The Backup Wrap-Up

Network segmentation best practices can be the difference between ransomware taking out one laptop and ransomware taking out your whole company. Prasanna, my co-author Dr. Mike Saylor, and I talk about how to stop running a flat network, what VLANs and microsegmentation actually do, and where you should start.

Mike and I wrote Learning Ransomware Response and Recovery around one basic idea: assume breach. You’re probably going to get hit, so the real question is how big the blast radius will be. Is it a plop, or does it take out the whole building?

We start with the old hard, crunchy exterior and soft, chewy interior model, and why so many billion-dollar organizations still run flat networks. Spoiler: laziness, budget, and management decisions all play a part. Mike explains VLANs with a hotel key card analogy that will make sense to those who aren’t network people. Then we take it a step further into microsegmentation, where access is based on what you’re there to do instead of where you’re plugged in.

Then we talk about:

• Get buy-in from on high.
• Inventory everything.
• Tag your workloads and build policy around those tags.
• Start with your crown jewels and work your way out. That means the stuff with tight RTOs and RPOs, plus the stuff you really don’t want ending up on the internet.
• Roll it out in phases instead of trying to rebuild everything in a day.
• Document every single rule, or the next guy will tear it all down and go flat again.

We also talk about why IT shouldn’t be the one deciding what’s critical (that’s what a business impact analysis is for) and how to wall off your backup network. You’ll also hear about the night before Y2K when the security team blocked my NetBackup ports one too many times and I lost it. And Mike explains how he used network segmentation to win an argument with a teenager.

If you’re a backup person who’s never had to think much about the network, this one’s for you.

Chapters:

00:00 – Intro

01:26 – Welcome, Prasanna and Dr. Mike Saylor

02:41 – My first client with firewalls on the inside

04:43 – Assume breach and the blast radius

06:24 – Grenades, house locks, and panic rooms

08:41 – What a flat network looks like

09:42 – Why so many companies still run flat networks

10:18 – VLANs explained with a hotel analogy

13:22 – Going further with microsegmentation

14:51 – The management overhead problem

15:15 – Why undocumented segmentation falls apart

18:45 – Leadership buy-in and starting with inventory

20:07 – Rolling it out in phases

21:16 – Tags, policy, and allow rules

22:56 – Default deny (and Mike says “it depends”)

24:00 – Start with your crown jewels

28:18 – Why IT shouldn’t decide what’s critical

30:38 – The night I lost my mind over segmentation

33:00 – Monitor traffic and wall off your backup network

34:35 – Final thoughts, home networks, and the chicken coop

36:04 – Mike’s teenager gets her own segment

Application whitelisting best practices can stop malware your antivirus never sees coming, but almost nobody follows them. Dr. Mike Saylor joins Prasanna and me to talk about why, and what it really takes to build an approved software list that sticks.

We start with SocGholish, a fake browser update campaign that’s been around since 2018. Every download is built just for the victim, so pattern-based tools can’t spot it. That’s exactly the kind of threat an approved software list shuts down.

Then we get into the hard part. You have to inventory every application in your environment, figure out who needs what, decide who pays for it, and build a process for exceptions. Mike explains why politics and overhead keep most companies from doing it. He also explains why shadow IT means your procurement process probably isn’t catching what you think it is.

We compare whitelisting with the simpler option of not letting users install software at all. We also talk about AppLocker, EDR policies, Office macros, MDM for mobile devices, and blocking executables in temp directories. Prasanna asks whether AI can take some of the friction out of software approvals, and Mike gives him a one-word answer. I also share a tip that makes the inventory step a lot less painful: run your whitelisting tool in audit-only mode first and let it build the list for you.

We wrap up with the good, better, best versions of this control. I tell a story about an old boss, Perl, and a bank policy that ended with him getting fired. And there’s a reminder that you will always need support from the top. Someone will always think they’re the exception, and senior management has to be willing to tell them they’re not.

If you’ve ever wondered whether locking down software installs is worth the fight, this episode is for you.

Chapters:

00:00:00 – Intro

00:01:30 – Welcome, Prasanna and Dr. Mike Saylor

00:02:37 – SocGholish and fake browser updates

00:04:57 – How often do companies really whitelist?

