Phishing Resistant MFA: Regular MFA Isn't Enough Anymore

Do you know how hard Russian hackers are trying to get your info?

And a good MFA system is often all that stands in their way.

Today, Prasanna, Dr. Mike Saylor, and I dig into multi-factor

authentication and why old school MFA really isn't enough anymore.

We talk about how bad guys steal your session tokens and wear you down

with fake MFA requests, and why even better than MFA is FIDO2 and passkeys.

We cover a Google Workspace attack that ran undetected for over a

year, and hand you some simple steps that you can be doing right now.

If you're still letting important accounts sit there with no MFA, uh, I got a

name for that, and it's not a nice one.

If this is your first time watching or listening to me, I'm W.

Curtis Preston, AKA Mr. Backup, and I've been obsessing over backup recovery, and

now cyber recovery, for over 30 years.

If that's your bag, then I'm your guy.

You're not gonna find anyone that cares about this topic more than me.

Ever since 1993, when a database died and I didn't have any backups.

Uh, that was not a good day.

Now I've written five O'Reilly books, a blog, and a podcast.

Here we turn unappreciated admins into cyber recovery heroes.

This is the Backup Wrap Up

Hi, and welcome to the Backup Wrap Up.

I'm your host W. Curtis Preston, and today I have with me, my two best friends.

First off, let me just talk about the guy that's currently cooking

in his seat, Dr. Mike Saylor.

How… What's the temperature over there today, Mike?

today it's, I think it's close to just over 100.

we're, we're just getting ready and excited for tomorrow's 106

Ouch

just, that's just, and I shared with you, before the call, it's

also really hot here in, Oceanside.

It's 85, which is, for us is just really high.

I've never tried to cook an egg on my head, but tomorrow I might

And speaking of super hot, how's it going, Prasanna?

I'm good, Curtis.

Nice to see you again, Mike, and I hope you are not planning to

go anywhere outside tomorrow.

Just, like, stay indoors all day long

I've gotta drive to Houston.

I'll be on the road all day

At least air conditioning.

Yes, air-conditioned road travel

quick, completely unrelated story of driving to Houston.

I once had a, situation where I had a, I was flying American Airlines

and I was flying in and out of Houston, but via DFW of course, 'cause

that was American Airlines, right?

And I found myself in Dallas and I, tried to get American to say, "Hey, h- how about

I just hop on the second leg, instead of going all the way to, driving all the

way to Houston just to get on a plane just to come right back where I am at?"

And they go, "No, you gotta do it. You gotta do it or otherwise you're gonna pay

$755 or whatever." So I drove to Houston, and one mile south, or one mile shy of the

Houston Airport, I got a speeding ticket

Oh.

the time,

I really thought where this, this was gonna go is that you got off

the plane in Dallas and went, "Wow, this weather sucks." And then you

got to Houston and you went, "Oh, well maybe Dallas wasn't so bad."

Yeah, the, what I remember at the time was the, trooper, I don't know,

the, the, the cop, told me that, at the time Texas and California

didn't, share, computers or whatever.

And so he said, "You need to surrender your driver's license." And I was

like, "I'm going to the plane." I really don't remember the end of that

story, but I remember the cop took my license, and, somehow I got home.

so gotta love Texas.

anyway, and American Airlines for putting me in that position, and

me for speeding, but whatever.

It's not my fault.

Of course not,

Uh-huh.

Uh-huh

speaking of not my fault, we're gonna start, we're gonna talk about, we're

gonna talk about MFA, multi-factor authentication, and, I thought

you'd start, Prasanna, with a story that we covered not that long ago.

do you wanna talk about that?

Yeah.

So this was, I wanna say it was probably a month ago, maybe two months ago, where,

a bad actor was detected and shut down.

But what ended up happening is there was a software package that was used

mainly, I think, in medical and some of, like, the academics instances

called REDCap, and it basically is a database that allows you to do things.

Anyway, what ended up happening is there were vulnerable, vulnerable versions

of that database out there running, and people, bad actors were able to exploit

it and attack the older REDCap instances.

