Backup Security Best Practices: Lessons From a Real Red Team Breach

There could be a hacker working their way into your backup server right

now, not because your firewall failed, but because nobody ever even bothered

to change the password on the box.

Today, Prasanna and I sit down with Mike Saylor, uh, to talk about backup

security best practices, the stuff that most teams skip, mainly because

backups are invisible until they're not.

Uh, we're talking about things like default passwords on backup hardware,

service accounts that nobody's looking at, uh, admin logins at 2:00 in the

morning, and why passkeys beat MFA.

There's a real story in here about a red teamer who broke into a company through

their backup system and walked out the front door with the domain controller.

If this is your first time watching or listening to me, I'm

W. Curtis Preston, aka Mr. Backup.

I've been obsessing about backup, recovery, and now cyber

recovery for over 30 years.

If that's your bag, then I'm your guy.

You're not gonna find anyone that cares about this topic more than me.

Ever since 1993 when I had to tell my boss that there were no backups of

the database that we had just lost.

Now I've written five O'Reilly books, a blog, and a podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap Up.

Hey, welcome to the Backup Wrap Up.

I'm your host, Debbie Curtis Preston, and today I have my two besties with me.

We've got Prasanna, getting more gray hair every day, and Mike,

my fellow gray-haired enthusiast.

How's it going, Mike?

It's going great.

Thanks for having me, and good to catch up with you guys

Yeah,

have a question, Curtis

What's that?

Is it better to have natural gray or is it better to dye your hair?

That's always been, like, the constant debate, and I think men typically

don't dye versus women, right?

I'm just going.

All

That's probably generalization

Prasanna.

Two little stories on, to answer that question.

clearly I've gone with natural, clearly.

and there was a minute there where I tried, some, like the kind that

is just supposed to subtly dye your hair, before I went completely gray.

And I did it, and my wife didn't even notice.

So I was like, then, what's even the point?" And then the other thing was

I was talking to her one day and I was like, my wife is Filipino for those

that don't know, and I said, one good thing about Filipino, you guys, like

your hair like stays black forever."

And she looked at me and she goes, know we dye it, right?"

It's like, "No, I had no idea."

Oh, Curtis.

typical dude.

Anyway.

All right.

So we are back to our, series, of, g- basically working through our new book,

that, Mike and I came out with, which is Learning Ransomware Response and Recovery.

For those of you watching on YouTube, you can see a giant version

of that over my shoulder there.

And, if you're not checking us out on YouTube, you should

definitely check out our channel.

And of course, we also have the shorts version.

we do 30 second to a minute and a half short clips, which are doing really well.

and we get a lot of, get a lot of, commentary on them.

sometimes, not good, but sometimes people have no problem with, expressing

their opinion, to a random stranger on the internet because they're generally

people that don't, know who we are.

And, so they're just, they just see me making a random claim and, and then

they wanna argue with me, which is fine.

You want discussion?

Yeah

yeah, more interaction, And, any comment, even if the comment is, "You're a

freaking idiot," it builds engagement.

So comments are good.

but today,

co-host has amazing hair

yeah.

Yeah, I-- we did

You talking about me?

Yeah.

sorry

We did get a, we did get a comment about your hair is gorgeous.

and I knew he was talking about you.

but, speaking of the book, there is a, there's a quote in there from one of our

podcast guests, which was Duane Lafleur.

Duane is a, he's a red team person, right?

he hacks companies on purpose for, as requested by the companies.

I once again will mention the movie Sneakers.

If you haven't seen it, go watch it.

it's not, obviously it- it's movies, but it does a pretty good job

of showing what, red teaming is.

And, and there's a few late great actors in there, specifically, Robert Redford.

y-

IP

great just, yeah.

but, it, Duane's, Duane talked about how he loved backups, except

not for the reason I love backups.

And that was he loved them because, one of the things that we talk about a lot

is that backups, because of what they are, where, you're either invisible

or you're in trouble, because of what they are, they often go, ignored from

a cybersecurity perspective, right?

For a couple of reasons.

