The Backup Wrap-Up

Building a cybersecurity culture in your company doesn't take a bigger budget — it takes a weekly habit. In this final episode of our encore series, returning guest snorkel42, a longtime Reddit voice in InfoSec, breaks down how he turned a company with zero dedicated security staff into one with a real security culture, just by committing to one small improvement every week instead of waiting on the next six-figure product.
We picked this one to bring back because of how it performed with you — not just downloads, but how much of the episode people actually stuck around for. That combination told us this conversation landed, and a lot of you came back to it more than once.
snorkel42 walks through where the term "security cadence" came from: a network engineering team, no InfoSec department, and a room full of unused tools nobody had the bandwidth to run. Instead of asking for more products, the team set a rule — one security change a week, no new vendor purchases allowed — for six months straight. What happened next is the real story: leadership noticed, and the team went from begging for resources to being handed them.
From there we get into what it actually took to build that cybersecurity culture day to day — the early challenges, how the team picked what to tackle first, and how a scrappy internal habit turned into something leadership actively championed. We also cover MFA, including why not all MFA is created equal, the SIM jacking risk that undercuts SMS-based codes, and the push-notification fatigue tactics attackers use to wear users down until they hit "yes" out of exhaustion. snorkel42 closes with a piece of advice worth sitting with: stop chasing the latest zero-day and start building your cybersecurity culture around how attacks actually function, start to finish. Do that, and ransomware protection comes along for free.
If you're the person in your company quietly carrying the security load, or you're trying to convince leadership that culture matters more than another line-item purchase, this one's for you.
00:00:00 — Cold open: you already own the tools you need
00:01:36 — Show intro and disclaimers
00:04:05 — Guest introduction: snorkel42's Reddit history and security cadence series
00:05:53 — Where the term "security cadence" came from
00:08:40 — Early challenges building the habit
00:44:57 — MFA, password security, and why not all MFA is equal
00:47:46 — SIM jacking and push-notification fatigue attacks
00:51:45 — Patching, WannaCry, and why chasing zero-days misses the point

Cybersecurity best practices for individuals aren't complicated — they're just often ignored, and that's exactly what this encore episode digs into. This is a rerun of one of our most-engaged episodes, brought back not just because of how many people downloaded it, but because of how much of it people actually stuck around for. Curtis and Prasanna sat down with Mark Shriner, host of the SecureTalk podcast, for a wide-ranging conversation about what it actually takes to protect yourself online — no jargon, no scare tactics, just the stuff that works.
Mark's path into cybersecurity started with a career pivot in 2017, and what he found was a field that goes a mile wide and a mile deep — everything from pen testing to encryption to endpoint protection. But the through-line of this conversation is that security isn't just an IT department problem anymore. It's everybody's problem, whether you're an executive with sensitive data or a parent trying to explain phishing to your kids.
The conversation opens with a genuinely shocking data point: in a University of Michigan study, researchers dropped USB drives around campus, and 48% of them got plugged into a computer, some within minutes. That's the kind of thing that makes MFA (multi-factor authentication) feel less optional. Curtis shares his own MFA journey — from skeptic to evangelist — and the group breaks down why SMS-based authentication is riskier than people think, especially with SIM swapping attacks on the rise.
From there, the conversation covers a lot of ground: the gift card scam that almost caught Mark's son on his third day of an internship, why "didn't expect it, don't click it" is one of the best pieces of advice you'll hear, and how phone-based social engineering is just as dangerous as email-based phishing. On the business side, Mark and Prasanna talk through device management, BYOD policies, and tools for spotting anomalous network behavior.
And of course, backups get their due. Mark's advice for individuals is refreshingly simple: use a cloud-based backup service if you can, but if you can't or won't, at least use whatever's already available to you — Time Machine, an external drive, anything. The point isn't the perfect solution. It's action. Which is exactly how the episode got its name: by the end, everyone agreed the real takeaway was just do something. Don't do nothing.
If you've been meaning to turn on MFA, start backing up your laptop, or just get a better handle on the basics, this is the episode to catch up on.
Chapter markers:
00:00 Cold open
00:03 Meet Mark Shriner
00:10 How Mark got into cybersecurity
00:15 The University of Michigan USB drive study
00:16 Turning on MFA: Curtis's personal journey
00:19 SIM swapping and SMS authentication risks
00:23 Top security concerns for individuals
00:24 Backups, ransomware emails, and phishing basics
00:25 Being aware and pausing before you click
00:26 The gift card scam story
00:28 Phone-based scams and social engineering
00:31 Careful what you post online
00:31 Company-level MFA and security best practices
00:34 Device management and BYOD
00:35 DDI tools and data leak detection
00:43 Cybersecurity best practices for individuals: backup edition
00:45 Just do something — the summary that named the episode

Ransomware lateral movement is exactly what it sounds like — once an attacker's inside your network, they start crawling around looking for more to encrypt, and stopping that crawl is often the difference between a bad day and a catastrophe. In this encore episode, part four of our seven-episode series pulling the best of the archives back into your feed, W. Curtis Preston and Prasanna Malaiyandi sit down with networking expert Tom Hollingsworth to break down exactly how attackers move once they're in, and what you can actually do about it.
This one's back because listeners didn't just download it — they stuck with it, and a fair number of you came back for a second listen. That kind of engagement told us this conversation was worth surfacing again, especially with ransomware attacks as common as they are right now.
Tom walks through the fundamentals of network segmentation — VLANs, air gaps, and why a "flat" network (where everything can talk to everything) is a gift to any attacker who gets in. From there the conversation moves into Zero Trust Network Architecture, what it actually takes to implement it at scale, and why flipping the switch from "allow everything" to "deny by default" is both the right move and the one that generates a thousand help desk tickets on day one. There's a good stretch on how schools, stadiums, and hotels handle network isolation differently than a typical enterprise, plus a practical rundown of incident response — locking down external access, isolating infected segments, keeping communication running when your own network is down, and why every kill switch needs to actually be wired to something.
If you've ever wondered how much of this is built into your existing networking gear versus something you have to buy separately, or you just want a clearer mental model for how ransomware spreads once it's past the perimeter, this is a great one to revisit.
Chapter Markers:
00:00:00 - Intro and why ransomware lateral movement matters right now
00:01:25 - Welcome back, meet Tom Hollingsworth
00:04:06 - Why isolating the network is step one after a ransomware attack
00:06:07 - Networking basics: how ransomware exploits flat networks
00:09:31 - VLANs, air gaps, and network segmentation
00:14:12 - Zero Trust Network Architecture explained
00:19:02 - Managing zero trust at scale across teams
00:25:48 - Special cases: schools, stadiums, and hotels
00:34:31 - Blocking newly registered domains to stop command and control
00:38:01 - Incident response: locking down the network
00:42:12 - Keeping communication running during an attack
00:44:54 - A real-world story: isolating infected devices
00:50:01 - Building segmentation in from the start

This episode is built around a ransomware response checklist — a three-part Reddit series by a security specialist who goes by snorkel42, breaking down exactly how to prevent, contain, and recover from a ransomware attack.
This is an encore episode, and it's back not just because a lot of people downloaded it originally, but because so many of you listened all the way through — some of you more than once. That kind of engagement told us this one was worth bringing back.
Curtis Preston and Prasanna Malaiyandi dig into snorkel42's series, which breaks the whole problem into three parts: how to stop ransomware from getting in, how to slow it down if it does, and what to actually do once you've been hit. Curtis and Prasanna go section by section — covering phishing and dropper prevention, application whitelisting, blocking lateral movement between servers, locking down RDP and SSH, honeypot files for catching intruders in the act, and building a real incident response plan before you ever need one.
They also get into the messier parts most people don't talk about — what it's actually like to negotiate for a decryption key, why getting your data back isn't the end of the story, and why a ransomware attack is nothing like a normal disaster recovery scenario. Along the way, Curtis makes the case that most organizations already have the gaps this attacker needs — and that fixing them now is a lot cheaper than fixing them after the fact.
Whether you're building your first incident response plan or just want to stress-test the one you've already got, this episode gives you a practical, section-by-section framework to work from.
Chapter Markers:
00:00 – Encore intro & episode setup
00:01:37 – Show intro and banter
00:06:21 – Preventing the breach: phishing, droppers, and whitelisting
00:14:46 – Blocking lateral movement, RDP/SSH lockdown
00:20:28 – Detecting exfiltration and honeypot files
00:24:19 – What to do once you've been hit
00:25:58 – Building your incident response plan
00:30:43 – Decryption, ransom payments, and why it's not over yet

How to protect backups from ransomware starts with a hard truth: attackers aren't just encrypting your data anymore, they're stealing it first — and no backup system on earth undoes an exfiltration. In this encore episode of The Backup Wrap-Up, Curtis and Prasanna dig into what real immutability looks like versus the marketing version, why root access quietly undermines most "immutable" storage claims, the difference between virtual and true physical air gaps, and the exact questions you should be firing at your backup vendor before you trust them with your last line of defense.
This one's an encore for a reason — it was one of the most listened-to episodes in the show's history, with listeners sticking around for the full runtime and then some. That's the kind of signal that tells you it's worth a second run.
Along the way, they cover S3 object lock and what actually happens if your account gets deleted or your credit card stops working, why compromised admin credentials are involved in the majority of attacks and what your vendor should be able to undo, and why bit rot — rare, but nasty when it's silent — still belongs on your checklist. If you manage backup or DR for a living, or you're just trying to figure out whether your current setup would actually hold up, this episode gives you a concrete list of questions to ask and red flags to watch for.
Chapters:
00:00 – Cold Open: Ransomware Is After Your Backups
01:19 – Welcome & Banter
05:50 – Topic Setup: Protecting Backups from Ransomware
07:36 – The Extortion & Exfiltration Playbook
15:25 – What Is an Air Gap?
18:22 – Virtual Air Gaps
27:57 – Real (Physical) Air Gaps
28:12 – What Is Immutability, Really?
29:23 – Bit Rot
30:42 – Root Access & the Limits of Immutability
32:51 – S3 Object Lock
40:20 – Questions to Ask Your Backup Vendor
42:31 – What Happens If You Delete Your Account?
44:29 – Compromised Credentials & Worst-Case Scenarios
46:41 – Final Thoughts