And then what they did is they just kind of waited around and saw people logging

in, and they somehow got credentials for the Google Workspace admin and kind

of then used that to log into Google Workspace as the admin and then set

up forwarding rules to forward pretty much all emails in the company or

in the institution to a random email address, and it was unmonitored, and

I think it was running for quite a while before they realized that it was

like over a year.

Yeah

yeah.

so this was a multi- multi-stage, it was a three-stage attack, right?

So the initial identification of the, vulnerable versions, which were

running in parallel with the newer versions, which is just bad, right?

and then, g- the credentials, and then using those credentials to log

into Gmail, and then using that to then do something else, which was

essentially exfiltration, right?

So is that, does that make it a four-stage?

I think that makes it a four-stage attack.

That is very, studious.

would that be the-

Yeah.

Could we also talk about the fact that they also made it such that if someone

tried to upgrade the RedCap instances, it would just redeploy the malware again

and just keep running over and over, and so you could never really fix it?

Good times.

are you impressed, Mike, with that, with that attack?

No.

it's, it's c- common progression of an attack and common creativity.

you know, they were, they were lucky because they found these vulnerable

systems that were out there and, and they were out there intentionally.

They, wanted these older systems out there to ensure usability and

accessibility from, you know, you know, the lowest common denominator.

so yeah, I'm not, not so impressed.

the same, same playbook that most, most bad guys are gonna follow, the,

the, the attack, you know, methodology.

just, they've, they've, they found a vulnerable system

and they took advantage of it

It's like going in and finding Windows XP systems out there.

Come on, if you're running Windows XP at this ti- date, right?

Yep.

some of the server versions, yeah

Could be, what was it?

Yeah, Windows XP.

But, that, that's really old, Windows XP.

Meantime, the compromise is less than 10 minutes if you plug it into the internet

I remember when, when, the, one of the most commonly exploited versions of

Windows Server was Windows Server 2000.

And, and I remember that we discovered this in 2013, and I remember saying

that it's a teenager at this point.

It's time for it to move out.

but, all right.

So old version's bad, but, let's talk about, Mike,

What does this have to do with MFA?

we're getting to the MFA.

So Mike, let's talk about, first why MFA is so important, right?

this is another story.

That story is if they simply had implemented MFA for their

Gmail instance, which by the way, I believe Gmail now requires.

Google Workspace

Google Workspace, requires MFA now, right?

I am… Every time I've set up, even if you don't do like the full MFA,

it's gonna require, you to v- verify who you are, all over the place.

But let's, Mike, I'd like to talk about the concept of social

engineering, which is a very common way that, the, the bad guys are using

phishing, to get, to get credentials.

So you want, you wanna talk about that?

What, what did we talk about that?

There's a lot of different ways.

So it's just, it's understanding your, your victim.

so doing your homework.

So, if you're gonna attack a particular organization or group or system

or you're gonna go research them.

what are their hobbies?

What, what does their social media footprint look like?

What does their credit look like?

What is, what kind of car do they drive?

Where do their kids go to school?

you're gonna find something out of all your research that

is common human interaction.

like, "Hey, my kid goes to school with your kid, and they gave me your email to

see if they could have a play date," or, "Timmy left his lunchbox," or something.

You know, that's, that's kind of, no, no pun intended, but elementary, but

that's, that's how you get people's first response, and that's really what you're

looking for, is that first response.

And in some cases, your social engineering, attack, y- you're

only, you only get one response, so sometimes you gotta be pretty good.

But at the same time, you know, statistically speaking, if your,

your target audience is large enough, statistically you've got

about a 20% or better success rate.

So if I send out a million email… Well, if I send out 10,000 emails, you know,

20% of 10,000 is still a good number.

I just need one, right?

In an organization, I just need one person to click on something that's gonna either

give me, harvest their credentials, or they are going to willingly give it to me.

Like, "Curtis, this is Mike from the IT department.

we have a new help desk, i- interface.

below is the link to automatically submit tickets or, or check on the

status of a, of, of a, of a help call.

here's our new 800 number.

it's gonna be great.

