Network Segmentation Best Practices: Shrink Your Ransomware Blast Radius

Odds are you’re going to get malware at some point.

The only question is whether it takes out one computer or your whole site.

In this episode, Prasanna, my co-author Dr. Mike Saylor, and I talk about how

network segmentation best practices can minimize the impact of an attack.

We cover VLANs and microsegmentation using a great analogy of a hotel.

We talk about starting with your crown jewels first, and why you

have to document every single rule.

There’s also a great story about me losing my mind once at a client

- caused by network segmentation.

If this is your first time watching or listening to me, I’m

W. Curtis Preston, AKA Mr. Backup.

I’ve been obsessing over backup, recovery, and now cyber recovery for over 30 years.

If that’s your bag, then I’m your guy.

You’re not going to find anyone that cares about it more than me.

Ever since 1993 when I had to tell my boss that there were no backups

of the database we just lost.

Now I’ve written Five O’Reilly books, a blog and a podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the backup wrap up.

Hi, and welcome to The Backup Wrap Up.

I'm your host, W. Curtis Preston, AKA Mr. Backup.

And first of all, I have with me my real estate non-advisor Prasanna Malaiyandi.

How's it going, Prasanna?

Good, Curtis.

So I think, the typical Indian fashion is anytime you have any money, you should

buy gold and you should buy real estate.

Nothing else matters, but just buy those two things and you'll be set for life

I see.

I am looking at real estate in one of the most expensive places to buy real estate.

I think I have an interesting take on it.

I'm not going

Yeah

but I, I have a interesting MO, would you not agree?

Oh yeah.

No, totally.

are very like, I don't, I… Creative I think.

No, creative.

Creative in like what you look for and all the rest.

Entrepreneurial, so

I try.

And speaking of entrepreneurs, we have Dr. Mike Saylor, my co-author on the book.

Welcome to the show again, Mike

Hey everybody.

Thanks for having me again

We're gonna have to get you like a room, like a, a spot on the couch or something.

all the rooms here, all the rooms here are gone.

but we'll do that.

we're gonna go back in time to, a hundred, hundred years ago, back

when I was working at a particular client at, the turn of the century.

And

Back in the day

back then that at the time I had never seen, and we're now going

to talk about it in this episode.

I think it's now becoming more commonplace, and for those of you that,

you're like, "What's he talking about?" What I'm talking about is it was the

first time I'd ever gone to a large company that had firewalls inside, right?

E- everywhere I had ever worked, the firewall, it was a hard, crunchy

exterior, soft, chewy interior, right?

that, that was, once you were inside, you were good, right?

That was the way… I worked my, I cut my teeth at a $35 billion credit card

corporation not that long before this, and there was nothing on the inside, right?

Other than, usernames and passwords, but there was nothing

that was blocking traffic.

Was that before PCI compliance and all the rest?

What?

Yeah.

no, I don't think so.

Okay, just checking.

I don't

Just checking

we'd have to Google

Yeah.

PCI didn't come out until just after, 2000,

Yeah, yeah.

So the answer is yes, that was before PCI compliance.

Okay

But, this particular company had a lot of, a lot of personal information and

they were basically saying… They were a company that I think of companies

would say this today, but they were the first company that I worked with

where they basically said, "IT is our product." "IT is not the thing that we do

to make our product with, the security.

If our security fails, the type of data that we store, our business is out of

business." And so they were like, "That just can't happen," and so they did the

kind of thing that we're talking about.

And of course, what we're talking about is network segmentation

As you were talking, I was trying to be like, "What is he going to be talking

about?" I was like, "That was not on my bingo card networks segmentation

So basically, the whole point here, and when Mike and I wrote the book, I

think the basic premise of the book was

you're probably gonna get ransomware.

That would be Learning Ransomware Response and Recovery over this

shoulder over here, and for those of you watching on YouTube, available

at, bookstores, available near you.