One is nobody wants to, get their hands in there because once you

start sticking around in the backups, somebody might ask you actually

to be the backup person, right?

And so there's that, and then because of that, it's often the junior person.

So you have the junior person running backups, and the junior person is the one

who knows the least about cybersecurity.

And today we're gonna talk about things that you need to be doing to

your backup system, and specifically we're gonna talk about accounts

today that are around all the time.

We're gonna talk about service accounts, we're gonna talk about passwords.

And he talked about, where he was able to penetrate a system, a company via their

backup system because what he did was he used some lackadaisical security to, take

control of the backup system and then used that control to restore, the backup

server to a, com- the storage completely outside of the company's, firewall.

It was a backup of the domain controller that he restored to outside of this,

their world where he then had complete control over that server and he was able

to extract all kinds of information.

And this is the kind of thing that we talk about a lot in the book where

it's like your backup server, only does it need to be protected because

you need it for recovery when you get hit from, a ransomware, but also

because it is an exfiltration Source, a potential exfiltration source.

And so there are unfortunately a lot of default passwords.

This is one of the things we're gonna talk about.

There's a lot of default passwords that are in, especially I'm

gonna say backup hardware.

there are some default passwords in some of the backup software, but

I think it's less of a, a problem.

But, so that's what we're gonna talk about in this episode.

Prasanna, it sounded like you, you had

I had a question.

Yeah.

I know you were just talking about default passwords, but I don't think

it applies only for the backup space.

I don't know if you've seen all the issues people have had with network

routers being compromised, being used as botnets for attacks in other places

or as resident, residential proxies.

But all of this stems from, people not changing the default password

when they buy a router, right?

You go buy a wireless access point and you are like, "Oh, I'll just

leave the defaults as it is."

Yeah, agreed

Everything that we're gonna say in this episode would also apply to any other

network or storage infrastructure, except that this podcast isn't called

The Network Schnetwork, it's called The Backup Wrap-Up, and so we're

gonna focus on the backup systems.

But yeah, Prasanna, you're completely, correct that, that there are a lot of,

default passwords out there, especially on network equipment that, the good news

is, at least with network equipment, there are people that actually want to

be network admins, and so they actually study it, and they tend to be, they often

tend to be cybersecurity leaning, and so they tend to be a little better at

doing this, although clearly not perfect.

Or have been doing it for a longer amount of time than the backup admins have been

Mike, the first thing I wanna talk about is this idea of service accounts.

and w- that they're invisible, that they're this thing that's

happening and it's a thing that you can then use to, to, attack things.

You wanna talk about what service accounts are?

About the service accounts Yeah the funny thing about service accounts a lot of

times when we red team an organization even the security services that you're

running are susceptible to compromise So a lot of times we take advantage of

like the antimalware service account or like a Qualys vulnerability scanner It's

a service account that's got privileges it's not protected they're assuming the

endpoint is protected And so when you compromise that account now you have

privilege across all of the endpoints where that agent or service is deployed

it is often overlooked and it's overlooked for a couple of reasons One typically

when you deploy a technology that requires a service account you give it privilege

cause you want it to work shortest path to getting things operational we don't have

to troubleshoot restricted access Just give it all the access and it'll work And

then we'll we'll pull the access back as needed but they forget that part or often

it's overlooked or we ran out of time or we ran out of budget or we've got this

other fire that came up we need to go put out and it just gets pushed off the plate

Mike,

and yeah it's very

and Mike, just real quickly, could you help y- listeners who may not

know, like what is a service account?

Because maybe not everyone is familiar with that aspect

they take a couple of different flavors The the probably the most common one

is just it's just a it's like another user account on the network So there's

mikecompanycom and then there's backupagentcompanycom so it's another

user account in the network and you just you have to know the credentials to log

into it and use it Sometimes that's just filed away somewhere in a password vault

or somebody's desk and you don't have to log into it because once it's running it

just runs until you need to make a change

and some of those accounts, Mike, some of those accounts, if they're created

by the backup software itself, they could indeed have like default passwords

that the backup software, put in there.

