The Backup Wrap-Up

Credential theft is how one stolen laptop turns into a full-blown breach. In this episode, Prasanna and I sit down with Dr. Mike Saylor to walk through how it happens and how to stop it.
Mike opens with a story that should make every IT person wince. A credit union employee had a logged-in laptop at a coffee shop, turned around, and it was gone. BitLocker didn’t help, because the machine was unlocked. The attackers harvested local credentials, learned how the credit union’s business processes worked, and then phished other employees from the inside while posing as the person who lost the laptop.
From there we get into how attackers think. Their first move is reconnaissance: what do I have, what’s it worth, and how do I keep access before somebody wipes it? Mike explains why the victim has about 30 minutes to respond, why a fear-based culture makes that window worse, and why you need a documented stolen-laptop playbook before you need it.
We also cover the stuff that makes credential theft so easy. Shared local admin passwords. Predictable new-user passwords with an exclamation point on the end (yes, really). Service accounts whose passwords never change. Default SNMP strings. Mike explains Kerberoasting in plain English and shares new research on how an unprotected printer can lead to a complete network takeover.
Then we talk about how to prevent credential theft. That means LAPS or a similar tool for unique local admin passwords, just-in-time credentials that expire on their own, tiered administration, and separate user and admin accounts for every admin. Mike tells the story of a database admin who deleted something in production because her test and production credentials were the same. We finish with alerting: what to alert on, why you’ll get a flood of false positives at first, and why my new freezer sensor proves the point.
If you manage credentials for anyone, this one’s worth your time.
Chapters
00:00 - Intro
01:49 - Welcome, Prasanna, and too many Reacher books
03:37 - Dr. Mike Saylor joins
04:07 - The stolen credit union laptop
05:42 - Reconnaissance and persistence: what attackers do first
08:31 - Privileged credentials that never change
10:36 - The 30-minute window after a stolen laptop
13:19 - Security culture and automated incident response
15:06 - Shared local admin passwords
17:23 - Predictable default passwords
18:20 - What attackers harvest: everything
19:01 - Kerberoasting explained
24:01 - Default credentials and the printer problem
25:22 - When the proof of concept becomes production
26:46 - The Brocade Silkworm story
28:07 - LAPS and just-in-time credentials
30:30 - Tiered administration and separate admin accounts
35:00 - Alerting on authentication events
36:10 - Expect false positives (and my freezer)
39:16 - Alert fatigue vs. alert annoyance
41:27 - Wrap-up

Network segmentation best practices can be the difference between ransomware taking out one laptop and ransomware taking out your whole company. Prasanna, my co-author Dr. Mike Saylor, and I talk about how to stop running a flat network, what VLANs and microsegmentation actually do, and where you should start.
Mike and I wrote Learning Ransomware Response and Recovery around one basic idea: assume breach. You’re probably going to get hit, so the real question is how big the blast radius will be. Is it a plop, or does it take out the whole building?
We start with the old hard, crunchy exterior and soft, chewy interior model, and why so many billion-dollar organizations still run flat networks. Spoiler: laziness, budget, and management decisions all play a part. Mike explains VLANs with a hotel key card analogy that will make sense to those who aren’t network people. Then we take it a step further into microsegmentation, where access is based on what you’re there to do instead of where you’re plugged in.
Then we talk about:
Get buy-in from on high.
Inventory everything.
Tag your workloads and build policy around those tags.
Start with your crown jewels and work your way out. That means the stuff with tight RTOs and RPOs, plus the stuff you really don’t want ending up on the internet.
Roll it out in phases instead of trying to rebuild everything in a day.
Document every single rule, or the next guy will tear it all down and go flat again.

