10 Must-Have Features of Any Backup System
Every backup system needs certain design elements to actually work when disaster strikes. In this episode of The Backup Wrap-up, W. Curtis Preston (Mr. Backup) and Prasanna Malaiyandi break down the 10 non-negotiable components your backup system must have. They cover the 3-2-1 rule, automated scheduling, recovery testing, defined RTOs and RPOs, backup security, SaaS protection, documentation, retention policies, monitoring, and endpoint backup. If your backup system is missing any of these elements, you're taking risks you can't afford. Curtis and Prasanna share war stories from real disasters and explain why no one cares if you can back up - they only care if you can restore. This fast-paced episode gives you the checklist every IT professional needs to evaluate their current backup approach.
You found the backup wrap up your go-to podcast for all things
Speaker:backup recovery and cyber recovery.
Speaker:In this episode, we cover something that should be required listening for
Speaker:anybody responsible for protecting business data, the 10 essential features.
Speaker:Every backup system needs.
Speaker:There's way too many companies that think they have backups when they really don't.
Speaker:And by the way, when I say backup system, I mean the overall system,
Speaker:not just a computer system.
Speaker:Because many times, um, you know, backups are actually SaaS based
Speaker:and things like that, right?
Speaker:Remember, no one cares if you can backup only if you can restore.
Speaker:Let's make sure that your backup system has at least these 10 things
Speaker:that you need to get started.
Speaker:By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr.
Speaker:Backup, and I've been passionate about backup and recovery for over 30 years.
Speaker:Ever since I had to tell my boss there were no backups of the production
Speaker:database that we had just lost.
Speaker:I don't want that to happen to you, and that's why I do this.
Speaker:On this podcast, we turn unappreciated backup admins into cyber recovery heroes.
Speaker:This is the backup wrap up.
Speaker:Welcome to the show.
Speaker:Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a guy
Speaker:who remembers to wear this shirt that I'm supposed to be wearing.
Speaker:Prasanna, Molly, how's it going?
Speaker:Prana?
Speaker:Oh my gosh.
Speaker:Are you in my head?
Speaker:I literally was just thinking about that as I was looking.
Speaker:I was like, why does he
Speaker:I'm in your head.
Speaker:I'm in your head.
Speaker:Yeah, I, I, um, I, you know what?
Speaker:I'm not even sure I know where the shirt is.
Speaker:Oh,
Speaker:Um, I dunno if you know this, I can be a little bit disorganized sometimes.
Speaker:You really?
Speaker:I know that comes as a great surprise.
Speaker:But, um, we went through all this thing to get the shirts
Speaker:Uh, by the way, for the listeners, I was asking Curtis for four years
Speaker:Yeah,
Speaker:to get swag to print
Speaker:Yeah, we finally got his shirt.
Speaker:And he's wearing it.
Speaker:Both of us need to put our mic in a different place though, so that you're,
Speaker:see
Speaker:so that you don't cover up the Yeah.
Speaker:Um, by the way, no one has, no one has reached out to me for swag.
Speaker:Listeners, if you want t-shirts, if you want something, please reach
Speaker:out to Curtis and let him know because I would like some more swag.
Speaker:Yeah.
Speaker:Do a backup, wrap up socks.
Speaker:Yes.
Speaker:Actually I should say merch, not swag.
Speaker:Yeah.
Speaker:Merch.
Speaker:Yeah.
Speaker:Swag is, yeah, merch is, you gotta buy it.
Speaker:Yes.
Speaker:the difference.
Speaker:We're not giving away free stuff over here, people.
Speaker:Um, all right.
Speaker:We're gonna cover a lot in this episode, so we're gonna cover it pretty high level.
Speaker:Uh, but we're gonna talk about the 10 backup.
Speaker:Things that every business needs,
Speaker:Could we
Speaker:right?
Speaker:facts?
Speaker:What
Speaker:Fast facts.
Speaker:fast facts?
Speaker:Yeah, fast facts.
Speaker:The 10 backup things that every, uh, business needs.
Speaker:And the first one.
Speaker:3, 2, 1. The 3, 2, 1 rule, which we've already, which, yeah, which we covered
Speaker:in the last episode, which is now really the 3, 2, 1, 1 0 rule, right?
Speaker:Three copies of your backup, two different media, one of which is somewhere else,
Speaker:one of which is immutable and zero errors because you did validation, uh, which
Speaker:actually is gonna be another one of our, another one of our things, right?