My latest book, fifth book actually, and, the first one where I brought

on a co-author, and, and that's how Mike and I got to know each other.

and interestingly enough, we have never actually met, for those

of you that don't know that.

Mike and I have never physically met in person.

We have always seen each other like this and during a bunch

of Zoom meetings with O'Reilly.

but we worked on a book, and the idea of the book was that

you should assume breach, right?

Assume that you're going to get ransomware, right?

or some other type of malware.

It doesn't have to be ransomware, but, we focused on ransomware.

And if you're going to assume that, one of the things that we were saying was you

want, if you're gonna assume it's going to get inside, you want to do whatever

you can to reduce the blast radius.

What do we mean by that, Prasanna?

When something gets in, how many things does it take out?

So if it gets in via an employee laptop, does it take out your servers, your main

production applications, everything else?

And that's kind of the blast radius

Yeah.

And of course that term comes from, bombs and such, right?

Going boom

yeah, going boom.

And it's gonna go boom.

The question is, does it, is it a plop or is it a, does it take out, company, right?

so is it like what we're about to talk about is similar to, you know in the

movies where a grenade gets tossed in and you have the one guy being like, "Oh,

no," and then he jumps up on the grenade?

Is what we're talking about similar to that?

That's a very sad story, but yes.

That would, that is one way to reduce the blast radius.

I will say it's, it's effective.

and there are people throughout history that have done that, and they deserve all

of the credit and goes to those people.

but what we're, I think what we're trying to say here is that you shouldn't

have, like again, to continue with the grenade analogy, you shouldn't have

your entire platoon in one building with no walls between them, right?

And one grenade just takes them out, right?

that, how's that for the analogy, Mike?

Pretty good

Bless you

I know you, you talk a lot about, we d- you know, we often, we use

analogies of of houses and things.

how would you put this in a house analogy?

it's very similar.

y- you want walls, you want other doors.

And to your point about having interior firewalls, you can

have interior… we do, right?

You have locks on your bathroom.

Some of us have locks on our bedrooms and our closets.

same principle.

Limit access to different of your environment that not everybody needs

or should have access to or can be walled off, when there's a threat

Can I just mention something?

And it's might seem like a non sequitur, but it's not.

I was, randomly shown YouTube videos over the weekend, and it's about,

houses that are supposed to be safe.

And so they talk about, perimeter defenses, and, they were showing,

an interior safe core, like you were talking about, Mike, like with 600

pound solid steel doors that you can…

with five bedrooms inside and supplies and everything else, so in case someone

makes it past the outside perimeter, you're safe in the interior, and you

don't have to worry about things.

And I was like, "Wow, that's pretty impressive."

And

was also $15 million.

that… Yeah, we're gonna bring that into the discussion.

I'm glad you brought that up, Prasanna, 'cause we're gonna, gonna

remind me, hopefully, by the end of this episode that I like that topic

or I like that analogy, quite a bit.

let me just look back here.

so opposite of what we're talking about, Mike, is a flat network.

You wanna talk about what that is?

It's like a, imagine a, a bicycle wheel, a hub and spoke.

So all of your core stuff is in the middle, and it connects

to everything, printers and workstations, and they can all talk.

And, it's easy to conceptualize that as just your office building.

but I've assessed billion-dollar organizations that have offices in

casinos and convention centers and high-rise buildings all over the

world, and it's a flat network.

From anywhere in the world, it could… you can ping the server

in the data center, and from a conference hall, from wherever.

It's completely flat, unrestricted,

W- why is that, Mike?

it seems to go against so many things we've talked about before and we will

be talking about in the podcast, but is it just easier to do it that way?

Absolutely easier, right?

so there's so many things that can contribute to poor network architecture.

One of them is laziness, or incompetence.

Another one is budget.

And so a lot of times we give the IT guys so much crap for, "Why did you build it

this way?" And they're like, "Hey, I know.

I know it's bad."

But, they didn't give me budget to buy a new router or one that's

capable of VLANs or whatever it was.

Sometimes it's budget.

