1 00:00:02,256 --> 00:00:06,246 On this episode of restored all we're talking about how to secure your backup 2 00:00:06,246 --> 00:00:11,676 data, to make sure that it doesn't get attacked in a ransomware attack. 3 00:00:12,006 --> 00:00:12,606 Hope you enjoy. 4 00:00:12,696 --> 00:00:13,356 The episode. 5 00:00:35,411 --> 00:00:38,471 W. Curtis Preston: Hi, and welcome to Backup Central's Restore it All podcast. 6 00:00:38,471 --> 00:00:39,231 I'm your host, W. 7 00:00:39,251 --> 00:00:41,471 Curtis Preston, a k a, Mr. 8 00:00:41,621 --> 00:00:45,881 Backup, and I with me, a guy whose only major flaw is that he 9 00:00:45,881 --> 00:00:47,801 won't go see scary movies with me. 10 00:00:48,161 --> 00:00:49,461 Prasanna Malaiyandi. 11 00:00:49,481 --> 00:00:50,021 How's it going? 12 00:00:50,021 --> 00:00:50,841 Prasanna. 13 00:00:51,056 --> 00:00:52,316 Prasanna Malaiyandi: I am good, Curtis. 14 00:00:52,316 --> 00:00:58,346 I, yeah, I'm not a big fan of scary movies, especially on a large screen. 15 00:00:59,036 --> 00:01:04,646 Um, I don't like, I know some people like you love it, but it's just I don't 16 00:01:04,646 --> 00:01:06,986 find joy in watching a scary movie. 17 00:01:06,991 --> 00:01:08,806 I do remember in college watching the Ring. 18 00:01:09,956 --> 00:01:10,826 On a big screen. 19 00:01:12,671 --> 00:01:14,261 W. Curtis Preston: That movie messed with my head. 20 00:01:15,641 --> 00:01:18,951 I remember coming home and asking someone to take my picture. 21 00:01:21,431 --> 00:01:23,261 And saying, is there a thing in the picture? 22 00:01:23,261 --> 00:01:25,151 You know, I was scared. 23 00:01:25,151 --> 00:01:26,321 I was scared to take the picture. 24 00:01:26,351 --> 00:01:26,591 Yeah. 25 00:01:26,591 --> 00:01:28,751 That movie, that was, that was a fun movie. 26 00:01:28,991 --> 00:01:31,271 Um, it really kind of messed with your head. 27 00:01:31,436 --> 00:01:34,946 Prasanna Malaiyandi: And you just saw a scary movie just recently. 28 00:01:35,471 --> 00:01:36,041 W. Curtis Preston: Yeah. 29 00:01:36,041 --> 00:01:36,651 It, it, 30 00:01:37,046 --> 00:01:38,156 Prasanna Malaiyandi: Well, I wouldn't know if I'd called 31 00:01:38,531 --> 00:01:40,841 W. Curtis Preston: movie per se, it's more like a thriller. 32 00:01:41,951 --> 00:01:46,511 Um, It's called the Menu and it stars. 33 00:01:46,541 --> 00:01:57,701 Uh, Ralph finds, um, a k a Voldemort, and uh, Anya, the girl from the Queens gambit. 34 00:01:58,926 --> 00:01:59,141 Yeah. 35 00:01:59,591 --> 00:02:04,151 Um, and some other, other character actors that you may be familiar with. 36 00:02:04,181 --> 00:02:10,211 Um, and, uh, it, it's, it's a movie that I, I enjoyed the movie. 37 00:02:10,301 --> 00:02:15,431 I will just say this, um, trigger alert for those who are bothered by such things. 38 00:02:15,431 --> 00:02:16,781 It does contain suicide. 39 00:02:17,451 --> 00:02:25,601 Um, having said that, um, within the context of the show, it, it was a 40 00:02:25,601 --> 00:02:27,041 significant part of the storyline. 41 00:02:27,581 --> 00:02:28,001 Prasanna Malaiyandi: Mm-hmm. 42 00:02:28,151 --> 00:02:33,521 W. Curtis Preston: Um, and um, but having said that, it 43 00:02:33,521 --> 00:02:37,421 was a really unique storyline. 44 00:02:37,421 --> 00:02:40,301 That's a commentary on Modern Day Society. 45 00:02:40,421 --> 00:02:45,071 You know, there's a class thing, there's a, there's a, yeah. 46 00:02:45,146 --> 00:02:47,276 Prasanna Malaiyandi: It's not often that you come out of a movie and be 47 00:02:47,276 --> 00:02:49,196 like, oh my God, that was so good. 48 00:02:49,751 --> 00:02:51,671 W. Curtis Preston: yeah, it was, it was, I really enjoyed it. 49 00:02:51,671 --> 00:02:54,251 I was like, oh, that was, I, I thought the ending. 50 00:02:55,856 --> 00:02:56,246 I don't know. 51 00:02:56,756 --> 00:03:02,276 I think I would've done something slightly differently within the ending, but the um, 52 00:03:02,546 --> 00:03:04,256 Prasanna Malaiyandi: That is why you are not the director, Curtis. 53 00:03:04,261 --> 00:03:04,946 We're the writer. 54 00:03:05,351 --> 00:03:07,661 W. Curtis Preston: Yeah, that's why I'm not the director or the writer. 55 00:03:07,661 --> 00:03:09,311 I, I was not the only one, by the way. 56 00:03:09,311 --> 00:03:12,671 I read some reviews and stuff, and a lot of people felt the ending 57 00:03:12,671 --> 00:03:15,131 was somewhat anti cli climactic. 58 00:03:15,131 --> 00:03:17,051 But it was one of those movies where you're like, what? 59 00:03:17,111 --> 00:03:18,101 What is over? 60 00:03:18,161 --> 00:03:20,861 Like, it's one of those kind of movies, but everything all the 61 00:03:20,866 --> 00:03:23,051 way up to that point I thought, I thought was really, really good. 62 00:03:23,291 --> 00:03:24,701 All the actors are really good. 63 00:03:24,881 --> 00:03:25,511 Um, 64 00:03:25,586 --> 00:03:27,296 Prasanna Malaiyandi: never seen a Bollywood movie? 65 00:03:28,981 --> 00:03:30,491 W. Curtis Preston: yeah, what's 66 00:03:30,686 --> 00:03:33,026 Prasanna Malaiyandi: Where it's like anti-climactic at the very end. 67 00:03:33,026 --> 00:03:37,736 It's like they literally, a lot of the movies boiled the ending down 68 00:03:37,736 --> 00:03:39,356 to like the last like five minutes. 69 00:03:41,141 --> 00:03:41,741 W. Curtis Preston: interesting. 70 00:03:42,521 --> 00:03:43,791 Um, this one, 71 00:03:44,036 --> 00:03:45,206 Prasanna Malaiyandi: Shrek, oh, you would be proud. 72 00:03:45,206 --> 00:03:45,566 Shrek. 73 00:03:45,566 --> 00:03:47,966 And I watched while you were watching this movie, Shrek and 74 00:03:47,966 --> 00:03:49,196 I watched a Bollywood movie. 75 00:03:49,661 --> 00:03:50,221 W. Curtis Preston: Uhhuh, 76 00:03:50,726 --> 00:03:56,816 Prasanna Malaiyandi: On Netflix and it was also suspenseful and kind of a comedy 77 00:03:56,846 --> 00:04:03,746 thriller ish, but I would say that they basically wrapped up all the entire 78 00:04:03,746 --> 00:04:05,306 movie in the last like five minutes. 79 00:04:06,296 --> 00:04:10,016 And then at the end, Shraddha and I were like, what did we just watch? 80 00:04:11,066 --> 00:04:11,756 W. Curtis Preston: Interesting. 81 00:04:12,611 --> 00:04:16,031 Prasanna Malaiyandi: because we, because it left so many things open at the end and 82 00:04:16,031 --> 00:04:18,221 we're like, did we just watch all of that? 83 00:04:18,221 --> 00:04:20,741 Just for that last closing part? 84 00:04:21,566 --> 00:04:22,016 W. Curtis Preston: That's funny. 85 00:04:22,361 --> 00:04:24,521 Prasanna Malaiyandi: it's like two and a half hours also, so, 86 00:04:25,911 --> 00:04:28,691 W. Curtis Preston: Interesting thing about this movie is, you know, how the movie's 87 00:04:28,691 --> 00:04:30,881 gonna end about halfway into the movie. 88 00:04:31,781 --> 00:04:33,671 Like they tell you how the movie's gonna end. 89 00:04:34,181 --> 00:04:36,071 Um, it's just how it gets there. 90 00:04:36,151 --> 00:04:37,961 It, it, it's just was, was really good. 91 00:04:38,891 --> 00:04:40,601 Um, so I recommend it. 92 00:04:40,781 --> 00:04:44,141 Um, and, uh, you know, the, the 93 00:04:44,186 --> 00:04:44,576 Prasanna Malaiyandi: are you and 94 00:04:44,871 --> 00:04:45,711 W. Curtis Preston: saga continues. 95 00:04:45,731 --> 00:04:46,211 What I. 96 00:04:46,526 --> 00:04:48,206 Prasanna Malaiyandi: Are you and Jeff gonna talk about it on 97 00:04:48,236 --> 00:04:49,946 your next, on the other podcast, 98 00:04:50,081 --> 00:04:51,881 W. Curtis Preston: know, he keeps threatening to record another 99 00:04:51,881 --> 00:04:53,351 episode and then he doesn't do it. 100 00:04:53,351 --> 00:04:55,031 But I'll , I'll take 101 00:04:55,136 --> 00:04:57,156 Prasanna Malaiyandi: I think Curtis is calling you out here. 102 00:04:59,961 --> 00:05:03,121 W. Curtis Preston: Jeff and I actually recorded a new episode this week, so look 103 00:05:03,121 --> 00:05:07,421 for it at, The Things That Entertain Us podcast, wherever you listen to podcasts. 104 00:05:07,477 --> 00:05:12,817 Today we're going, we're continuing in our backup to basic series, and we're 105 00:05:12,822 --> 00:05:17,767 covering, again, we're covering the book, modern Data Protection on Hold. 106 00:05:18,382 --> 00:05:23,392 For those of you watching this on backup central.com where you can watch the video 107 00:05:23,632 --> 00:05:26,332 of Prasanna and I waxing philosophical. 108 00:05:28,447 --> 00:05:35,977 Um, and, uh, you know, what we're doing is we're sort of going through the book and 109 00:05:35,982 --> 00:05:39,937 just discussing, you know, some important topics that I, that I found in the book. 110 00:05:40,447 --> 00:05:46,027 Um, and this next one is about protecting backup and archive data, which I 111 00:05:46,027 --> 00:05:47,797 think we can all agree is important. 