We also talk about why IT shouldn’t be the one deciding what’s critical (that’s what a business impact analysis is for) and how to wall off your backup network. You’ll also hear about the night before Y2K when the security team blocked my NetBackup ports one too many times and I lost it. And Mike explains how he used network segmentation to win an argument with a teenager.
If you’re a backup person who’s never had to think much about the network, this one’s for you.
Chapters:
00:00 – Intro
01:26 – Welcome, Prasanna and Dr. Mike Saylor
02:41 – My first client with firewalls on the inside
04:43 – Assume breach and the blast radius
06:24 – Grenades, house locks, and panic rooms
08:41 – What a flat network looks like
09:42 – Why so many companies still run flat networks
10:18 – VLANs explained with a hotel analogy
13:22 – Going further with microsegmentation
14:51 – The management overhead problem
15:15 – Why undocumented segmentation falls apart
18:45 – Leadership buy-in and starting with inventory
20:07 – Rolling it out in phases
21:16 – Tags, policy, and allow rules
22:56 – Default deny (and Mike says “it depends”)
24:00 – Start with your crown jewels
28:18 – Why IT shouldn’t decide what’s critical
30:38 – The night I lost my mind over segmentation
33:00 – Monitor traffic and wall off your backup network
34:35 – Final thoughts, home networks, and the chicken coop
36:04 – Mike’s teenager gets her own segment

Application whitelisting best practices can stop malware your antivirus never sees coming, but almost nobody follows them. Dr. Mike Saylor joins Prasanna and me to talk about why, and what it really takes to build an approved software list that sticks.
We start with SocGholish, a fake browser update campaign that’s been around since 2018. Every download is built just for the victim, so pattern-based tools can’t spot it. That’s exactly the kind of threat an approved software list shuts down.
Then we get into the hard part. You have to inventory every application in your environment, figure out who needs what, decide who pays for it, and build a process for exceptions. Mike explains why politics and overhead keep most companies from doing it. He also explains why shadow IT means your procurement process probably isn’t catching what you think it is.
We compare whitelisting with the simpler option of not letting users install software at all. We also talk about AppLocker, EDR policies, Office macros, MDM for mobile devices, and blocking executables in temp directories. Prasanna asks whether AI can take some of the friction out of software approvals, and Mike gives him a one-word answer. I also share a tip that makes the inventory step a lot less painful: run your whitelisting tool in audit-only mode first and let it build the list for you.
We wrap up with the good, better, best versions of this control. I tell a story about an old boss, Perl, and a bank policy that ended with him getting fired. And there’s a reminder that you will always need support from the top. Someone will always think they’re the exception, and senior management has to be willing to tell them they’re not.
If you’ve ever wondered whether locking down software installs is worth the fight, this episode is for you.
Chapters:
00:00:00 – Intro
00:01:30 – Welcome, Prasanna and Dr. Mike Saylor
00:02:37 – SocGholish and fake browser updates
00:04:57 – How often do companies really whitelist?
00:05:18 – Inventory, licensing, and exceptions
00:07:08 – Shadow IT and the $30 NDA
00:10:08 – Who actually does this
00:11:01 – Politics and overhead
00:12:12 – Just don’t let users install software
00:14:37 – AppLocker and EDR policies
00:15:47 – Can AI reduce the friction?
00:17:08 – Layered responses to a single threat
00:18:47 – Office macros and click-through users
00:20:49 – Is whitelisting a silver bullet?
00:21:29 – Signatures and the ideal whitelisting process
00:25:41 – Mobile devices and MDM
00:28:44 – Temp directories and executables
00:31:55 – How do you learn what you don’t know?
00:33:19 – Audit mode as your inventory
00:35:05 – AI agents, integrations, and CoSnitch
00:38:07 – Good, better, best
00:40:33 – The Perl story
00:43:21 – Final thoughts

Building an incident response team is something you do before the incident, not during it. Prasanna, Dr. Mike Saylor, and I walk through who needs to be on that team, why each person matters, and how to get them lined up now so nobody’s scrambling when ransomware hits.
We’re back after a few weeks off, and we came back with a topic I care a lot about. When I cracked a rim on my Tesla, I didn’t watch YouTube videos and grab a wrench. I called a team of people who know tires. Your cyber incident deserves the same treatment. Mike puts it plainly: you don’t want to be recruiting people when the house is on fire.
We cover the core roles. There’s the incident commander, who keeps the business off the backs of the people putting out the fire. There are the subject matter experts on the tech side. And there’s the executive sponsor, who makes the calls you’re not allowed to make. We talk about why legal, compliance, PR, and finance need a seat at the table. We also explain why “there is no evidence customer data was accessed” is a very different sentence from “customer data was not accessed.” (Looking at you, LastPass.)
Then we get into the outside help: your cyber insurance carrier, a third-party incident response firm with a retainer already signed, law enforcement, and your vendors. Mike explains what the FBI will and won’t do for you. He covers why you can’t just pay a ransom to anyone on the OFAC list, and why calling Bob on a Sunday is not a plan.
If your current incident response plan is “we’ll figure it out,” this episode is for you. Listen in, then go write down some names.
Chapters:
00:00 Cold open
01:30 We’re back (and Gemini let me down)
03:27 Why you need a team, not YouTube University
04:29 Know your team before the house is on fire
07:43 Fire crews, training, and the USS Constellation
09:27 Incident response is a business problem
12:02 Core roles: leaders and subject matter experts
14:14 Executive sponsors and who comes back first
16:09 Asset lists, owners, and pre-authorization
17:11 Incident commander vs. incident leads
20:00 Legal, compliance, and attorney-client privilege
22:59 PR and the LastPass problem
24:47 Finance and cyber insurance
27:07 Third-party incident response teams and retainers
32:06 Bringing in law enforcement
33:48 Sanctions, Bitcoin, and paying the ransom
38:05 Vendors who answer the phone on a weekend
39:34 Write it down and name your deputies
40:20 Tabletop exercises
43:06 Wrap-up

Endpoint hardening is the unglamorous work of closing the windows and locking the doors before somebody comes along and jiggles the handle. Prasanna, Dr. Mike Saylor and I walk through what that actually looks like: secure builds and golden images, which services to shut off, which ones to uninstall so a bad guy can't just switch them back on, USB lockdown, full disk encryption, BIOS and UEFI, and the phone in your pocket that logs onto your corporate Wi-Fi every morning.
Mike opens with the analogy he uses in the book. Bad guys casing your organization are doing what a burglar does walking down your street — checking every door, every window, every garage. An unpatched box screaming its version number to the internet is a broken window with a sign on it.
Then we get practical. Your receptionist's computer is running a web server she will never use. Your new Dell shipped with Xbox Game Bar running by default. Mike's point is that turning those off isn't enough, because an attacker living off the land will just turn them back on. Uninstall the thing.
We also get into the argument nobody wins: locking down USB ports. Prasanna makes the end-user case, Mike makes the red team case, and we land on data leakage controls as the middle ground. Then Mike explains how he gets into a laptop that's suspended instead of logged off, and why your encrypted drive doesn't help you in that state.
If you've been told you should harden your endpoints and nobody ever handed you the list, this one's for you. Start with one image, the lowest common denominator, and build from there. Don't let perfect be the enemy of good.
CHAPTERS
00:00 Your receptionist's computer is running a web server
01:39 Welcome, with Prasanna and Dr. Mike Saylor
03:52 The house analogy: broken windows and unlocked doors
06:22 Do you just have to be safer than your neighbor?
08:49 Assume breach, and close the windows anyway
09:52 Secure builds and golden images
13:37 One image for everyone, or one per role?
14:39 Level one hardening: turning off what nobody uses
16:20 Xbox Game Bar, and why disabling isn't enough
19:07 The USB lockdown fight
22:46 BIOS, UEFI, and malware that survives a reimage
26:35 Full disk encryption only works if you log off
29:42 Physical access trumps everything
30:07 Port scans, Nmap, and banner grabbing
31:50 Building your hardening checklist
33:14 The endpoint in your pocket