Certainly and that lead that leads it to the next type and that's more of an

agentbased software So you install a piece of software on the computer it has its own

credentials and you authenticate it back to a console like your backup console your

antivirus console and it just it runs on that that endpoint with those credentials

and often back to the initial comment often it's a privileged privileged account

Yeah, because if you think about backups, in order for backups to do their job,

they have to have superuser access.

They have to be able to access all files in order to both, first to be able to

res- to back them up, but also, just as importantly, to be able to restore them.

You have to have write-level access to all the accounts, and that does bring me back.

I'll pick on, what back in the day was my favorite product was NetBackup,

and, they had a tool called BPGP.

they did, I do, I did find out they definitely eventually, got rid of this

tool, but, it was originally called BPCP.

BP was the Backup Plus, the original name of the product.

And if you were on the backup server, you could use BPCP to read or write any

file transfer from any file from any client where that daemon, was running.

and so it ju- it just made it really easy.

even with the software, with most backup software products, you can use

the software to back up a file, then restore it locally, but BPCP made it

possible to just do it in one step.

and that just gives you an idea of the kind of thing that

you could do if you have this.

Certainly and if I could add two two comments real quick One since you brought

it up is it pronounced demon or daemon

I say demon,

I say Damon.

you do you're backup guy

Yeah

yeah, it is spelled daemon.

I don't know.

by the way, it's also pronounced L- Linux, based on the fact that it came from Linus

I will never pronounce it

I will never pronounce it that way either, but it is based on the name

of the guy who wrote it initially, whose name is pronounced Linus.

whatever.

Anyway,

the last thing I'll add the last thing I'll add on default passwords there

there's another problem or a a a variation of the default password situation and

that's coincidental password So maybe the password has been changed but

it's the same password that's used for a lot of other things So this admin

account password is the same as that admin password But then also when you

get to managed service providers so maybe you outsource IT management that

IT management company may be using the same backup password for your

environment that as the same password they're using at another company's

environment

my head to think of that

world very similarly bad guys are looking for the shortest path with the least

with the most value So if I'm gonna steal if I know to look for backups

and that's where all the data is gonna look at managed service providers cause

that's where all the passwords are

Yeah.

So if I compromise one managed service provider I likely have

access to many client environments

a thing, this was several years ago, but there was a dentist

Post office, yeah

that they hacked the MSP, and as a result they were able to hack,

hundreds of dentists around the country

That's right

So for the service account, Mike's, because when it gets deployed to

your environment, you're going to have multiple agents deployed across

all of these systems in order to be able to back up and restore them.

Are each of these service accounts across all of the individual machines

uniquely protect- or do they have unique passwords, or is it typically

a single service account which might be local to a particular machine might

share a common password with another service account on a different machine?

Typically and I would say typically putting that in the 90 percentile range

the passwords are the same I think there are some highly regulated and

possibly highly more secure environments where you could assign unique passwords

but that's definitely the exception

more management, more complexity, all the rest of that

For sure

For

so it's bad enough if we, are able to compromise a single account.

what then, let's talk about privilege escalation, Mike.

what is privilege escalation and what could someone do, once they achieve that?

So privilege escalation is taking whatever access you you're able to gain

at whatever level normal user guest super user admin global admin and get to that

next level and sometimes we talk about privilege escalation but sometimes you can

actually justify demotion for a particular objective so maybe I wanna pretend I'm

Curtis So I'm global admin I have that ability I can now give myself access to

a a demoted account like Curtis normal user in order to use Curtis's identity

to achieve whatever but the promotion part or the escalation part is I am

Curtis and I wanna be an admin so I'm using Curtis's local permissions on his

computer or his network permissions to find and recon is always the first phase

Find those service accounts find those accounts that have default passwords

and then escalate to that and that whether that's straight to admin or an

administrative privileged account or some series of stepping stones to get there

the thing from a backup perspective that I want people to understand is that almost

every backup software product that I worked with has the idea of a pre and a

post script, So if you can put a script in the appropriate place, the backup

software will run that script as the privileged account that backup runs at.

So if you basically create a script, it creates a user that gives you the

permission that you want, the backup, and put it in the right place, backup will

then use that, will run that script for you, and then you can put in the script

to clean up, behind yourself, right?

So this is just something you need to be aware of.

You should be looking for these scripts, that you should be checking if there

aren't any of these scripts, you should be looking to make sure that

they don't magically appear, right?

and then also if you are using these scripts, you should make sure that

the, that they don't, change on you

Do you know, Curtis or Mike, if any of these backup systems actually look

to see if a script has been changed, like outside… I'm just imagining

a case that someone goes, like a script is defined, a pre-script.

They go behind the scenes to the file system.

They change the script.

They haven't changed the name of it, right?

But is there any backup software that actually does like a verification

to ensure that like a script has not changed between when the admin

actually configured it versus now?

Yeah.

I, I don't, I certainly don't know of any that do that.

But I tell you what, we've got a lot of listeners, and a lot

of them are vendor, people.

So I… If you're aware of a product that does do that, that checks the

scripts that, you know, that… It would be… What would be really nice

is to make sure that the first time a new script is run, it, we send up

some authentication and say, "Hey, is this what you intended to do?" and you

do four eyes, authentication, which is where you have to have two people,

to authenticate That would be nice.

It would also be nice to do what you're suggesting, which is, checking

to make sure that the script that we're running is the same as this.

You could do that by fingerprinting and all that kind of stuff.

But, so this is just something to look into.

and then, let's talk about… What?

Go ahead.

real real quick on that I yeah I'm not familiar with a backup solution that does

that but there are thirdparty tools that do file integrity monitoring so they'll

look for changes in the hash changes in the configuration Tripwire used to do that

I don't know what they're called today But then a lot of security monitoring

tools you can point at an object whether that's a file or a folder or metadata and

it'll alert you when something changes

because all those, the, the ones that I'm aware of, the, would put the script

in a particular predictable place.

and, and so you could monitor for that.

So let's talk about something that I talk a lot about, Mike, and that

is this idea that the backup system should not share any, credentials with

the production environment, right?

that we don't put it in the, Active Directory domain, for example.

why is that the case?

Well which it just it goes back to that idea or the concept of putting as many

layers of security and obfuscation and really just extra effort as you can to

not only deter and potentially hinder but also give you time to identify when

weird things are happening So for example if you've got your backup your backup

system on a separate network like a like a management network so all your servers

you'd have two two network interfaces one for production and one for backup and

management all day long your production network interface is just super busy

and it's dynamic there's just tons of activity and you that's needle in a hayst

needle in a haystack looking for bad actors But on your management interface

that's like you can baseline that You know exactly what's going on there when to

expect backups what bandwidth looks like connections and all those things So much

less dynamic traffic on that interface and much easier to identify when weird things

are happening So there's that then on the Active Directory side let's just take the

example that you brought up where a bad guy was able to to get a copy of a domain

controller then the domain controller has all the privileged accounts and some of

those are you just have to have like your global admin and Office 365 exchange admin

All those things are in your normal Active Directory and they need to be but some of

these others like your backup admin maybe your your cybersecurity tools some of

those other things recovery accounts So if someone does compromise your

domain you've got this other interface with separate credentials that you

might be able to re reacquire some of those servers or part of your network

Yeah, I li- I like that separate network.

I've always been a fan of the separate network, for backup traffic, more

so back when that really meant that the backup system could get

a predictable amount of bandwidth.

But now, And what's really nice about it now is that we can do this, this is

part of infrastructure as code, right?

That you can just literally, as you're creating your VMs, in the cloud, you

can create them this way, and you say, "All backup traffic goes through

this, port, and production traffic goes through that port." Prasanna,

actually see that in production today, Mike?

oh,

I wonder if a lot of this like sort of… 'Cause I know like ideally,

it is best practice to have like separate management network, backup

network, and production network.

But that's also like time-consuming to set up and manage over time and everything

else, And also in the world of virtual machines where it could be easier,

but it's also still a bit of a pain.

And so are you actually seeing people continue to have these like

isolated networks that they use?

