Backup security best practices are the difference between a bad day and a total network takeover — and this episode proves it with a real story.

We sit down with a red team pro's account of breaking into a company through nothing more than a weak backup server password, then using it to grab full control of their domain controller from outside the firewall.

Backup security best practices don't get talked about enough, mostly because backups are invisible until they fail — and that invisibility is exactly what attackers rely on.

In this episode, Prasanna, Mike Saylor, and I break down the real gaps that get exploited: default passwords still sitting on backup hardware from the day it shipped, service accounts running quietly in the background with more privilege than anyone remembers granting them, and admin accounts that get used directly instead of monitored properly.

We also get into the authentication side of backup security best practices — why multi-factor authentication is good but passkeys are better, why "we'll just email you a one-time code" isn't the security upgrade companies think it is, and why an authenticator app locked behind its own PIN beats trusting a device forever.

Mike shares a story about catching failed admin logins every single Thursday morning — and the surprisingly human reason behind them, which is a good reminder that not every anomaly is a hacker.

If you're responsible for backup infrastructure, security operations, or you just inherited the backup admin job because nobody else wanted it, this episode gives you a real checklist for closing the gaps most teams never think to check.

CHAPTERS:

00:00 – Cold open: the hacker on your backup server

01:34 – Welcome and episode setup

04:17 – The Duane Lafleur red team story

06:41 – Backup servers as an exfiltration risk

08:19 – Service accounts: the invisible attack surface

28:40 – Locking down the admin account

30:08 – MFA vs. passkeys for backup security

LINKS:

Read the book: https://www.oreilly.com/library/view/learning-ransomware-response/9781098169572/

Check out backupcentral.com

Subscribe for more on backup, ransomware, and cyber recovery every week.