Speaker:So if, if your backups don't conform at least to the 3, 2, 1 rule, then
Speaker:you know they're not really backups.
Speaker:Yeah, exactly right.
Speaker:Um, so the, the next thing is, uh, scheduled backups.
Speaker:So why, why does that matter?
Speaker:Prasanna?
Speaker:Well, if you aren't doing frequent backups or scheduled backups, then
Speaker:you're probably avoiding or skipping or don't have a backup you can
Speaker:restore from, and you're probably not meeting the needs of the business.
Speaker:So you wanted a
Speaker:schedule.
Speaker:You don't wanna have to go push a button, right?
Speaker:It should run automatically based on what you and the business have decided.
Speaker:Yeah, if you're not doing scheduled backups, you're not really doing backups.
Speaker:Right.
Speaker:Um, you know, you're, you're gonna, you're gonna have, you're
Speaker:gonna have to remember to do them.
Speaker:And so they should, they should just run right.
Speaker:Get, get humans out of the system as much as possible.
Speaker:So if you're not doing regularly scheduled backups, then again, I, I, I
Speaker:don't, I don't even know why we're here.
Speaker:Well, I, I think it's also important, automated is another key word there,
Speaker:Yeah.
Speaker:right?
Speaker:It should not be because I, for instance, do scheduled backups of my
Speaker:personal data, but it's me doing that manually every day or every month.
Speaker:That, that's actually a really good point, right?
Speaker:I'm glad you brought that up.
Speaker:It needs to be automatically scheduled backups right.
Speaker:Um, and, uh, yeah, this should happen.
Speaker:And when we talk about, um, uh, another thing that we need to be doing all the
Speaker:time, that is a little thing called, uh, recovery testing or backup testing,
Speaker:backup testing, or recovery testing.
Speaker:I guess the only reason, the only reason we back up is so we can restore.
Speaker:No, I, you know, I, I used to say a lot.
Speaker:No one cares if you can back up.
Speaker:They only care if you can restore.
Speaker:Yep, and you need to make sure you're doing your recovery testing
Speaker:because you don't know if that backup is going to be successfully
Speaker:restored when you actually need it.
Speaker:The only way you know ahead of time is you have to do your testing.
Speaker:You might have forgotten to do part of an application backup.
Speaker:You might have forgotten a piece of your infrastructure.
Speaker:You need to back up as well in order to successfully restore down the road.
Speaker:The only way you know is you do the testing ahead of time.
Speaker:Yeah, exactly.
Speaker:And um, you know, I can think, I can think back in the day when, um, I
Speaker:remember I was at a, uh, a large, uh.
Speaker:Cell phone manufacturing company, and we'd been bagging it for months.
Speaker:And then we went to go do a recovery test.
Speaker:Uh, we found out that the tape drives, uh, they weren't so good at reading,
Speaker:they just, they just knew how to write.
Speaker:Um, you know, you can't, unless you do the, the recovery testing,
Speaker:you're not gonna find that stuff out.
Speaker:Right.
Speaker:There's just, we, we could, we could, we could spend.
Speaker:Hours and hours and hours telling you stories of bad things that happened.
Speaker:When you don't do testing, you're, you're only going to find out, uh,
Speaker:you know the, what's wrong, right?
Speaker:think you did talk about this a few episodes ago, but your about
Speaker:how there was a new compression
Speaker:Yeah.
Speaker:The compression feature.
Speaker:Yeah.
Speaker:We didn't, yeah.
Speaker:never tested it, and your
Speaker:Yeah.
Speaker:from tape was slow.
Speaker:Yeah, it was ultra slow and ultimately we found out that it actually
Speaker:wouldn't even work because of the way that the feature, uh, worked.
Speaker:It was, it was assumptions made, um, that, that were just not true.
Speaker:yeah,
Speaker:It was a really bad design, but, uh, again, you're not gonna know that stuff
Speaker:until you actually do, uh, testing.
Speaker:So the next one is going back to what I talked about earlier about why you
Speaker:needed sort of automated schedules, backup schedules, is you need to
Speaker:also define your recovery objectives.
Speaker:Yeah.
Speaker:And do you wanna talk a little bit about that?
Speaker:Because I know people forget about this or they think, oh, as a backup
Speaker:admin, I'm responsible for this.
Speaker:But I think it's important to sort of like really talk about this.
Speaker:Yeah, this is one of those things where you cannot, you, you really
Speaker:cannot design a backup system.