We're looking forward to improving service and, and solving your problems faster."

Mike, don't give people ideas, Mike

this is the old- this is one of the oldest ones, the help desk one.

But, you know, click here or, open this attachment to, to, for your

chance at winning one of 20 Starbucks gift cards for being the first one to

write a review on the IT department service, you know, level of service.

and you do.

And so, you know, maybe I've got a… Next, next thing that happens

is I've gotta enter my email address and log into the network.

Like, "Please verify your credentials so we know it's you and not, not your

kids or your neighbor." So it's, you know, email phishing is getting a user

to interact with the email in order to either automatically harvest or, prompt

them to provide, credentials because it looks legitimate or, or it appeals to

their humanity or, you know, I want my kid's lunchbox back or whatever it is

I remember one time, and, to this day I don't know if this was a successful

phishing attack or if this was a successful test of my ability to, or

inability to recognize a phishing attack.

When I worked at a former employer, they, they had some sort of incident

where we were given free, we were gonna get free credit monitoring for a while.

And right at that moment is when I got a, a contact from, "Hey, we're gonna,

sign up for your free credit monitoring.

All we need is what?

Your name, your birth date and your Social Security number." And I found

out that it was not, the company indeed that was contacting me.

But it was s- it was so expertly timed that I fell for it.

And to this day, I don't know if, I gave all my, the three pieces of

information that they want all in one go, or if it was just, them testing,

You… But here's a, here's a question for you, Curtis, and also Mike.

At this point, don't you just assume everyone has it out there?

Like, that information's just out there anyway?

Yeah, I kind of joke that I, I, I protect myself from identity

theft by maintaining bad credit.

I mean, you're- you've got access to my stuff, you just don't wanna use it

I like that.

by the way, it's technically not on topic, but I have all my

credit reports locked, right?

And that, I think that's a life, thing that everybody else should have, is

that, in the rare instances where you're actually opening new credit, you can

unlock it for 24 hours, do the thing, and, in fact, most of them allow you,

actually can just y- one of the choices is unlock for 24 hours just for that

situation, and that would at least stop those people, if they get access to that.

Just a note to my US listeners, all three credit reporting agencies

are required by law to allow you to freeze your credit report for free.

So I the, I can't recommend this strongly enough.

It's not technically related to the, um, to this situation, but

it's just something that a lot of people don't realize is there.

You log into Experian, Equifax, and transunion.com you know, get a

login if you don't already have one, log in, and then look for freeze.

You may have to look around for it.

Honestly, some of them really hide it.

But it is there, it's required by law, and then freeze it.

It does mean that when you apply for credit, you will get you will

get initially told, "Hey, you need to go unfreeze your report."

It's a minor inconvenience for the, hopefully, infrequent action of

you actually applying for new credit.

And this is a big identity theft thing that you can do.

I'd love to hear, for those of you are, that are from other countries, I'd

love to hear in the YouTube comments, uh, what you do in your country.

But so you just freeze it and it stays frozen.

And then some of them, and I prefer these, actually allow you to do a temporary

unfreeze, uh, or thaw, if you will.

I actually use the word a lock my c- uh, credit, uh, they actually have a credit

lock, and they will charge you for it.

It does exactly the same thing as a freeze.

And, and by the way, when you're logging into these pages, they all want you to

pay for a membership, but they all, they just immediately throw that in your face.

Just close that out to, These companies are already making enough off of you.

You don't need to, uh, sign up for a membership.

Um, signing up for a credit monitoring service, that's

an entirely different thing.

But anyway, so freeze your credit reports unless you are applying for credit.

And again, I'd love to hear comments from other listeners from other countries

and yeah, I agree, Prasanna, you just assume that all that stuff's out there.

but for the record, I do still have my Facebook birthday and my real birthday.

I don't wanna make it easy for them.

so all right.

So that, there's, so basically 'cause social engineering is just a, a

variety of tactics, as you said, to get people to, either directly give

you the information you're looking for or to get, or to, basically just

open the door in some way to develop a relationship in some way so that you

can then at some point eventually get the, the thing that you're looking for.