112 00:05:48,777 --> 00:05:52,277 If you would like to download a free e-book copy of Modern Data Protection, 113 00:05:52,307 --> 00:05:54,857 you can do so at druva.com  slash ebook. 114 00:05:55,057 --> 00:05:58,117 Uh, we have to protect it from a couple of different things, right? 115 00:05:59,377 --> 00:06:04,387 We have to, mainly what I'm talking about in here is protecting 116 00:06:04,387 --> 00:06:07,357 it against attacks, right? 117 00:06:08,017 --> 00:06:16,567 Um, both attacks from like a, um, like a disaster type type attack. 118 00:06:16,567 --> 00:06:22,237 But, but mainly what I'm talking about is protecting it from cyber attacks, which. 119 00:06:23,737 --> 00:06:26,767 Um, I'm gonna have these same conversations over and over, so 120 00:06:26,767 --> 00:06:30,907 sometimes I forget what we say here versus what I say other places, but 121 00:06:32,857 --> 00:06:42,487 it, it is a well acknowledged fact that some of the largest of the ransomware 122 00:06:42,487 --> 00:06:52,537 bad actors are specifically targeting backup systems in order to do the. 123 00:06:53,302 --> 00:06:57,712 The extortion style of ransomware attack, and let me specify what I'm saying there. 124 00:06:58,312 --> 00:07:04,552 So, you know, a, a bunch of companies started realizing that, well, if I just 125 00:07:04,552 --> 00:07:09,052 get a decent backup in recovery and disaster recovery system, I can say, you 126 00:07:09,057 --> 00:07:12,202 know, pound sand to the ransomware folks. 127 00:07:12,772 --> 00:07:16,192 Well, the ransomware folks then said, oh, well, we'll show you. 128 00:07:16,402 --> 00:07:20,812 And so they developed this, this exfiltration style, right. 129 00:07:21,777 --> 00:07:29,152 and the um, The idea there is that they find databases and file 130 00:07:29,152 --> 00:07:33,292 systems and spreadsheets and whatnot that contains sensitive data. 131 00:07:33,297 --> 00:07:34,522 That could be two different things. 132 00:07:34,527 --> 00:07:35,992 That could be your company secrets. 133 00:07:35,992 --> 00:07:37,342 It could be your company plans. 134 00:07:37,342 --> 00:07:42,527 It could be your 11 herbs and spices or your, your, um, You know, your 135 00:07:42,527 --> 00:07:48,377 corporate plans for the next year, you know, um, but it could also be 136 00:07:48,467 --> 00:07:51,347 secrets that are like embarrassing. 137 00:07:51,707 --> 00:07:54,167 Uh, I think the best example of that, and I know we've talked 138 00:07:54,167 --> 00:07:55,457 about it, is the Sony attack 139 00:07:56,227 --> 00:07:58,717 Prasanna Malaiyandi: This is the one where someone broke in to the 140 00:07:58,717 --> 00:08:04,687 movie studios and got a bunch of emails talking about scripts and 141 00:08:04,717 --> 00:08:06,577 actors and all the rest of that. 142 00:08:06,817 --> 00:08:12,307 W. Curtis Preston: and very, some, some, and not very, not very flattering terms. 143 00:08:12,307 --> 00:08:12,607 Yeah. 144 00:08:12,907 --> 00:08:14,317 So it could be that, right? 145 00:08:14,827 --> 00:08:21,457 But the point is, there is no way to protect against that once the data's out. 146 00:08:21,997 --> 00:08:22,327 Prasanna Malaiyandi: Yep. 147 00:08:22,612 --> 00:08:23,902 W. Curtis Preston: It's not like the other attack. 148 00:08:23,902 --> 00:08:27,712 If you get the, the old school attack, if you had a good backup system, you're good. 149 00:08:27,832 --> 00:08:30,652 It doesn't matter how good of a backup system you have, if the data is 150 00:08:30,652 --> 00:08:37,162 exfiltrated, uh, you're gonna be forced to make some major, uh, decisions, right? 151 00:08:38,422 --> 00:08:45,922 So, um, so what, what these, uh, ransomware groups have started 152 00:08:45,922 --> 00:08:52,552 realizing is, they, uh, instead the, the people are starting to 153 00:08:52,552 --> 00:08:54,922 harden their primary environments. 154 00:08:54,922 --> 00:08:55,282 Right? 155 00:08:56,212 --> 00:09:02,332 And so, but one, you know, you, you, you've heard me talk, did 156 00:09:02,337 --> 00:09:06,652 I say one thing that has never changed in backup and recovery in 157 00:09:06,652 --> 00:09:07,942 the world of backup and recovery? 158 00:09:07,942 --> 00:09:09,022 Do you, do you know what it is? 159 00:09:09,022 --> 00:09:13,072 I often say like the one thing that has never changed, 160 00:09:14,242 --> 00:09:19,042 Prasanna Malaiyandi: that the junior person is always responsible for backups 161 00:09:19,042 --> 00:09:19,882 and recovery. 162 00:09:20,167 --> 00:09:23,917 W. Curtis Preston: that is technically a cause of the thing of the thing that 163 00:09:23,917 --> 00:09:25,187 Prasanna Malaiyandi: No one who cares about 164 00:09:25,417 --> 00:09:27,577 W. Curtis Preston: no one wants to do the backups, right? 165 00:09:28,087 --> 00:09:32,377 No one wants to raise their hand and say that they want to be the backup guy. 166 00:09:32,647 --> 00:09:33,427 So why does that matter? 167 00:09:33,427 --> 00:09:37,297 Well, it's because it means that, that it ends up being an 168 00:09:37,297 --> 00:09:40,117 an or and an ignored system. 169 00:09:40,417 --> 00:09:40,837 Prasanna Malaiyandi: Yep. 170 00:09:41,917 --> 00:09:49,192 W. Curtis Preston: and as a result, it means that it gets ignored by everyone, 171 00:09:49,192 --> 00:09:51,082 including the cybersecurity folks. 172 00:09:51,232 --> 00:09:51,622 Right? 173 00:09:52,102 --> 00:09:54,232 Prasanna Malaiyandi: They're like, ah, that's just a systematic in the corner. 174 00:09:54,232 --> 00:09:55,042 It's fine. 175 00:09:55,312 --> 00:09:58,492 We don't care about it except it contains all of our data. 176 00:09:59,332 --> 00:09:59,872 W. Curtis Preston: Yeah. 177 00:10:00,572 --> 00:10:06,352 And depending on how, how you handle, um, things like encryption, 178 00:10:07,132 --> 00:10:09,122 they may be able to unen encrypt. 179 00:10:09,592 --> 00:10:13,132 Said backups and then, you know, get the keys to the kingdom. 180 00:10:13,357 --> 00:10:16,177 Prasanna Malaiyandi: Yeah, and like you were saying earlier, Curtis, 181 00:10:16,177 --> 00:10:20,167 the fact that a lot of people focus on production systems harden 182 00:10:20,167 --> 00:10:23,107 them, but they may not always be considering these backup systems. 183 00:10:24,442 --> 00:10:25,462 W. Curtis Preston: Right, right, right. 184 00:10:25,747 --> 00:10:26,467 Prasanna Malaiyandi: Easy target. 185 00:10:27,292 --> 00:10:28,132 W. Curtis Preston: Easy target. 186 00:10:28,132 --> 00:10:29,952 And so you need to. 187 00:10:31,012 --> 00:10:32,497 not be such an easy target, right? 188 00:10:33,007 --> 00:10:36,697 It's like the old joke about the guy, two guys crossing a field and they 189 00:10:36,697 --> 00:10:41,587 see, they see a bull and the guy says, you know, can you outrun that bull? 190 00:10:41,587 --> 00:10:42,997 He said, Nope, I don't have to. 191 00:10:43,237 --> 00:10:43,837 What are you talking about? 192 00:10:43,867 --> 00:10:45,157 All I have to do is outrun you, 193 00:10:45,322 --> 00:10:45,442 Prasanna Malaiyandi: You 194 00:10:46,747 --> 00:10:51,177 W. Curtis Preston: So, so you just want to be less of an interesting 195 00:10:51,182 --> 00:10:53,057 target than the person next to you. 196 00:10:54,667 --> 00:10:58,687 So the, the first thing that we talk about in terms of protecting 197 00:10:58,687 --> 00:11:00,247 backup data is encryption, 198 00:11:00,832 --> 00:11:03,442 Prasanna Malaiyandi: Yeah, which everyone should be doing. 199 00:11:03,442 --> 00:11:08,182 Like if no, if you aren't doing encrypting your backups, I don't 200 00:11:08,182 --> 00:11:09,352 know what's wrong with you. 201 00:11:09,352 --> 00:11:12,542 Like even if it's not encrypted, honestly, 202 00:11:12,547 --> 00:11:13,867 W. Curtis Preston: Tell us what you really think. 203 00:11:14,232 --> 00:11:14,582 Prasanna Malaiyandi: No. 204 00:11:15,502 --> 00:11:19,852 , no, because encryption isn't some heavyweight thing that it used to be. 205 00:11:19,852 --> 00:11:20,182 Right. 206 00:11:20,182 --> 00:11:25,402 You don't have to go physically encrypt your data as it comes out. 207 00:11:25,402 --> 00:11:27,352 You could do disc level encryption, right? 208 00:11:27,682 --> 00:11:28,132 There's so. 209 00:11:28,747 --> 00:11:33,067 Ways you could leverage encryption to fit into your environment. 210 00:11:33,067 --> 00:11:36,277 It should be a no-brainer that all your data at rest is encrypted. 211 00:11:37,117 --> 00:11:38,977 And in a lot of companies, right? 212 00:11:38,977 --> 00:11:42,067 If you wanna fit, be sort of like, uh, what is it? 213 00:11:42,067 --> 00:11:45,997 If you wanna look at HIPAA com, uh, readiness or other things, right? 214 00:11:46,002 --> 00:11:48,127 Other regulatory obligations. 215 00:11:48,397 --> 00:11:51,397 A lot of 'em say All your data at at rest should be encrypt. 216 00:11:52,132 --> 00:11:52,742 W. Curtis Preston: Mm-hmm. 217 00:11:53,152 --> 00:11:58,102 . Well, I, um, I do think, I do think backup page backup data should be 218 00:11:58,102 --> 00:12:00,232 encrypted for this very reason. 