Cybersecurity Best Practices for Individuals (Encore)

Half of a group of Michigan college students plugged in a random USB

drive that they found lying around, some of them within minutes.

If you're shocked as I was by that story, then you're

listening to the right episode.

It's the fifth in our Encore series, where we're bringing back an episode that

listeners really seem to engage with.

My co-host, Prasanna Malaiyandi, and I, uh, sat down with Mark

Schreiner, host of the SecureTalk podcast, to talk cybersecurity

best practices for individuals.

Not the enterprise SOC stuff that we normally talk about.

Real, practical things that you and your family should be doing.

Things like multi-factor authentication, phishing prevention, SIM swapping

protection, password managers, and of course, my favorite topic, backups.

We landed on a phrase by the end of this episode that summed up the whole thing,

and that is, "Just do something." Don't let perfect be the enemy of protected.

By the way, if this is your first time watching or listening to me, I'm

W. Curtis Preston, AKA Mr. Backup.

I've been obsessing over backup, recovery, and now cyber recovery for over 30 years.

If that's your bag, then I'm your guy and you should probably subscribe.

You're not gonna find anybody that cares about that topic more than me.

Ever since 1993 when I had to tell my boss that there were no backups of

the database that we had just lost.

Now I've written five books, a blog, and a podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap-Up.

hi and welcome to backup.

Central's podcast.

I'm your host, W Curtis Preston AKA Mr. Backup and have with me, my close personal

friend, but a guy who's impossible to get an actual date with Prasanna

Malaiyandi How's it going Prasanna

oh, Curtis, I'm good.

I'm talking about?

Don't you.

I know the fact that you came all the way up to Santa Clara to visit the

office and we didn't get a chance.

to meet

And how many times has that happened?

Just saying,

We didn't.

no.

I think last time you came up, we did meet because remember we did the photo shoot.

okay.

All right.

That

Yes,

The photo shoot doesn't count.

it does.

I think so.

Okay.

before we met twice, so

I

I get to carry over one of those, but you were also busy.

You were also,

feeling a little butt hurt

but you were also busy with your dinners and.

friend, by the way, my friend whose wife isn't even in town, like who, who

took priority over hanging out with me?

What entity I want you to say publicly, what entity took

priority over, hanging out with me.

The dog.

The dog.

Yeah.

Yeah.

The dog, you had something to do with the dog.

And so that was more important than hanging out with me, but whatever,

I love you.

I'm clearly

I love you, Curtis.

I love you.

whatever.

All right.

So our guest is like, what have I wandered into,

Exactly.

Yeah.

we actually have a, this is one of the few times where I was on our guest's

podcast and now he's on my podcast.

Mark Shriner is the strategic sales director for me, by the

way, is it memo Q is that.

perfect.

Okay.

Okay.

Mark Shriner is the strategic sales director for a memo Q a leading

translation management system, a provider, and the founder of host of the secure talk

podcast, which is how we came to meet.

I got to go over and talk about backups on his podcast, and then he got to come here.

He's now on my podcast to talk about security.

He graduated from Penn state university with a bachelor's degree

in liberal arts and sciences.

2022, he completed Harvard cyber security, managing risk in the

information age, diploma program.

So I'm fascinated.

and by the way, welcome to the podcast Mark Shriner

Thank you, Curtis.

And thank you persona.

It's a actually, I've had fun watching you guys with the intro there.

You seem like an old married couple or something too,

We're an old, married couple that never sees each other.

I'm

Yeah.

cause Prasanna lives in and you know what it is.

It's a Santa Clara

Prasanna

Yeah.

He lives in Santa Clara.

I live in San Diego and you live a little bit farther north,

as I recall up in Seattle.

Yes.

Yes.

And I'm envious of both of your weather.

I actually, to be honest with you, I just spent the last three months traveling

between Arizona, St. George, Utah, Las Vegas, and San Diego and Los Angeles

all in that area for three months for business and for some personal business.

in three months we had five cloudy, rainy days.

And I got back here at the beginning of may thinking like, Hey, it's

safe to come back to Seattle wrong.

Yeah, it's funny to see.

Seattle is one of those places where, when it is sunny, it is just one of

the most beautiful places on earth.

I remember.

And I think I told you on when I was on your podcast, that I did some

work for Amazon back in 1998, I put in for the record, I put it in their

first enterprise wide backup system.

I was there in the summer.

And not a single cloudy day for three months.

And it was like I said to them,

Yeah.

going up to Mount Rainier and going out on the sound and them

throw the fish there it's a pike

Yeah.

market, of course, hanging out at the bubble gum wall.

I'm just saying, I like Seattle,

Yeah.

I went for a trip.

Yeah.

I went up for a trip, I think four years ago around this time in may.

And the weather was gorgeous, like perfectly sunny And I was

asking everyone, I was like, what are you guys complaining about?

The weather is gorgeous.

They're like, you just ended up being here on the perfect week.

Yeah, in contrast right now in Seattle or in San Diego, we are in

the middle of what we call may gray.