I can think of another, of a story that I saw Kevin Mitnick telling once where

he talked about, he, they had a way where they would in, they would find a person

of note in an, in, in an environment, and they would invite them to speak at

a conference, a non-existent conference.

and then they would say, we just need to do a quick Zoom interview with you prior

to the thing to talk about, whatever." And they give them a Zoom link, and it's

a bad Zoom link, and that link downloaded the, the, the dropper, to do the bad

thing, and then took them to Zoom.

so the person had no idea that anything had just happened, and they just, at

that point, they were just at, they were completely controlling their computer.

So yeah,

Yeah,

engineering, yeah.

What's that?

it's kinda like a s-spoof in the middle.

Yeah

bank, bank, bank account logins are the same way.

the most, the, the cl- the most recent one that I've seen that's pretty clever

is, you know, when, when you get a, a phishing email and you wanna report it

as phishing, know, there's the button at the top that says, "Report as phishing."

Yeah

Well, bad guys are sending phishing emails with the report

phishing button in the email.

So you, you know it's bad, it looks bad.

I'm gonna click the mu- button to report it as bad, but clicking that button is

the trigger for the malware in the email.

Oh, man

Yeah

Tell you what, man, that, that's just not good.

hang on.

Let me pull up my, All right.

let's talk about, Fido2, right?

do you wanna talk about what Fido Fast Identity Online

Well, there you go.

It's kinda like the one-time password stuff, but it's a little more permanent.

so strong, a, a good, a good FIDO, profile, and I think there's, there's

different versions of FIDO out now too.

in fact, I think it's called FIDO2.

the, the idea though is something more than, you know, just your

username and password, but also something outside of just an email

or a text message you would get.

Could you give examples, Mike?

Like based on what you just said, like what would that potentially encompass

Well, so traditional MFAs, you know, an SMS message or a

one-time password or, an email.

FIDO is, is true encrypted token.

you can install it on a, on your laptop or your phone, but it has to be paired,

so it's public and private keys.

So it's got a… Your, your public key's out there, so if I wanted to have a

communication with Prasanna, in order to encrypt that, you would get my public

key, I would get your public key, and then our private keys would match those up.

and those, those private keys are on our device.

so it's, it's kind of an old school asymmetric encryption approach that

they've just kind of put a new name on it and attached it to a new way

of talking and encrypting our stuff.

But it's, it's really re- it's, it's designed to be transactional instead

of like normal email communication.

It's, it's a, it's assigned to a authentication or a purchase or,

it's more transactional

When we get to the actual, action points or, acti- when we get to the actual ac-

action items, it's gonna be really simple.

So we just need to drive home the point here of why this is such a big deal.

and I think the ArcGIS story is another scary one where there was

an entire year that went by where they had control of something, and

that all started with what, Mike?

Well, the, the, the Flax Typhoon, and, and I think that's the, the case

we're talking about here, is actually the, the name of But the, the initial

identification of this particular attack was because of their botnet.

and so looking for vulnerable systems, looking for a way in, Flax Typhoon is

primarily a, an espionage campaign, s- so it's not so much access as it

is true information and, and, and more specifically government-level information.

So, pretty confident that Flax Typhoon is run by the Chinese government.

targets were primarily government organizations,

Taiwan, Asia, America, Canada.

the, the,

the initial compromise was VPNs and firewalls, vulnerabilities, web servers.

and then from there, that compromise allowed them to based on tools and

s- and software available to them, so living off the land, type of attack.

So, you know, PowerShell, Python, Sysinternals, RDP,

from one machine to the next.

one of the things that makes me smile about this, this particular campaign is,

is all of the fun cyber threat acronyms and, and code words, like Juicy Potato.

so,

Sweet potato

so, so many of the tools and, and techniques in, in, in Flax Typhoon were,

were pretty kind of… I, I don't know who came up with the words or the code names.

Mimikatz has been around for a while.

That's a good credential harvesting.