219 00:12:00,292 --> 00:12:00,652 Right? 220 00:12:01,072 --> 00:12:04,852 And I'll give you different reasons for the different things, right? 221 00:12:04,852 --> 00:12:08,302 So if it's, if you got a backup server on-prem and you're 222 00:12:08,307 --> 00:12:09,822 storing your backups on a. 223 00:12:11,032 --> 00:12:14,182 File system, you know, an NFS mounted file system. 224 00:12:15,112 --> 00:12:18,772 Then if they're unencrypted, you know 225 00:12:18,922 --> 00:12:19,912 Prasanna Malaiyandi: Everyone has access. 226 00:12:19,972 --> 00:12:20,272 Yeah. 227 00:12:20,732 --> 00:12:23,362 W. Curtis Preston: Everyone has access to those backups and a lot of these PR 228 00:12:23,482 --> 00:12:31,342 backup products they offer like to, to, to, so some of the backup products store 229 00:12:31,342 --> 00:12:33,772 the backups, not in a backup format. 230 00:12:33,772 --> 00:12:36,742 They're in native format, so you could just mount a disc, right? 231 00:12:37,312 --> 00:12:39,712 Other backup products, put it in a backup format. 232 00:12:40,702 --> 00:12:43,652 but they offer an ability to read that backups like it, 233 00:12:43,652 --> 00:12:45,172 it's, it's for DR purposes. 234 00:12:45,172 --> 00:12:48,952 So, so if you're not encrypting them, then you're just, you're 235 00:12:48,952 --> 00:12:50,062 just asking for trouble. 236 00:12:50,242 --> 00:12:51,382 So that's the disc side. 237 00:12:51,387 --> 00:12:53,692 The second side will be the tape side. 238 00:12:53,697 --> 00:12:56,902 So if you are, and believe it or not, many people are still making backup 239 00:12:56,902 --> 00:13:02,242 tapes and they're making 'em primarily, I think for offsite, uh, storage. 240 00:13:02,437 --> 00:13:02,857 Prasanna Malaiyandi: Yep. 241 00:13:03,652 --> 00:13:08,212 W. Curtis Preston: And so, And this is the, this is the one where I'm like, 242 00:13:08,242 --> 00:13:15,082 if you are ma, if you are putting your company's like crown jewels onto a little, 243 00:13:15,292 --> 00:13:19,702 you know, plastic tape and then you're handing it to a man in a van and you are 244 00:13:19,702 --> 00:13:26,812 not at this point encrypting that data, you know, professional malfeasance at this 245 00:13:26,977 --> 00:13:32,137 Prasanna Malaiyandi: Well, and I wonder, it's almost as if that should be like 246 00:13:32,137 --> 00:13:37,177 a default, you know, like you can't write data out without encrypting it, 247 00:13:38,287 --> 00:13:41,917 but I guess you have to deal with key management and all the rest of that, 248 00:13:41,922 --> 00:13:45,292 and so, , do you have flexibility to shoot yourself in the foot? 249 00:13:46,537 --> 00:13:47,617 W. Curtis Preston: yeah, exactly. 250 00:13:48,217 --> 00:13:53,797 Um, but I will also say this encryption is only good, is only as good as the 251 00:13:53,797 --> 00:13:57,367 authentication and authorization and key management system that is connected to it. 252 00:13:58,177 --> 00:14:00,547 And if you can easily defeat. 253 00:14:01,162 --> 00:14:07,402 That, uh, system then, you know, and, and, and I mentioned, so for example, 254 00:14:07,402 --> 00:14:12,532 I know we mentioned it on the podcast, please do not make your backup server 255 00:14:12,532 --> 00:14:14,662 part of your, uh, active directory. 256 00:14:15,442 --> 00:14:16,912 What, what is it, what is it called? 257 00:14:16,917 --> 00:14:17,512 A cloud? 258 00:14:18,292 --> 00:14:19,162 Just a domain. 259 00:14:19,492 --> 00:14:19,822 Yeah. 260 00:14:20,422 --> 00:14:23,152 Um, please don't do that. 261 00:14:23,302 --> 00:14:29,002 , so the next term is one that we can debate. 262 00:14:30,172 --> 00:14:32,692 Uh, and I, I honestly, I don't even need you. 263 00:14:32,842 --> 00:14:36,142 I can debate it myself, right? 264 00:14:36,142 --> 00:14:39,742 It's one of those where I go back and forth, um, you 265 00:14:39,742 --> 00:14:40,732 know, and that's the term air. 266 00:14:42,382 --> 00:14:43,752 Prasanna Malaiyandi: What is like air gap? 267 00:14:43,752 --> 00:14:44,072 Curtis? 268 00:14:44,737 --> 00:14:48,187 W. Curtis Preston: well, well, there is, what was an air gap? 269 00:14:48,232 --> 00:14:48,382 Prasanna Malaiyandi: Yeah. 270 00:14:50,437 --> 00:14:54,007 W. Curtis Preston: It's, and it is where it, it is from once we get the term. 271 00:14:54,577 --> 00:14:59,347 So the idea was to put a gap of error between the protection 272 00:14:59,347 --> 00:15:01,597 copy and the protected thing. 273 00:15:02,287 --> 00:15:03,997 Prasanna Malaiyandi: Or, or since you're dealing with plumbing 274 00:15:03,997 --> 00:15:07,027 right now, since you're dealing with plumbing right now, right? 275 00:15:07,027 --> 00:15:09,457 You have an air gap normally, right? 276 00:15:09,457 --> 00:15:11,347 When you think about your dishwasher 277 00:15:11,632 --> 00:15:13,642 W. Curtis Preston: Now you made me think about the dishwasher that 278 00:15:13,837 --> 00:15:14,197 Prasanna Malaiyandi: or, 279 00:15:14,212 --> 00:15:15,322 W. Curtis Preston: life a living hell. 280 00:15:15,367 --> 00:15:15,667 Prasanna Malaiyandi: Fine. 281 00:15:15,847 --> 00:15:16,987 Or a toilet. 282 00:15:17,197 --> 00:15:17,547 How about that? 283 00:15:18,832 --> 00:15:20,547 that's actually technically a water gap, but 284 00:15:22,537 --> 00:15:23,437 W. Curtis Preston: Don't, you're killing me. 285 00:15:23,467 --> 00:15:25,327 Don't be, don't be bringing plumbing into this. 286 00:15:25,897 --> 00:15:27,397 Um, anyway, yeah. 287 00:15:27,397 --> 00:15:31,687 So you, you had to separate the, and it meant, again, it meant the, 288 00:15:31,867 --> 00:15:33,937 it meant the man in the van, right? 289 00:15:33,942 --> 00:15:38,587 You, you, you, you put some tapes in a box and you handed that box to a, you 290 00:15:38,592 --> 00:15:41,797 know, a man or a woman, and then they got into a van and they took it someplace. 291 00:15:41,977 --> 00:15:47,667 And in order to get to that thing, you needed to physically, Um, access it. 292 00:15:47,667 --> 00:15:47,937 Right? 293 00:15:47,937 --> 00:15:52,137 Which meant that if you were a hacker and you wanted to get to it, it, 294 00:15:52,137 --> 00:15:53,727 it would be virtually impossible. 295 00:15:53,727 --> 00:15:55,287 Not completely impossible. 296 00:15:55,287 --> 00:15:57,897 There's no, there's no, cuz I remember, 297 00:15:57,927 --> 00:15:58,902 Prasanna Malaiyandi: than cyber. 298 00:15:59,127 --> 00:16:03,627 W. Curtis Preston: yeah, I remember for example, we would, uh, once a 299 00:16:03,697 --> 00:16:08,637 year at an unannounced time, we would attempt to circumvent the security of. 300 00:16:09,427 --> 00:16:16,897 Uh, storage fender and we would, uh, use really good like liars and whatnot. 301 00:16:17,137 --> 00:16:20,617 And more specifically, we would use someone like me that they 302 00:16:20,617 --> 00:16:22,117 knew, they knew the person. 303 00:16:22,987 --> 00:16:26,857 And so they would go over there and they would, and we would just have 304 00:16:26,857 --> 00:16:30,547 this really, really like elaborate. 305 00:16:31,042 --> 00:16:38,062 Scenario that basically would want, would want the, it would make the 306 00:16:38,062 --> 00:16:43,132 person that works there want to leave us alone in the vault with the tapes. 307 00:16:44,392 --> 00:16:46,522 And at least once we were able to do that, 308 00:16:47,337 --> 00:16:47,457 Prasanna Malaiyandi: Hmm. 309 00:16:48,217 --> 00:16:52,857 Was a person go, or did the person have to go through training, I guess. 310 00:16:53,707 --> 00:16:56,437 W. Curtis Preston: Yeah, I don't, I, you know, honestly, I was so long ago, I don't 311 00:16:56,437 --> 00:17:00,007 remember what happened to that, to that person who left us alone in the vault. 312 00:17:00,727 --> 00:17:01,957 But, so that's what I'm saying. 313 00:17:01,957 --> 00:17:04,327 It's not, it, it was never 100%. 314 00:17:04,777 --> 00:17:05,287 Right. 315 00:17:05,377 --> 00:17:11,777 Um, the, um, I mean, you've seen the movies, you know, I've 316 00:17:11,777 --> 00:17:13,807 seen Oceans 11 and 12 and 13. 317 00:17:14,977 --> 00:17:20,287 The um, but the problem is most of us don't use tape. 318 00:17:20,662 --> 00:17:20,932 Prasanna Malaiyandi: Mm-hmm. 319 00:17:21,652 --> 00:17:24,202 W. Curtis Preston: And most of us, or many of us don't even 320 00:17:24,202 --> 00:17:25,582 use a data center anymore. 321 00:17:26,542 --> 00:17:33,412 So this idea of putting a, an actual air gap between A and B is quite difficult. 322 00:17:33,417 --> 00:17:41,662 And so we've sort of adopted or adapted to the, you know, the virtual air gap. 323 00:17:41,722 --> 00:17:42,142 Right. 