And then next, next month will be June loom.

this is the worst time of the year to actually visit San Diego.

you can get sunny days, but there will be, multiple days in a row where

it's just a hundred percent overcast.

and.

the fog that comes in or is it just overcast and gray?

It's overcast and gray.

it's not.

So the fog we call that the Marine layer, the Marine layer generally

burns off after around nine or 10.

if you have a strong Marine layer and it's just weird because there's no rain

connected with it, it's just gloomy, and, it just is what it is and, and I

Seattle weather.

They're like, yeah.

and it just.

people will come here.

So I thought you guys were sunny I'm like, to tell you it's may gray man.

Welcome to San Diego.

I've been in San Diego, it's always been sunny and I come down

there three or four times a year.

I'll be there twice, this summer for soccer, for my son's soccer tournaments.

but I love it.

I'm interesting, interested to know, do you think that people.

act and say, what were our personalities different based upon the area and

what I'm getting at is, so for example, in San Diego, do you find

that people are more or less outgoing or Seattle or in Silicon valley?

do you notice that.

I think people are attracted to areas based on, this is our great people

made or they, born or whatever.

same, I think that people are certain types of people are

attracted to certain types of areas.

and I think people that are.

That liked to be outside or attracted to places where that's the case.

Yeah.

but people come here and they, they actually, many people reject

or they react quite negatively to the intense brown that we have.

It's guys, this is a desert.

the only reason that.

That we can occupy this world is thanks to the Colorado river.

You know what that right?

The Colorado river and the LA aqueduct.

that brings water over from, those mountains.

and, and now we finally have our first, desalination plant in Carlsbad.

It's applying 10% of San Diego water, it's a desert, which means everything's brown.

And anything that you see that's green is either some type of cactus

or it is being watered by someone,

It's artificial.

Or where it's artificial, it's a cell phone tree.

but yeah, I don't know.

Yeah.

I don't know.

It's if you're a person who hates a lot of songs, this would

not be the place to be, right?

are people that I've heard of people that hate the sun.

I think they're generally called vampires, but no, sorry.

No,

This is not a time for vampires.

it is very green up here.

It's very nice.

and it's interesting, you mentioned the desalination plant because it's not just

California that, has issues with water.

It's the whole Southwest right now.

And at some point, the Colorado river is dwindling lake Powell, lake Mead.

They're, their levels are going down

It looks horrible yet.

this is a kind of a borderline national security issue.

and then you think about the wildfires because it's the dry dryness.

Desalination plants probably can't help with that, but they can help

with some of the, lack of water.

What are you, what are your, how is it working?

is it solar based?

Is it what's how's it powered?

and is it, is this

Yeah, I think I don't know a lot about it, about like how it works.

I know it took 15 years to make it happen.

And I know that generally speaking, the environmentalist's aren't

huge fans, and the current, the next thing that is finally.

Happening and, it's one of the, where you just have to mentally get past it.

It's a, unofficially referred to as toilet to tap.

that is what's happening.

Finally in California.

It's guys, we're not getting any more water and it's really expensive

to pull it out of the ocean.

why don't we filter what we already have, and that's starting

to happen in these areas.

So we'll see.

in Singapore for four years in, in Singapore is a big, they have no, none

of their own water supplies there.

They're

Right.

dependent upon, a pipeline from Malaysia they have the.

Toilet to tap plants.

And,

Yeah.

you had the prime minister of Singapore go over there and pour himself a glass of

water and just drink it there on the spot.

And I said, if it's good enough for him,

Yep.

Yeah.

yeah, you don't want to think about it.

Like you said, though.

You don't want to think about it, but, try not to, try not to,

but, so I'm curious.

So your, how did you, drew you to cybersecurity?

Well, a couple of different things.

I think.

in 2017 we were moving back from a nine year stint in Asia, moving back to the

states and a good friend of mine, had.

A company that would be with becoming a Microsoft

cybersecurity compliance partner.

he was looking for some help on the business development side.

And, and I started taking a look.

The more I researched, the more interested I became because, cybersecurity is

something that can go a mile wide.

and then also a mile deep

Yeah.

one of those things.

If you want to talk about, pen testing, backups, encryption, different, compliance

organizations, you can just go in so many, data loss prevention, endpoint protection.

you can go so many different directions and then each one of those, you can

go down these super deep rabbit holes.

And I like learning.

The other thing I, that I find interesting about cybersecurity back then, and now is.

Before, I think we thought that this is the cybersecurity.

There was a couple of people in the back, in the corner of the it department

that their job is cybersecurity, but everybody in an organization needs

to have some type of awareness and responsibility for security, but beyond.

that as individuals and consumers, we need to be aware

of some security best practices.

And so it affects everybody's life.

And it's something that, 30 years ago, nobody was talking about

because there was no internet.

And now it's

Yeah.

important with the internet, social media, everything.

I have three children.

And they need to know some best practices about, what does a phishing campaign

look like or a phishing attack look like?