Anybody that hears Mimikatz knows it's, it's associated with,

with malware and cyber attacks.

But the privilege escalation tool that they used was called Juicy Potato.

and some of the web shells, like one of the web shells was called, China Chopper.

just so just some, some fun acronyms and, and, and terminology.

But, was actually big problem

at some, point, didn't they get access to an administrator, like

login again that, that again didn't seem to have any MFA on it?

they did, and some of those systems were like IoT devices, like cameras.

So if you remember back in the day, I'm talking, man, had to have

been almost 10 years ago or more, the Mirai, the Mirai, botnet.

Got it.

Yep

And so in Flax Typhoon, they w- their botnet was called Raptor Train.

and so the Raptor Train using the Mirai-type virus compromised hundreds of

thousands of IoT devices in this campaign.

And so that was cameras, routers, switches, network storage devices.

so that Mirai, i- you remember back, it, it, in that case, M- the Mirai

botnet was successful because some of the credentials for those devices were

hard-coded on the chips, and the, the manufacturer of those chips didn't care.

They're like, "I just produce chips.

It goes in something, I have no control over that." so very similarly, this

attack group and their botnet, were able to leverage hard-coded credentials to

get access to the device, and in some cases, it was root level device, access.

And

Oof

other cases, it got them on the device where they were then able to deploy

Mimikatz or use some of these other, available tools to, to harvest credentials

The way I would put all of that together is that the, the bad actors have a,

a seemingly infinite number of ways that they can harvest credentials.

We talked about phishing, we talked about using old versions of

software that have vulnerabilities, and we talked about just, botnets.

th- they just have a seemingly… and d- I think we pr- we've probably

just scratched the surface, Mike?

Of, a seemingly infinite,

Well, it is seemingly infinite, because we don't do… We don't

think like they do, and they do this 24 hours a day, seven days a week.

we only do it 8:00 to 5:00, Monday through Friday, a lot,

as, as a normal user, right?

and probably not the full eight hours.

We're, we're doing other stuff, or just not focused.

But yes, it is seemingly un- unending, and, and ever-evolving

ways of harvesting our credentials

Prasanna

have a question for you now.

Sure

So we've talked about all these scary ways that they're always gonna be

ahead of us, that we're never gonna be able to catch up because we don't have

the time or effort or expertise to be focused on securing things all the time.

S- so like, do we just like sort of call it quits, unplug

ourselves from the internet, and just go back to sticks and fire

that,

out in the-

that's a great question, Prasanna, but that is the only way to

have a truly system, right?

I think my point, and Mike, feel free to enhance this point, but my

point is you have to assume that the bad guys are going to get someone's

credentials in your environment.

And so the idea, this is the whole point of MFA, right?

The whole idea of MFA is that, that th- there is a seemingly limitless number

of ways, you know, that the bad guys can get, the other is, the, the purchasing

of the, the dumps, the credential dumps that are available online, right?

th- there's so many ways for them to get access to credentials that you are

committing, I'll say this again, you are committing professional malfeasance

if you are allowing access to important accounts without MFA turned on, right?

you're noticing this, and we're gonna go a little bit, it's, we're gonna

talk about phishing resistant MFA.

But you've noticed this happen in your personal life, Prasanna?

can you think of what's happened to you over the last, I wanna say

10 years with things like your bank, with things like Gmail, with

Oh, yeah, everything, yeah, everything's going multi-factor authentication, right?

It's you log in, it sends something, because now you also have phones, right?

And so everything gets sent to your phone where it's like, "Hey, did you try to log

in on this laptop? Accept or deny from your phone or some other device," right?

And so you see this happening because it's becoming easier, I guess.

Do you, do you think it's becoming easier to enforce MFA versus before?

Like I remember when I was working and you'd sort of walk around

with the little key fob, right?

With the rotating code, and that you always had to have it in order

to be able to log in, and if for some reason it wasn't there or

the battery died, you're screwed.

I think MFA has made it a little easier.