324 00:17:42,562 --> 00:17:52,912 Um, the, um, Uh, so this is separated in as many ways as we can. 325 00:17:52,942 --> 00:17:53,212 I don't know. 326 00:17:53,272 --> 00:17:54,222 You want to talk about 327 00:17:54,382 --> 00:17:58,102 Prasanna Malaiyandi: Yeah, and I think we talked about this on the episode about 328 00:17:58,102 --> 00:18:00,082 backups, or maybe it was restores, but. 329 00:18:01,117 --> 00:18:07,627 It's even though they are available online, right, that second copy, 330 00:18:07,627 --> 00:18:10,897 so it's not the same as having that tape in a vault somewhere. 331 00:18:11,077 --> 00:18:14,397 You wanna make that, make it as close to that as possible. 332 00:18:14,857 --> 00:18:16,087 And we totally get that. 333 00:18:16,087 --> 00:18:18,127 You still have to have connectivity, right? 334 00:18:18,127 --> 00:18:20,047 It's still gonna be up, but can you lock it down? 335 00:18:20,457 --> 00:18:25,687 Can you basically make that target as inaccessible as possible? 336 00:18:27,367 --> 00:18:31,747 Uh, to prevent it from being attacked by say, someone, um, gaining access 337 00:18:31,747 --> 00:18:33,577 to your backup source, right? 338 00:18:33,577 --> 00:18:35,017 And now they have access to your vault. 339 00:18:35,497 --> 00:18:39,847 Uh, some of the examples are if you're backing up in the cloud, right, put 340 00:18:39,852 --> 00:18:44,467 it in a separate account that no one has access to other than whatever 341 00:18:44,467 --> 00:18:46,157 is transferring the data, right? 342 00:18:46,297 --> 00:18:47,887 Make it in a different region. 343 00:18:47,887 --> 00:18:49,867 So it's not easily accessible. 344 00:18:50,287 --> 00:18:52,867 And there are many, many, many other things you could do as well. 345 00:18:52,867 --> 00:18:54,117 But those are just some of the example. 346 00:18:55,417 --> 00:18:57,907 W. Curtis Preston: Yeah, I like if we're talking cloud, I like the 347 00:18:57,907 --> 00:19:00,607 idea of putting it in a different region and a different account. 348 00:19:01,147 --> 00:19:01,567 Right. 349 00:19:01,627 --> 00:19:04,057 Um, because we're not just talking about hacking. 350 00:19:04,057 --> 00:19:08,857 We're also, we also need to think about like, Disaster recovery 351 00:19:08,857 --> 00:19:10,207 and things like that, right? 352 00:19:10,297 --> 00:19:13,747 So again, O V H Cloud, we don't want to have that happen to us. 353 00:19:13,747 --> 00:19:18,337 So we want to make sure that a copy of the backup data is, is well far away 354 00:19:18,337 --> 00:19:19,927 from the thing that it's protecting. 355 00:19:21,037 --> 00:19:26,557 And yeah, separate account in a much more limited, an account with much 356 00:19:26,557 --> 00:19:30,847 more limited access, and you can. 357 00:19:31,252 --> 00:19:34,552 Um, you can consider using immutable storage, but we're 358 00:19:34,552 --> 00:19:36,082 gonna talk about that later. 359 00:19:36,082 --> 00:19:42,002 But essentially, this is the, we, we separated as much as possible. 360 00:19:42,022 --> 00:19:49,522 This is why, um, you know, one of your previous employers data domain, right? 361 00:19:49,582 --> 00:19:53,452 And, and, and, All of those things, they would always talk about 362 00:19:53,452 --> 00:19:55,162 replicating to another data domain. 363 00:19:55,912 --> 00:20:00,142 And I always, I always remember thinking, well, if I'm replicating to 364 00:20:00,142 --> 00:20:03,982 another data domain, it's essentially like in order to do that, I gotta 365 00:20:03,982 --> 00:20:07,042 have it in the same like land. 366 00:20:07,192 --> 00:20:07,642 Right? 367 00:20:07,702 --> 00:20:09,982 Or, or at least it's gonna look like it's in the land. 368 00:20:09,982 --> 00:20:10,432 Right. 369 00:20:11,002 --> 00:20:11,512 Um, 370 00:20:12,127 --> 00:20:14,227 Prasanna Malaiyandi: that's why they actually introduced a 371 00:20:14,227 --> 00:20:17,047 feature, specifically talking about data domain, right? 372 00:20:17,047 --> 00:20:19,147 Their cyber recovery solution. 373 00:20:19,662 --> 00:20:20,272 W. Curtis Preston: Mm-hmm. 374 00:20:20,307 --> 00:20:25,012 Prasanna Malaiyandi: that allowed for writing to a lockdown data domain that 375 00:20:25,012 --> 00:20:26,722 didn't have access from anywhere else. 376 00:20:26,842 --> 00:20:30,562 And going back to the point you were talking about, Curtis, okay, is it 377 00:20:30,567 --> 00:20:33,622 on the network and I can connect to it then, doesn't that make it open? 378 00:20:33,622 --> 00:20:37,252 And so what it would actually do is shut down network ports right 379 00:20:37,252 --> 00:20:41,032 outside of your backup windows, such that it's not available, or 380 00:20:41,032 --> 00:20:42,532 at least your attack surface is. 381 00:20:44,432 --> 00:20:47,032 W. Curtis Preston: Could you delete the backups? 382 00:20:47,032 --> 00:20:47,662 Was it. 383 00:20:48,292 --> 00:20:52,162 Could you delete the backups once you send it to it via the backup interface? 384 00:20:53,032 --> 00:20:53,752 Prasanna Malaiyandi: Typically no. 385 00:20:54,652 --> 00:20:55,012 W. Curtis Preston: Okay. 386 00:20:55,192 --> 00:20:57,532 Because that, cuz that would be, that would be an important part. 387 00:20:57,537 --> 00:20:57,892 Right. 388 00:20:58,042 --> 00:20:59,692 Prasanna Malaiyandi: It would also replicate like your 389 00:20:59,692 --> 00:21:00,622 backup environment, right? 390 00:21:00,622 --> 00:21:03,742 So you'd have your own backup server in that vault, if you will. 391 00:21:03,742 --> 00:21:07,012 So there's no connectivity to anything outside, because if there 392 00:21:07,012 --> 00:21:08,422 is, then you're just open to risk. 393 00:21:09,697 --> 00:21:10,387 W. Curtis Preston: Right, right. 394 00:21:10,987 --> 00:21:16,477 Um, yeah, so just like, so I've got a list here on virtual air gap here. 395 00:21:16,987 --> 00:21:20,017 So I talk about disabling or impairing R D P. 396 00:21:20,167 --> 00:21:21,047 Why does that matter? 397 00:21:22,012 --> 00:21:25,312 Prasanna Malaiyandi: Ah, so many ransomware issues have happened. 398 00:21:26,257 --> 00:21:26,917 Rdp, which 399 00:21:26,987 --> 00:21:28,067 W. Curtis Preston: what is R D P by the way? 400 00:21:28,387 --> 00:21:29,067 Thank you, 401 00:21:29,497 --> 00:21:29,737 Prasanna Malaiyandi: right? 402 00:21:29,737 --> 00:21:33,517 Which is how most people connect remotely to a Windows client. 403 00:21:34,297 --> 00:21:39,157 Um, most people forget to turn it off or they leave it on because it's just easier. 404 00:21:39,157 --> 00:21:40,657 They don't need to physically connect to it. 405 00:21:41,087 --> 00:21:46,282 Uh, The only downside is it's a big attack surface, and there are 406 00:21:46,282 --> 00:21:48,022 a lot of exploits using R D P. 407 00:21:48,022 --> 00:21:52,762 And so when you enable R D P, you're letting yourself or leaving yourself 408 00:21:52,762 --> 00:21:56,542 open to hackers and other exploits coming in, which could then move 409 00:21:56,542 --> 00:22:00,142 laterally across your network and take out other pieces of your environment. 410 00:22:01,162 --> 00:22:04,312 W. Curtis Preston: Yeah, there is a way to automate sort of disabling and 411 00:22:04,312 --> 00:22:08,302 enabling R D P, um, like on a large scale. 412 00:22:08,782 --> 00:22:13,882 Um, I also talk about putting it in a different operating system, right? 413 00:22:13,887 --> 00:22:16,522 Not using the same operating system for your backups in your 414 00:22:16,522 --> 00:22:18,982 primary, uh, if that's possible. 415 00:22:19,042 --> 00:22:22,162 I know that there's a lot of big window shops and they use windows. 416 00:22:23,182 --> 00:22:24,832 Uh, backup servers. 417 00:22:25,732 --> 00:22:27,052 I don't think that's a good idea. 418 00:22:27,142 --> 00:22:33,847 Um, but you know, Um, and by the way, I, I forgot to throw out our disclaimer. 419 00:22:33,847 --> 00:22:36,197 I'll throw out, um, Prasanna. 420 00:22:36,467 --> 00:22:37,397 Prasanna. 421 00:22:37,417 --> 00:22:38,887 And I work for different companies. 422 00:22:39,247 --> 00:22:40,147 I work for Druva. 423 00:22:40,152 --> 00:22:41,137 He works for Zoom. 424 00:22:41,647 --> 00:22:43,627 And this is not a podcast of either company. 425 00:22:43,627 --> 00:22:47,527 This is an independent podcast and the opinions that you hear are ours. 426 00:22:48,157 --> 00:22:51,907 And, uh, be sure to rate us@ratethispodcast.com slash restore. 427 00:22:52,417 --> 00:22:56,687 And, um, if you'd like to join the conversation, you want to talk. 428 00:22:57,132 --> 00:22:58,542 What's going on in your world? 429 00:22:58,992 --> 00:23:01,842 Uh, you know, whether you're, uh, you know, an end user. 430 00:23:01,842 --> 00:23:04,992 If you're an end user, we really want to have you, you know, real 431 00:23:04,997 --> 00:23:08,142 people that actually do backups out there in the trenches. 