I haven't seen any new ones A lot of the ones that are out there have been there

for a while mostly in telecom And y your backup strategy your management strategy's

gonna drive that architecture in the environments where I've seen the separate

interface their backup jobs were huge and even having the separate interface

and better bandwidth they still struggled with backup jobs completing before the

next business day so that was primarily the driver for the strategy for those

organizations is how do we make our backup strategy effective instead of thinking we

need a new strategy and then probably more recently today they're all mostly VLANs

instead of physical network interfaces

Yeah, that's a good point.

do you wanna, just cover what a VLAN is real quick for those

that are not familiar with that?

Yeah So a a VLAN is j it's a virtual network but it's run off of one appliance

And so if you think about a a switch with let's just 32 16 32 ports that you

would plug in your network cables to when you log into that that switch the

interface for that allows you to assign or create these virtual networks so that

network jack Ethernet jack one through six is VLAN one now you can create access

lists and restrictions whether it's computer in VLAN one cannot talk to any

other computers and vice versa so it's isolated but you can also restrict the

type of traffic we don't allow people in VLAN one to receive internet traffic we

restrict that both normal HTML and the encrypted 443 ports and those protocols

You can do a lot with VLANs from a a another layer of network management

and security And then a computer a a server again if you had two network

interfaces or even a virtual network interface now that we're talking about

virtual machines you can connect that one computer to one to many virtual networks

through through that VLaning switch

is a way we can segregate the traffic even though we only have one actual interface.

Right

about most consumer Wi-Fi devices or routers these days, right?

You have a guest network and you have your normal, right?

And that is a form of s- network segregation.

I'm sure they're using VLANs or something under the covers as well.

All right.

So let's just talk about, let's review, the basically the things that people

can do, to help with this problem.

and the first one I'm gonna talk about is the easy one, which is go look for and

change all the default passwords, right?

think about all of these backup, especially backup service accounts.

Prasanna, you mentioned network infrastructure.

I'd say storage infrastructure.

servers don't tend to have, 'cause unless it's a, an appliance

server that you bought, they don't tend to have default passwords.

Although I suppose like a, particular distribution might have that.

any other default passwords, Mike, that you can think of that people

should go be look, looking to change?

Just about anything comes with a default password whether it's blank or password

admin or the name of the product and there there may also be a support account so if

you need help you're gonna call a number or get on a website and they're gonna

be able to remote connect in using their support account My recommendation to all

of those support situations turn it off until you need help Don't just leave it

on cause those are just like home security systems you A contractor now it's not

even the company that installs it now they hire contractors that come out and

install your home security system and the default you know key or password is 1111

or what have you And you can put in your new code 1234 But unless you delete or

disable the original code it's still there

Yeah,

But it… One, one thing though.

So I have a sprawling enterprise network, right?

With a whole bunch of devices.

How am I supposed to figure out, what has default passwords and what doesn't?

is there a tool out there that can ki- that can look across my entire

network and they say, "Hey, this is the type of device you have.

Okay, let me try its default"?

A vulnerability scanner like like Nessus You can you can You There's an open source

version of Nessus it doesn't have all the bells and whistles but it's good enough

Yep.

Spell that, Mike

make sure you read the NESSUS Nessus make sure you read the manual or watch

some some YouTube videos before you run it cause it can it can be disruptive if

you don't configure it well But there are plugins for or switches to turn

on to test for default passwords and there's other So those are traditional

network devices like switches routers servers some software and then for OT

operational technology related hardware like SCADA devices and thermostats and

printers and smart boards there are other tools that are more current on

configurations and passwords for those

Yeah.

to go back to your support account, I can, give a shout-out to Rubrik here.

One of the things I know, and maybe there's other products that do this,

but I just know in, in the case of Rubrik, they're not able to connect

from the outside to the support account.

They require you to do an SSH tunnel.

the, the server is set up or the, the appliance is set up in such a way that

you can't connect to the outside on that account, and it would be… If

it's possible for you to do that, And by the way, if you guys are aware of

other backup software or backup hardware products that, that do that same

concept, I like that as well, that the account is set up in such a way that you

cannot connect to it from the outside.

the, I like that a lot.

another thing… Go ahead.