And so kind of over the last 10 years, like you're saying, yeah, I think

back then there was nothing, and now it's sort of become commonplace

now I think the difference bet- between back then and now is that we always

have this other thing on us now, right?

We always have our s- we should always have our smartphone with us,

Where's your phone, Curtis?

my phone is right here, sir. Thank you very

Okay.

and by the way my life is, I can't go anywhere without my phone.

My car runs from my phone, so as soon as I step… And which is perfect for me,

'cause I, I got serious, By the way, I've officially been diagnosed with ADHD now,

'cause I had to wait 60 years to find out, "Yeah, Curtis, you got ADHD." So the

fact that I can't leave the house without a phone, I get in my car, that means

I always have my phone with me, right?

'Cause otherwise I definitely would be the guy that's 40 miles away

and going, "Oh, crap, I left my phone back at my house," right?

but yeah, we have that device with us, and now we have a number of

pieces of software, commercial ones like the Symantec VIP, tool.

I know that a couple of my different vendors require that.

or, free versions from Google or Authy or, pr- Mike, you mentioned you use a- another

tool that, you mentioned that I think on, I don't know, a few recordings ago.

You use a, a, a completely different tool.

I don't remember what it was.

It doesn't matter.

But yeah, there are a number of tools.

and yes, there are also the truly secure ones are the, those things that, you

know, the, like the YubiKey, right?

The, that, that is a truly secure, one-time password thing that,

that isn't… the only downside to the phone is potentially somebody

could hack your phone, right?

So if you're seeing this happen in your personal life, and you're in your

professional life, and you're in and you care at all about cybersecurity, if

you've got important accounts that are just sitting there waiting for you to

just log in with no, other authentication, then again, professional malfeasance.

I don't wanna, call you nasty names, but don't know what el- I don't

know what else to say at that point.

Mike, let's talk a little bit about… I know this is something you've

talked about before multiple times.

We talk about this idea of killing the trust button, right?

this is something you talk a lot about.

You w- you wanna talk about that?

Sure.

I think a lot of organizations and a lot of systems and networks have

this inherent trust out in the world that, you know, we need to be able

to, we, we need to be accessible.

we want, Well, and, and there's a couple of reasons for that.

One is just making it easy so that I don't have to go do

custom rules or manage something.

and so that.

Well then, there's also a level of skill required for, in a lot of

cases, for implementing changes that, could filter or restrict access.

So it- it's just easy to, to leave the door open or the doors

unlocked or, or have fewer layers.

I see it a lot where organizations call and say, "Hey, I've got this problem.

I think someone's trying to get me- to me from Germany." I said, "Okay.

Well, we can look into that, but in the, in the meantime, do you guys care

about people from Germany hitting your network?" "No." Well, just block Germany.

Well, that's an easy problem.

It's solved.

then, you know, all right, so there's, there's website traffic,

there's network traffic, there's VPN traffic, there's cloud.

all of those things, and this goes back to, you know, how do

we, how do we better protect ourselves, whether it's MFA or not?

And, and it's, it's really about understanding the risk to us, us as

an individual, us as a, a company, then what kind of things can we put in

place to mitigate those risks, right?

So if, if we're concerned about people stealing our, our users'

credentials, what can we do to reduce the likelihood of that happening?

Well, we could really focus in on who should have the ability to log in.

So even if Curtis's were compromised, if he's logging in

from Germany, it won't work, right?

Right

Well then, all right, so we implement MFA so that… You know, Curtis figures

that out, so he compromises a, a machine in, in the US to log in from

the US, and now the credentials work, but he's being challenged with MFA.

he steals, he steals Prasanna's MFA token by phishing it, sending him a phishing m-

email that gets him to go to a website.

because he's already trusted in his browser, the website

scrapes that MFA token.

Now I have all three things, U- ID, password, MFA.

But I can configure my system to only allow one login, no concurrent logins.

Definitely no logins across, know, land speed travel distances.

so there's… I mean, there's tons of things you can do

You've

to mitigate all of this

before, right?

Right.