432 00:23:08,142 --> 00:23:08,442 Weed. 433 00:23:08,442 --> 00:23:10,482 You're, you're it, man. 434 00:23:11,802 --> 00:23:24,232 No I do, uh, you know, as soon as I think about, um, Back when I used to 435 00:23:24,232 --> 00:23:28,402 be the person in the trenches, like when I was a consultant, and I, and 436 00:23:28,402 --> 00:23:37,162 I, I flashback to this one time where we were completely redoing the backups 437 00:23:37,342 --> 00:23:45,362 of, I'll just say a large television station, like, like a national 438 00:23:45,367 --> 00:23:50,302 television station, and I remember. 439 00:23:52,057 --> 00:23:57,997 I remember that time when the, when the, the, the director of it basically said, 440 00:23:58,597 --> 00:24:01,657 nobody's going home until this is done. 441 00:24:01,987 --> 00:24:07,207 He literally, I mean, there's a long story following up to this, but he basically, 442 00:24:07,777 --> 00:24:14,137 um, held us hostage in the data center and said, no one's going home until this, 443 00:24:14,227 --> 00:24:16,687 this thing that you said is gonna happen. 444 00:24:16,687 --> 00:24:17,797 You said it's gonna happen. 445 00:24:18,037 --> 00:24:19,987 I'm like, yeah, but it's not gonna finish until. 446 00:24:20,722 --> 00:24:26,272 10 30 at night, he's like, yeah, so we're not going home until it's done. 447 00:24:27,202 --> 00:24:32,602 And I'm like, okay, well this is kidnapping, but whatever. 448 00:24:32,782 --> 00:24:36,352 Um, you know, uh, so I think about stuff like that, right? 449 00:24:36,352 --> 00:24:38,032 I think about those moments of terror. 450 00:24:38,032 --> 00:24:41,782 But yeah, so I, you know, I wanna live vicariously through those who have 451 00:24:41,787 --> 00:24:43,312 been through those moments of terror. 452 00:24:44,122 --> 00:24:44,662 Um, 453 00:24:45,137 --> 00:24:49,357 Prasanna Malaiyandi: interesting to learn like what the more recent challenges 454 00:24:49,357 --> 00:24:51,877 are in environments, because otherwise 455 00:24:51,997 --> 00:24:52,357 W. Curtis Preston: That too. 456 00:24:52,357 --> 00:24:52,657 Yeah, 457 00:24:53,382 --> 00:24:55,687 Prasanna Malaiyandi: otherwise, how do you build great products, you know, or build 458 00:24:55,732 --> 00:24:57,382 W. Curtis Preston: Exactly, exactly. 459 00:24:58,342 --> 00:25:01,672 So what, what I was thinking about saying, which is what reminded me to do the 460 00:25:01,672 --> 00:25:07,072 disclaimer, is just that, um, you know, one way to have a different operating 461 00:25:07,072 --> 00:25:09,052 system is to use a SaaS provider. 462 00:25:09,352 --> 00:25:13,462 Druva is not the only one, uh, but there are SaaS providers 463 00:25:13,467 --> 00:25:15,172 that are cloud native or use. 464 00:25:15,532 --> 00:25:20,452 Non windows, uh, tools that, um, you know, you do that. 465 00:25:20,452 --> 00:25:22,972 Also, you, you gain the second thing that I list here, which 466 00:25:22,972 --> 00:25:24,262 is about separating the storage. 467 00:25:24,622 --> 00:25:28,312 Please don't, um, you know, we talked, we talked about that already, 468 00:25:28,672 --> 00:25:31,282 the, these replication, right? 469 00:25:31,672 --> 00:25:33,852 Uh, but the, um, 470 00:25:35,137 --> 00:25:37,357 Prasanna Malaiyandi: but it's also like, don't use nfs. 471 00:25:38,587 --> 00:25:39,547 W. Curtis Preston: Yeah, exactly. 472 00:25:39,547 --> 00:25:39,847 Yes. 473 00:25:39,847 --> 00:25:43,507 Don't use NFS as a way to back up to the server use. 474 00:25:43,717 --> 00:25:47,737 There are ways to back up to, for example, a data domain box in other boxes 475 00:25:48,277 --> 00:25:50,947 without exposing the backups via nfs. 476 00:25:51,307 --> 00:25:52,997 Uh, I also talk about using object storage. 477 00:25:53,017 --> 00:25:55,297 I'm a huge fan of using object storage. 478 00:25:55,627 --> 00:25:59,107 Now, some of you go, well, object storage is too slow, to which I 479 00:25:59,112 --> 00:26:01,237 say, then you're using it wrong. 480 00:26:02,227 --> 00:26:02,827 Right. 481 00:26:03,127 --> 00:26:05,827 Um, Druva uses object storage. 482 00:26:05,827 --> 00:26:09,457 All our backups are on object storage, and we are not too slow. 483 00:26:09,457 --> 00:26:13,657 In fact, we get into competitions all the time with these big 484 00:26:13,777 --> 00:26:15,517 on-prem companies and we win. 485 00:26:15,997 --> 00:26:18,337 And here we are, we're a copy in the cloud and they're an on-prem 486 00:26:18,342 --> 00:26:20,527 appliance, and we win that restore test. 487 00:26:20,597 --> 00:26:25,567 Object storage is not too stor slow, but if you, if you treat it like file system 488 00:26:25,567 --> 00:26:27,367 storage, I think then it is, right? 489 00:26:27,367 --> 00:26:27,937 If you put. 490 00:26:28,072 --> 00:26:28,267 Prasanna Malaiyandi: Yeah. 491 00:26:28,882 --> 00:26:31,777 W. Curtis Preston: all your backups in one object, right? 492 00:26:31,777 --> 00:26:35,797 Tonight's, tonight's backup of server X is an image, and that 493 00:26:35,797 --> 00:26:39,607 image becomes an object on, uh, s3. 494 00:26:39,787 --> 00:26:40,117 Yeah. 495 00:26:40,267 --> 00:26:41,887 Then it's gonna be slow, right? 496 00:26:42,937 --> 00:26:45,967 Um, we talk about using aut storage. 497 00:26:45,972 --> 00:26:47,437 We're gonna come back to that in a minute. 498 00:26:47,497 --> 00:26:49,657 Um, that, that's an option that we talked 499 00:26:49,732 --> 00:26:50,182 Prasanna Malaiyandi: And then, 500 00:26:50,257 --> 00:26:50,887 W. Curtis Preston: S3 501 00:26:51,082 --> 00:26:52,252 Prasanna Malaiyandi: yeah, and then your. 502 00:26:53,557 --> 00:26:56,287 And then your favorite topic is using tape. 503 00:26:56,557 --> 00:26:59,917 I know, Curtis, you always like to throw out the disclaimer. 504 00:26:59,917 --> 00:27:03,217 Actually, I should thank you because before this podcast, 505 00:27:03,222 --> 00:27:04,777 I knew very little about tape. 506 00:27:04,782 --> 00:27:08,527 Now I know just a bit more about tape, given the number of experts 507 00:27:08,532 --> 00:27:09,967 who've come on in talking to you. 508 00:27:09,972 --> 00:27:11,767 But yeah, it's 509 00:27:11,947 --> 00:27:14,767 W. Curtis Preston: There there's no, there's no beating the tape when it comes. 510 00:27:14,767 --> 00:27:16,327 That's an actual air gap. 511 00:27:16,657 --> 00:27:17,017 Prasanna Malaiyandi: Yep. 512 00:27:17,407 --> 00:27:17,752 W. Curtis Preston: right? 513 00:27:18,012 --> 00:27:22,252 If, if you, if you want a real air gap, I'm, I know there's challenges with 514 00:27:22,252 --> 00:27:26,542 it, you know, uh, but there is, you know, there is, there is an air gap 515 00:27:26,842 --> 00:27:27,172 Prasanna Malaiyandi: Yep. 516 00:27:27,652 --> 00:27:29,752 W. Curtis Preston: Uh, and I already talked about using a backup service. 517 00:27:29,752 --> 00:27:32,422 So let's talk about immutability. 518 00:27:32,842 --> 00:27:33,142 Prasanna Malaiyandi: Yep. 519 00:27:33,412 --> 00:27:34,792 W. Curtis Preston: Um, this, 520 00:27:35,272 --> 00:27:36,292 Prasanna Malaiyandi: Is it a made up word? 521 00:27:36,352 --> 00:27:38,032 It sounds a little like a made up word, 522 00:27:39,472 --> 00:27:41,752 W. Curtis Preston: you know, this is another one of those things 523 00:27:41,752 --> 00:27:43,822 where we have to go back in time. 524 00:27:45,607 --> 00:27:55,837 Historically immutability wa it, it, it was like a legal term that you needed 525 00:27:55,837 --> 00:28:02,197 to be able to prove that the thing you were presenting in court had not changed. 526 00:28:02,257 --> 00:28:03,307 It was immutable. 527 00:28:03,312 --> 00:28:07,927 That's all, you know, immutable just means cannot be changed. 528 00:28:08,317 --> 00:28:10,217 So when you're, when you. 529 00:28:11,462 --> 00:28:14,617 uh, you pres, you, you know, you have to preserve chain of custody and you 530 00:28:14,617 --> 00:28:18,037 have to, you have to be able to say, or it's really helpful if you're able 531 00:28:18,037 --> 00:28:22,837 to say, this email that I'm showing you is exactly the same email as the email 532 00:28:22,837 --> 00:28:25,405 that we got five years ago from Steve. 533 00:28:25,612 --> 00:28:28,552 Prasanna Malaiyandi: Yep, and nothing changed and no one had 534 00:28:28,552 --> 00:28:30,332 the ability to change it yet. 535 00:28:31,537 --> 00:28:34,507 W. Curtis Preston: That's where we used to talk about immutability. 536 00:28:35,287 --> 00:28:39,847 Now we talk a lot about it in terms of cyber attacks. 537 00:28:40,772 --> 00:28:46,042 And I would add to that, we also talk about it in terms of things like bit rot. 538 00:28:46,072 --> 00:28:50,602 We've talked about bit rot on this podcast where this is 539 00:28:50,602 --> 00:28:52,492 silent data corruption, right? 540 00:28:52,492 --> 00:28:55,762 That bits just flip underneath magnetic storage devices. 541 00:28:55,762 --> 00:28:57,082 It's just the way they work. 542 00:28:58,177 --> 00:29:03,302 and the, you know, and if, if you've got, if you've got a bunch of petabytes 543 00:29:03,302 --> 00:29:05,192 of data, you got flipped bits in there. 544 00:29:05,432 --> 00:29:07,562 It's just a matter of, it's just 545 00:29:08,517 --> 00:29:10,177 Prasanna Malaiyandi: when you're gonna run across it, right? 546 00:29:10,562 --> 00:29:10,982 W. Curtis Preston: yeah. 547 00:29:11,012 --> 00:29:11,432 Yeah. 548 00:29:11,702 --> 00:29:19,022 Um, so, so when we talk about immutability, we say, well, we, if 549 00:29:19,402 --> 00:29:20,792 somebody says they have immutable. 550 00:29:21,502 --> 00:29:24,322 Backups or immutable storage. 551 00:29:24,712 --> 00:29:29,272 What you're saying is stuff that gets put here can't be changed. 552 00:29:30,202 --> 00:29:33,832 And here's the thing. 553 00:29:35,572 --> 00:29:38,122 on how you look at it, it's complete nonsense. 554 00:29:39,232 --> 00:29:40,902 Prasanna Malaiyandi: Because everything's just software. 555 00:29:41,222 --> 00:29:41,812 Anything can be cheap. 556 00:29:41,842 --> 00:29:42,922 W. Curtis Preston: is changeable. 557 00:29:43,072 --> 00:29:45,262 Give me a torch, I'll change that. 558 00:29:45,612 --> 00:29:46,852 S o b, right? 559 00:29:47,182 --> 00:29:47,842 Give me phy. 560 00:29:47,872 --> 00:29:48,812 So physical. 561 00:29:50,077 --> 00:29:50,977 All bets are off. 562 00:29:51,477 --> 00:29:59,707 Everyone knows that, um, if it's something on a server that you can, that, that, 563 00:29:59,827 --> 00:30:05,497 that is in your data center, that also, in my opinion, is not really immutable. 564 00:30:06,527 --> 00:30:11,242 Um, because if someone has root, uh, on that server, they can wipe the server. 565 00:30:11,782 --> 00:30:15,352 Uh, it's even built, like, you know, when we talk about immutable storage on 566 00:30:15,357 --> 00:30:17,092 Lennox, it's not really that immutable. 567 00:30:17,092 --> 00:30:18,442 It's it's immutable ish. 568 00:30:18,742 --> 00:30:22,192 So, so why do I say, like, why do I talk about it if it's bs? 569 00:30:23,062 --> 00:30:24,052 Well, here's the point. 570 00:30:24,262 --> 00:30:26,932 Nothing was ever a hundred percent immutable, 571 00:30:27,847 --> 00:30:30,007 Prasanna Malaiyandi: Even that document right, that you were talking about. 572 00:30:30,577 --> 00:30:31,837 W. Curtis Preston: Yeah, exactly right. 573 00:30:31,837 --> 00:30:37,057 As long as like if, if, if you put something on a a, a, a, right once 574 00:30:38,017 --> 00:30:42,307 cd, uh, optical platter, right? 575 00:30:42,307 --> 00:30:46,627 A worm tape, it's immutable to a point. 576 00:30:47,737 --> 00:30:50,827 If you have physical access, it's no longer immutable. 577 00:30:51,517 --> 00:30:56,047 You could, you could say from a legal standpoint, you could later, if you have 578 00:30:56,247 --> 00:30:59,527 the same disc and you've preserved chain of custody, and you could say, we can 579 00:30:59,527 --> 00:31:03,847 show that this disc was not destroyed, and we can show via these check sums and 580 00:31:03,847 --> 00:31:06,517 whatnot, that the stuff that we're giving you is the stuff that we have before. 581 00:31:07,852 --> 00:31:11,812 Saying that you've got a storage system that can't ever, ever, ever be changed. 582 00:31:12,052 --> 00:31:15,112 Um, I would argue it's just nonsense. 583 00:31:15,142 --> 00:31:15,472 Right. 584 00:31:15,472 --> 00:31:19,192 So it's, it's a, it's a, it's a, it's a degree. 585 00:31:19,192 --> 00:31:20,812 It's a what, what did we call it? 586 00:31:20,812 --> 00:31:23,422 Like a, like a spectrum. 587 00:31:23,427 --> 00:31:23,752 Thank you. 588 00:31:23,752 --> 00:31:24,892 I knew there was a word in there. 589 00:31:25,432 --> 00:31:25,972 Prasanna Malaiyandi: And even 590 00:31:25,972 --> 00:31:27,412 W. Curtis Preston: prism is what was coming to mind. 591 00:31:27,922 --> 00:31:31,282 Prasanna Malaiyandi: and even for those storage systems that have immutability, 592 00:31:31,282 --> 00:31:35,302 right, that are used for like financial records and everything else, a lot 593 00:31:35,302 --> 00:31:39,232 of that is certified by the storage vendors saying they have all the checks 594 00:31:39,237 --> 00:31:41,062 in place and all the rest, right? 595 00:31:41,062 --> 00:31:44,112 In the end it's all just software, right? 596 00:31:44,242 --> 00:31:47,872 So they've built in the, into the software, those checks to make sure 597 00:31:47,872 --> 00:31:50,332 that data cannot be deleted, right. 598 00:31:50,332 --> 00:31:51,142 And is present. 599 00:31:52,402 --> 00:31:56,092 W. Curtis Preston: And the, and you know, after we're doing all this, like 600 00:31:56,092 --> 00:31:59,152 we're gonna, I'm slamming it and then I'm gonna talk about how important it's 601 00:31:59,542 --> 00:32:08,182 . But the other is, um, Uh, I'd say the, the one that I like the best right now 602 00:32:08,182 --> 00:32:11,722 is like the, the object lock and s3. 603 00:32:12,172 --> 00:32:15,892 And what I like about that is because it's, it is at least 604 00:32:15,892 --> 00:32:17,552 physically separated from. 605 00:32:18,427 --> 00:32:18,997 You. 606 00:32:19,147 --> 00:32:22,567 Now, that doesn't mean that somebody can't go crazy in the AWS data 607 00:32:22,567 --> 00:32:26,947 center and, and blow it up, but even that, it's built into that. 608 00:32:27,397 --> 00:32:31,057 So it, it would have to be like, it would have to be a really concerted 609 00:32:31,062 --> 00:32:36,187 attack to be able to attack multiple locations of S3 to be able to do damage. 610 00:32:37,057 --> 00:32:38,517 Prasanna Malaiyandi: it's, it's not only multiple 611 00:32:38,587 --> 00:32:40,567 W. Curtis Preston: is as low as, what's that? 612 00:32:40,747 --> 00:32:44,917 Prasanna Malaiyandi: It's not just multiple locations of s3, but also 613 00:32:44,917 --> 00:32:48,067 they have to tack your primary site as well, so everything needs to be 614 00:32:48,497 --> 00:32:51,817 coordinated across multiple vendors and corporations, which will probably have 615 00:32:51,817 --> 00:32:53,887 their own security practices, et cetera. 616 00:32:54,112 --> 00:32:58,012 W. Curtis Preston: this is, this is that, this is that, uh, spectrum, right? 617 00:32:58,042 --> 00:33:02,872 I, I'd put, I'd put that and write, you know, worm tape, write once, 618 00:33:02,877 --> 00:33:06,442 read, write once, read many tape. 619 00:33:07,072 --> 00:33:09,802 Um, and then, and, and optical plat. 620 00:33:09,832 --> 00:33:11,662 I put that on one end of the spectrum. 621 00:33:13,067 --> 00:33:16,942 on the other put at the end of the spectrum is I would have unencrypted 622 00:33:17,962 --> 00:33:26,062 backup stored on a NFS mounted storage system behind a Windows backup server. 623 00:33:26,722 --> 00:33:27,022 Prasanna Malaiyandi: Yep. 624 00:33:29,242 --> 00:33:30,142 W. Curtis Preston: that's your spectrum. 625 00:33:30,292 --> 00:33:33,982 So we wanna be closer to this end than that end. 626 00:33:34,582 --> 00:33:35,092 Right? 627 00:33:35,212 --> 00:33:36,862 Um, nothing is ever 628 00:33:36,882 --> 00:33:37,162 Prasanna Malaiyandi: downsides. 629 00:33:37,642 --> 00:33:37,912 Yeah. 630 00:33:38,002 --> 00:33:41,482 And there are some downsides to immutability too, right? 631 00:33:41,602 --> 00:33:45,982 Uh, you can't, like once the data gets written, you can't delete it 632 00:33:45,987 --> 00:33:48,082 before that time period typically. 633 00:33:48,082 --> 00:33:50,422 So there are some challenges as well. 634 00:33:51,787 --> 00:34:00,292 W. Curtis Preston: So, um, so what we need to do, Is we need to, I, I think 635 00:34:00,292 --> 00:34:05,722 there's multiple things there is that, um, we need to protect against access. 636 00:34:06,082 --> 00:34:09,952 We need to protect against, you know, change deletion, corruption. 637 00:34:10,612 --> 00:34:14,242 Um, uh, what was I, what was I talking about? 638 00:34:14,272 --> 00:34:16,902 Um, bit rot, right? 639 00:34:18,352 --> 00:34:20,722 So there are vendors out there. 640 00:34:24,202 --> 00:34:34,522 they're like, well, we have a, append only file system, and and, 641 00:34:34,642 --> 00:34:37,762 and we have data lock on the backups. 642 00:34:38,422 --> 00:34:39,952 And so they say, we're immutable. 643 00:34:40,492 --> 00:34:42,982 And, and I'm like, okay. 644 00:34:42,982 --> 00:34:46,732 And, and they say because they're saying that like, you can't encrypt the backups 645 00:34:46,732 --> 00:34:48,112 with a, with a ransomware attack. 646 00:34:48,157 --> 00:34:48,457 Prasanna Malaiyandi: Yep. 647 00:34:49,202 --> 00:34:50,467 W. Curtis Preston: and I, and I go, that's good. 648 00:34:50,467 --> 00:34:54,487 That's farther, that's, that's closer to the other one than the other ones. 649 00:34:54,727 --> 00:34:56,377 But it's like, well, what about other things? 650 00:34:56,767 --> 00:34:57,067 Right. 651 00:34:57,067 --> 00:35:01,477 What about other types of attacks that attack the operating system itself? 652 00:35:01,897 --> 00:35:02,287 Right. 653 00:35:03,787 --> 00:35:06,367 You know, if if you gain privileged access to that server, 654 00:35:07,677 --> 00:35:08,237 right? 655 00:35:08,857 --> 00:35:11,287 Prasanna Malaiyandi: And I wanna clarify though, what you're talking 656 00:35:11,292 --> 00:35:17,287 about is someone who's written their own file system or is leveraging a file 657 00:35:17,287 --> 00:35:20,877 system on top of a standard server. 658 00:35:22,237 --> 00:35:22,747 W. Curtis Preston: Yes. 659 00:35:23,392 --> 00:35:26,212 Prasanna Malaiyandi: Not a storage appliance, because I think that's a 660 00:35:26,212 --> 00:35:30,022 little bit more, that's like further along in the spectrum, I would say 661 00:35:30,742 --> 00:35:33,742 like a purpose-built storage appliance 662 00:35:34,267 --> 00:35:34,477 W. Curtis Preston: yeah. 663 00:35:34,477 --> 00:35:35,887 So, okay. 664 00:35:35,887 --> 00:35:41,437 So, so, so we got a couple different types of backup servers here, right? 665 00:35:41,442 --> 00:35:44,587 So we got the purpose-built backup appliance of various 666 00:35:45,457 --> 00:35:45,967 Prasanna Malaiyandi: flavors. 667 00:35:45,967 --> 00:35:46,267 Yep. 668 00:35:46,957 --> 00:35:47,497 W. Curtis Preston: flavors. 669 00:35:47,502 --> 00:35:47,977 Sure. 670 00:35:48,757 --> 00:35:52,077 Um, and I would put them. 671 00:35:53,347 --> 00:35:55,627 More immutable, right? 672 00:35:55,627 --> 00:35:58,927 So immutable is supposed to be a binary condition, but I 673 00:35:58,927 --> 00:36:00,217 don't see it as that, right? 674 00:36:00,217 --> 00:36:06,067 So, um, I put it more immutable than I bought a box. 675 00:36:06,127 --> 00:36:10,327 I installed Windows or Linux, and I install my favorite backups or software. 676 00:36:10,897 --> 00:36:11,857 Why? 677 00:36:11,917 --> 00:36:13,627 Why, why do you feel that way? 678 00:36:13,627 --> 00:36:14,377 I agree with you. 679 00:36:14,377 --> 00:36:15,247 Why do you feel that way? 680 00:36:15,712 --> 00:36:19,552 Prasanna Malaiyandi: I feel that way because when it comes to that appliance, 681 00:36:19,762 --> 00:36:22,462 typically there's more things locked down. 682 00:36:22,462 --> 00:36:25,222 There's less configuration options, right? 683 00:36:25,227 --> 00:36:27,152 It's kind of purpose built for that reason. 684 00:36:27,802 --> 00:36:30,832 Versus when you're rolling your own, you have to worry 685 00:36:30,832 --> 00:36:32,092 about all those dependencies. 686 00:36:32,092 --> 00:36:33,862 What flavor of the OS are you taking? 687 00:36:34,072 --> 00:36:36,232 Are you running through all the security patches? 688 00:36:36,232 --> 00:36:39,532 Is it, are there any nuances in the way it's being deployed 689 00:36:39,532 --> 00:36:42,292 today that leads to security vulnerabilities and things like that? 690 00:36:43,207 --> 00:36:44,017 W. Curtis Preston: Yeah, exactly. 691 00:36:44,017 --> 00:36:49,567 And, and when you update those appliances, you update an 692 00:36:49,567 --> 00:36:51,787 image which updates everything. 693 00:36:52,147 --> 00:36:58,027 Versus if I have a a box, a Windows box, I gotta update Windows or Linux. 694 00:36:58,537 --> 00:36:59,047 I've gotta make 695 00:36:59,062 --> 00:36:59,452 Prasanna Malaiyandi: the backup 696 00:36:59,737 --> 00:37:01,447 W. Curtis Preston: following the new security, then you gotta 697 00:37:01,447 --> 00:37:02,377 update the backup software. 698 00:37:02,377 --> 00:37:02,767 So, yeah. 699 00:37:02,767 --> 00:37:05,797 And these are, and I would say that's, so I would say that the 700 00:37:05,797 --> 00:37:07,717 appliances are more immutable than. 701 00:37:08,887 --> 00:37:10,537 Than the build drill in box. 702 00:37:10,777 --> 00:37:20,227 Um, and the, uh, but I, but I'm just gonna say that if you, if we're 703 00:37:20,227 --> 00:37:25,957 talking physical access, I still, I'm gonna put a service like S3 or a 704 00:37:25,957 --> 00:37:30,277 service like Druva that's up in the cloud, farther down the immutability 705 00:37:30,282 --> 00:37:35,557 spectrum than a survey, than a server that is sitting in your data center. 706 00:37:35,782 --> 00:37:36,142 Prasanna Malaiyandi: Yep. 707 00:37:36,922 --> 00:37:42,082 And I think it's important because everyone is now doing virtualized, right? 708 00:37:42,082 --> 00:37:44,572 It doesn't matter if it's a physical server or a virtual server. 709 00:37:44,952 --> 00:37:47,332 Anything that's running on your infrastructure or in your 710 00:37:47,452 --> 00:37:47,812 W. Curtis Preston: Right, 711 00:37:49,042 --> 00:37:51,862 Prasanna Malaiyandi: is less secure in that immutability spectrum. 712 00:37:53,482 --> 00:37:53,962 W. Curtis Preston: Yeah. 713 00:37:54,592 --> 00:38:01,642 Um, the, uh, yeah, I put in the book a lot of things are mislabeled, immutable, 714 00:38:02,452 --> 00:38:06,382 uh, I just, again, it's a spectrum, but. 715 00:38:08,137 --> 00:38:13,057 If, if all you're doing is writing backups to a Linux file 716 00:38:13,057 --> 00:38:17,287 system with the immutability flag turned on, that is not immutable. 717 00:38:17,287 --> 00:38:23,347 I mean, it's, it is more immutable than not But if I, but if someone 718 00:38:23,347 --> 00:38:27,847 with root can and, and you gotta have someone with root, right? 719 00:38:28,357 --> 00:38:32,527 So if a person with root can go in and unset all those immutability flag, 720 00:38:33,127 --> 00:38:33,697 Prasanna Malaiyandi: It don't matter. 721 00:38:34,792 --> 00:38:35,632 W. Curtis Preston: That's, I don't know. 722 00:38:35,812 --> 00:38:38,512 That's just not, it's be, it's better than nothing. 723 00:38:39,442 --> 00:38:39,832 Right? 724 00:38:39,832 --> 00:38:45,232 So I, I don't want to be the, the, you know, perfect is the enemy of good or 725 00:38:45,232 --> 00:38:47,872 whatever, but I, I don't need perfect. 726 00:38:47,872 --> 00:38:53,062 And so I don't wanna say that that's crap, but I, I think it's, it's not as immutable 727 00:38:53,062 --> 00:38:54,622 as those appliances that we talked about. 728 00:38:54,622 --> 00:38:58,312 And I still think that a service where nobody gets access to your 729 00:38:58,312 --> 00:39:00,322 servers is more immutable than that. 730 00:39:00,562 --> 00:39:00,892 Prasanna Malaiyandi: Yeah. 731 00:39:02,562 --> 00:39:04,612 W. Curtis Preston: and I still want everybody to back up everything to Tape 732 00:39:07,012 --> 00:39:08,272 Prasanna Malaiyandi: Oh, Curtis, you and 733 00:39:08,452 --> 00:39:11,422 W. Curtis Preston: although I work at, I work at a tapeless backup company. 734 00:39:11,842 --> 00:39:13,792 Um, so 735 00:39:15,967 --> 00:39:16,507 Prasanna Malaiyandi: But, but here's 736 00:39:17,392 --> 00:39:17,512 W. Curtis Preston: Go 737 00:39:17,677 --> 00:39:19,387 Prasanna Malaiyandi: one thing I wanna ask, and I know we've 738 00:39:19,387 --> 00:39:20,947 covered this on prior podcasts. 739 00:39:22,837 --> 00:39:28,837 What are things that an admin can do to understand where on that spectrum, 740 00:39:29,257 --> 00:39:33,967 when someone says, when a vendor says immutability, what are questions 741 00:39:33,967 --> 00:39:35,527 that they should be asking to be able 742 00:39:35,632 --> 00:39:36,412 W. Curtis Preston: a great question. 743 00:39:37,372 --> 00:39:41,182 Who has root or admin, right? 744 00:39:41,812 --> 00:39:46,372 Who has that and what controls are placed over that? 745 00:39:47,812 --> 00:39:54,022 So, um, if it's an appliance, so like I, I know of like one company. 746 00:39:56,872 --> 00:40:00,692 They do have root, they have a password, they have the root password 747 00:40:00,697 --> 00:40:04,132 on your system, or they have the password to an account that has 748 00:40:04,137 --> 00:40:06,472 a u i D of zero for those of you. 749 00:40:07,132 --> 00:40:13,282 Um, which is essentially the same thing, but in order to log into that account, 750 00:40:13,282 --> 00:40:14,992 they can't log into that account remotely. 751 00:40:15,052 --> 00:40:15,922 You have to. 752 00:40:16,302 --> 00:40:19,122 You have to do an SSH tunnel and all that stuff, right? 753 00:40:19,122 --> 00:40:21,282 You have to open up a door for them to log in. 754 00:40:22,032 --> 00:40:24,822 Um, you know, what kind of protections are put against that. 755 00:40:26,352 --> 00:40:31,602 Uh, if the answer is it's just a local box and you're the one that has route, 756 00:40:31,812 --> 00:40:37,212 or there's unprotected route access from someone, um, I just, I worry well. 757 00:40:38,117 --> 00:40:42,427 you know, so if, if, if you or anyone in your ministry in your 758 00:40:42,487 --> 00:40:46,717 place has root, that's not very immutable, it's better than nothing, 759 00:40:47,257 --> 00:40:49,177 but it's not very immutable, right? 760 00:40:49,687 --> 00:40:57,337 If you know root, like if, if, if you normally never log into 761 00:40:57,337 --> 00:40:59,587 the system as root, right? 762 00:40:59,617 --> 00:41:05,407 No one in your, you only at you, you go to a ui, you log it as you, right? 763 00:41:05,527 --> 00:41:07,147 Um, and. 764 00:41:08,137 --> 00:41:11,287 There isn't direct route access by anyone. 