Sometimes it was management that made that decision, and IT guys just get the brunt

of it it looks bad and it's all technical

Mike, you already brought up the term of VLANs, and we, I just, during, we took a

little bit of a break during which we had a number of, episodes, and one of the ones

that got the most traffic was the one that we talked about, network segmentation.

And, we talked about VLANs, and, the… not sure everybody really

understands if you're not a network person, again, re- realizing that we're

reaching people that are maybe backup oriented, maybe cy- even cyber oriented,

but they're not network oriented.

do you wanna dive into, what we're talking about from a VLAN perspective?

Sure.

and I like to come up with analogies that, are relatable, and I'm trying to… I'm

buying time here to come up with one.

Hotels.

So think of a, a hotel where you've had to use your room key in the elevator, right?

So there's hotels where you can get in and push any button regardless of what

floor your room is on, and then there's hotels where you get in and you have to

use your room key, and the floor that you select is restricted to the room key.

So that's similar to a VLAN.

So physically, we've built this hotel with floors one through, let's just say

one through 10, so that's the physical architecture, and part of that physical

architecture is the security of each room.

I have to have the key to get into my room as well.

So if you think of the hotel where you can go to any floor without

having to use your room key,

You have the potential to segment that network so that based on the access in my

room key, that dictates where I can go.

You can then further segment or restrict access in this network, in this hotel

by saying, "You can only go to the floor in this building or that part

of this network based on the access on your card or your credentials, your

login credentials," as an example.

So that's more virtual.

So it's not physical restricted, although elevator, but

elevator goes to every floor.

Virtually, I'm segmenting this hotel by access privileges,

and that's what a VLAN does.

So on a… Imagine, imagine the network hardware or the switch as

the building itself, and there's all these different places you can

plug stuff into this network switch.

those would be the different floors So when you log into the interface of this

switch, you can draw a box around the, the places you plug stuff in and say,

"I want this to be floor two." And only with access to floor two can access

floor two, and possibly even things on floor two, like the janitor closet.

Like I can get to my room on floor two, but my badge doesn't

work on the janitor closet.

So you can further restrict things inside of VLAN as well.

But in essence, does that resonate with you guys as far

We want to even evolve past, sort of basic VLANs, which are typically port-based,

and then go to micro-segmentation, which is more, application-based, and

purpose-based, which I think you were, again, going with that analogy, you

were going with you have a guest in the hotel, you have a food person, right?

You have a maintenance person.

You have a, an administrative person.

You may even have a vendor, right?

That it's able to go to certain things at certain times, and I think that's

closer to the idea of micro-segmentation, where we're able to say not just these

ports, 'Cause I know we can say this VLAN are on these ports, and this VLAN

are on these ports, but I like the idea, the, the key card analogy that you said.

So imagine if literally every single door, and probably, like, when I'm thinking

about this, this is probably very close to the way things are in a big hotel, that

literally every single door has a key card entry, then you can dynamically allocate,

people's in that segment of the hotel, and that, again, that segment is very virtual.

It ha- it has to do with your purpose and not necessarily based on your location.

although that's where it starts because we're gonna do this, this

segmenting inside this hotel, right?

but then you can further subdivide it out based on what you are here to do,

I actually really like the analogy, Mike, 'cause it makes a lot of sense.

and I'm gonna ask this every single time you bring up a technology thing,

and please don't say it depends.

But one question is, this is all great, especially when you get

down to micro-segmentation, 'cause you can really secure devices.

And with v- VLANs, you can also ensure, as an example, that floor two can't make

it down to floor three, but it's o- or up to floor three, but it's okay for

floor four to maybe go down to floor three because that's where the gym

is, or for f- everyone to have access to the lobby, to the ground floor.

This is all great, but when you start to get very complicated

micro-segmentation and VLANs and everything else, it becomes a nightmare

from, a management perspective.

So at home I run multiple networks.