It just takes time and effort and skill and an understanding, and all

of that is great on the technical side until you implement it and then you

get your users going, "Well, that's too difficult, and I don't like that."

And so now you've got the political fight, and a lot of technical people

will give up on the political fight.

It's just like, you know what?

as you were talking… Oh.

it's not worth losing my job over

As you were talking through that last point, Mike, I was just thinking in my

head, I'm like, "Why do all products and companies just do this by default?" And

you hit on it at the very end, right?

It's like users are gonna complain.

There's gonna be friction in their experience.

They're not gonna like it, and then you're gonna get so many support tickets.

You're gonna be like, "Whoa, whoa, whoa, what do we do?

Let's go back to the old way."

Yep.

And so it, it comes down to a balance of security and usability from a, a technical

and controls perspective, and then a personal administrative, it's do I wanna,

do I wanna fight this battle or do I wanna live to, you know, work another day?

'cause I mean, your time's, your time's limited in either way, in either case,

but would you rather be fired because you, you tried to do something good, or you

got fired because you didn't do something good and the, the company was compromised

and you were fired for that reason?

Yeah

there's… I mean, it's a struggle

I think a place to start, I, the- I've seen that.

I've seen that where, and I've seen it in backups, right?

I've seen it where you're trying to do the thing and you get the group that's like,

"Ah, I don't wanna do the thing," right?

Whatever, whether it's, in my case, in backups, I go all the way back to

when I was that oil and gas company and, I was just trying to enable

backups for the first time this really big Oracle database, right?

that was really important.

It had never been backed up, and it involved me doing a couple of things

that the DBA was fighting me on.

I, I, it's in, in, it- I can't fathom the idea of having a m- a

valid system that isn't backed up and anybody being okay with that.

But still, that would happen.

The same thing happens in cybersecurity, right?

Ca- do you think it would be easier to at least, and perhaps more important to

start with administrative accounts, right?

privileged accounts, right?

It's, at first off it's a smaller number, and possibly it's a different group

of people that will have some better understanding of the importance of this.

does that sound like a good idea?

Absolutely.

You can, you can log and alert on, privileged account use, whether

it's an admin or a service account.

and all of that stuff should be tracked, both successful and failed

login attempts for privileged accounts

Now, the things that you suggested earlier, th- those all sounded great,

but they sounded complicated, right?

it sounds easy to turn off Germany.

It turns out easy to turn off Russia.

but the, some of the o- other stuff, it sounded like it starts to get complicated.

So my question is, you're like, it's not complicated for you, Mike," but I'm just

saying for maybe the aver- person, is

It's really not

are there tools that can help this be easier to do?

There's tons of tools, but then you've gotta go learn a tool.

a lot of, a lot of these, capabilities are built into stuff

you probably already pay for.

So your normal Windows machine, Windows 11 as an example, you've got a

firewall, you've got Windows Defender.

All that stuff comes with the, your Windows license.

watch a YouTube video on how to configure it to protect you better.

You'll learn, you'll learn everything you need to know in, like, 15 minutes, and

Could you…

walk you through it.

If you're an administrator in Office 365 as an example, there are hundreds of hours

of training videos for free that walk you through all this stuff step by step.

And if you don't wanna watch a video, it's all lined out in a nice Microsoft

document that'll s- take you through it, step one through whatever with links.

you click the link, and it takes you right into your admin console,

the exact right spot to do it.

there are tools in Office 365 that allow you to test.

Like, I wanna turn this on, let me test it make sure I don't, you know,

break the, break the environment.

pick a user.

Start with, start with your admin account

Yeah

So, so the, here's my biggest thing, like given it's 2026 and we're in

the age of AI, like why don't you just go ask like Claude or Gemini

or take your pick of AI assistant

even, even, more succinctly with Microsoft, you know what?

Buy a Copilot license, it's like $100 a year, and tell Copilot now

that you're the licensed- you're the admin and you've got a Copilot

license, ask Copilot to help you.

It has the same privileges that you do and can see all that stuff

I had a mission critical system that went down yesterday, right

at the very inopportune time.

You know what that was?

Your TV

Yeah.

My TV, stopped working just before we had invited a bunch of people over to

, watch the World Cup final, and I used AI.

I was like, I got three different pieces.

I got the Apple TV box, I got the soundbar, and it's going through the

soundbar up to the TV," and I hadn't used this particular TV in a while.

And, I d- just sat there, worked through.

I was like, "I got this,"… The- these are the brands of the

things I have, and Claude, just worked me through, fixing it, and

Yes, I've been replaced.

'Cause last time

I was d- done in a few minutes.

You b- By the

I helped you troubleshoot this, I remember.

I completely agree that, that is definitely, a, a great place to start.

because all of those phishing-resistant things that you talk about… And by

the way, d- let's just talk about, why isn't MFA by itself good enough?

Why can't we just turn on MFA?

And there are a bunch of reasons, right?

you talked about stealing session credentials.

That is a possibility, right?

other things are, the, the MFA exhaustion, right?

Which is something where, you just bombard the, you meaning the, the, the bad guy,

just bombard the person with so many inf- MFA requests that at some point they just

respond just to make it go away, which is a horrible response, but I think we

can agree that there's certain groups of people that would respond that way, right?

And that's why we have to add this extra logic behind MFA, to make

it more resistant to phishing.

there's still that, that usability and culture part behind it.

I mean, you talked about MFA exhaustion.

Do you have locking your house exhaustion?

Right?

You're gonna go back home because you forgot to lock the front door.

You care.

You have a responsibility.

MFA should, should be the same, if you're not requiring MFA every time they log in,

then you've diminished the value of it.

But then also on the back end, on the IT side, or the technical

side, there are controls for limiting the lifespan of MFA also.

So Mike's been logged in for 20 hours on the same MFA token.

That shouldn't l- you know, they should expire at some point,

The…

can configure that

Do you know if they, 'cause I know a lot of websites, right?

It's like you log into your bank and you enter and it's like, "Oh, remi-

reme- remember me for next time," so you don't get the MFA again.

Do you know, Mike, and that's like the exact opposite of

what you want, right, from MFA.

And so I guess the question I had is, Mike, in these tools that you were talking

about where you can set these policies, do you know if they also have that

ability to say, "Hey, by the way, never allow a user to say trust this device"?

Yeah, so that was a group policy you can push out.

So there's a couple things.

As a, as an IT administrator, I can restrict what browsers you can use.

I don't want you to use, Firefox, just as an example.

So you can only use Edge and Chrome, right?

So I-- there's, there… You can, you can push policies out like that, and

then within that policy and within MFA, you can, you can select never allow or

prohibit, you can prohibit users from saving, MFA credentials in browsers.

Yep.

And, and any other credentials.

You can prohibit them from saving credentials in, in the

Yeah

in general.

Yep.

My websites

Or credit, or payment

Explorer

Oops.

Netscape.

That's gave… Wow, you took us back there.

All right, MFA is really important.

and what… as long as we're talking about it, we'll just throw in passkeys is

actually, are actually better than MFA.

But, today we're talking about least have MFA, for goodness sakes.

And also, look into being more resistant to phishing, these extra

features that Mike talked about, to look for things like impossible travel.

how is he in both in San Diego and London all at the same time, right?

that's what they call impossible travel.

And why is he… i- if you can add some logic of like, why is he never

logs in at 3:00 in the morning.

Why is he logging in at 3:00 in the morning?

Perhaps, just add an extra level of security when weird things happen, right?

all right.

thanks, Prasanna and Mike, once again

It's always fun

Never enough time to say all I wanna say, but I'm glad I could contribute

Yeah, All right.

And thanks, to everyone out there listening.

you're why we do this.

That is a wrap

The Backup Wrap Up is written, recorded, and produced by me, W. Curtis Preston.

If you need backup or DR consulting, content generation, or expert witness

work, check out backupcentral.com.

You can also find links for my O'Reilly books on the same website.

Remember, this is an independent podcast, and any opinions that

you hear are those of the speaker and not necessarily an employer.

Thanks for listening