Speaker:Without recovery objectives, right.
Speaker:I mean, you can, right?
Speaker:You can just, you can define, you know, but, but it's like, um, you,
Speaker:you, you really have to define the recovery objectives upfront.
Speaker:And if you don't define them upfront and you don't agree to them upfront, then you
Speaker:can't properly design the backup system.
Speaker:You.
Speaker:And, and, and so you end up sort of just doing what we always do, which is
Speaker:like, oh, we're gonna do, we're gonna do it and we're gonna recover every day.
Speaker:We're gonna bring, you know, gonna back up every day.
Speaker:We're gonna, we're gonna send it off site and we're gonna do the thing.
Speaker:And then you go to do the restore and then you, you, you, you go to do, um,
Speaker:the restore it and, and it works, but it fails from a perception standpoint.
Speaker:And that's because if you don't have recovery objectives.
Speaker:The, the recovery objectives that are in the mind of the bosses are going
Speaker:to be very different than the recovery objectives that are in your mind.
Speaker:You're like, Hey, this was awesome.
Speaker:The restore happened.
Speaker:Uh, it, you know, it, it only took, uh, eight hours and, you
Speaker:know, and, and it, and it succeeded and we restored all the data.
Speaker:And you're like, you're feeling, you know, hunky dory and then the bosses
Speaker:are chewing you out because they thought it was gonna take an hour.
Speaker:Yeah.
Speaker:And I think one other thing I want to touch on is as a backup
Speaker:admin, I the one who's coming up with these recovery objectives, or
Speaker:New.
Speaker:Yeah, good point.
Speaker:Yeah.
Speaker:The, it needs to come from the business, right?
Speaker:Any of this, these SLAs, recovery objectives, need
Speaker:to start with the business.
Speaker:We want, we, we don't wanna lose any data and we don't wanna lose any time, right?
Speaker:So that's, that's where we always start, right?
Speaker:A RTO and an RPO of of zero.
Speaker:That's recovery time objective and, and recovery point objective of zero.
Speaker:And then you need to walk that back based on, okay, you can have an RTO and RPO of
Speaker:zero, it's gonna cost you $50 billion.
Speaker:Uh, and then, you know, and then they walk it back, right?
Speaker:So you, again, you, this is about setting expectations.
Speaker:And also using those, those objectives to both define and design the backup
Speaker:system, but also to pay for it,
Speaker:Yeah,
Speaker:right?
Speaker:Because, um, you know, it, it, uh,
Speaker:it's really hard to get money for backups.
Speaker:and we talked about this I think like three episodes ago.
Speaker:Yes, we did.
Speaker:Yes, we did.
Speaker:Um, so the next is about isolating, uh, you know, backups
Speaker:from a security perspective.
Speaker:And we did just talk about this with the 3 2, 1, 1 0 episode.
Speaker:We talked about immutable backups.
Speaker:Uh, there there is a term that we didn't talk about, which is another
Speaker:really important term when we talk about, uh, isolating backups.
Speaker:You know what that term is, right?
Speaker:The
Speaker:least privilege.
Speaker:Access
Speaker:No,
Speaker:patch management.
Speaker:no.
Speaker:MFA.
Speaker:Keeping back up secure.
Speaker:Oh
Speaker:I know it there.
Speaker:There's like eight, 800 things you could be choosing.
Speaker:Air gap.
Speaker:Yeah.
Speaker:But of course, and, and again and again, air gap backups, we can't really
Speaker:have air gap backups it in the truest sense, uh, because that technically
Speaker:means that it's offline and it's, it's, there is literally a gap of air.
Speaker:There is no connectivity from A to B.
Speaker:Uh, you can't really have that with modern backup and recovery design,
Speaker:but you can just have, you can.
Speaker:Approximate it as much as you can.
Speaker:Right?
Speaker:Again, just realize that from a cyber cybersecurity perspective, um, that
Speaker:the threat actors are immediately gonna go after your backups, right?
Speaker:And so you gotta separate them.
Speaker:I.
Speaker:So I was also thinking when you brought up this, uh, topic, was
Speaker:thinking from sort of separating out, I know we talked about, active
Speaker:directory, so sort of having something separate from a backup perspective
Speaker:Yep.
Speaker:as network isolation if needed.
Speaker:So you're isolating your backup traffic from your production
Speaker:traffic, just keeping it isolated, walled off from everything else.
Speaker:So if something happens on your production network, it's not easy
Speaker:to get into your backup network.
Speaker:Yeah, and the thing you mentioned earlier, uh, and your incorrect
Speaker:answer to my question, it's, um, least, least privilege, right?
Speaker:Using the concept of least privilege, give, giving each person the, the,
Speaker:the absolute least, least amount of privilege that they need in order to
Speaker:do their job in the backup system.
Speaker:Uh, and then isolating it, uh, as much as you can.
Speaker:Uh, encrypting backups also, right?
Speaker:Uh, in case somebody gets to them from via some other source.
Speaker:Because remember, backups, they're not only used as a way to, uh, to restore,
Speaker:but, uh, a threat actor can use them as a way to exfiltrate data from your
Speaker:environment, which is, uh, very, very bad.
Speaker:So the next one.
Speaker:Yay.
Speaker:My turn is SaaS backups.
Speaker:Right.
Speaker:Make sure that
Speaker:SAS needs backups.
Speaker:Huh?
Speaker:No.
Speaker:If you haven't listened to our last episode, you should go
Speaker:listen to that on 3 2 1 1 0.
Speaker:Yeah.
Speaker:SaaS needs backups, so make sure you are backing up your SaaS applications.
Speaker:Don't just trust the vendor that they are going to be doing your backups or
Speaker:Yeah.
Speaker:backup.
Speaker:Because again, if you, if you just listened to our previous episode,
Speaker:they're not backing up your data.
Speaker:There.
Speaker:There are some vendors, uh, Microsoft 365, uh, Salesforce that do offer a
Speaker:backup service that you pay extra for.
Speaker:That is different.
Speaker:And, and I don't want to criticize any of those specifically, um, because I don't,
Speaker:I don't know anything about the specific.
Speaker:The specifics of those products.
Speaker:What I will say is just me personally, I would rather have the data on a third
Speaker:party service rather than as part of the, you know, that And can you think of
Speaker:a company of why I might feel that way?
Speaker:I
Speaker:The company,
Speaker:of a story of a cloud event that we covered
Speaker:there were many cloud events we covered.
Speaker:I am just
Speaker:specifically where the vendor had the copy of the data.
Speaker:Co-located with the data
Speaker:Oh yes.
Speaker:OVH.
Speaker:OVH.
Speaker:Yeah.
Speaker:Yeah.
Speaker:right.
Speaker:know, go look.
Speaker:You know this, this was a company that had made a number of very bad
Speaker:decisions, and since they were.
Speaker:Bad at making, they would argue that, look, we were doing a budget
Speaker:service and this is, we made budget decisions based on the fact that it
Speaker:was a budget service and I don't care.
Speaker:Right.
Speaker:My point is they made a number of bad design decisions, and
Speaker:though they made, also made bad design decisions on the backup.
Speaker:And so that's where I was like, if it's a company that messes up, you want a
Speaker:backup that's from somebody that didn't mess up, and so that's why I would rather
Speaker:have the backup be with another company.
Speaker:Yep.
Speaker:Um, yeah, let's talk about documentation.
Speaker:No, no one likes documentation,
Speaker:No one likes documentation, right?
Speaker:Um, and, and the big thing here, I mean, you, you need to, you need to.
Speaker:Be able to describe how the different parts work.
Speaker:The real, the real thing here is the concept of runbook, right?
Speaker:And that that should be part of your disaster recovery plan, which is
Speaker:part of your cyber recovery plan.
Speaker:Um, part of your incident recovery plan.
Speaker:Uh, that, that a person, again, this is a high bar to set, but a person
Speaker:that is technical and understands.
Speaker:What buttons are right, um, should be able to follow your
Speaker:runbook and do and do the thing.
Speaker:Yeah.
Speaker:shouldn't need the backup person or the DR person to be the one running the recovery.
Speaker:It should be somebody that, that is competent should be able to look at it.
Speaker:Uh, and also there should be.
Speaker:Uh, some sort of, um, identity management system that would allow this person
Speaker:to then get into the, the places that they need to get into as well.
Speaker:I was thinking about the hurricane that hit a tropical island.
Speaker:Yeah.
Speaker:Story.
Speaker:And in that story, go back and listen to the episodes.
Speaker:Basically, hurricane hit an island wiped out the connectivity to the mainland.
Speaker:They needed to restore the data, but all the active directory and
Speaker:identity systems were in the mainland, so they couldn't restore the data.
Speaker:to fly people from the mainland back to the island in order to be able to
Speaker:actually do the restore and great story, go back and listen to the episode.
Speaker:The interesting thing though, Curtis,
Speaker:I thought what they did was actually they had to get connectivity back to the, I
Speaker:thought that's what they did, so that the
Speaker:but I think they had to actually do,
Speaker:I, well, I know they, I know they flew people.
Speaker:I just, I think in order for it to work at all, I think they had to get, they
Speaker:used satellite connectivity to get access to the internet so that they could then.
Speaker:Access that, the, the thing on the mainline, I thought that's what happened.
Speaker:It's been a while since I
Speaker:a copy of the active directory
Speaker:did.
Speaker:They,
Speaker:or
Speaker:that's highly possible.
Speaker:Maybe I should go listen to the My own, my own
Speaker:But
Speaker:episode.
Speaker:is where
Speaker:I.
Speaker:important that there are certain scenarios that local backup folks who are managing
Speaker:the site may not be able to handle.
Speaker:And so it is okay if needed to bring in specialists to
Speaker:deal with certain scenarios.
Speaker:Which again is why you want to have documented procedures and runbooks
Speaker:so that those specialists can, uh, can follow them and get stuff done.
Speaker:So next on our list is retention policies.
Speaker:What are retention policies, Curtis, and why do, like, don't
Speaker:we just keep data forever?
Speaker:Come on.
Speaker:Storage is cheap.
Speaker:I have been at clients that kept data forever.
Speaker:In fact, I remember one, it was a financial firm in, uh, New York City
Speaker:and they had a forever data retention policy, and they were very proud in
Speaker:talking about the number of features and ways in which things had to be
Speaker:added to, uh, Veritas net backup.
Speaker:Just because of them.
Speaker:They were very ex.
Speaker:you should be proud of.
Speaker:Yeah.
Speaker:Right.
Speaker:Uh, d data retention should not be too short.
Speaker:I, I've, I've seen that, that's, I've seen on that end, uh, you
Speaker:know, the, the crazy end of forever.
Speaker:I also knew one of the friends of the pod, uh, Stuart Little,
Speaker:uh, he worked at a company where, uh, he was, they were a client of
Speaker:mine and the boss there had this.
Speaker:Like total opposite opinion, which was two weeks.
Speaker:His retention period for all backups was two weeks.
Speaker:This hurt my little backup heart, right?
Speaker:Because I can think of so many scenarios where two weeks is not enough, but he,
Speaker:he was just very adamant to not, um, have backups subject to like e-discovery
Speaker:Yeah,
Speaker:and so.
Speaker:sense,
Speaker:Yeah, it makes sense that that was why, but I, I just
Speaker:felt two weeks was excessive.
Speaker:So somewhere between two weeks and infinity, you should be defining
Speaker:what your retention periods are.
Speaker:But I think one thing to mention is not all your data has to
Speaker:have the same retention period.
Speaker:there's two things we need to talk about here.
Speaker:That's one of 'em, right?
Speaker:Why?
Speaker:Why don't, why didn't it have all the anger retention?
Speaker:Because some data you don't want to keep for long period of times, other data for
Speaker:compliance reasons or other purposes, you have to keep for a long period of time.
Speaker:It doesn't make sense to keep all the data for the longest period of time.
Speaker:You have to keep data for.
Speaker:Right.
Speaker:And, and all data's not created equal.
Speaker:You don't back it up at the same frequency.
Speaker:You don't back it up at the same retention.
Speaker:Uh, there are, there is data that is.
Speaker:Uh, of, of high risk, sorry.
Speaker:There is data of high risk in terms of high risk of
Speaker:lawsuits and things like that.
Speaker:Uh, the longer you keep data, the more data that you might be
Speaker:required to, uh, provide in some sort of, uh, e-discovery situation.
Speaker:it's also just cost too, right?
Speaker:kept everything forever, your costs are going to skyrocket
Speaker:from a backup perspective.
Speaker:Yes.
Speaker:I don't care what method you're using to store your data,
Speaker:you're paying by the gigabyte.
Speaker:In some way, shape, or form, right?
Speaker:And so if you store everything, then, then, you know, um, your, your,
Speaker:your costs are gonna be significant.
Speaker:Uh, so that, that's one thing that you need to keep in mind is that not
Speaker:all data needs to be, uh, stored the same amount of time, and you should
Speaker:be, do you know, you should be doing it based on the, the data type and the
Speaker:risks and all of these things, right?
Speaker:The other is that you should not be deciding this, just like recovery times.
Speaker:Uh, you should not be deciding retention periods.
Speaker:This, this should absolutely not be a decision that, that the backup
Speaker:person is making, and it, it, it shouldn't be a technical person at all.
Speaker:This, this is a business discussion based on, uh, compliance, based on
Speaker:legal liabilities, based on costs.
Speaker:These are all business decisions that should not be
Speaker:coming from the backup admin.
Speaker:It should be coming from, uh, you know, the people with the purse strings.
Speaker:Yes, but if you're being told, go back up this data and it doesn't have a retention
Speaker:period, I think it is up to the backup, a admin to say, Hey, I don't see information
Speaker:I need in order to be able to do my job.
Speaker:Can you please tell me what the retention period is for this data?
Speaker:Right.
Speaker:Yeah.
Speaker:I would, I would say in the absence of being given that I would, I would
Speaker:set the retention period to like seven years and then go back to them and say,
Speaker:Hey, I've set this for seven years.
Speaker:You might want to, you know, let me know.
Speaker:No,
Speaker:You know, something less than that.
Speaker:Right.
Speaker:Uh, the next is, and again, some people when we talk about 3, 2, 1,
Speaker:1 0, and I say, well, you know, this is sort of what defines a backup.
Speaker:Other people feel that without what we're about to talk about, again,
Speaker:you don't have backups, and that is monitoring and alerting, right?
Speaker:So.
Speaker:If you're not, you know, we talked about you should have a, a regular
Speaker:backup schedule, you should have defined recovery objectives.
Speaker:You should also have a system through which you know that the backups are doing
Speaker:the things that they're supposed to do.
Speaker:I
Speaker:Right?
Speaker:Curtis a months ago.
Speaker:It should be fine running
Speaker:Yeah.
Speaker:right.
Speaker:This is definitely not set it and forget it.
Speaker:I will say that.
Speaker:Right.
Speaker:Um, I I will, I'll tell, I'll tell a funny story.
Speaker:Um, we.
Speaker:Back before you, you know, it was a lot hard.
Speaker:It, it was, it was just hard to get centralized backup reporting back when
Speaker:I was doing this like 30 years ago.
Speaker:And we actually wrote Custom Pearl Code that went and grabbed a bunch of
Speaker:backup statuses, um, and created a web based, uh, reporting system for, in
Speaker:this case it was net backup and, um.
Speaker:Again, I'm just gonna say this is, mind you, this was a long time ago.
Speaker:in the day.
Speaker:Uh, and, and I, and I, I did what I was told, but they asked, uh, for a,
Speaker:what we called management view feature.
Speaker:And so that was if you went and you, you like pushed this button,
Speaker:all the backups, uh, went green.
Speaker:So, so in case management was stuck, so we had like the regular view,
Speaker:which is our view, and it would show you like each, each backup.
Speaker:And then there were like, it was like a week of little green boxes,
Speaker:and then you, you could see the red boxes and then, you know, you could
Speaker:see that, you know, there were, there was red or green after the red.
Speaker:And, um, but yeah, they, they, they asked for a feature where you could
Speaker:push a button and, uh, it made it look all better for, for management.
Speaker:Oh boy.
Speaker:and so that, that's, that's monitoring and then also alerting is like,
Speaker:you know, backup failures, things like a, a, a good modern system.
Speaker:You should be able to define your recovery objectives, and then it
Speaker:should tell you if you're unable to meet your recovery objectives, right?
Speaker:If you're unable to be, if you say you have a a four hour RTO.
Speaker:But you're not even able to complete backups within four hours.
Speaker:This is a problem.
Speaker:If you say you have a four hour RPO and you're not backing up at least
Speaker:every four hours, then you're gonna have, you're not compliant to the, the
Speaker:objectives that you have specified.
Speaker:Also from a monitoring and alerting perspective, one of
Speaker:the things with ransomware
Speaker:mm-hmm.
Speaker:in encrypts data.
Speaker:When it
Speaker:Yep.
Speaker:encrypts data, you're gonna end up with larger backups than normal.
Speaker:Yep.
Speaker:you have monitoring and alerting in place, maybe it could detect
Speaker:anomalies and say, Hey, by the way,
Speaker:Yes.
Speaker:all of a sudden your 10 gigabyte backup turned out to be one terabyte.
Speaker:What's going on?
Speaker:Yep.
Speaker:Uh, and, and the other thing also it that, that's a great, that's
Speaker:a great, uh, recommendation.
Speaker:The other also is of course, that you're running out of storage,
Speaker:Yeah.
Speaker:right.
Speaker:This is a problem.
Speaker:Right.
Speaker:And I'll also say that a lot of.
Speaker:Reporting systems.
Speaker:They're really good on reporting what happened.
Speaker:They're not so good sometimes at reporting what didn't happen.
Speaker:There needs to be some aspect of your reporting system so that
Speaker:you can check the total inventory against the total backup inventory.
Speaker:Again, a compliance check to see that every, uh, system, uh, is
Speaker:automatically included in the backups.
Speaker:Yep.
Speaker:and how are we doing on time?
Speaker:I think
Speaker:Yeah, yeah.
Speaker:We're good.
Speaker:Yeah.
Speaker:VMware and other
Speaker:Yes,
Speaker:make that easier because they do provide that inventory to the backup system
Speaker:yes,
Speaker:But
Speaker:yes,
Speaker:when you have physical systems, when you have SaaS applications,
Speaker:other things like that, it may be a little bit more difficult.
Speaker:absolutely.
Speaker:And so wrapping this up, we have endpoint, uh, device protection.
Speaker:A lot of times on this podcast or what a lot of people think about,
Speaker:it's like their database applications or virtualization environment.
Speaker:But have a lot of endpoints out there that you need to be protecting as well.
Speaker:And Curtis, I know you've brought up sort of cybersecurity.
Speaker:Do you want to talk about some of the issues that come up in endpoints?
Speaker:Yeah, well the, you know, basically you have this incredibly powerful thing
Speaker:in your hand that has access, right?
Speaker:And, and also.
Speaker:When we talk about things like, uh, biometric access and all
Speaker:that sort of stuff, right?
Speaker:You, you have all of that.
Speaker:Everything is relying on this device, right?
Speaker:And also perhaps your laptop.
Speaker:those
Speaker:Oh, thank for the thank you.
Speaker:Uh, and then also your laptop.
Speaker:Like my laptop has touch, ID built into it, right?
Speaker:Um, so it's an incredibly powerful device, but, and also it's a device.
Speaker:Upon which we rely so much.
Speaker:Right?
Speaker:And so you need a system through which you can recover that device if it
Speaker:goes, uh, if things go poorly, right?
Speaker:And whether it's, it's, it's, it's hacked.
Speaker:Um, it, or you just drop it, you know, in a sink somewhere, right?
Speaker:Shut up.
Speaker:I know.
Speaker:Shut up, shut up.
Speaker:I know what you're talking about.
Speaker:Um, and, um.
Speaker:If you do something stupid, you know what?
Speaker:You know, when I cracked, when I cracked my screen, uh, several years ago, I went,
Speaker:I went and got it repaired and, and then while walking to my car from the screen
Speaker:repair place, I, I tripped and I literally fell onto my phone and I cracked the
Speaker:screen again and I just had to go back.
Speaker:Um,
Speaker:Curtis.
Speaker:Hmm.
Speaker:yeah, that sucks.
Speaker:Um, but anyway.
Speaker:The question you should ask yourself as to whether or not you need to
Speaker:do endpoint backup as whether or not your endpoint has data on it.
Speaker:Right?
Speaker:Data that only resides there, right?
Speaker:If you're, if you're using, if you're using an iPhone or an Android.
Speaker:And that's what we're talking about from an endpoint perspective.
Speaker:And you're just using Google Photos or, uh, you know, iPhoto, and that's what
Speaker:we're talking about that is generally synchronized up to the cloud, right?
Speaker:Yeah.
Speaker:Um, but if you're using a third party app to do photos of your job sites,
Speaker:because there are third party apps that do photos of your job sites.
Speaker:Where, where are those photos are?
Speaker:Are they only on the phone?
Speaker:Are they synchronized up to the cloud?
Speaker:Uh, is there a system by which you can find out that all of the,
Speaker:that synchronization is working
Speaker:Yeah.
Speaker:you don't find out too late that these really important job site
Speaker:photos were only on Steve's phone and now Steve's phone just got ran
Speaker:over by a truck because Steve got ran over by a truck and, uh, poor Steve.
Speaker:Yes.
Speaker:Poor Steve.
Speaker:Right.
Speaker:So that's the question.
Speaker:If you have endpoint devices where data is being created on those endpoint
Speaker:devices as opposed to just using them.
Speaker:So 99% of what I do, al almost a hundred percent of what I do really is
Speaker:In
Speaker:I'm using a, some cloud service.
Speaker:To do the thing, like right now we're using a cloud service to record this data.
Speaker:The, this, this recording until I edit it, it only sits in this, um,
Speaker:you know, this little cloud service.
Speaker:It's not, I'll just tell you that right now.
Speaker:The, the, during the interim, if we would be like, uh, we
Speaker:would be like, uh, those guys.
Speaker:What were those guys?
Speaker:The, the, the storage container, uh, people, the life uncontained.
Speaker:Oh, yes.
Speaker:Yeah, we would be like dim, uh, we would lose, we, we would
Speaker:lose a couple of episodes.
Speaker:I think, uh, if, if squad cast decided to, to go tango uniform, but what I
Speaker:was saying was that I use this and then I'm gonna use, I'm gonna use uh
Speaker:uh, descrip, which is gonna pull this over to Descrip and it's gonna edit it.
Speaker:And that happens in the cloud.
Speaker:There is a cloud, there is a local copy of Descrip.
Speaker:It runs on my laptop, but that's just, um.
Speaker:Like a cash
Speaker:You it, it's a cash copy, right?
Speaker:So if that's the way you're dealing with stuff, then you don't really
Speaker:have to worry that much about endpoint device Pro, you know, backup.
Speaker:Yeah.
Speaker:You need to worry about it from a device protection and data protection
Speaker:standpoint to to access to those systems because they could be used
Speaker:to access the, your critical data.
Speaker:But you don't.
Speaker:If you're not creating data and storing data on that endpoint, then
Speaker:you don't have to worry about it.
Speaker:But if you are, then you should.
Speaker:Yeah.
Speaker:Well, and also everything you've mentioned I agree with only
Speaker:applies to backing up the data.
Speaker:It has nothing to do with endpoint device or detection and response EDR tools and
Speaker:right,
Speaker:right?
Speaker:right.
Speaker:That's
Speaker:Yeah.
Speaker:that you still probably need, even if you are using a hundred percent
Speaker:cloud services, because those endpoint devices are a gateway to your network.
Speaker:Yeah.
Speaker:So yeah, EDR tools, uh, which again, we discuss in the
Speaker:ransomware book, uh, learning, ransomware response and recovery.
Speaker:Those are, they're, they're the canary in the coal mine, right?
Speaker:They, you most likely will be getting ransomware via an endpoint.
Speaker:So having EDR on your is a great way to find that before it becomes a problem.
Speaker:So.
Speaker:I wonder what other countries use instead of canary in a coal mine.
Speaker:Are we the only country with coal mines?
Speaker:We're not the only country with coal mines.
Speaker:You just, maybe we don't have the, they, they don't have the,
Speaker:um, surely they also used canary.
Speaker:What is a canary?
Speaker:Why do we say canary in a coal mine?
Speaker:Do you, do you, do you know the etymology of that, right?
Speaker:miners used to take canaries in with them, and therefore, if oxygen was.
Speaker:Running out or whatever else.
Speaker:If there was an
Speaker:Yeah.
Speaker:they were about to pass out, then the canary would pass out first or die,
Speaker:Yeah.
Speaker:therefore they knew there wasn't enough oxygen, so then
Speaker:Time to get out.
Speaker:Exactly.
Speaker:Um, I just had a memory of, um, Zoolander when Zoolander, he was,
Speaker:he was, when he worked in the coal mines that he came out like one day.
Speaker:He goes, I think I got the black lung.
Speaker:Love, love that movie.
Speaker:Alright, well there you go.
Speaker:10 backup elements that you need to have in any company.
Speaker:Right?
Speaker:Let's just review 'em again, the 3, 2, 1 rule, the regular backup schedule,
Speaker:backup testing, and verification, defined recovery objectives.
Speaker:Backup security and isolation, SaaS backup, uh, documentation
Speaker:and runbooks, uh, retention policies, monitoring and alerting.
Speaker:And finally, endpoint backup.
Speaker:Uh, this is good.
Speaker:I like this episode.
Speaker:I like, you know, episodes with lists, fast facts.
Speaker:All right, thanks.
Speaker:Prasanna for being my canary in a co
Speaker:or bird brain being my bird brain.
Speaker:anytime, Curtis, for you.
Speaker:All right.
Speaker:And, uh, thanks to everyone listening, uh, that is a wrap.