What's that?

that thought and enhancing my previous comment about turning stuff off when you

don't need it that includes publicfacing services so if a vendor does need to SSH

or VPN in to address help you address a problem those services should only be

enabled and turned on when they're needed

Agreed.

not just all

Agreed.

Especially my favorite service, RDP, the, the

Ransomware Deployment Protocol.

Two two other things I'd like to add

sure

is one of the other situations that we run into a lot is backup admin is running

daytoday operations as backup admin So he's checking his email he's surfing the

internet and that's the admin account And so good best practice is Bob backup admin

has a b a normal Bob account that's not an admin and that's what he's doing daytoday

stuff in and then he's gotta log into Bob the backup admin to do backup admin stuff

Like

That's painful, Mike.

And then the last thing I'll mention because if this happened your your

red team example earlier would have been more difficult if not preventable

encrypt your backups and have different credentials for the decryption part

Yeah.

Agreed.

Agreed.

Now, in the case of this particular red team, he was able to actually take control

of the backup server, and so encryption doesn't help at that point, right?

he didn't steal backups, he stole the back- he stole the backup server, right?

and I think that's a mi a a common misconception for people that

think my data's encrypted it's only encrypted when you're not using it

Right

you can't work on encrypted data We're not that smart

yeah, by the

when you log in or authenticate to a system that's encrypted it becomes

unencrypted so that you can use it

By the way, along the same lines as, admin also, if your account, if

your admin account doesn't need to be named admin, change that, right?

Again, don't make it the default username and the default password, right?

admin?

yeah, admin, yeah, exactly.

and then we can also just talk about just hardening everything, but

especially the management plane and especially backup stuff, and that is

if you're not using either MFA or, pass keys on your, security infrastructure

and your backup infrastructure, it's time to do that, right?

Prasanna, you wanna remind us what MFA is and why we care?

Yeah.

MFA is multi-factor authentication.

So you see this everywhere, right?

It's like you log in using your password and it's "Please

touch your keypad," right?

The biometric sensor in order to know it's you or look at the face

ID so it knows it's you, and so this way you have multiple ways to

authenticate that it's just you.

It's not just the password you know, but it's also, who you are.

And so that's multi-factor authentication.

Passkey is, I don't know what I would call it.

It's like passwords on steroids because you don't really need to

know the password anymore, right?

It's the ability to tie a particular device to a particular website such that

you no longer necessarily need to use a password whenever you are accessing that.

It's tied… And once again, it uses sort of MFA or, biometrics

in order to do the initial establishing of the authentication.

But after that, it's automatic.

Yeah, so you

How'd I do?

yourself to the device and the device authe- authenticates itself.

Mike, just curious, one thing I've noticed lately has been random

companies that I interface with and they've done away with passwords,

but they've replaced it with, "We're going to email you a one-time code."

And I'm like, "This isn't better." w- your thoughts on that?

No I agree given enough reconnaissance and time bad guys are gonna figure that

out for that organization And if it also depends on whether are you emailing it to

my personal account Are you emailing it to my work account are you requiring me to

go set up a new account like that I don't use for anything else there's ways of

doing that and each one of them have pros and cons but long story short MFA really

needs to be a wwhat would be considered outofbounds communication so not normal so

like a an authenticator app on your phone is probably the better So you've gotta

Yeah

and set it up with layers also So my authenticator app requires a PIN to get

into the authenticator app in order to get the code to use as MFA to get into

whatever site But preempting all of that making sure that policy does not allow

me to bypass MFA because I now trust this device or remember me or any of those

other things that would then store an MFA token in a browser or on this computer to

be trusted again in the future MFA has to happen every time in order to be effective

again, Mike, I, I so often learn random stuff from you that, and this is the one

today, and that is I didn't know the, my, my particular authenticator app does not

require a pin, and I like that idea a lot.

I'm gonna go check to see if it supports it, and then perhaps

I just haven't turned it on.

Similar to back in the day when you talked about having a separate browser

for, or a separate browser session, and the way I did it was I take my accounts

that matter, and I run it on a completely different browser, and then I t- I use

Chrome as my, regular browser, and then I use a different browser for that stuff.

And I actually installed a Chrome plugin that if I go to any of those accounts that

matter, it says, "Hey, you're not supposed to be over here. You're supposed to be

over there in the other place," right?

So I love it when I… I've been

Learn tidbits.

it when I learn st- stuff new.

th- this particular old dog, new tricks.

What was that, Mike?

similar to your plugin, on the company network, if you've-- if

you're diligent about making sure that your admins are using the admin

account only when they're doing admin stuff, you can monitor, like alert.

Every time an admin logs in, someone should know.

It gets logged, and then over time, you've got a baseline.

Like admins, 99% of the time, they're only logging into the admin account

Monday through Friday, eight to five, maybe Saturday to do some work.

But so if you can baseline that activity along with having

visibility into it, again, you can start to look for anomalies.

Someone, admin logged in at 2:00 a.m., we should call the admin

and see if that's really them.

And that's, if it's a one-off thing, then that's, that's easy to manage.

then on the audit or even incident response side, if you're looking

backwards about, in, in time for activity about an, an admin account, you

should be able to tie admin logged in.

is there a ticket associated with that?

was there a, a change in the backup system?

Was there a break fix, a new install, a new config?

Is there a ticket for that?

So that goes back to general controls and are we actually doing, these good,

am I following the change management or patch management policy or what have you?

so from an audit perspective, there's that.

then incident response also, if it's an admin and we're logging those activities,

that's gonna help us build the picture for how this happened and when it happened and

Yeah,

all that

and you can also, a very common thing to do is to prevent the ability to log in

directly as the, the admin account, right?

you can say, you can establish that.

You have to es- you have to start with establishing that as a policy, right?

And then there are technological things that you can do to simply

prevent a person from logging in, directly to the admin account.

They have to log in as themselves and then become the admin account.

and that even if you can't prevent it, you can, again,

like you said, monitor for that.

So if they, if somebody, if anybody does directly monitor into the admin

account, that's an event, right?

That you need to go research, which…

And maybe it's just your employee, it's 2:00 in the morning and they're half

asleep and they don't know what they're doing, but, maybe it's a, bad guy.

I had the opposite, situation go where we were seeing failed login attempts to

an admin account every Thursday morning.

And, we would escalate that to the client.

They would go look at it, they'd close the ticket, and, but

we wouldn't get any feedback.

But every Thursday morning, there were these failed admin account logins,

and it was because their admin was going through a tough patch and would

go get drunk every Wednesday night and come in Thursday morning and have

trouble remembering his password.

So eventually we heard the whole story, but, that's

Yeah, b- Curtis, one of the things you write, you talked about MFA

and passkeys at the beginning.

Yeah

Do you know of any backup systems that use passkeys?

I know that there are some that support it, yeah.

yeah.

and I think most… what some of them do is they outsource it to,

if you're gonna use an OTP, right?

You're gonna, you're gonna use something like Okta, right?

They're gonna use some sort of SSO, right?

Single sign-on package, and then they outsource it to that.

but I am aware of a handful that, that directly support passkeys, and this

is the thing, like if you're not, if you're not looking into passkeys now,

it's the best thing that's available, from a security perspective, from

a login pers- security perspective.

It's better than MFA.

if you're using MFA, we're actually gonna be doing, the, an upcoming

episode on we're gonna be talking about phishing-resistant MFA why that's a thing

and why you need it and, and what to do.

But again, you could just skip it and go straight to passkeys.

and that's a good thing.

right.

any final thoughts, Mike?

Be diligent, read the manual, change your passwords

There you go.

Prasanna

I got nothing, but I do miss our, podcast recordings, so looking

forward to the upcoming ones

Yeah.

Yeah.

It was, we took a little break there.

and, so hopefully the people are enjoying the, or did enjoy the, the

encore episodes that we put out.

There were some really good episodes in there, so I hope they enjoyed those.

and I'm glad that we're now, recording again.

all right, folks, thanks for listening.

You are why we do this.

That is a wrap

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening