161 --> 00:02:23,891 so that you don't cover up the Yeah. 47 00:02:24,251 --> 00:02:27,761 Um, by the way, no one has, no one has reached out to me for swag. 48 00:02:28,571 --> 00:02:33,431 Listeners, if you want t-shirts, if you want something, please reach 49 00:02:33,431 --> 00:02:36,971 out to Curtis and let him know because I would like some more swag. 50 00:02:38,516 --> 00:02:38,806 Yeah. 51 00:02:39,191 --> 00:02:41,111 Do a backup, wrap up socks. 52 00:02:41,466 --> 00:02:41,686 Yes. 53 00:02:42,486 --> 00:02:43,886 Actually I should say merch, not swag. 54 00:02:44,666 --> 00:02:45,026 Yeah. 55 00:02:45,116 --> 00:02:45,686 Merch. 56 00:02:46,136 --> 00:02:46,376 Yeah. 57 00:02:46,376 --> 00:02:48,866 Swag is, yeah, merch is, you gotta buy it. 58 00:02:49,286 --> 00:02:49,506 Yes. 59 00:02:49,706 --> 00:02:50,456 the difference. 60 00:02:52,736 --> 00:02:55,106 We're not giving away free stuff over here, people. 61 00:02:55,646 --> 00:02:57,026 Um, all right. 62 00:02:57,696 --> 00:03:01,416 We're gonna cover a lot in this episode, so we're gonna cover it pretty high level. 63 00:03:01,746 --> 00:03:05,466 Uh, but we're gonna talk about the 10 backup. 64 00:03:06,111 --> 00:03:09,471 Things that every business needs, 65 00:03:09,591 --> 00:03:09,801 Could we 66 00:03:09,831 --> 00:03:10,251 right? 67 00:03:10,341 --> 00:03:10,881 facts? 68 00:03:11,541 --> 00:03:11,961 What 69 00:03:12,201 --> 00:03:13,191 Fast facts. 70 00:03:13,401 --> 00:03:14,151 fast facts? 71 00:03:14,151 --> 00:03:15,141 Yeah, fast facts. 72 00:03:15,741 --> 00:03:19,011 The 10 backup things that every, uh, business needs. 73 00:03:19,011 --> 00:03:19,581 And the first one. 74 00:03:20,706 --> 00:03:25,026 3, 2, 1. The 3, 2, 1 rule, which we've already, which, yeah, which we covered 75 00:03:25,026 --> 00:03:29,526 in the last episode, which is now really the 3, 2, 1, 1 0 rule, right? 76 00:03:29,736 --> 00:03:32,886 Three copies of your backup, two different media, one of which is somewhere else, 77 00:03:33,036 --> 00:03:37,986 one of which is immutable and zero errors because you did validation, uh, which 78 00:03:37,986 --> 00:03:41,166 actually is gonna be another one of our, another one of our things, right? 79 00:03:41,376 --> 00:03:45,036 So if, if your backups don't conform at least to the 3, 2, 1 rule, then 80 00:03:45,036 --> 00:03:46,446 you know they're not really backups. 81 00:03:47,091 --> 00:03:48,561 Yeah, exactly right. 82 00:03:49,011 --> 00:03:53,811 Um, so the, the next thing is, uh, scheduled backups. 83 00:03:53,841 --> 00:03:55,281 So why, why does that matter? 84 00:03:55,281 --> 00:03:55,691 Prasanna? 85 00:03:56,166 --> 00:04:00,426 Well, if you aren't doing frequent backups or scheduled backups, then 86 00:04:00,666 --> 00:04:04,496 you're probably avoiding or skipping or don't have a backup you can 87 00:04:04,496 --> 00:04:07,736 restore from, and you're probably not meeting the needs of the business. 88 00:04:07,736 --> 00:04:08,606 So you wanted a 89 00:04:08,606 --> 00:04:09,176 schedule. 90 00:04:09,206 --> 00:04:11,336 You don't wanna have to go push a button, right? 91 00:04:11,366 --> 00:04:14,726 It should run automatically based on what you and the business have decided. 92 00:04:15,611 --> 00:04:18,401 Yeah, if you're not doing scheduled backups, you're not really doing backups. 93 00:04:18,461 --> 00:04:18,851 Right. 94 00:04:18,911 --> 00:04:21,041 Um, you know, you're, you're gonna, you're gonna have, you're 95 00:04:21,041 --> 00:04:22,901 gonna have to remember to do them. 96 00:04:23,441 --> 00:04:25,181 And so they should, they should just run right. 97 00:04:25,181 --> 00:04:28,901 Get, get humans out of the system as much as possible. 98 00:04:29,171 --> 00:04:33,341 So if you're not doing regularly scheduled backups, then again, I, I, I 99 00:04:33,341 --> 00:04:34,931 don't, I don't even know why we're here. 100 00:04:35,201 --> 00:04:38,471 Well, I, I think it's also important, automated is another key word there, 101 00:04:39,161 --> 00:04:39,431 Yeah. 102 00:04:39,431 --> 00:04:39,791 right? 103 00:04:39,851 --> 00:04:43,571 It should not be because I, for instance, do scheduled backups of my 104 00:04:43,571 --> 00:04:47,231 personal data, but it's me doing that manually every day or every month. 105 00:04:47,696 --> 00:04:49,646 That, that's actually a really good point, right? 106 00:04:49,676 --> 00:04:50,576 I'm glad you brought that up. 107 00:04:50,576 --> 00:04:53,216 It needs to be automatically scheduled backups right. 108 00:04:53,711 --> 00:04:56,801 Um, and, uh, yeah, this should happen. 109 00:04:57,191 --> 00:05:03,341 And when we talk about, um, uh, another thing that we need to be doing all the 110 00:05:03,341 --> 00:05:09,671 time, that is a little thing called, uh, recovery testing or backup testing, 111 00:05:09,881 --> 00:05:11,441 backup testing, or recovery testing. 112 00:05:11,441 --> 00:05:14,981 I guess the only reason, the only reason we back up is so we can restore. 113 00:05:14,981 --> 00:05:16,721 No, I, you know, I, I used to say a lot. 114 00:05:16,721 --> 00:05:17,981 No one cares if you can back up. 115 00:05:17,981 --> 00:05:19,181 They only care if you can restore. 116 00:05:19,196 --> 00:05:22,326 Yep, and you need to make sure you're doing your recovery testing 117 00:05:22,326 --> 00:05:26,166 because you don't know if that backup is going to be successfully 118 00:05:26,166 --> 00:05:28,056 restored when you actually need it. 119 00:05:28,116 --> 00:05:31,536 The only way you know ahead of time is you have to do your testing. 120 00:05:31,776 --> 00:05:34,386 You might have forgotten to do part of an application backup. 121 00:05:34,536 --> 00:05:36,546 You might have forgotten a piece of your infrastructure. 122 00:05:36,546 --> 00:05:40,566 You need to back up as well in order to successfully restore down the road. 123 00:05:40,806 --> 00:05:43,206 The only way you know is you do the testing ahead of time. 124 00:05:44,256 --> 00:05:45,096 Yeah, exactly. 125 00:05:45,096 --> 00:05:49,896 And um, you know, I can think, I can think back in the day when, um, I 126 00:05:49,896 --> 00:05:53,136 remember I was at a, uh, a large, uh. 127 00:05:54,036 --> 00:05:58,536 Cell phone manufacturing company, and we'd been bagging it for months. 