I have a VLAN, multiple VLANs, and just, organizing devices, dealing

with firewall rules, everything else like that across my environment,

and mine's a very simple network.

Of course, I make it complicated, but that's just how I am.

I'm just imagining, Curtis's example he brought up at the beginning, right?

That very large financial company he used to work at, right?

And how they would go about managing VLANs and micro-segmentation across thousands,

hundreds of thousands of devices

It is a lot of overhead, and one of the reasons, another one of the reasons

that you may see a flat network is that there used to be some level of comple-

complexity and technical, confusion, and we'll call it that, when, a new IT

engineer comes in, and that beautifully designed architecture of all these VLANs

and micro-segmentation was not documented.

And so the new guy comes in with zero turnover, zero ramp-up time,

and n- things start breaking or he doesn't know how it's built.

So he's gotta tear all that stuff down and start over.

You can figure some of that out based on the type of technology you have,

but it takes time, and, in a lot of organizations we don't have bandwidth,

and we need bandwidth to do stuff like…

So I have seen that, where it becomes flat in order to start over.

a- and one of the critical points I'll make about this, and hopefully you

both practice this in your segmented environment, is you have to document it.

You have a diagram, you have ports, you've got screenshots of your VLAN

interface, you've got, a printout of the configuration and your

rules, most importantly your rules.

a- so that if something does break, or if you need someone to come

and help you, it's documented.

It's easier to see on paper.

I'll add to that then that, a- and one of the things I wanna add

to the analogy in this discussion is that, a- and you mentioned it,

it's dynamic or it can be dynamic.

Even though I've set this floor or these rooms as part of this VLAN, because it's

virtual, I don't have to go run new cable.

I can just go into the interface and pretty much drag and

drop, this port or that room.

I want it now to belong to this other VLAN.

m- having those, that virtual segmentation makes it much easier to ma- to manage.

and then the last thing I'll mention is, there's multiple parts

to make this work effectively.

There's the architecture obviously.

There's the documentation, then there's the acc- and very often network

architecture and access control are different stakeholders, different SMEs.

making sure that the communication is there so that when either one of

them get, an objective to say, this VLAN's gotta change or this access has

to change, they still have to be able to collaborate and make that work.

So absolutely, it can get complicated pretty quick

Yeah, and like anything else that we've talked about, and that we'll

talk about on this show, the b- the bigger the environment is, the more,

A, it has to start with from on high.

It has to be empowered from on high, right?

Because you're gonna, you're gonna trip over a few, electrical cords and unplug

some stuff once in a while, right?

you start doing this.

But that's, I'd say, the number one.

And then number two, it's got to start with an inventory, right?

Because we first have to know everything that we have.

and then, then we n- we start grouping that inventory together, right?

And we start observing the inventory.

We start observing how, these workloads interact with each other, and then we

start tagging those workloads, right?

now how you do tagging and then how you use those tags is gonna

be incredibly different based on whether or not we're talking about

a traditional on-prem workload.

Are we talking about, containers?

are we talking about a purely cloud-based workload?

How you use, how you implement those tags and then how you use those tags

are gonna be incredibly different.

I think that's probably, once you have… Again, it, we say it like,

"Oh, yeah, just go inventory." I understand that the bigger you

are, the bigger of a pain this is.

But as I've often said, any good security plan is usually a pain, right?

I like, Curtis, how you approached that, like getting the

inventory and walking through.

But I think another thing to also mention is you don't have to deploy your

entire VLAN infrastructure in one go.

You could say, "Here are the critical applications," or maybe,

"Here are the risky devices.

Let me segment those off first, and then I can slowly roll out everything

else and have a prioritized plan for how to approach this," rather than

saying, "I need to destroy everything and rebuild everything in a day."

There's a lot of variety in segmentation, and it comes

down to what's your objective?

so a lot of organizations simply segment, public areas, conference rooms, lobby from

production areas or normal user areas.

They segment production from test so that things that happen

in a test environment don't…

So it's being done to some degree.

just how do we take that, somebody's doing it, somebody's capable and knowledgeable

and skilled in creating these segments.