00:05:18 – Inventory, licensing, and exceptions

00:07:08 – Shadow IT and the $30 NDA

00:10:08 – Who actually does this

00:11:01 – Politics and overhead

00:12:12 – Just don’t let users install software

00:14:37 – AppLocker and EDR policies

00:15:47 – Can AI reduce the friction?

00:17:08 – Layered responses to a single threat

00:18:47 – Office macros and click-through users

00:20:49 – Is whitelisting a silver bullet?

00:21:29 – Signatures and the ideal whitelisting process

00:25:41 – Mobile devices and MDM

00:28:44 – Temp directories and executables

00:31:55 – How do you learn what you don’t know?

00:33:19 – Audit mode as your inventory

00:35:05 – AI agents, integrations, and CoSnitch

00:38:07 – Good, better, best

00:40:33 – The Perl story

00:43:21 – Final thoughts

Building an incident response team is something you do before the incident, not during it. Prasanna, Dr. Mike Saylor, and I walk through who needs to be on that team, why each person matters, and how to get them lined up now so nobody’s scrambling when ransomware hits.

We’re back after a few weeks off, and we came back with a topic I care a lot about. When I cracked a rim on my Tesla, I didn’t watch YouTube videos and grab a wrench. I called a team of people who know tires. Your cyber incident deserves the same treatment. Mike puts it plainly: you don’t want to be recruiting people when the house is on fire.

We cover the core roles. There’s the incident commander, who keeps the business off the backs of the people putting out the fire. There are the subject matter experts on the tech side. And there’s the executive sponsor, who makes the calls you’re not allowed to make. We talk about why legal, compliance, PR, and finance need a seat at the table. We also explain why “there is no evidence customer data was accessed” is a very different sentence from “customer data was not accessed.” (Looking at you, LastPass.)

Then we get into the outside help: your cyber insurance carrier, a third-party incident response firm with a retainer already signed, law enforcement, and your vendors. Mike explains what the FBI will and won’t do for you. He covers why you can’t just pay a ransom to anyone on the OFAC list, and why calling Bob on a Sunday is not a plan.

If your current incident response plan is “we’ll figure it out,” this episode is for you. Listen in, then go write down some names.

Chapters:

00:00 Cold open

01:30 We’re back (and Gemini let me down)

03:27 Why you need a team, not YouTube University

04:29 Know your team before the house is on fire

07:43 Fire crews, training, and the USS Constellation

09:27 Incident response is a business problem

12:02 Core roles: leaders and subject matter experts

14:14 Executive sponsors and who comes back first

16:09 Asset lists, owners, and pre-authorization

17:11 Incident commander vs. incident leads

20:00 Legal, compliance, and attorney-client privilege

22:59 PR and the LastPass problem

24:47 Finance and cyber insurance

27:07 Third-party incident response teams and retainers

32:06 Bringing in law enforcement

33:48 Sanctions, Bitcoin, and paying the ransom

38:05 Vendors who answer the phone on a weekend

39:34 Write it down and name your deputies

40:20 Tabletop exercises

43:06 Wrap-up

Endpoint hardening is the unglamorous work of closing the windows and locking the doors before somebody comes along and jiggles the handle. Prasanna, Dr. Mike Saylor and I walk through what that actually looks like: secure builds and golden images, which services to shut off, which ones to uninstall so a bad guy can't just switch them back on, USB lockdown, full disk encryption, BIOS and UEFI, and the phone in your pocket that logs onto your corporate Wi-Fi every morning.

Mike opens with the analogy he uses in the book. Bad guys casing your organization are doing what a burglar does walking down your street — checking every door, every window, every garage. An unpatched box screaming its version number to the internet is a broken window with a sign on it.

Then we get practical. Your receptionist's computer is running a web server she will never use. Your new Dell shipped with Xbox Game Bar running by default. Mike's point is that turning those off isn't enough, because an attacker living off the land will just turn them back on. Uninstall the thing.

We also get into the argument nobody wins: locking down USB ports. Prasanna makes the end-user case, Mike makes the red team case, and we land on data leakage controls as the middle ground. Then Mike explains how he gets into a laptop that's suspended instead of logged off, and why your encrypted drive doesn't help you in that state.

If you've been told you should harden your endpoints and nobody ever handed you the list, this one's for you. Start with one image, the lowest common denominator, and build from there. Don't let perfect be the enemy of good.

CHAPTERS

00:00 Your receptionist's computer is running a web server

01:39 Welcome, with Prasanna and Dr. Mike Saylor

03:52 The house analogy: broken windows and unlocked doors

06:22 Do you just have to be safer than your neighbor?

08:49 Assume breach, and close the windows anyway

09:52 Secure builds and golden images

13:37 One image for everyone, or one per role?

14:39 Level one hardening: turning off what nobody uses

16:20 Xbox Game Bar, and why disabling isn't enough

19:07 The USB lockdown fight

22:46 BIOS, UEFI, and malware that survives a reimage

26:35 Full disk encryption only works if you log off

29:42 Physical access trumps everything

30:07 Port scans, Nmap, and banner grabbing

31:50 Building your hardening checklist

33:14 The endpoint in your pocket

Least privilege best practices start with one uncomfortable question: does this person actually need this access? A hospital in Portugal answered yes for everybody, gave every employee doctor-level access to patient records, and got hit with a 400,000 euro GDPR fine. The court's read was that they hadn't even attempted the concept.

Mike Saylor, Prasanna, and I get into what least privilege really means, then move straight to the part nobody wants to talk about: where you start when everybody already has domain admin. Mike lays out three approaches, from "turn everything off and see who screams" to a real analysis of job roles. We talk about why role-based administration is the vehicle that gets you there, and why role sprawl will eat you alive if you build a custom role for every human in the building.

From there we get into segregation of duties, which accounting figured out decades before IT did. Your admin account should not be the account you use to check Gmail. That leads into non-repudiation, su versus sudo, and why logs have to leave the box and land in a SIEM before somebody edits them.

The last third is action items. Inventory your privileged accounts, your service accounts, your support accounts, and the fire call accounts you break glass for. Track more than the name and the privilege level: who owns it, why it exists, when the password changed, when it expires. And if you run backups, split your roles apart. Editing backup configs, running backups, and doing restores should not be the same permission. Somebody quietly shortening retention is invisible to the person watching last night's job reports. A restore never trips an alarm at all.

If your admins fight you on any of this, Mike has a thought about that too.

00:00 The hospital where the janitor could read your chart

04:26 The 400,000 euro fine, and the failed appeal

07:50 What least privilege actually means

08:54 Three ways to start when everyone has too much

11:17 Access that follows people as jobs change

12:57 Role-based administration is the vehicle

16:13 Role sprawl and the 80/20 rule

18:26 Segregation of duties, borrowed from accounting

20:28 Back when everybody had root: su and sudo

21:59 Non-repudiation and getting logs into a SIEM

25:31 Inventory privileged, service, and fire call accounts

27:41 The three backup roles you should separate

32:39 What your account inventory should track

35:31 Expiring accounts nobody uses

36:42 When admins push back, be concerned

Password length vs complexity isn't a close call. Dr. Mike Saylor joins Curtis and Prasanna to explain why the capital letter, the number, and the special character your bank demands do less for you than simply adding characters.

Mike walks through the rainbow table project — an operation that has spent years computing password hashes nonstop and will sell you 20 terabytes of the results. Nobody cracks your password. They look it up. The catch, and the whole reason this episode matters, is that the project has only reached ten characters after all that work.

The three also cover why some LastPass customers had their vaults drained and others didn't, where the 16-character recommendation comes from, how to build a passphrase you'll remember, whether forced password rotation accomplishes anything, and what happened when Mike rolled out fingerprint-locked laptops to fifty field employees.

Get the book: Learning Ransomware Response and Recovery at stopransomware.com

RDP security best practices come down to one rule most admins break on day one: that protocol has no business facing the internet. Dr. Mike Saylor and Prasanna Malaiyandi join me to break down why RDP earned the nickname Ransomware Deployment Protocol, who's out there scanning for your open port right now, and what to actually do about it.

Here's the part that gets me. Every Windows box ships with this thing turned on. You didn't ask for it. Nobody handed you a manual. It's just there, running, waiting. Mike calls it a dollar store hammer — still a tool, still gets the job done, just not the one you'd pick if anybody gave you a budget. I call it a hack-me sign taped to your back.

We get into how initial access brokers work, and it's less sophisticated than you'd hope. Somebody runs a Shodan query, gets a list of every exposed RDP service on the planet with IP addresses and device types, cross-references it against leaked credentials, packages the whole thing up, and sells it. Mike says the recon that used to take days now takes about 30 seconds with the AI tools floating around the dark net.

Then there's the credentials-don't-even-matter problem. Default RDP traffic isn't encrypted internally. Mike walks through a routing table poisoning job where his team captured an admin's keystrokes going to a server. No login required. Just be in the middle.

The back half is all fixes. Block the protocol and the port, not one or the other, because attackers will happily move to a different port. Check 3389 before you kill it — your database might be sitting on it. Enforce network level authentication. Put a VPN or a zero trust product in front, and Mike points out enterprise-grade stuff runs about six bucks a user now, so the "no budget" excuse is thinner than it used to be. Bastion hosts. Group policy. Monitoring at the endpoint, network, and firewall layers, with a governance layer on top so you know what's allowed before something breaks at 2am.

Prasanna plays devil's advocate the whole way through and swears he isn't pro-RDP. Mike wears three hats and can't pick one. I have exactly one opinion and I'm not moving off it.

CHAPTERS:

00:00 Windows ships with a back door

01:26 Welcome and my Facebook Marketplace weekend

03:18 Why RDP means Ransomware Deployment Protocol

04:46 What RDP actually does

05:51 Blue hat, red hat: Mike's split opinion

06:11 Does RDP deserve its bad reputation?

08:10 On by default, and you can't fully kill it

09:30 The back door nobody locks

11:52 Does the cloud secure RDP for you?

14:12 Who scans for exposed RDP, and how Shodan works

17:10 Initial access brokers explained

18:36 Vulnerabilities that skip credentials entirely

19:08 Unencrypted traffic and stolen keystrokes

20:38 The never-on-the-internet rule

20:59 The network survival stack: VPN and zero trust

23:22 Block the port and the service

24:17 Stopping lateral movement once they're inside

25:25 Network level authentication

27:50 Port 3389: check before you block it

29:44 Bastion hosts

30:26 Monitoring, auditing, and governance

31:19 Blue, red, and purple hats

Phishing resistant MFA is the difference between a bad guy getting one email address and a bad guy getting your entire company's inbox. On this episode, Prasanna, Dr. Mike Saylor, and I dig into why plain old multi-factor authentication isn't the finish line anymore; it's the starting line.

We open with a real attack: a vulnerable REDCap database, stolen Google Workspace admin credentials, and email forwarding rules quietly running for over a year before anyone noticed. From there Mike breaks down how social engineering actually works (the research bad guys do on you before they ever send an email) and why "report as phishing" buttons have themselves become an attack vector. I share the story of the free credit monitoring scam that got me, and why freezing your credit reports is one of the best five-minute security moves you can make.

Mike then walks through FIDO2 and passkeys, why they're built on old-school public/private key encryption, and why they're transactional instead of just another code sent to your phone. We cover the Flax Typhoon espionage campaign, the Raptor Train botnet, and how hard-coded credentials on IoT devices turned into root-level access for a foreign intelligence operation.

Then Mike introduces "killing the trust button," which is phrase for the idea that most networks default to open, and every one of those defaults is a decision somebody made without thinking about the risk. We talk about blocking traffic by country, limiting concurrent logins, expiring MFA tokens, and why starting with your administrative accounts is the easiest place to build momentum. And yes, we talk about just asking an AI assistant like Copilot or Claude to walk you through turning this stuff on, because you probably already have these tools and don't know it.

We close on why MFA by itself still isn't enough — session token theft, MFA exhaustion attacks, and the "remember this device" setting that undoes everything you just set up. If you're the person responsible for an environment with important accounts sitting there with no MFA, we've got a name for that, and it's not a nice one.

Chapters:

0:00 – Cold Open

1:31 – Welcome to the Show

4:12 – The REDCap/Google Workspace Attack

8:38 – Social Engineering: How Attackers Do Their Homework

13:06 – Freeze Your Credit Reports

16:55 – What Is FIDO2? (Phishing Resistant MFA Explained)

18:58 – Flax Typhoon and the Raptor Train Botnet

24:43 – Professional Malfeasance: No More Excuses for Skipping MFA

28:05 – Killing the Trust Button

32:51 – Start With Your Administrative Accounts

36:36 – Why MFA Alone Isn't Enough: MFA Exhaustion

39:27 – Passkeys, Impossible Travel, and Final Takeaways

Backup security best practices start with one uncomfortable truth: if you haven't checked your backup server for a default password, someone else might check it for you. In this episode, Prasanna and Mike Saylor join me to dig into how backup systems become the easiest way into your network — and the easiest way out for stolen data. We walk through the real story of a red teamer who used a backup server's weak credentials to restore a domain controller straight outside the company's firewall, then had the run of the place.

From there we get into the stuff that actually gets skipped: service accounts nobody's watching because they're "always on" and mostly invisible, default passwords baked into backup hardware that never get changed, and why the backup admin — usually the newest, most junior person on the team — ends up holding the keys without the security training to know what they're holding. We talk about how to find every service account you've got, how to figure out which ones actually need the privileges they've been handed, and why "it's always been that way" is exactly how breaches happen.

We close out on authentication: multi-factor authentication versus passkeys, why email one-time codes aren't the security win companies think they are, and why an authenticator app with its own PIN beats "remember this device" every time. Mike also shares a story about catching failed admin logins that turned out to be something a lot more human than a hacker — and why monitoring for those anomalies matters either way.

If you manage backup infrastructure, run a security team, or just got handed the backup admin job because nobody else wanted it, this episode is your checklist. Backup security best practices aren't complicated — they're just consistently ignored, and that's exactly what attackers count on.

Chapters:

00:00 – Cold open: the hacker on your backup server

01:34 – Welcome and episode setup

04:17 – The Duane Lafleur red team story

06:41 – Backup servers as an exfiltration risk

08:19 – Service accounts: the invisible attack surface

28:40 – Locking down the admin account

30:08 – MFA vs. passkeys for backup security

Building a cybersecurity culture in your company doesn't take a bigger budget — it takes a weekly habit. In this final episode of our encore series, returning guest snorkel42, a longtime Reddit voice in InfoSec, breaks down how he turned a company with zero dedicated security staff into one with a real security culture, just by committing to one small improvement every week instead of waiting on the next six-figure product.

We picked this one to bring back because of how it performed with you — not just downloads, but how much of the episode people actually stuck around for. That combination told us this conversation landed, and a lot of you came back to it more than once.

snorkel42 walks through where the term "security cadence" came from: a network engineering team, no InfoSec department, and a room full of unused tools nobody had the bandwidth to run. Instead of asking for more products, the team set a rule — one security change a week, no new vendor purchases allowed — for six months straight. What happened next is the real story: leadership noticed, and the team went from begging for resources to being handed them.

From there we get into what it actually took to build that cybersecurity culture day to day — the early challenges, how the team picked what to tackle first, and how a scrappy internal habit turned into something leadership actively championed. We also cover MFA, including why not all MFA is created equal, the SIM jacking risk that undercuts SMS-based codes, and the push-notification fatigue tactics attackers use to wear users down until they hit "yes" out of exhaustion. snorkel42 closes with a piece of advice worth sitting with: stop chasing the latest zero-day and start building your cybersecurity culture around how attacks actually function, start to finish. Do that, and ransomware protection comes along for free.

If you're the person in your company quietly carrying the security load, or you're trying to convince leadership that culture matters more than another line-item purchase, this one's for you.

00:00:00 — Cold open: you already own the tools you need

00:01:36 — Show intro and disclaimers

00:04:05 — Guest introduction: snorkel42's Reddit history and security cadence series

00:05:53 — Where the term "security cadence" came from

00:08:40 — Early challenges building the habit

00:44:57 — MFA, password security, and why not all MFA is equal

00:47:46 — SIM jacking and push-notification fatigue attacks

00:51:45 — Patching, WannaCry, and why chasing zero-days misses the point