What w how do they protect their passwords?

What should they shouldn't do with their mobile devices, et cetera.

So it affects everybody.

And it's this like new field that was created partially based upon the

explosion of the internet in IOT.

I think we're just getting started in both in terms of understanding

the threat landscape, but also the, the best practices for prevention.

Does that make sense?

Do you see that a lot of this, I know it's an interesting point.

You made that it's rolling into consumers.

Like everyone has to start caring about this.

Like every day.

Do you start to find that's actually happening or.

Or are people yeah, that's just something that a company has to

worry about or a business has to worry about, or like this large CEO

has to worry about not necessarily.

yeah, let me answer that by backing up even farther.

I think in companies right now, where it used to be the perception of the.

of the it teams or the, the CISO's job there, is an a growing or

increasing awareness that it's everybody's responsibilities.

And so you'll have not only do you have structured educational, programs,

but you'll have simulated phishing campaigns and things like that.

So go enterprise wide.

And if you get the CEO and he clicks on the wrong thing and boom, guess

what you got to go to training you're in a you're doing timeout.

and companies try to make that.

So in companies it's becoming, I guess increasingly common for people to accept

that everybody has a responsibility.

If you find a thumb drive in the parking lot, don't just walk in and

stick it in your company's device.

and sharing those stories, I remember growing up and listening to my

grandparents, tell stories about this accident, that accident, this person who

did something good, did something bad.

And we learn from those stories.

And I think when we share these stories about hacks or, the famous

story about somebody finding a thumb drive and then putting it in their

device and then, downloading some malware inadvertently, learn from

that and those stories are important.

So that's one method of, or one, data point.

Come people in organizations are becoming increasingly where individuals I think

are also becoming extreme, increasingly aware, let's start off with high net

worth individuals, where they are very much in the sites of, targeted phishing,

spear, phishing campaigns, right?

And so there are certain tools and methods and processes out there to

help these people at least become aware of what's what the threat looks.

like But beyond that, I think, just the general public, if I look at

my kids, are pretty suspicious and cynical and almost jaded, in terms of

look at this, they'll show me stuff.

They're like, look at this, it's just, and because it's obviously it's a scam.

And so I think.

people are becoming increasingly aware at the same time you still hear

of consumers every day, for example, they're transferring money to a title

agency and somebody spoofs the, the address, that w where they're supposed to

they're there, the account information, that kind of stuff is happening in.

yes and no, to answer

Yeah.

I think people are becoming more aware, but there's, we have a long ways to go.

Yeah.

So that there was a study back in 2016, from the university of Michigan

where they left a series of USB drives that had an HTML there that if you

open up an HTML, it had an image tag.

So they were able to identify, how many people actually clicked on the thing.

do you suppose the percentage was of the people that.

university of Michigan, that's a, that's what?

big 10.

those guys probably I'm west coast, so I'm afraid to guess.

W what was it?

It was half,

Wow.

That was in what year?

20

Wow.

USB drives around the Urbana champagne CA these are college kids.

These are,

At the one of the best universities in the

Yup.

They said they found that 48% of the drives are picked up

and plugged into a computer.

Some within minutes of being dropped.

Yeah.

Let's just, yeah.

hopefully the situation or the awareness is getting better.

I look at little things like, turning on MFA's or multi-factor

authentication two factor authentications for just any, obviously any bank

accounts, but any of your online, tools or apps, just turn it on,

Yeah, exactly.

a simple thing.

That's going to stop 99%.

But some people that, it's a hassle.

Yeah.

If you're, if your account gets compromised, then

that's going to be a hassle.

Yeah.

I've mentioned on this podcast a few times that I went from being an MFA newb,

I don't know, four or five years ago to.

Slowly.

and then it sorta, it was a snowball situation.

I ended up rolling MFA anywhere it mattered.

and the cause I have, oh Lord, I have 800 accounts.

Yeah.

At, I'm not kidding.

I have a password manager, so I, I can pull it up and see it.

And I have, just hundreds and hundreds of accounts at random

places where I don't ever.

man?

Hey,

I just, it's just stuff.

Anyway.

Anyway, my point is.

to tell me Curtis's into some shady stuff, man.

If he's got 800 accounts

I just hope he talks about his experience with MFA.

Yeah.

Yeah.

The story.

so I, don't my point of mentioning how many accounts I have.

I don't have on most of those.

Because they're just stuff where I don't, there's no information I'm just

anyway, I did roll out MFA, everywhere.

And I use Google authenticator and wherever I could, because of what I knew

about that using Google authenticator.

text-based MFA and by the way, I dunno, I'd like to come back to

that idea, but here's what happened.

I got a new phone locked out of all my accounts.

because I didn't know.

I didn't know what I didn't know.

And so I, I, when I re when I rolled that out again, I switched to authy

as an app, which allows you to back up the stuff and try, anyway.

Yeah.

I'm a huge fan of MFA.

and I've mentioned before that, I went from being a newb to being very angry.

If there's a, if there's a company that I'm interacting with where

things matter and they don't have.

the authenticator style of, MFA.

I do want to ask you this, and, how much you know about why the

text-based method of authentication is bad, like sending an SMS message.

I'm just going to take a shot of the dark.

I'm just going to say that it can be somehow intercepted and

somebody could actually just use it or somebody or you could, yeah.

something, a derivative of that.

But tell

Yeah.

Yeah.

know what I, I was hoping, what you knew more than I did,

Yeah.

because it's

now,

and Prasanna you're, you're up on this stuff.

So here's the thing I'm wondering there's a company that offers

multiple methods of authentication.

my, my, my credit union, they have my phone and, they, they use a, they have

an authenticator method where you get, you get the little six digit code.

If you, pull up their app on your phone.

I prefer that method.

I use that method whenever I can, but should I be bothered by the

fact that they also support SMS?

there's no way to disable the fact that they have

I would be a little worried just because the number of SIM swap attacks

that are happening these days, like you hear it all the time when it comes

to crypto, With all these acts where someone SIM swaps with someone else

gets the authenticator code, cleans out their wallet, They're a Bitcoin wallet.

So I think it is common.

And even T-Mobile right.

Was accused of allowing a porting out of numbers as well.

That's another thing that can.

right.

Yes.

so you think I should be worried?

I don't know what I could do.

Yeah.

And it also depends to what extent, like some random person going after

you specifically Curtis, right.

I'm

a

big deal.

exactly.

But I think there are cases like if you're a high net worth user or even

you have sensitive data or things like that, that you care about.

That I think, yeah, you should be worried about even email,

Multi-factor authentication.

Sometimes it's worrisome as well.

It's things which you can't completely secure on a.

Yeah.

I know.

that most of the organizations that I'm F MFA with, offer an option could be,

for example, a token that you have, it could be the authenticator app could be

a text, could be an email and they offer the consumer the choice at this point.

probably just trying to make it easy for somebody to opt in with something.

But there are obviously some that are more secure than others.

And I spoke earlier about the awareness of some consumers, especially high net worth

individuals, becoming more cyber aware.

And the specific attack that I was thinking about is SIM swapping.

And it's be, I, I know a gentleman that's been, SIM swapped three times.

and it's, he described it as he was on an airplane.

He got out the airplane, his phone wouldn't work.

And it is took him days to get back online.

It was maddening, scary, and primarily done through social

engineering where they contact the

Provider.

Yeah.

and convince them that are you and that you need a new SIM.

And it's just that.

Yeah.

They made it so easy to port numbers as well.

that's also another common vector.

What does that mean to port a number?

Does that mean to change carriers?

To change carriers

Okay.

And so basically instead of just doing a SIM swap, they just pretend to be you and

Yup.

your number to another

Yup.

Wow.

Yeah.

That's not good.

These bad guys are really bad mint.

I think that's something we can all agree

Yeah.

yeah, so like I have multiple accounts where, so goo like Gmail.

Okay.

Gmail.

It's very specific on what authentication.

Systems that you use and you can disable ones that you

don't want to use specifically.

You can disable SMS authentication, but my credit union, it supports all of them.

And I suppose the only way to disable SMS based authentication is to delete

my cell phone from the account.

But that's just weird,

But change it to like a mobile number or, sorry, to the home number,

Yeah.

allows you to say, is this a cell phone or.

Or a mo or a home number.

I'm sure if you select a home number, it won't send you SMS, but

a ho what's a home number.

a

landline

a landline and old school.

I know I've seen places where it's is this a home number or is this a cell phone?

Interesting.

so I'm curious, mark, what do you, if you're, so I know, as a dedicated to

backup, there's, I have my top five of these are things and by the way, on your

podcast, the first, like my biggest one, you and I talked about was the idea that

cloud stuff is automatically backed up.

Which it isn't if somebody were to say, what are the top five things

that I need to be concerned about, as a, either personally or it sounds

like personally you're thinking MFA,

Yeah.

I would say that's just a best practice personally or for companies and companies

have a little bit more sophisticated tools at their disposal, so they can push

an MFA depending on, the user behavior.

Are they logging in from.

A new location.

Are they logging in from another country?

Is there some kind of anomalous behavior, mark never

Yes.

these files now he's downloading gigs, downloading gigabytes of finance records.

I think we're gonna force an MFA on that.

so I think MFA is a foundational thing, for individuals or organizations.

I think some other best practices for individuals again, would be backup to

ensure that your information is backed up.

I don't know if you guys have seen these, Mr. Backup gives me a

Yeah.

I'm very excited about that.

from Mr.

Very excited

Backup

that.

the, you have, you guys get these emails that say, Hey, I'm sorry to

tell you, but I've been spying on you for the last couple of months.

And, and if you don't send this money to whatever, I'm going to release this

stuff, this, this thing of you going into these inappropriate websites

and they send these emails out to.

Thousands of people and some people, cause they know that some people will

be like, oh my God, I should pay this.

Yeah.

you should.

For one, if you get that email.

Delete it, care what

Right.

through.

It's just a, they're just phishing and too, if you've got your stuff

backed up, you don't have to worry about anybody encrypting anything.

Now, if they're going to release stuff, that is another thing from

malware is if they take your records, even though you've backed them up.

they're going to release something that you don't want released to the public,

that's a whole nother discussion, but definitely you should back up, antivirus,

running an antivirus is, super important.

what else?

as a consumer.

being aware and pausing.

When you see something that looks a little off any time somebody says, Hey,

there's a problem with your account.

We need you to log in and can now just stop or, oh, your order for $15,000 from

Amazon is on its way, And you're like

Yeah.

out, dude, just,

Yeah.

if you didn't expect it don't click it

Exactly.

that's a perfect way to say it.

I like that.

Didn't expect it.

Don't click it.

And obviously you can, cause you can look at the, the sender's real address

and see, is this something real read?

It is a lot of this stuff, they've got shoddy grammar, fuzzy

images, but people get worked up.

yes, but I'm sure you've seen the ones where you get an email from the CEO.

Hey mark.

I need you to run out and buy 50 gift cards for target and send, it's happened

to one of my boys, who was working as an internship for the cybersecurity

committee that I was working with before, which the is Adaquest the CEO

of Adaquest, his name is Hiram Machado.

it was like my son's third day into his internship.

And he got an email saying, Hey, Makai I need you to run out and buy,

$500 worth of gift cards from target.

And I need you to, once you have that, just let me know, and I'll

tell you what we're going to do with them, but I need this for this

event we're doing this afternoon.

so Makai again, telling you the kids are getting smarter these days.

Hopefully not the ones in university of Michigan, I guess that was 2016.

he emailed me and he goes, what should I do with that?

And I said, send it.

I said, we're going to use this as a case study in a learning

example, don't do anything with it.

but yeah, I don't.

what advice would you guys give.

I mean stuff's all good.

I think, the, you talked about hovering over the site to see the site.

What I generally say is if you.

get an unexpected communication from somebody you actually do business with.

Because I get stuff like that.

My Citibank card has been compromised.

I'm like I haven't had a Citibank card in 20 years.

So I think I'm pretty good, but I get, I've gotten phished from like PayPal,

stuff like that or not from PayPal.

as a PayPal based positioning,

PayPal.

bending, pretending to be PayPal, is if you are actually concerned,

if it sounds like something that, that might be real, to paypal.com.

interact in any way with that email, go to PayPal.com or contact PayPal's phone

number, not anything listed in that email.

would, it's interesting though.

There are times when I, in fact, just a couple of days ago.

I got contacted by a company that I do business with.

there was a credit card company and they were like, we're such and such

from such and such credit card company.

And we want to call to verify charges.

how about I freaking verify you?

you're

Yeah.

nude

Show me your

me show, they will, we want to authenticate.

We want to authenticate you.

before we talk to you about account, I'm like, how do I authenticate you?

Like, why do you people still think this is like Lee?

I will call.

Thank you.

Thank you for calling.

I will call the 800 number on and by the way, it was a real thing.

I will call the 800 number on my credit card and I will ask for the fraud

department and it was real thing.

Th that's annoying that happens, because that is a phishing

No.

right?

Absolutely.

in people think that, all cyber attacks are through email or somehow

somebody is getting into your network.

Some of them are just a phone

Yeah.

I've been called by.

The IRS, the texts, whatever.

And yeah, this Mr. Shriner.

Yes.

We have an urgent matter that we need to talk to you about.

really, and I, sometimes I just where's this gonna go?

Cause I know at one point they're going to ask me for social

security date of birth, blah, blah,

Yeah.

I'm like, okay.

yeah.

What's going on?

They're like, before we can go any further, we need to get some information.

typically the smart ones, they won't go right to social security.

But just say they'll say, I just want to confirm that

your name is blah, blah, blah.

They got your name.

I'm

Yeah.

that's me and that you're living at.

yeah.

Yeah.

And so now I'm starting to respond to them.

And then as sooner or later they're like, okay.

And then, can we give us the year of your date of birth, and you're

like, and they just start to

Yeah.

good ones, start to tease it out of you because they're not gonna, if

they come in first, first thing to ask you is social security people like.

But you down there and then, they build a rapport and that's

what they're all looking for.

Yeah, it feels like they have that information already.

So it's okay, what's this one more piece of information.

fine.

it.

Just to verify that we're talking to the right person, right?

and it's funny.

Cause I remember when my dad retired, like he'd always get all these calls from.

Scammers or salespeople.

And I'd be like, you guys should just chat with them.

It's what do you have to lose?

Just don't give them any information.

But at least you're saying, yeah,

to talk

exactly.

And at least you're saving someone else from having to get a call.

right?

There's a, there's an English dude that I've seen.

He does videos where he interacts with these folks and he like, he does talks

where he talks about his interactions.