It just takes a strategy to roll that out in more meaningful ways

Yeah, and also, you talk about the way that this is already being done.

I'm sure that it's very common for when b- people are given a laptop,

for example, that automatically gets put into a segment, right?

And then you're… And the same thing is, and I think the more modern of

an environment you have, the more virtualized, the more cloudy, if I

could- the cloudier you are and the more virtualized you are, the more used to

tags you, you are at this point, right?

We didn't really do tags, at least not when I was doing physical servers, right?

and I- it doesn't, it's not so strongly encouraged as it is in the

virtualized world and the cloud world.

It's oh, what is the tag for this environment?

And you can automatically create those tags, right?

You automatically create an Oracle tag, you automatically create an application

tag, a laptop tag, a whatever tag.

And so you could end up having these segments already, you're just not, you

haven't yet gone to the next level, which is policy, And we say, "Okay, now that

we have everything tagged, or at least we think we have everything tagged," or to

go with you, Prasanna, I completely agree.

We think we have the important critical, y- workloads tagged.

Let's see if we can enact a policy where that, let's cl- let's cr-

start creating the allow rules.

Okay, the, all of the ones with this tag can all talk to each other, but

they're not allowed to talk to the ones with this tag, the laptop tag, right?

and then you go, the big thing is when you start doing the deny, and, but

Mike, I just wanna get your take on that.

My understanding is typically with firewalls and VLAN segmentation, by

default usually things are denied unless you allow explicit access.

I think it changes from vendor to vendor, but I think that's

usually the best practice, right?

So in North America it's denied by default.

In South America it's allowed, but I'm

A dum-

It's 'cause, things…

You almost had me there, Mike.

wherever it flows the other way when you flush the toilet.

it truly, I'm, I have to say it this time, it depends.

It does.

But once you,

firewalls will

if you have decided to have a flat network for whatever reason, you've

turned off that default deny.

Yeah.

You have.

you've got a rule that sits on top of it,

Yeah.

Deny, deny, deny.

It's a double negative, which is a positive

Allow all, and if that doesn't work, then deny.

But yeah.

Yeah.

It's the chmod 777 for the old, Unix, people on, on the thing.

the I do wanna go back to the thing that you said earlier, the

idea of the, this panic room.

I do think that, and it's very similar, it's related to what you said just a

few minutes ago, and that is we really need to figure out the workloads that

either, A, are super critical from a business operating perspective, right?

Meaning what… these are typically gonna be workloads that we're going to

have very tight RPOs and RTOs, right?

That's recovery point objective and recovery time objective.

If you're not familiar with those terms, go search on our episodes, that

we fully define those terms, right?

So they have very tight RPOs and RTOs, and so these are ones where the

business can't d- can't do without them for very long periods of times.

These would be the ones where we start putting them in the panic room.

These are the ones that we start saying, "Okay, we really have to wall these

off, from, as much as possible." And then to that, I would add not so much

business critical from a money-making standpoint, but business critical

from a, it would re- it would be really bad if this information got out

Was it emails?

email Y-

I was going to the Sony hack from years ago.

That's literally what went in my mind.

right?

yeah, the informa- this is your, your corporate secrets, your… F- both

corporate secrets from a, meetings you really would not rather have public,

like what happened with the Sony hack, and then, also just your corporate IP,

your intellectual property, getting out.

So starting there, you do have to be careful, right?

Because you're also messing with the crown jewels, so you don't wanna mess those up.

but what do you think about that idea, Mike, of starting at the core there?

I think it's a great idea.

so especially in a large environment.

In a smaller environment, it's very easy to go this and this, can and

shouldn't and, I can s- I can see the important stuff from here, right?

So but in a larger environment, especially multiple locations,

multiple floors, multiple departments, you're gonna start fighting politics

with, for access, defining access.

So it's much easier in my experience, to start with the

crown jewels and work your way out.

is it that you care about?