765 00:41:11,587 --> 00:41:16,687 And the only way you can get route access is you can, um, you do the SSH 766 00:41:16,747 --> 00:41:18,937 tunnel thing that's more immutable. 767 00:41:18,937 --> 00:41:19,927 I like that better. 768 00:41:20,887 --> 00:41:24,397 Um, you still, but again, if you don't know this already, you still have 769 00:41:24,402 --> 00:41:26,197 to do physical security against that 770 00:41:26,377 --> 00:41:26,707 Prasanna Malaiyandi: Yep. 771 00:41:26,707 --> 00:41:27,517 Exactly. 772 00:41:27,547 --> 00:41:28,507 W. Curtis Preston: do every other box. 773 00:41:28,507 --> 00:41:28,897 Right. 774 00:41:29,737 --> 00:41:36,182 Um, and then, You know, you ask a lot of que just ask a lot of questions. 775 00:41:36,187 --> 00:41:41,512 What happens if so, for example, I'm currently wondering because I haven't 776 00:41:41,512 --> 00:41:47,662 found a good answer online, I'm currently wondering what happens with Amazon S3 777 00:41:47,962 --> 00:41:50,992 object lock if I delete my account. 778 00:41:52,402 --> 00:41:53,572 Prasanna Malaiyandi: I don't think they allow you to. 779 00:41:53,572 --> 00:41:57,562 It depends on what type of object lock you're using, because there are 780 00:41:57,622 --> 00:41:59,662 W. Curtis Preston: know what, I know what you're saying, right. 781 00:41:59,872 --> 00:42:02,182 Um, but if I'm u is it the compliance mode? 782 00:42:02,182 --> 00:42:03,172 It's the more, 783 00:42:03,847 --> 00:42:04,237 Prasanna Malaiyandi: Yeah. 784 00:42:05,002 --> 00:42:05,332 W. Curtis Preston: yeah. 785 00:42:05,572 --> 00:42:07,042 So assuming I'm using compliance 786 00:42:07,297 --> 00:42:07,597 Prasanna Malaiyandi: Oh wait. 787 00:42:07,627 --> 00:42:09,637 Compliance is R L C R, lg. 788 00:42:09,667 --> 00:42:14,827 I think compliance is less in governance is more, or is it the 789 00:42:14,902 --> 00:42:15,572 W. Curtis Preston: whichever it 790 00:42:15,637 --> 00:42:15,847 Prasanna Malaiyandi: Yeah. 791 00:42:15,997 --> 00:42:16,387 Whichever way 792 00:42:16,552 --> 00:42:17,542 W. Curtis Preston: I think it's the other way around. 793 00:42:17,542 --> 00:42:20,662 But anyway, so I'm using the more strict one. 794 00:42:21,737 --> 00:42:23,572 and my credit card stops working. 795 00:42:25,822 --> 00:42:26,212 Right. 796 00:42:26,242 --> 00:42:28,492 It's not like they're gonna keep my storage forever. 797 00:42:28,972 --> 00:42:30,952 You, when you say they won't let you delete it. 798 00:42:31,672 --> 00:42:32,782 Well, I don't have to delete it. 799 00:42:32,782 --> 00:42:34,852 I'm just gonna have my credit card not work anymore. 800 00:42:35,812 --> 00:42:36,202 Right. 801 00:42:37,102 --> 00:42:37,492 What 802 00:42:37,597 --> 00:42:40,297 Prasanna Malaiyandi: like you said, it's not protected in all scenarios, right? 803 00:42:41,092 --> 00:42:41,572 W. Curtis Preston: Right. 804 00:42:41,812 --> 00:42:43,462 I don't know what the answer is. 805 00:42:44,092 --> 00:42:44,722 I am curious. 806 00:42:44,722 --> 00:42:47,122 I actually bought, I, I keep forgetting to do this, but I want to 807 00:42:47,122 --> 00:42:49,502 go create an Amazon account separate. 808 00:42:49,737 --> 00:42:50,347 Prasanna Malaiyandi: Mm-hmm. 809 00:42:51,052 --> 00:42:52,762 W. Curtis Preston: Put some object lock stuff in there. 810 00:42:53,122 --> 00:42:58,522 Not a whole lot, just like 90 days or something, but, but like a couple of 811 00:42:58,522 --> 00:43:02,482 gigabytes or something, and then go delete my account and see what happens. 812 00:43:02,542 --> 00:43:04,132 See if they let me delete the account. 813 00:43:04,912 --> 00:43:08,482 Um, I did read something somewhere that, that there is 814 00:43:08,482 --> 00:43:10,732 this like 30, 60 day timeframe. 815 00:43:11,322 --> 00:43:11,482 Prasanna Malaiyandi: Hmm. 816 00:43:12,232 --> 00:43:15,482 W. Curtis Preston: So again, that's still better because I'm assuming 817 00:43:15,482 --> 00:43:18,472 that if you're using Amazon S3 and. 818 00:43:18,502 --> 00:43:18,802 Prasanna Malaiyandi: by. 819 00:43:19,397 --> 00:43:22,282 W. Curtis Preston: or any of the other folks you're gonna, you're gonna know 820 00:43:22,282 --> 00:43:24,202 that somebody deleted your account 821 00:43:24,367 --> 00:43:24,667 Prasanna Malaiyandi: Yeah. 822 00:43:25,672 --> 00:43:26,152 W. Curtis Preston: Right. 823 00:43:26,812 --> 00:43:37,672 Um, and I know what I would want you to ask is what happens if, what happens 824 00:43:37,702 --> 00:43:40,042 if someone gets through someone? 825 00:43:40,222 --> 00:43:46,642 So I was just seeing a thing that said that it's like more than half of hacks 826 00:43:46,642 --> 00:43:48,322 are through compromised credentials. 827 00:43:48,802 --> 00:43:51,652 So what happens if someone, you know, you're a backup service? 828 00:43:51,982 --> 00:43:56,602 What happens if someone gets ahold of my admin credentials 829 00:43:56,842 --> 00:43:59,032 and is able to circumvent mfa? 830 00:43:59,512 --> 00:43:59,872 Prasanna Malaiyandi: Yep. 831 00:44:01,312 --> 00:44:02,182 How much damage can they 832 00:44:02,332 --> 00:44:03,232 W. Curtis Preston: do you have against? 833 00:44:03,237 --> 00:44:04,822 Yeah, how much damage they can do. 834 00:44:05,002 --> 00:44:08,572 Can you undo any of that damage, et cetera, et cetera, et cetera. 835 00:44:08,572 --> 00:44:14,392 I know that if we go back in time, let's say two years, I don't think 836 00:44:14,392 --> 00:44:16,672 Druva had good answers to that question. 837 00:44:17,332 --> 00:44:17,722 Right. 838 00:44:17,722 --> 00:44:21,172 I remember being in those meetings and saying, Hey, we need to address this. 839 00:44:21,322 --> 00:44:22,522 We have addressed that. 840 00:44:22,522 --> 00:44:25,792 I think we now have really good answers to those questions. 841 00:44:26,332 --> 00:44:32,692 Um, but does your, does you know, if you're not using Druva, does your vendor 842 00:44:32,692 --> 00:44:34,172 have good answer to those questions? 843 00:44:34,177 --> 00:44:35,212 I don't know. 844 00:44:35,662 --> 00:44:35,992 Right. 845 00:44:35,992 --> 00:44:39,802 So, yeah, so come up with worst case scenarios and that one. 846 00:44:40,327 --> 00:44:45,637 Of compromised admin credentials, whether you're talking a service or 847 00:44:46,657 --> 00:44:51,847 so, like for example, I know that like Druva has data lock, you know, 848 00:44:51,877 --> 00:44:53,827 rubric and cohesive have data locks. 849 00:44:54,097 --> 00:45:00,187 I know that with them, if you, if you compromise, uh, credentials and 850 00:45:00,187 --> 00:45:06,207 you log into them and try to delete, if you, if you enable datalock, 851 00:45:06,212 --> 00:45:07,537 you will not be able to do so. 852 00:45:07,747 --> 00:45:08,107 Right. 853 00:45:08,587 --> 00:45:12,832 So, , what is your vendor's answer to that question? 854 00:45:14,002 --> 00:45:19,582 Um, and um, and then also ask 'em about bit rot. 855 00:45:20,512 --> 00:45:21,922 What are they doing about bit rot? 856 00:45:22,222 --> 00:45:25,822 If they're using object storage, I feel better cuz object storage 857 00:45:25,822 --> 00:45:29,302 will automatically detect bit rot happening underneath. 858 00:45:29,842 --> 00:45:34,162 Uh, cuz it will change the hash and somebody will be like, Hey, well not 859 00:45:34,162 --> 00:45:36,172 somebody, a program will figure it out. 860 00:45:37,622 --> 00:45:39,667 Um, I think Biro is rare. 861 00:45:39,967 --> 00:45:40,747 Just for the record. 862 00:45:40,897 --> 00:45:41,647 I think it's rare. 863 00:45:42,787 --> 00:45:43,137 Um, 864 00:45:44,062 --> 00:45:44,932 Prasanna Malaiyandi: It's rare. 865 00:45:45,672 --> 00:45:46,537 W. Curtis Preston: bit error. 866 00:45:47,107 --> 00:45:47,467 Right. 867 00:45:47,497 --> 00:45:47,857 But, 868 00:45:48,592 --> 00:45:49,882 Prasanna Malaiyandi: But it's still bad 869 00:45:49,897 --> 00:45:50,917 W. Curtis Preston: not, not a problem. 870 00:45:51,082 --> 00:45:51,292 Prasanna Malaiyandi: Yeah. 871 00:45:51,292 --> 00:45:53,482 And the problem is when it's silent, that's the worst. 872 00:45:54,337 --> 00:45:54,937 W. Curtis Preston: Exactly. 873 00:45:55,057 --> 00:45:56,227 That's the worst. 874 00:45:56,857 --> 00:45:57,217 All right. 875 00:45:57,217 --> 00:45:58,777 Well enough about protecting backup data. 876 00:45:58,777 --> 00:46:00,037 You got any final thoughts? 877 00:46:00,312 --> 00:46:02,002 Prasanna Malaiyandi: Well, I think we covered it all. 878 00:46:02,332 --> 00:46:04,612 I really like virtual air gaps, but that's just me 879 00:46:08,827 --> 00:46:11,227 W. Curtis Preston: I like the old school air gaps, but it's really 880 00:46:11,227 --> 00:46:12,547 hard to do those these days. 881 00:46:13,597 --> 00:46:14,107 All right. 882 00:46:14,107 --> 00:46:16,837 Well thanks for listening to us. 883 00:46:16,957 --> 00:46:19,777 Be sure to subscribe so that you can restore it all.