Have you seen.

I've seen stuff like that.

yeah.

I don't know if I've seen that specific one, but yeah, where they just go and

after a while the scammers, they were getting really frustrated after a while.

Cause they start to realize that they're the ones getting scammed,

yeah.

Yeah.

There's this one guy and he's just really funny.

And he does he doesn't like a talk

Yeah.

he does it on stage where he talks about his interactions with these

folks and it's just, he does it in a

Yeah.

way.

So the phone calls, Phone calls and emails.

Don't click on the emails.

Like just again, if you think it's actually from PayPal,

then go to paypal.com.

Not anything with that.

Go

and one of the points mark made earlier around social engineering,

I think people also just, it should just be careful what they post online.

If you're like putting Facebook messages or tweets,

Hey,

careful.

Yeah.

for a three week vacation to The Bahamas, Yeah.

Sorry.

Yeah.

Yeah, no.

That's totally the case.

Or it's oh yeah.

Or you start inadvertently being like, Hey, it's my birthday.

Or it's oh, my mother is so and so right.

And, or a favorite dog's name.

And all the rest of this and people can take that information and they

could use it for social engineering to extract other information from you.

I know what your favorite dog's

Yeah.

I, because he was more important than me.

I'm sorry, I'm

Are you a little bit?

Are you a

I think he's really hurt, man.

oh, it's okay.

man.

I went to il fornaio without you.

That's

some really good food.

yeah.

So what about companies?

So we talked about, we talking about have MFA, so there's two ways to about MFA.

You should, as a company, be offering MFA when people are

interacting with your service online,

Yeah.

and then you should, as a company, I like what you were talking about earlier.

cause obviously, by the way, I haven't thrown out our disclaimer, so Prasanna

and I work for different companies.

I work for Druva, he works for zoom and this is not a podcast of either company

and the opinions here are all ours.

And, be sure to rate us by the way, at a ratethispodcast.com/restore

And then, if you want to come on.

listen to me, complain to Prasanna yourself life.

you could

do

that

We

love guests.

it just it on Twitter or wcurtispreston@gmail with Druva for

example, we've supported, third-party MFA for awhile, and now we support native MFA.

if you're a company.

If you're a cloud company, or if you're a company that has information

that is important like that, and people are logging into your system

without MFA Then bad company.

and it should also not be SMS based authentication you should offer,

authenticator method and, and I'm gonna throw out, going to throw out, Don't be.

a website that is hard to use a password manager with, Don't be complaining

about one or two of the character.

The special characters that my password manager came up with, or I

had one this week that complained.

They're like, Hey man, your password's too long.

It was

Yes,

characters.

they said, you can use a maximum 17 characters and I'm like,

17.

Yeah, 17.

That is so weird,

and, the, So based on that, I no longer interact with the IRS.

I'm not.

But I also want to go back to a point mark made earlier, which was that MFA.

I don't think solves everything.

You still need those, especially as a business, you still need those other

things to look for anomalies, right?

For look, to look at the behavior of the user because MFA will protect

you to a certain extent, but it's not the only line of defense.

Oh, yeah.

at the corporate level again, The complexity of the problem and the P the

complexity of the solutions available are much greater, at the corporate level.

you have things like, device management, for example, and these

days everybody wants to BYOD but you also have corporate devices.

And, but on my B my own device, I'm going to have access to company apps and data.

How does the company manage that?

there's mobile device management tools out there that can, if I lose my phone, I can

tell the company, Hey, I lost my phone.

They can remote wipe their data.

they can do remote backups, all of that stuff.

they can check for anamolous behavior on a phone.

Mark just logged in from Bellevue, but he's also logging in.

from Romania.

Something's wrong here.

Yup.

yeah, that stuff and it's, depending on the size and the shape of the

organization, it can be, you have SEIMs to monitor all types of

activity to collect your logs.

that's, again, it comes back to that original point of why cybersecurity,

cause it's such a broad field and there's so many different.

It's constantly evolving.

it's pretty cool.

Yeah.

I'm curious what you think about, so one of the things I'm pushing outside

of the backup space, one of the things that I'm pushing people to do

or companies to do is to look into a couple of different types of tools.

One is we've had, we had somebody on here from a company that does a DDI, right?

So what did we decide that was DNS

DHCP and IPAM.

And IPAM Yeah.

and so th that, those one group of tools, which is they can do things of like,

why is somebody going to this really?

why is something looking at a DNS address that is a. a DNS name

that is like characters long, and it doesn't make any sense.

That, that is a,

Sure

ransomware thing, reaching out for command and control.

that's number one and number two, the type of software or system or

whatever that can identify data leaks.

so that you it's there's a general level of outgoing.

traffic and then suddenly there's this giant spike from Fred's desktop.

that never happened before.

And the

Vacation.

Fred's on vacation.

Cause he posted on Facebook that he's in Maui this week.

and his laptops doing that.

What do you think about those two types of tools?

I think, on the situation, it's, every tool has its usage.

And I think for most companies, both of those make sense.

for both those tools make sense for a lot of companies and organizations out there.

and guess the question, I, again, I'm.

not Technical more at the kind of higher level understanding

what the, to understand, what the problems are putting together.

Some solutions.

One of the challenges is that you have so many different vendors

of so many different tools.

And so do you look for these custom bespoke kind of solutions

and tools, or do you work with.

a Platform provider, for example, Microsoft 365 has

a lot of DLP tools in there.

They have, advanced threat protection.

they have antivirus, anomaly detection, all of that's built in there.

so do you, and then device management as well.

Or do you say no, we don't want to put all of our eggs in the Microsoft basket

and we want to go for best in breed.

And I don't know.

Prasanna like at, I don't know how much you can talk about at Zoom but like, how

do you guys decide, what kind of a tool are you going to go with a, an integrated

approach or do you look for best in breed?

So I can't talk specifically about Zoom but in general, right?

I think it's going to come down to.

The need for a tool, as well as the expertise.

If I'm looking at sort of small, medium businesses where maybe they

don't have specialized it admins, we face the same thing in backup as well.

There is no one who could go learn everything and

anything about security tools.

And so you're going to probably want a single tool that allows

you to solve everything.

Just like in backup.

You have those issues as well, but once you get to larger companies,

or if you have specialized problems, you might start to.

rollout into, okay.

I now need a specialized tool, a best of breed tool because I have this special

need, or I now have the skillsets to be able to address some of these issues.

And therefore I'm going to pick different tools based on my needs.

And I think it's hard to say one is better than another.

I think it depends on where you are and what your needs are.

Yeah, I would agree.

and not just because I work for a SaaS company, but I would agree that where

there's a big business need, that you have such as email, clearly a business

need a need that every business has, that if a SaaS solution is available

and it's a well-known respected cetera solution that you can vet out then.

from a security basis, I would prefer that over something that you're going

to, let's say I would prefer Microsoft 365 over exchange on prem a heartbeat

exchange on prem is harder to secure.

It's harder to manage.

So you've got to manage the system.

You've got to manage the storage and then you got to manage the backup of that.

And then you gotta make sure that backup gets off site.

of that is easier.

If you have Microsoft 365 now you should be backing it up, right?

Microsoft is not backing it up for you.

That was what you and I talked on your podcast, but there are services,

that will back up, obviously Druva offers one, but there are many

companies that backup Microsoft 365.

And so I think from a security basis, as long as you vet the security vendor,

look at, look for things like MFA, look for things like, what their NDA situation

is to cut the type of data that they have, whether or not they share personal

information, cause some, so many of these SaaS vendors, that's actually

their, their business model is they're either cheap or free, and they make.

You know their money with using your personal data?

that's, that's not what I'm

Yep.

No.

it's interesting.

when you talk about, tool selection, I think another factor should be,

do you have the in-house expertise?

and if you don't, how accessible is it on the market?

Because right now, depending on what tool you're trying to deploy,

it could be very challenging.

you can get a great deal and that's interesting, cause it would be what

people will start talking about.

how much is this per seat or per license One of the things that

you have to look at is what are your deployment costs going to be?

And then what are your ongoing maintenance costs going to be in

terms of the expertise to manage that?

And that's something that often come into play until after the,

Yeah.

they focus on the technology, or the vendor, but not on the

total cost of the deployment.

And, I would encourage everybody.

to do that

Yeah

And also along with the deployment, it's how flexible is it to change

as your environment changes as well?

I think some in some tools are very static.

It's easy to deploy the first time, but anytime you add a new app or a new

environment or something else, it becomes very difficult Or it's time consuming

to get it, to expand to now cover that new workload, versus maybe it's

better to get something that might be a little bit more complex for the initial

deployment, but like you said, ongoing maintenance, ongoing monitoring, All

the rest of that becomes a lot easier.

Yeah,

lots of sense.

I think that's why from a security basis, I'm a big fan of SaaS apps because

you look at again in the backup space.

if you're using an on-prem backup software, you must be up to date.

on what, you have both box, maybe multiple boxes that are, you might have

a server, you might have a storage array and a. that you must be up to date on

that operating system and protecting that operation, securing it, doing

all of those things, hope you have MFA on that backup server, by the way.

and then you've got the software, the backup software that you have to stay

up on and people are notoriously very bad at upgrading their backup software

that, the, we, we brought a guy over from Veritas and he told us that their best.

guess was that the average time that customers took to upgrade

their backup software was 18 months.

If it works, don't touch it.

what's that

If it works, don't touch it.

People are terrified of upgrading their backup server.

Cause it's the last line of defense, but the problem is back up.

The problem is that ransomware folks, specifically the Conti group are

specifically targeting backup servers.

so not only is it, something that, that needs to be protected.

It is a, it is a direct attack point,

I'm curious because we touched on consumers before.

what are your recommendations or suggestions for just individuals, to, in

terms of backing up their personal data.