And it could be m- obviously more than one thing.

It could… Is it your enterprise, your ERP, your financial system?

Is it, We have a client that does, a lot of crash testing, and their intellectual

property is all the video and telemetry from the sensors in the crash test.

They manufacture other stuff, but this is their crown jewel.

This is what makes them who they are.

so it's this, maybe priority one.

Some manufacturing, priority two.

something else, intellectual… design drawings, intellectual

property type stuff is three.

now you've identified all your really important stuff that you

care about that's gonna keep the lights on and, the business moving.

For each one of those, who needs acs- access to it, daytime, normal

behavior, let's baseline all that.

How's it being used?

What's normal?

it being backed up?

'Cause it's not just who's accessing it day to day.

Where's that data going it's getting archived?

what's our disaster recovery plan for that thing and all the stuff that supports it?

'Cause that's gonna go into segmentation.

'Cause if you have a, a, a disaster and we've gotta rebuild that somewhere

else, you also have to rebuild all that access stuff somewhere else, that goes

back to that stuff being documented.

But absolutely, start at the core, work your way out, and then fight those

battles and they're political battles.

On, on… As you do that, as, as your circles, your concentric circles of

security grow, your onion, you're gonna, you're gonna run into these

political battles of, "I needed access to that." Really, why?

'Cause it doesn't support any of the use cases that we've identified or defined.

And so do we need an exception for that?

Do we need to pivot or redefine?

and I- in my opinion, that's a, an amazing way to start.

Mike, one of the things you mentioned is you said, I think you said

something along the lines of, yeah, identify like what's important

and then start figuring that out.

But as an IT guy, I- or network guy, I'm not the one who's

figuring that out, right?

I… that's not my decision, right?

It should not be your decision

guy's decision of what the RTO and RPO are, right?

Abso- or the, yeah, absolutely.

Everything's data and architecture to us.

we can tell you the value of that thing.

We can tell you the value of a DLT tape.

We can value the value of a firewall or how much it's gonna cost to

run 100 yards of ethernet cable.

we can tell you all those things.

We cannot tell you the value of the stuff that traverses it or is stored

on it or is being used by the business.

That we're not that, I'm not gonna say we're not that smart, but we, our f-

we don't have the bandwidth to consume that or to be concerned with that.

It's,

the business.

it's not your role, right?

nope,

Yeah

it's not your lane.

And there's an exercise called a business impact analysis that can be done.

it's fairly concise and it's impact.

it's similar to a risk assessment where we just go talk to the,

y- the key stakeholders that are driving critical business functions.

"Tell me what you do here. Tell me what data and information, your role requires."

We talk about the technology that, that's required to support that role,

but we also talk about contingencies.

Like what would you do if your computer's not available?

How would you continue doing your job?

Anyway, long story short, that BIA would identify key stakeholders, critical

processes and procedures, all the stuff that those jobs require or lean on.

gonna point you, if not identifying it directly what your crown jewels are, it's

gonna really point you in that direction.

You're gonna see a lot of commonality, that could help you identify those things

Mike, I, I didn't hear anything you said after DLT tape

You started droo- I saw some drool coming out of your mouth

you… I was like, "Man, Mike is dating himself there."

Time Track,

It…

I didn't wanna go that far back

gracious, DLT.

haven't thought about DLT in a minute, as the kids say.

So Curtis, for you, I'm surprised… So I know we're

talking about network segmentation.

I'm surprised you have not brought up the story where you wanted

to bash your head into the wall because of network segmentation

You mean from that same client?

Yep.

that's the same one, yeah.

Yep.

y- it, it can… th- this is, this is like a, this is like a how

not to do kind of thing, right?

So the, the, this company that I talked about was very segmented off,

and, one of the only application that needed to talk to every other

application was my application, right?

Backup.

so I broke every segmentation, system that they had because I need… the,

the idea of having a single server that could talk to every other server

just basically blew their minds.