128 00:05:58,536 --> 00:06:00,546 And then we went to go do a recovery test. 129 00:06:00,606 --> 00:06:03,756 Uh, we found out that the tape drives, uh, they weren't so good at reading, 130 00:06:04,086 --> 00:06:05,646 they just, they just knew how to write. 131 00:06:06,156 --> 00:06:10,596 Um, you know, you can't, unless you do the, the recovery testing, 132 00:06:10,596 --> 00:06:11,796 you're not gonna find that stuff out. 133 00:06:11,796 --> 00:06:11,976 Right. 134 00:06:12,126 --> 00:06:14,981 There's just, we, we could, we could, we could spend. 135 00:06:15,741 --> 00:06:19,371 Hours and hours and hours telling you stories of bad things that happened. 136 00:06:19,671 --> 00:06:23,871 When you don't do testing, you're, you're only going to find out, uh, 137 00:06:23,871 --> 00:06:26,841 you know the, what's wrong, right? 138 00:06:27,171 --> 00:06:31,811 think you did talk about this a few episodes ago, but your about 139 00:06:31,811 --> 00:06:34,541 how there was a new compression 140 00:06:34,871 --> 00:06:35,111 Yeah. 141 00:06:35,111 --> 00:06:36,041 The compression feature. 142 00:06:36,041 --> 00:06:36,341 Yeah. 143 00:06:36,371 --> 00:06:37,421 We didn't, yeah. 144 00:06:37,496 --> 00:06:38,936 never tested it, and your 145 00:06:39,011 --> 00:06:39,131 Yeah. 146 00:06:39,416 --> 00:06:41,251 from tape was slow. 147 00:06:41,861 --> 00:06:44,951 Yeah, it was ultra slow and ultimately we found out that it actually 148 00:06:44,951 --> 00:06:48,941 wouldn't even work because of the way that the feature, uh, worked. 149 00:06:48,941 --> 00:06:54,041 It was, it was assumptions made, um, that, that were just not true. 150 00:06:54,271 --> 00:06:54,561 yeah, 151 00:06:55,181 --> 00:06:58,871 It was a really bad design, but, uh, again, you're not gonna know that stuff 152 00:06:58,871 --> 00:07:00,701 until you actually do, uh, testing. 153 00:07:00,814 --> 00:07:05,134 So the next one is going back to what I talked about earlier about why you 154 00:07:05,134 --> 00:07:09,304 needed sort of automated schedules, backup schedules, is you need to 155 00:07:09,304 --> 00:07:12,694 also define your recovery objectives. 156 00:07:13,309 --> 00:07:13,609 Yeah. 157 00:07:13,984 --> 00:07:15,544 And do you wanna talk a little bit about that? 158 00:07:15,544 --> 00:07:18,514 Because I know people forget about this or they think, oh, as a backup 159 00:07:18,514 --> 00:07:19,894 admin, I'm responsible for this. 160 00:07:19,894 --> 00:07:23,644 But I think it's important to sort of like really talk about this. 161 00:07:24,049 --> 00:07:29,089 Yeah, this is one of those things where you cannot, you, you really 162 00:07:29,089 --> 00:07:31,099 cannot design a backup system. 163 00:07:31,909 --> 00:07:34,039 Without recovery objectives, right. 164 00:07:34,039 --> 00:07:35,329 I mean, you can, right? 165 00:07:36,619 --> 00:07:40,784 You can just, you can define, you know, but, but it's like, um, you, 166 00:07:40,804 --> 00:07:44,539 you, you really have to define the recovery objectives upfront. 167 00:07:44,539 --> 00:07:49,729 And if you don't define them upfront and you don't agree to them upfront, then you 168 00:07:49,729 --> 00:07:51,979 can't properly design the backup system. 169 00:07:52,309 --> 00:07:52,789 You. 170 00:07:53,389 --> 00:07:56,839 And, and, and so you end up sort of just doing what we always do, which is 171 00:07:56,839 --> 00:07:59,419 like, oh, we're gonna do, we're gonna do it and we're gonna recover every day. 172 00:07:59,419 --> 00:08:01,189 We're gonna bring, you know, gonna back up every day. 173 00:08:01,189 --> 00:08:04,429 We're gonna, we're gonna send it off site and we're gonna do the thing. 174 00:08:04,429 --> 00:08:10,309 And then you go to do the restore and then you, you, you, you go to do, um, 175 00:08:10,369 --> 00:08:15,729 the restore it and, and it works, but it fails from a perception standpoint. 176 00:08:15,729 --> 00:08:19,149 And that's because if you don't have recovery objectives. 177 00:08:20,214 --> 00:08:25,194 The, the recovery objectives that are in the mind of the bosses are going 178 00:08:25,194 --> 00:08:27,984 to be very different than the recovery objectives that are in your mind. 179 00:08:27,984 --> 00:08:29,394 You're like, Hey, this was awesome. 180 00:08:29,394 --> 00:08:30,504 The restore happened. 181 00:08:30,804 --> 00:08:35,544 Uh, it, you know, it, it only took, uh, eight hours and, you 182 00:08:35,544 --> 00:08:38,424 know, and, and it, and it succeeded and we restored all the data. 183 00:08:38,424 --> 00:08:41,814 And you're like, you're feeling, you know, hunky dory and then the bosses 184 00:08:41,814 --> 00:08:44,394 are chewing you out because they thought it was gonna take an hour. 185 00:08:44,724 --> 00:08:44,934 Yeah. 186 00:08:45,084 --> 00:08:48,774 And I think one other thing I want to touch on is as a backup 187 00:08:48,774 --> 00:08:52,344 admin, I the one who's coming up with these recovery objectives, or 188 00:08:52,449 --> 00:08:53,409 New. 189 00:08:53,559 --> 00:08:54,399 Yeah, good point. 190 00:08:54,399 --> 00:08:54,789 Yeah. 191 00:08:55,209 --> 00:08:57,069 The, it needs to come from the business, right? 192 00:08:57,339 --> 00:09:00,339 Any of this, these SLAs, recovery objectives, need 193 00:09:00,339 --> 00:09:01,119 to start with the business. 194 00:09:01,684 --> 00:09:05,374 We want, we, we don't wanna lose any data and we don't wanna lose any time, right? 195 00:09:05,374 --> 00:09:07,144 So that's, that's where we always start, right? 196 00:09:07,144 --> 00:09:09,724 A RTO and an RPO of of zero. 197 00:09:09,994 --> 00:09:13,504 That's recovery time objective and, and recovery point objective of zero. 198 00:09:13,624 --> 00:09:17,974 And then you need to walk that back based on, okay, you can have an RTO and RPO of 199 00:09:17,974 --> 00:09:20,224 zero, it's gonna cost you $50 billion. 200 00:09:20,704 --> 00:09:23,584 Uh, and then, you know, and then they walk it back, right? 201 00:09:23,824 --> 00:09:28,564 So you, again, you, this is about setting expectations. 202 00:09:28,999 --> 00:09:35,929 And also using those, those objectives to both define and design the backup 203 00:09:35,929 --> 00:09:38,269 system, but also to pay for it, 204 00:09:38,424 --> 00:09:38,604 Yeah, 205 00:09:38,749 --> 00:09:39,169 right? 206 00:09:39,289 --> 00:09:42,949 Because, um, you know, it, it, uh, 207 00:09:43,489 --> 00:09:44,999 it's really hard to get money for backups. 208 00:09:45,744 --> 00:09:47,524 and we talked about this I think like three episodes ago. 209 00:09:48,234 --> 00:09:48,774 Yes, we did. 210 00:09:48,924 --> 00:09:49,434 Yes, we did. 211 00:09:50,394 --> 00:09:55,764 Um, so the next is about isolating, uh, you know, backups 212 00:09:55,944 --> 00:09:57,924 from a security perspective. 213 00:09:57,924 --> 00:10:01,074 And we did just talk about this with the 3 2, 1, 1 0 episode. 214 00:10:01,674 --> 00:10:03,234 We talked about immutable backups. 215 00:10:03,414 --> 00:10:06,714 Uh, there there is a term that we didn't talk about, which is another 216 00:10:06,714 --> 00:10:11,184 really important term when we talk about, uh, isolating backups. 217 00:10:11,214 --> 00:10:12,324 You know what that term is, right? 218 00:10:14,489 --> 00:10:14,709 The 219 00:10:16,884 --> 00:10:17,484 least privilege. 220 00:10:17,484 --> 00:10:18,084 Access 221 00:10:18,699 --> 00:10:19,299 No, 222 00:10:19,494 --> 00:10:20,334 patch management. 223 00:10:20,769 --> 00:10:21,099 no. 224 00:10:23,724 --> 00:10:23,934 MFA. 225 00:10:23,979 --> 00:10:25,359 Keeping back up secure. 226 00:10:25,704 --> 00:10:26,064 Oh 227 00:10:30,579 --> 00:10:31,239 I know it there. 228 00:10:31,239 --> 00:10:33,549 There's like eight, 800 things you could be choosing. 229 00:10:34,154 --> 00:10:34,494 Air gap. 230 00:10:36,009 --> 00:10:36,339 Yeah. 231 00:10:36,939 --> 00:10:41,799 But of course, and, and again and again, air gap backups, we can't really 232 00:10:41,799 --> 00:10:47,109 have air gap backups it in the truest sense, uh, because that technically 233 00:10:47,109 --> 00:10:51,219 means that it's offline and it's, it's, there is literally a gap of air. 234 00:10:51,219 --> 00:10:53,259 There is no connectivity from A to B. 235 00:10:53,829 --> 00:10:58,779 Uh, you can't really have that with modern backup and recovery design, 236 00:10:58,779 --> 00:10:59,979 but you can just have, you can. 237 00:11:00,334 --> 00:11:02,794 Approximate it as much as you can. 238 00:11:03,184 --> 00:11:03,604 Right? 239 00:11:03,814 --> 00:11:11,284 Again, just realize that from a cyber cybersecurity perspective, um, that 240 00:11:11,284 --> 00:11:14,974 the threat actors are immediately gonna go after your backups, right? 241 00:11:15,364 --> 00:11:17,164 And so you gotta separate them. 242 00:11:17,164 --> 00:11:17,194 I. 243 00:11:17,634 --> 00:11:21,804 So I was also thinking when you brought up this, uh, topic, was 244 00:11:22,584 --> 00:11:27,594 thinking from sort of separating out, I know we talked about, active 245 00:11:27,594 --> 00:11:31,164 directory, so sort of having something separate from a backup perspective 246 00:11:31,384 --> 00:11:31,704 Yep. 247 00:11:31,764 --> 00:11:33,714 as network isolation if needed. 248 00:11:34,779 --> 00:11:38,589 So you're isolating your backup traffic from your production 249 00:11:38,589 --> 00:11:42,009 traffic, just keeping it isolated, walled off from everything else. 250 00:11:42,009 --> 00:11:44,949 So if something happens on your production network, it's not easy 251 00:11:44,949 --> 00:11:46,599 to get into your backup network. 252 00:11:47,239 --> 00:11:50,649 Yeah, and the thing you mentioned earlier, uh, and your incorrect 253 00:11:50,649 --> 00:11:55,539 answer to my question, it's, um, least, least privilege, right? 254 00:11:55,539 --> 00:11:59,649 Using the concept of least privilege, give, giving each person the, the, 255 00:11:59,649 --> 00:12:02,529 the absolute least, least amount of privilege that they need in order to 256 00:12:02,529 --> 00:12:04,059 do their job in the backup system. 257 00:12:04,509 --> 00:12:07,839 Uh, and then isolating it, uh, as much as you can. 258 00:12:08,154 --> 00:12:10,104 Uh, encrypting backups also, right? 259 00:12:10,344 --> 00:12:13,944 Uh, in case somebody gets to them from via some other source. 260 00:12:13,944 --> 00:12:18,894 Because remember, backups, they're not only used as a way to, uh, to restore, 261 00:12:19,104 --> 00:12:23,074 but, uh, a threat actor can use them as a way to exfiltrate data from your 262 00:12:23,074 --> 00:12:24,844 environment, which is, uh, very, very bad. 263 00:12:25,934 --> 00:12:26,984 So the next one. 264 00:12:27,284 --> 00:12:27,554 Yay. 265 00:12:27,554 --> 00:12:29,954 My turn is SaaS backups. 266 00:12:30,884 --> 00:12:31,214 Right. 267 00:12:31,274 --> 00:12:32,204 Make sure that 268 00:12:32,279 --> 00:12:33,449 SAS needs backups. 269 00:12:33,644 --> 00:12:34,004 Huh? 270 00:12:34,334 --> 00:12:34,514 No. 271 00:12:35,504 --> 00:12:37,754 If you haven't listened to our last episode, you should go 272 00:12:37,754 --> 00:12:40,214 listen to that on 3 2 1 1 0. 273 00:12:40,769 --> 00:12:41,159 Yeah. 274 00:12:41,234 --> 00:12:45,494 SaaS needs backups, so make sure you are backing up your SaaS applications. 275 00:12:45,944 --> 00:12:49,844 Don't just trust the vendor that they are going to be doing your backups or 276 00:12:50,039 --> 00:12:50,399 Yeah. 277 00:12:50,474 --> 00:12:50,864 backup. 278 00:12:51,134 --> 00:12:54,644 Because again, if you, if you just listened to our previous episode, 279 00:12:55,064 --> 00:12:56,444 they're not backing up your data. 280 00:12:56,714 --> 00:12:56,954 There. 281 00:12:56,984 --> 00:13:03,824 There are some vendors, uh, Microsoft 365, uh, Salesforce that do offer a 282 00:13:03,824 --> 00:13:06,614 backup service that you pay extra for. 283 00:13:06,614 --> 00:13:07,484 That is different. 284 00:13:07,604 --> 00:13:13,484 And, and I don't want to criticize any of those specifically, um, because I don't, 285 00:13:13,484 --> 00:13:15,284 I don't know anything about the specific. 286 00:13:15,869 --> 00:13:17,579 The specifics of those products. 287 00:13:17,939 --> 00:13:22,559 What I will say is just me personally, I would rather have the data on a third 288 00:13:22,559 --> 00:13:27,959 party service rather than as part of the, you know, that And can you think of 289 00:13:27,959 --> 00:13:30,599 a company of why I might feel that way? 290 00:13:31,574 --> 00:13:31,694 I 291 00:13:33,089 --> 00:13:33,959 The company, 292 00:13:34,094 --> 00:13:37,439 of a story of a cloud event that we covered 293 00:13:38,609 --> 00:13:40,409 there were many cloud events we covered. 294 00:13:40,409 --> 00:13:40,979 I am just 295 00:13:41,099 --> 00:13:43,844 specifically where the vendor had the copy of the data. 296 00:13:46,454 --> 00:13:47,774 Co-located with the data 297 00:13:48,029 --> 00:13:49,229 Oh yes. 298 00:13:49,229 --> 00:13:50,129 OVH. 299 00:13:50,624 --> 00:13:51,284 OVH. 300 00:13:51,284 --> 00:13:51,674 Yeah. 301 00:13:52,334 --> 00:13:52,664 Yeah. 302 00:13:52,904 --> 00:13:53,254 right. 303 00:13:53,414 --> 00:13:53,984 know, go look. 304 00:13:54,494 --> 00:13:58,154 You know this, this was a company that had made a number of very bad 305 00:13:58,154 --> 00:13:59,744 decisions, and since they were. 306 00:14:00,044 --> 00:14:04,154 Bad at making, they would argue that, look, we were doing a budget 307 00:14:04,154 --> 00:14:07,514 service and this is, we made budget decisions based on the fact that it 308 00:14:07,514 --> 00:14:09,404 was a budget service and I don't care. 309 00:14:09,944 --> 00:14:10,304 Right. 310 00:14:10,304 --> 00:14:15,194 My point is they made a number of bad design decisions, and 311 00:14:15,194 --> 00:14:18,464 though they made, also made bad design decisions on the backup. 312 00:14:18,464 --> 00:14:22,514 And so that's where I was like, if it's a company that messes up, you want a 313 00:14:22,514 --> 00:14:26,564 backup that's from somebody that didn't mess up, and so that's why I would rather 314 00:14:26,564 --> 00:14:29,414 have the backup be with another company. 315 00:14:29,799 --> 00:14:30,019 Yep. 316 00:14:31,514 --> 00:14:34,724 Um, yeah, let's talk about documentation. 317 00:14:35,474 --> 00:14:37,364 No, no one likes documentation, 318 00:14:37,394 --> 00:14:39,824 No one likes documentation, right? 319 00:14:40,124 --> 00:14:44,384 Um, and, and the big thing here, I mean, you, you need to, you need to. 320 00:14:45,359 --> 00:14:47,849 Be able to describe how the different parts work. 321 00:14:48,239 --> 00:14:51,659 The real, the real thing here is the concept of runbook, right? 322 00:14:52,319 --> 00:14:56,579 And that that should be part of your disaster recovery plan, which is 323 00:14:56,579 --> 00:14:58,229 part of your cyber recovery plan. 324 00:14:58,589 --> 00:15:01,019 Um, part of your incident recovery plan. 325 00:15:01,529 --> 00:15:07,769 Uh, that, that a person, again, this is a high bar to set, but a person 326 00:15:07,769 --> 00:15:09,569 that is technical and understands. 327 00:15:09,844 --> 00:15:15,634 What buttons are right, um, should be able to follow your 328 00:15:15,634 --> 00:15:17,704 runbook and do and do the thing. 329 00:15:17,929 --> 00:15:18,219 Yeah. 330 00:15:18,514 --> 00:15:24,874 shouldn't need the backup person or the DR person to be the one running the recovery. 331 00:15:25,144 --> 00:15:29,254 It should be somebody that, that is competent should be able to look at it. 332 00:15:29,314 --> 00:15:31,534 Uh, and also there should be. 333 00:15:32,609 --> 00:15:37,919 Uh, some sort of, um, identity management system that would allow this person 334 00:15:37,919 --> 00:15:41,399 to then get into the, the places that they need to get into as well. 335 00:15:41,699 --> 00:15:44,849 I was thinking about the hurricane that hit a tropical island. 336 00:15:45,569 --> 00:15:46,079 Yeah. 337 00:15:46,169 --> 00:15:46,739 Story. 338 00:15:47,759 --> 00:15:51,239 And in that story, go back and listen to the episodes. 339 00:15:52,049 --> 00:15:55,529 Basically, hurricane hit an island wiped out the connectivity to the mainland. 340 00:15:55,769 --> 00:15:58,439 They needed to restore the data, but all the active directory and 341 00:15:58,439 --> 00:16:01,649 identity systems were in the mainland, so they couldn't restore the data. 342 00:16:02,459 --> 00:16:06,329 to fly people from the mainland back to the island in order to be able to 343 00:16:06,329 --> 00:16:10,739 actually do the restore and great story, go back and listen to the episode. 344 00:16:11,519 --> 00:16:13,949 The interesting thing though, Curtis, 345 00:16:13,949 --> 00:16:18,779 I thought what they did was actually they had to get connectivity back to the, I 346 00:16:18,779 --> 00:16:21,149 thought that's what they did, so that the 347 00:16:21,494 --> 00:16:23,264 but I think they had to actually do, 348 00:16:23,519 --> 00:16:25,739 I, well, I know they, I know they flew people. 349 00:16:25,889 --> 00:16:29,639 I just, I think in order for it to work at all, I think they had to get, they 350 00:16:29,639 --> 00:16:34,769 used satellite connectivity to get access to the internet so that they could then. 351 00:16:35,159 --> 00:16:38,159 Access that, the, the thing on the mainline, I thought that's what happened. 352 00:16:38,339 --> 00:16:39,329 It's been a while since I 353 00:16:39,404 --> 00:16:41,054 a copy of the active directory 354 00:16:41,879 --> 00:16:42,119 did. 355 00:16:42,119 --> 00:16:42,389 They, 356 00:16:43,244 --> 00:16:43,334 or 357 00:16:43,409 --> 00:16:44,909 that's highly possible. 358 00:16:44,939 --> 00:16:47,984 Maybe I should go listen to the My own, my own 359 00:16:48,134 --> 00:16:48,254 But 360 00:16:48,329 --> 00:16:48,899 episode. 361 00:16:49,184 --> 00:16:49,784 is where 362 00:16:49,864 --> 00:16:49,984 I. 363 00:16:50,264 --> 00:16:56,024 important that there are certain scenarios that local backup folks who are managing 364 00:16:56,024 --> 00:16:57,464 the site may not be able to handle. 365 00:16:57,614 --> 00:17:01,874 And so it is okay if needed to bring in specialists to 366 00:17:01,874 --> 00:17:03,164 deal with certain scenarios. 367 00:17:03,869 --> 00:17:07,259 Which again is why you want to have documented procedures and runbooks 368 00:17:07,289 --> 00:17:13,469 so that those specialists can, uh, can follow them and get stuff done. 369 00:17:14,909 --> 00:17:17,879 So next on our list is retention policies. 370 00:17:18,299 --> 00:17:21,359 What are retention policies, Curtis, and why do, like, don't 371 00:17:21,359 --> 00:17:22,529 we just keep data forever? 372 00:17:22,529 --> 00:17:22,829 Come on. 373 00:17:22,829 --> 00:17:23,639 Storage is cheap. 374 00:17:24,509 --> 00:17:27,959 I have been at clients that kept data forever. 375 00:17:27,989 --> 00:17:34,949 In fact, I remember one, it was a financial firm in, uh, New York City 376 00:17:35,459 --> 00:17:42,869 and they had a forever data retention policy, and they were very proud in 377 00:17:42,869 --> 00:17:48,659 talking about the number of features and ways in which things had to be 378 00:17:48,659 --> 00:17:51,449 added to, uh, Veritas net backup. 379 00:17:51,959 --> 00:17:53,339 Just because of them. 380 00:17:55,349 --> 00:17:56,309 They were very ex. 381 00:17:56,384 --> 00:17:57,044 you should be proud of. 382 00:17:57,329 --> 00:17:57,839 Yeah. 383 00:17:57,989 --> 00:17:58,469 Right. 384 00:17:58,829 --> 00:18:03,089 Uh, d data retention should not be too short. 385 00:18:03,089 --> 00:18:06,509 I, I've, I've seen that, that's, I've seen on that end, uh, you 386 00:18:06,509 --> 00:18:08,219 know, the, the crazy end of forever. 387 00:18:08,459 --> 00:18:12,339 I also knew one of the friends of the pod, uh, Stuart Little, 388 00:18:12,729 --> 00:18:17,769 uh, he worked at a company where, uh, he was, they were a client of 389 00:18:17,769 --> 00:18:21,609 mine and the boss there had this. 390 00:18:21,924 --> 00:18:26,214 Like total opposite opinion, which was two weeks. 391 00:18:26,934 --> 00:18:30,594 His retention period for all backups was two weeks. 392 00:18:31,074 --> 00:18:33,324 This hurt my little backup heart, right? 393 00:18:33,324 --> 00:18:38,784 Because I can think of so many scenarios where two weeks is not enough, but he, 394 00:18:39,054 --> 00:18:46,674 he was just very adamant to not, um, have backups subject to like e-discovery 395 00:18:46,719 --> 00:18:46,959 Yeah, 396 00:18:47,934 --> 00:18:48,234 and so. 397 00:18:48,339 --> 00:18:48,969 sense, 398 00:18:49,214 --> 00:18:52,359 Yeah, it makes sense that that was why, but I, I just 399 00:18:52,359 --> 00:18:53,679 felt two weeks was excessive. 400 00:18:53,679 --> 00:18:58,329 So somewhere between two weeks and infinity, you should be defining 401 00:18:58,329 --> 00:18:59,529 what your retention periods are. 402 00:18:59,529 --> 00:19:05,379 But I think one thing to mention is not all your data has to 403 00:19:05,379 --> 00:19:07,209 have the same retention period. 404 00:19:07,629 --> 00:19:09,279 there's two things we need to talk about here. 405 00:19:09,279 --> 00:19:10,329 That's one of 'em, right? 406 00:19:10,509 --> 00:19:10,749 Why? 407 00:19:10,749 --> 00:19:13,449 Why don't, why didn't it have all the anger retention? 408 00:19:13,749 --> 00:19:19,389 Because some data you don't want to keep for long period of times, other data for 409 00:19:19,389 --> 00:19:23,349 compliance reasons or other purposes, you have to keep for a long period of time. 410 00:19:23,649 --> 00:19:26,649 It doesn't make sense to keep all the data for the longest period of time. 411 00:19:26,649 --> 00:19:27,549 You have to keep data for. 412 00:19:28,644 --> 00:19:29,124 Right. 413 00:19:29,214 --> 00:19:31,734 And, and all data's not created equal. 414 00:19:31,944 --> 00:19:33,774 You don't back it up at the same frequency. 415 00:19:33,774 --> 00:19:35,049 You don't back it up at the same retention. 416 00:19:35,869 --> 00:19:38,089 Uh, there are, there is data that is. 417 00:19:39,414 --> 00:19:42,534 Uh, of, of high risk, sorry. 418 00:19:42,744 --> 00:19:45,564 There is data of high risk in terms of high risk of 419 00:19:45,564 --> 00:19:47,004 lawsuits and things like that. 420 00:19:47,334 --> 00:19:51,684 Uh, the longer you keep data, the more data that you might be 421 00:19:51,714 --> 00:19:56,214 required to, uh, provide in some sort of, uh, e-discovery situation. 422 00:19:56,259 --> 00:19:57,849 it's also just cost too, right? 423 00:19:58,479 --> 00:20:01,839 kept everything forever, your costs are going to skyrocket 424 00:20:01,839 --> 00:20:03,249 from a backup perspective. 425 00:20:04,119 --> 00:20:04,629 Yes. 426 00:20:04,689 --> 00:20:07,659 I don't care what method you're using to store your data, 427 00:20:07,989 --> 00:20:09,249 you're paying by the gigabyte. 428 00:20:09,579 --> 00:20:11,379 In some way, shape, or form, right? 429 00:20:11,589 --> 00:20:15,909 And so if you store everything, then, then, you know, um, your, your, 430 00:20:15,999 --> 00:20:17,709 your costs are gonna be significant. 431 00:20:18,009 --> 00:20:20,679 Uh, so that, that's one thing that you need to keep in mind is that not 432 00:20:20,679 --> 00:20:24,219 all data needs to be, uh, stored the same amount of time, and you should 433 00:20:24,219 --> 00:20:27,009 be, do you know, you should be doing it based on the, the data type and the 434 00:20:27,009 --> 00:20:28,569 risks and all of these things, right? 435 00:20:28,929 --> 00:20:33,069 The other is that you should not be deciding this, just like recovery times. 436 00:20:33,444 --> 00:20:36,594 Uh, you should not be deciding retention periods. 437 00:20:36,594 --> 00:20:39,864 This, this should absolutely not be a decision that, that the backup 438 00:20:39,864 --> 00:20:44,334 person is making, and it, it, it shouldn't be a technical person at all. 439 00:20:44,364 --> 00:20:49,824 This, this is a business discussion based on, uh, compliance, based on 440 00:20:49,824 --> 00:20:52,944 legal liabilities, based on costs. 441 00:20:53,004 --> 00:20:56,154 These are all business decisions that should not be 442 00:20:56,154 --> 00:20:57,894 coming from the backup admin. 443 00:20:58,164 --> 00:21:01,554 It should be coming from, uh, you know, the people with the purse strings. 444 00:21:01,824 --> 00:21:06,774 Yes, but if you're being told, go back up this data and it doesn't have a retention 445 00:21:06,774 --> 00:21:12,954 period, I think it is up to the backup, a admin to say, Hey, I don't see information 446 00:21:12,954 --> 00:21:15,024 I need in order to be able to do my job. 447 00:21:15,174 --> 00:21:17,884 Can you please tell me what the retention period is for this data? 448 00:21:18,759 --> 00:21:19,209 Right. 449 00:21:19,359 --> 00:21:19,629 Yeah. 450 00:21:19,629 --> 00:21:25,149 I would, I would say in the absence of being given that I would, I would 451 00:21:25,149 --> 00:21:28,149 set the retention period to like seven years and then go back to them and say, 452 00:21:28,149 --> 00:21:29,589 Hey, I've set this for seven years. 453 00:21:29,589 --> 00:21:31,119 You might want to, you know, let me know. 454 00:21:31,119 --> 00:21:31,449 No, 455 00:21:31,929 --> 00:21:33,189 You know, something less than that. 456 00:21:33,249 --> 00:21:33,549 Right. 457 00:21:34,779 --> 00:21:39,111 Uh, the next is, and again, some people when we talk about 3, 2, 1, 458 00:21:39,111 --> 00:21:42,039 1 0, and I say, well, you know, this is sort of what defines a backup. 459 00:21:42,699 --> 00:21:46,539 Other people feel that without what we're about to talk about, again, 460 00:21:46,539 --> 00:21:49,869 you don't have backups, and that is monitoring and alerting, right? 461 00:21:49,869 --> 00:21:49,929 So. 462 00:21:51,249 --> 00:21:54,489 If you're not, you know, we talked about you should have a, a regular 463 00:21:54,489 --> 00:21:56,949 backup schedule, you should have defined recovery objectives. 464 00:21:57,279 --> 00:22:01,899 You should also have a system through which you know that the backups are doing 465 00:22:02,259 --> 00:22:03,789 the things that they're supposed to do. 466 00:22:03,819 --> 00:22:04,059 I 467 00:22:04,089 --> 00:22:04,509 Right? 468 00:22:04,749 --> 00:22:06,069 Curtis a months ago. 469 00:22:06,069 --> 00:22:07,479 It should be fine running 470 00:22:07,629 --> 00:22:08,079 Yeah. 471 00:22:08,174 --> 00:22:08,354 right. 472 00:22:08,649 --> 00:22:10,899 This is definitely not set it and forget it. 473 00:22:10,899 --> 00:22:11,679 I will say that. 474 00:22:11,709 --> 00:22:12,129 Right. 475 00:22:12,519 --> 00:22:15,579 Um, I I will, I'll tell, I'll tell a funny story. 476 00:22:15,639 --> 00:22:17,259 Um, we. 477 00:22:17,859 --> 00:22:20,379 Back before you, you know, it was a lot hard. 478 00:22:20,439 --> 00:22:26,349 It, it was, it was just hard to get centralized backup reporting back when 479 00:22:26,349 --> 00:22:28,329 I was doing this like 30 years ago. 480 00:22:28,539 --> 00:22:32,559 And we actually wrote Custom Pearl Code that went and grabbed a bunch of 481 00:22:32,559 --> 00:22:40,329 backup statuses, um, and created a web based, uh, reporting system for, in 482 00:22:40,329 --> 00:22:43,779 this case it was net backup and, um. 483 00:22:46,059 --> 00:22:49,689 Again, I'm just gonna say this is, mind you, this was a long time ago. 484 00:22:49,704 --> 00:22:49,944 in the day. 485 00:22:50,019 --> 00:22:56,739 Uh, and, and I, and I, I did what I was told, but they asked, uh, for a, 486 00:22:56,739 --> 00:22:58,839 what we called management view feature. 487 00:23:00,039 --> 00:23:03,639 And so that was if you went and you, you like pushed this button, 488 00:23:03,939 --> 00:23:06,309 all the backups, uh, went green. 489 00:23:10,029 --> 00:23:14,439 So, so in case management was stuck, so we had like the regular view, 490 00:23:14,469 --> 00:23:17,979 which is our view, and it would show you like each, each backup. 491 00:23:17,979 --> 00:23:21,039 And then there were like, it was like a week of little green boxes, 492 00:23:21,459 --> 00:23:24,459 and then you, you could see the red boxes and then, you know, you could 493 00:23:24,459 --> 00:23:27,519 see that, you know, there were, there was red or green after the red. 494 00:23:28,239 --> 00:23:31,719 And, um, but yeah, they, they, they asked for a feature where you could 495 00:23:31,719 --> 00:23:35,109 push a button and, uh, it made it look all better for, for management. 496 00:23:36,199 --> 00:23:36,739 Oh boy. 497 00:23:37,344 --> 00:23:40,614 and so that, that's, that's monitoring and then also alerting is like, 498 00:23:40,794 --> 00:23:46,734 you know, backup failures, things like a, a, a good modern system. 499 00:23:47,034 --> 00:23:50,874 You should be able to define your recovery objectives, and then it 500 00:23:50,874 --> 00:23:54,534 should tell you if you're unable to meet your recovery objectives, right? 501 00:23:54,534 --> 00:23:57,924 If you're unable to be, if you say you have a a four hour RTO. 502 00:23:58,794 --> 00:24:01,914 But you're not even able to complete backups within four hours. 503 00:24:01,914 --> 00:24:02,844 This is a problem. 504 00:24:03,114 --> 00:24:07,344 If you say you have a four hour RPO and you're not backing up at least 505 00:24:07,344 --> 00:24:11,334 every four hours, then you're gonna have, you're not compliant to the, the 506 00:24:11,334 --> 00:24:13,494 objectives that you have specified. 507 00:24:14,049 --> 00:24:18,279 Also from a monitoring and alerting perspective, one of 508 00:24:18,279 --> 00:24:19,629 the things with ransomware 509 00:24:20,459 --> 00:24:20,879 mm-hmm. 510 00:24:21,039 --> 00:24:21,759 in encrypts data. 511 00:24:22,149 --> 00:24:22,419 When it 512 00:24:22,419 --> 00:24:22,639 Yep. 513 00:24:22,689 --> 00:24:25,779 encrypts data, you're gonna end up with larger backups than normal. 514 00:24:26,019 --> 00:24:26,239 Yep. 515 00:24:26,409 --> 00:24:29,649 you have monitoring and alerting in place, maybe it could detect 516 00:24:29,649 --> 00:24:31,449 anomalies and say, Hey, by the way, 517 00:24:31,449 --> 00:24:31,989 Yes. 518 00:24:32,229 --> 00:24:37,629 all of a sudden your 10 gigabyte backup turned out to be one terabyte. 519 00:24:37,659 --> 00:24:38,439 What's going on? 520 00:24:39,549 --> 00:24:39,879 Yep. 521 00:24:40,479 --> 00:24:43,809 Uh, and, and the other thing also it that, that's a great, that's 522 00:24:43,809 --> 00:24:45,219 a great, uh, recommendation. 523 00:24:45,249 --> 00:24:47,589 The other also is of course, that you're running out of storage, 524 00:24:47,754 --> 00:24:48,044 Yeah. 525 00:24:48,399 --> 00:24:48,699 right. 526 00:24:48,729 --> 00:24:49,539 This is a problem. 527 00:24:49,719 --> 00:24:50,109 Right. 528 00:24:50,409 --> 00:24:52,359 And I'll also say that a lot of. 529 00:24:52,929 --> 00:24:54,459 Reporting systems. 530 00:24:54,459 --> 00:24:56,559 They're really good on reporting what happened. 531 00:24:57,129 --> 00:24:59,919 They're not so good sometimes at reporting what didn't happen. 532 00:25:00,099 --> 00:25:04,539 There needs to be some aspect of your reporting system so that 533 00:25:04,539 --> 00:25:09,129 you can check the total inventory against the total backup inventory. 534 00:25:09,339 --> 00:25:13,329 Again, a compliance check to see that every, uh, system, uh, is 535 00:25:13,329 --> 00:25:15,159 automatically included in the backups. 536 00:25:15,489 --> 00:25:15,729 Yep. 537 00:25:16,839 --> 00:25:17,919 and how are we doing on time? 538 00:25:17,949 --> 00:25:18,459 I think 539 00:25:18,639 --> 00:25:18,939 Yeah, yeah. 540 00:25:18,939 --> 00:25:19,269 We're good. 541 00:25:19,269 --> 00:25:19,419 Yeah. 542 00:25:20,079 --> 00:25:22,449 VMware and other 543 00:25:22,494 --> 00:25:23,004 Yes, 544 00:25:23,319 --> 00:25:26,889 make that easier because they do provide that inventory to the backup system 545 00:25:27,324 --> 00:25:27,864 yes, 546 00:25:28,359 --> 00:25:28,599 But 547 00:25:28,644 --> 00:25:29,154 yes, 548 00:25:29,319 --> 00:25:31,959 when you have physical systems, when you have SaaS applications, 549 00:25:31,989 --> 00:25:34,629 other things like that, it may be a little bit more difficult. 550 00:25:35,874 --> 00:25:36,564 absolutely. 551 00:25:36,804 --> 00:25:42,534 And so wrapping this up, we have endpoint, uh, device protection. 552 00:25:43,614 --> 00:25:46,884 A lot of times on this podcast or what a lot of people think about, 553 00:25:46,884 --> 00:25:50,694 it's like their database applications or virtualization environment. 554 00:25:50,949 --> 00:25:56,979 But have a lot of endpoints out there that you need to be protecting as well. 555 00:25:57,189 --> 00:26:00,249 And Curtis, I know you've brought up sort of cybersecurity. 556 00:26:00,579 --> 00:26:03,699 Do you want to talk about some of the issues that come up in endpoints? 557 00:26:04,929 --> 00:26:09,909 Yeah, well the, you know, basically you have this incredibly powerful thing 558 00:26:09,909 --> 00:26:12,339 in your hand that has access, right? 559 00:26:12,339 --> 00:26:13,539 And, and also. 560 00:26:14,319 --> 00:26:18,489 When we talk about things like, uh, biometric access and all 561 00:26:18,489 --> 00:26:19,419 that sort of stuff, right? 562 00:26:19,419 --> 00:26:20,739 You, you have all of that. 563 00:26:21,249 --> 00:26:23,349 Everything is relying on this device, right? 564 00:26:23,349 --> 00:26:25,119 And also perhaps your laptop. 565 00:26:25,119 --> 00:26:25,509 those 566 00:26:25,599 --> 00:26:28,059 Oh, thank for the thank you. 567 00:26:28,779 --> 00:26:30,099 Uh, and then also your laptop. 568 00:26:30,099 --> 00:26:32,859 Like my laptop has touch, ID built into it, right? 569 00:26:33,429 --> 00:26:39,009 Um, so it's an incredibly powerful device, but, and also it's a device. 570 00:26:39,504 --> 00:26:41,814 Upon which we rely so much. 571 00:26:41,874 --> 00:26:42,324 Right? 572 00:26:42,864 --> 00:26:49,854 And so you need a system through which you can recover that device if it 573 00:26:49,854 --> 00:26:52,374 goes, uh, if things go poorly, right? 574 00:26:52,944 --> 00:26:55,464 And whether it's, it's, it's, it's hacked. 575 00:26:55,524 --> 00:27:01,404 Um, it, or you just drop it, you know, in a sink somewhere, right? 576 00:27:01,404 --> 00:27:02,034 Shut up. 577 00:27:02,184 --> 00:27:02,484 I know. 578 00:27:02,484 --> 00:27:03,474 Shut up, shut up. 579 00:27:03,984 --> 00:27:05,124 I know what you're talking about. 580 00:27:05,694 --> 00:27:08,124 Um, and, um. 581 00:27:08,904 --> 00:27:11,304 If you do something stupid, you know what? 582 00:27:11,484 --> 00:27:16,674 You know, when I cracked, when I cracked my screen, uh, several years ago, I went, 583 00:27:16,674 --> 00:27:21,744 I went and got it repaired and, and then while walking to my car from the screen 584 00:27:21,744 --> 00:27:27,264 repair place, I, I tripped and I literally fell onto my phone and I cracked the 585 00:27:27,264 --> 00:27:28,764 screen again and I just had to go back. 586 00:27:30,024 --> 00:27:30,624 Um, 587 00:27:31,359 --> 00:27:32,049 Curtis. 588 00:27:32,049 --> 00:27:32,109 Hmm. 589 00:27:32,334 --> 00:27:33,384 yeah, that sucks. 590 00:27:33,444 --> 00:27:34,584 Um, but anyway. 591 00:27:35,109 --> 00:27:37,839 The question you should ask yourself as to whether or not you need to 592 00:27:37,839 --> 00:27:41,979 do endpoint backup as whether or not your endpoint has data on it. 593 00:27:42,729 --> 00:27:43,029 Right? 594 00:27:43,119 --> 00:27:46,239 Data that only resides there, right? 595 00:27:46,239 --> 00:27:49,509 If you're, if you're using, if you're using an iPhone or an Android. 596 00:27:49,719 --> 00:27:52,419 And that's what we're talking about from an endpoint perspective. 597 00:27:53,079 --> 00:27:58,869 And you're just using Google Photos or, uh, you know, iPhoto, and that's what 598 00:27:58,869 --> 00:28:02,439 we're talking about that is generally synchronized up to the cloud, right? 599 00:28:02,454 --> 00:28:02,744 Yeah. 600 00:28:03,099 --> 00:28:08,319 Um, but if you're using a third party app to do photos of your job sites, 601 00:28:09,099 --> 00:28:11,649 because there are third party apps that do photos of your job sites. 602 00:28:12,849 --> 00:28:14,529 Where, where are those photos are? 603 00:28:14,529 --> 00:28:15,609 Are they only on the phone? 604 00:28:15,609 --> 00:28:17,469 Are they synchronized up to the cloud? 605 00:28:17,799 --> 00:28:21,879 Uh, is there a system by which you can find out that all of the, 606 00:28:21,909 --> 00:28:23,409 that synchronization is working 607 00:28:23,624 --> 00:28:23,914 Yeah. 608 00:28:24,039 --> 00:28:27,909 you don't find out too late that these really important job site 609 00:28:27,909 --> 00:28:31,809 photos were only on Steve's phone and now Steve's phone just got ran 610 00:28:31,809 --> 00:28:37,569 over by a truck because Steve got ran over by a truck and, uh, poor Steve. 611 00:28:37,779 --> 00:28:38,139 Yes. 612 00:28:38,139 --> 00:28:39,039 Poor Steve. 613 00:28:39,054 --> 00:28:39,534 Right. 614 00:28:40,044 --> 00:28:40,974 So that's the question. 615 00:28:41,004 --> 00:28:46,434 If you have endpoint devices where data is being created on those endpoint 616 00:28:46,434 --> 00:28:49,824 devices as opposed to just using them. 617 00:28:49,884 --> 00:28:56,304 So 99% of what I do, al almost a hundred percent of what I do really is 618 00:28:56,619 --> 00:28:56,769 In 619 00:28:56,934 --> 00:28:59,724 I'm using a, some cloud service. 620 00:29:00,099 --> 00:29:03,789 To do the thing, like right now we're using a cloud service to record this data. 621 00:29:03,789 --> 00:29:09,729 The, this, this recording until I edit it, it only sits in this, um, 622 00:29:09,789 --> 00:29:11,589 you know, this little cloud service. 623 00:29:13,119 --> 00:29:15,069 It's not, I'll just tell you that right now. 624 00:29:16,329 --> 00:29:19,509 The, the, during the interim, if we would be like, uh, we 625 00:29:19,509 --> 00:29:21,039 would be like, uh, those guys. 626 00:29:21,039 --> 00:29:21,849 What were those guys? 627 00:29:21,849 --> 00:29:27,969 The, the, the storage container, uh, people, the life uncontained. 628 00:29:28,689 --> 00:29:29,269 Oh, yes. 629 00:29:29,769 --> 00:29:32,979 Yeah, we would be like dim, uh, we would lose, we, we would 630 00:29:32,979 --> 00:29:34,059 lose a couple of episodes. 631 00:29:34,059 --> 00:29:40,599 I think, uh, if, if squad cast decided to, to go tango uniform, but what I 632 00:29:40,599 --> 00:29:44,769 was saying was that I use this and then I'm gonna use, I'm gonna use uh 633 00:29:44,769 --> 00:29:49,299 uh, descrip, which is gonna pull this over to Descrip and it's gonna edit it. 634 00:29:49,299 --> 00:29:50,499 And that happens in the cloud. 635 00:29:50,709 --> 00:29:53,979 There is a cloud, there is a local copy of Descrip. 636 00:29:53,979 --> 00:29:57,399 It runs on my laptop, but that's just, um. 637 00:29:57,534 --> 00:29:58,104 Like a cash 638 00:29:58,224 --> 00:30:00,144 You it, it's a cash copy, right? 639 00:30:00,354 --> 00:30:03,264 So if that's the way you're dealing with stuff, then you don't really 640 00:30:03,264 --> 00:30:06,564 have to worry that much about endpoint device Pro, you know, backup. 641 00:30:06,819 --> 00:30:07,109 Yeah. 642 00:30:07,134 --> 00:30:11,004 You need to worry about it from a device protection and data protection 643 00:30:11,004 --> 00:30:15,174 standpoint to to access to those systems because they could be used 644 00:30:15,174 --> 00:30:17,154 to access the, your critical data. 645 00:30:17,154 --> 00:30:17,694 But you don't. 646 00:30:17,994 --> 00:30:21,174 If you're not creating data and storing data on that endpoint, then 647 00:30:21,174 --> 00:30:22,314 you don't have to worry about it. 648 00:30:22,314 --> 00:30:24,294 But if you are, then you should. 649 00:30:24,594 --> 00:30:24,804 Yeah. 650 00:30:24,894 --> 00:30:29,484 Well, and also everything you've mentioned I agree with only 651 00:30:29,484 --> 00:30:31,494 applies to backing up the data. 652 00:30:31,734 --> 00:30:37,374 It has nothing to do with endpoint device or detection and response EDR tools and 653 00:30:37,734 --> 00:30:38,094 right, 654 00:30:38,154 --> 00:30:38,604 right? 655 00:30:38,934 --> 00:30:39,144 right. 656 00:30:39,144 --> 00:30:39,414 That's 657 00:30:39,534 --> 00:30:39,924 Yeah. 658 00:30:39,984 --> 00:30:42,954 that you still probably need, even if you are using a hundred percent 659 00:30:42,954 --> 00:30:47,214 cloud services, because those endpoint devices are a gateway to your network. 660 00:30:48,324 --> 00:30:48,714 Yeah. 661 00:30:48,744 --> 00:30:52,824 So yeah, EDR tools, uh, which again, we discuss in the 662 00:30:52,824 --> 00:30:55,554 ransomware book, uh, learning, ransomware response and recovery. 663 00:30:56,064 --> 00:30:59,244 Those are, they're, they're the canary in the coal mine, right? 664 00:30:59,244 --> 00:31:03,414 They, you most likely will be getting ransomware via an endpoint. 665 00:31:03,954 --> 00:31:08,304 So having EDR on your is a great way to find that before it becomes a problem. 666 00:31:08,454 --> 00:31:08,754 So. 667 00:31:08,979 --> 00:31:12,519 I wonder what other countries use instead of canary in a coal mine. 668 00:31:15,309 --> 00:31:17,109 Are we the only country with coal mines? 669 00:31:19,209 --> 00:31:20,979 We're not the only country with coal mines. 670 00:31:21,129 --> 00:31:24,609 You just, maybe we don't have the, they, they don't have the, 671 00:31:24,639 --> 00:31:28,569 um, surely they also used canary. 672 00:31:28,749 --> 00:31:29,559 What is a canary? 673 00:31:29,589 --> 00:31:31,329 Why do we say canary in a coal mine? 674 00:31:31,329 --> 00:31:33,789 Do you, do you, do you know the etymology of that, right? 675 00:31:34,059 --> 00:31:39,279 miners used to take canaries in with them, and therefore, if oxygen was. 676 00:31:40,284 --> 00:31:41,934 Running out or whatever else. 677 00:31:41,934 --> 00:31:42,414 If there was an 678 00:31:42,424 --> 00:31:42,714 Yeah. 679 00:31:42,774 --> 00:31:45,864 they were about to pass out, then the canary would pass out first or die, 680 00:31:45,879 --> 00:31:46,329 Yeah. 681 00:31:46,374 --> 00:31:48,474 therefore they knew there wasn't enough oxygen, so then 682 00:31:48,519 --> 00:31:49,299 Time to get out. 683 00:31:50,439 --> 00:31:51,069 Exactly. 684 00:31:51,489 --> 00:31:56,409 Um, I just had a memory of, um, Zoolander when Zoolander, he was, 685 00:31:57,039 --> 00:32:00,489 he was, when he worked in the coal mines that he came out like one day. 686 00:32:00,489 --> 00:32:02,079 He goes, I think I got the black lung. 687 00:32:05,259 --> 00:32:06,249 Love, love that movie. 688 00:32:06,939 --> 00:32:07,929 Alright, well there you go. 689 00:32:07,979 --> 00:32:10,829 10 backup elements that you need to have in any company. 690 00:32:10,829 --> 00:32:11,159 Right? 691 00:32:11,159 --> 00:32:15,549 Let's just review 'em again, the 3, 2, 1 rule, the regular backup schedule, 692 00:32:15,579 --> 00:32:19,359 backup testing, and verification, defined recovery objectives. 693 00:32:19,729 --> 00:32:24,499 Backup security and isolation, SaaS backup, uh, documentation 694 00:32:24,499 --> 00:32:28,249 and runbooks, uh, retention policies, monitoring and alerting. 695 00:32:28,249 --> 00:32:30,709 And finally, endpoint backup. 696 00:32:31,369 --> 00:32:32,239 Uh, this is good. 697 00:32:32,239 --> 00:32:33,199 I like this episode. 698 00:32:33,529 --> 00:32:36,529 I like, you know, episodes with lists, fast facts. 699 00:32:36,859 --> 00:32:37,999 All right, thanks. 700 00:32:37,999 --> 00:32:40,279 Prasanna for being my canary in a co 701 00:32:43,429 --> 00:32:45,229 or bird brain being my bird brain. 702 00:32:46,734 --> 00:32:48,024 anytime, Curtis, for you. 703 00:32:49,254 --> 00:32:49,734 All right. 704 00:32:49,824 --> 00:32:53,814 And, uh, thanks to everyone listening, uh, that is a wrap.