I'm going to sound like a broken record, but SaaS backup, man,

Okay.

there are SaaS backup Druva's not one of them.

There are SaaS backup companies that target consumers and you're,

you're looking at 50 bucks a year, that sort of thing.

I, pay more than I would like to back up my iPhone, like I pay for paid for iCloud.

So that's, there's that, but there are a number of services that will back up.

What's important to you.

and specifically if you've got a, if you've got a laptop, and

let's be honest, you got a laptop.

it's.

It's not that hard to get that laptop backed up.

I am not a fan of using.

USB devices to backup the laptop.

know it works.

The problem is that USB devices generally sitting right next to, or in the same

bag that the laptop itself is you get a theft, there goes your backup,

you get a fire that goes your backup.

So I much prefer for the same reasons for the companies.

I prefer a cloud-based system that will backup the most important stuff for you.

Right.

I'll Disagree with Curtis here

Okay,

I am.

here we go.

I agree that to some extent, yes.

SaaS based is good.

I just muted your microphone Prasanna

Thanks, Curtis.

I've never done that.

That was fun.

So I agree that there are certain things that you do, you will, you

want to use a SaaS based service.

for But if you're not willing to shell out, or if you don't think you

really need it, take at least what's there with your existing, laptop, for

instance, if you have time machine, I know Curtis, we've had the discussion

about time machine in the past.

You're not as thrilled about it, but if you do have a mechanism,

use that mechanism rather than.

have nothing Right.

I'd rather have someone

Yeah.

something rather than being like, oh, do I want to pay $50 a year or whatever it is?

Yes.

Those are better solutions, but take what you have and just do.

something

Yeah, I'm not going to disagree with that.

the only thing I will say is that hard drive that you, if you have the hard

drive already, I'm not saying it's bad.

I'm just saying you just need to think about the fact that, that hard drive

is, it's so do things like rotate,

Yeah.

problem is you go buy You go buy a modern hard drive.

to, to back up your system.

that's going to be a hundred bucks plus, That's a couple of years of

the service that I'm talking about.

Yeah,

just saying,

I got it.

I got it.

Yeah.

I thought, I think the big thing is just do something.

Don't do nothing.

Yeah,

I think we're saying that for, I think that's our summary statement.

Maybe we'll make that the pilot title of the podcast just do something.

the Nike thing, but just put, just change it to something.

do something.

it's not as inspiring as it, but something,

I like it.

Hey, I

yeah.

something.

cause you asked me earlier.

how did your, the idea to do a podcast come about and and your

friendship and how did that work?

I dunno, I got the idea of doing a podcast after being.

After going from not believing in podcasts.

Like I didn't get it.

I didn't understand why anybody would do a podcast.

and then I started listening to podcasts.

I got in a situation where they were valuable to me as a person.

Then I was like, I talk a lot.

Maybe this would be something to do.

And and then I encountered Prasanna in the office, he used to work at Druva,

that's how, that's where I met him.

And, I went up to him.

And, I proposed the idea of us doing a podcast together because I thought

that we had a, a decent interaction and Prasanna just jumped at the chance.

Didn't you Prasanna

I was like, what are we going to talk about for 20 minutes?

I have nothing to talk about at all.

I don't know what you're talking about.

yeah.

It very quickly evolved into kind of a forty-five minutes About three years ago.

3 years ago?

Yeah.

I remember first couple of episodes and being okay, we got to plan this out.

What are we going to talk about?

What are the questions?

And for me, it just evolved into, I just like to have a conversation,

this is, let's just see where it goes.

Most of the time it works, sometimes it flops, but.

Most of the time it works.

Yeah.

And sometimes we get, really just a really banter going and, you can sometimes

uncover some really interesting stuff.

I got to say that I feel, extremely I'm looking at Curtis's background and he's

got diplomas or certificates or something.

At least he's got books there.

yeah.

That's my book right there.

Oh,

Yeah.

little

Behind me.

there on the shoulder.

Yeah.

A little, just a little bit.

Yeah.

it's a very small, so it's not that good of a product placement, but, yeah.

Anyway.

Subliminal.

Yeah.

yeah.

all thanks a lot, mark, for coming on the podcast

this has been awesome.

I don't get a chance to be on too many other podcasts other than my own.

And, I've really enjoyed this.

You guys are awesome and funny and obviously very, deep subject

matter experts in this area.

So I've enjoyed it.

I, and unlike being on your podcast, you can now just leave

and then I have to edit it.

I'm out of here.

What are you going to get this edited?

Yeah.

is he gonna go online,

Yeah.

come

Yeah, exactly.

Thursday.

Exactly.

All right.

right, guys.

Hey,

and thanks.

and have a great 20, 22.

Okay.

Cheers.

thanks Prasanna it's, even though you ditched

me

I'm sorry.

Curtis curtis know

and,

I'm sorry, I disagreed with you about SaaS but yeah, do something.

whatever.

All right.

And

Thanks mark.

make sure to subscribe so that you can restore it all.