And so they kept trying to, wall me off, and they kept doing it via ports.

They kept seeing if they could figure out what ports, And a-

at this point it was NetBackup.

What ports was NetBackup using?

And they'd say, "We figured it out." And then they would… And then I'd

come to work the next day, and I'd find out that the backups all failed

because they had blocked it off, right?

and then it w- it was the, the final night of the fin- it was Y2K.

Y2K was coming.

And, it was the, it was after code, the code, freeze.

So I was like, "Okay, so no more stuff," and everything.

And I was there at 10 o'clock at night, 'cause that's when I

was doing a lot of this work.

And, I went to go run the backups, and they hung, and I lost my mind.

And I started screaming out a blue streak, because I thought I was alone

in the building, and thought I could get away with it, and, turns out I was not.

And the guy that I was reporting to was there, and he stuck his head out

and asked me if I was, like losing it.

And I was just like, the network, the security with the

and the da- da-da." And he's like, "I got it."

Yeah.

So you can step on some people.

Try not to do that, or try to do that as little as possible,

but, leave that up to Mike.

Let Mike step on people I just, something tells me he could do that.

the, I- so here's the thing.

What we're basically saying is first off, the idea is, is monitor traffic,

look at traffic that's going from VLAN to VLAN, see what's, happening.

I do… If you have a VLAN for the backup, especially if you have a separate

network for the backup system, quarantine that off as much as possible, right?

especially things like, authentication and authorization so that you don't

have, we talk about this with, with, active directory, right?

where you don't want that to, if your primary active directory is compromised,

you don't want that to bleed over into the, into the backup system.

And then as we've already talked, l- look at the high value targets, look at

the, the ones that are both h- valuable from a business perspective in terms

of keeping the, the lights on, and then also in terms of the data that you

really wouldn't wanna get out, and that's where you should start this process.

And then Google VLANs and micro-segmentation for whatever

type of environment you have, right?

The three big ones being traditional infrastructure, say highly virtualized,

but maybe I'll say f- I say four.

So a highly virtualized but physical infrastructure, then we start

talking about, containers and modern workloads, and then we talk about

a highly cloud, based environment.

And then, how do I do micro-segmentation in a cloud-based environment or

whatever it is you have, and learn that.

'Cause we can't cover all of that in, in an episode like this.

We're just trying to, we're just trying to seed you, give you ideas.

any final thoughts on that?

I'll start with you, Prasanna.

No, I think people should be using VLANs.

the

Just be careful when people start complaining because your firewall rules

blocked off access that they used to have

Yeah.

How about you, Mike?

Agreed.

VLANing is, it's a pretty simple skill to learn.

a lot of the te- technologies out there today, the interface is very intuitive,

but it does take some strategy.

don't go log in and just start doing stuff.

it out on paper first.

Really think through how I want to segment stuff, even at home.

seg- create a, a guest wireless network.

That's a great way to start.

I have camera- I have, internet-connected cameras that are on a different segment

in my home, including… I've got two.

I've got the house, and I've got the chicken coop.

so the chickens are on their own segment because it's, much

further away from the house.

If it gets compromised, then it's on its own segment.

a- and it doesn't hurt anything to play with it, at home, 'cause you can undo it.

Just put some thought to it before you start messing with it,

you could,

easy to do

you can undo it, Mike, until someone in the household complains that

the internet's down or they're not able to stream to the Apple TV

from their phone or whatever it is.

So just be careful with that too.

Yeah.

All right,

tell you a, a

Go ahead

real quick practical story.

So my, my oldest, this was years ago when she was in high school.

she would wait till 10, 10 o'clock midnight to get on

the internet with her friends.

And though she was upstairs, it was right above our room, and so we could hear her.

and so I put her on her own network segment, and then I assigned,

time restrictions to that segment.

So just letting you know.

that's one

Herc?

Me- mean daddy.

all right.

And with that, I will say thank you for listening and thank

you for you two coming on.

that is a wrap

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening