The Backup Wrap-Up

RDP security best practices come down to one rule most admins break on day one: that protocol has no business facing the internet. Dr. Mike Saylor and Prasanna Malaiyandi join me to break down why RDP earned the nickname Ransomware Deployment Protocol, who's out there scanning for your open port right now, and what to actually do about it.
Here's the part that gets me. Every Windows box ships with this thing turned on. You didn't ask for it. Nobody handed you a manual. It's just there, running, waiting. Mike calls it a dollar store hammer — still a tool, still gets the job done, just not the one you'd pick if anybody gave you a budget. I call it a hack-me sign taped to your back.
We get into how initial access brokers work, and it's less sophisticated than you'd hope. Somebody runs a Shodan query, gets a list of every exposed RDP service on the planet with IP addresses and device types, cross-references it against leaked credentials, packages the whole thing up, and sells it. Mike says the recon that used to take days now takes about 30 seconds with the AI tools floating around the dark net.
Then there's the credentials-don't-even-matter problem. Default RDP traffic isn't encrypted internally. Mike walks through a routing table poisoning job where his team captured an admin's keystrokes going to a server. No login required. Just be in the middle.
The back half is all fixes. Block the protocol and the port, not one or the other, because attackers will happily move to a different port. Check 3389 before you kill it — your database might be sitting on it. Enforce network level authentication. Put a VPN or a zero trust product in front, and Mike points out enterprise-grade stuff runs about six bucks a user now, so the "no budget" excuse is thinner than it used to be. Bastion hosts. Group policy. Monitoring at the endpoint, network, and firewall layers, with a governance layer on top so you know what's allowed before something breaks at 2am.
Prasanna plays devil's advocate the whole way through and swears he isn't pro-RDP. Mike wears three hats and can't pick one. I have exactly one opinion and I'm not moving off it.
CHAPTERS:
00:00 Windows ships with a back door
01:26 Welcome and my Facebook Marketplace weekend
03:18 Why RDP means Ransomware Deployment Protocol
04:46 What RDP actually does
05:51 Blue hat, red hat: Mike's split opinion
06:11 Does RDP deserve its bad reputation?
08:10 On by default, and you can't fully kill it
09:30 The back door nobody locks
11:52 Does the cloud secure RDP for you?
14:12 Who scans for exposed RDP, and how Shodan works
17:10 Initial access brokers explained
18:36 Vulnerabilities that skip credentials entirely
19:08 Unencrypted traffic and stolen keystrokes
20:38 The never-on-the-internet rule
20:59 The network survival stack: VPN and zero trust
23:22 Block the port and the service
24:17 Stopping lateral movement once they're inside
25:25 Network level authentication
27:50 Port 3389: check before you block it
29:44 Bastion hosts
30:26 Monitoring, auditing, and governance
31:19 Blue, red, and purple hats

Phishing resistant MFA is the difference between a bad guy getting one email address and a bad guy getting your entire company's inbox. On this episode, Prasanna, Dr. Mike Saylor, and I dig into why plain old multi-factor authentication isn't the finish line anymore; it's the starting line.
We open with a real attack: a vulnerable REDCap database, stolen Google Workspace admin credentials, and email forwarding rules quietly running for over a year before anyone noticed. From there Mike breaks down how social engineering actually works (the research bad guys do on you before they ever send an email) and why "report as phishing" buttons have themselves become an attack vector. I share the story of the free credit monitoring scam that got me, and why freezing your credit reports is one of the best five-minute security moves you can make.
Mike then walks through FIDO2 and passkeys, why they're built on old-school public/private key encryption, and why they're transactional instead of just another code sent to your phone. We cover the Flax Typhoon espionage campaign, the Raptor Train botnet, and how hard-coded credentials on IoT devices turned into root-level access for a foreign intelligence operation.
Then Mike introduces "killing the trust button," which is phrase for the idea that most networks default to open, and every one of those defaults is a decision somebody made without thinking about the risk. We talk about blocking traffic by country, limiting concurrent logins, expiring MFA tokens, and why starting with your administrative accounts is the easiest place to build momentum. And yes, we talk about just asking an AI assistant like Copilot or Claude to walk you through turning this stuff on, because you probably already have these tools and don't know it.
We close on why MFA by itself still isn't enough — session token theft, MFA exhaustion attacks, and the "remember this device" setting that undoes everything you just set up. If you're the person responsible for an environment with important accounts sitting there with no MFA, we've got a name for that, and it's not a nice one.
Chapters:
0:00 – Cold Open
1:31 – Welcome to the Show
4:12 – The REDCap/Google Workspace Attack
8:38 – Social Engineering: How Attackers Do Their Homework
13:06 – Freeze Your Credit Reports
16:55 – What Is FIDO2? (Phishing Resistant MFA Explained)
18:58 – Flax Typhoon and the Raptor Train Botnet
24:43 – Professional Malfeasance: No More Excuses for Skipping MFA
28:05 – Killing the Trust Button
32:51 – Start With Your Administrative Accounts
36:36 – Why MFA Alone Isn't Enough: MFA Exhaustion
39:27 – Passkeys, Impossible Travel, and Final Takeaways

Backup security best practices start with one uncomfortable truth: if you haven't checked your backup server for a default password, someone else might check it for you. In this episode, Prasanna and Mike Saylor join me to dig into how backup systems become the easiest way into your network — and the easiest way out for stolen data. We walk through the real story of a red teamer who used a backup server's weak credentials to restore a domain controller straight outside the company's firewall, then had the run of the place.
From there we get into the stuff that actually gets skipped: service accounts nobody's watching because they're "always on" and mostly invisible, default passwords baked into backup hardware that never get changed, and why the backup admin — usually the newest, most junior person on the team — ends up holding the keys without the security training to know what they're holding. We talk about how to find every service account you've got, how to figure out which ones actually need the privileges they've been handed, and why "it's always been that way" is exactly how breaches happen.
We close out on authentication: multi-factor authentication versus passkeys, why email one-time codes aren't the security win companies think they are, and why an authenticator app with its own PIN beats "remember this device" every time. Mike also shares a story about catching failed admin logins that turned out to be something a lot more human than a hacker — and why monitoring for those anomalies matters either way.
If you manage backup infrastructure, run a security team, or just got handed the backup admin job because nobody else wanted it, this episode is your checklist. Backup security best practices aren't complicated — they're just consistently ignored, and that's exactly what attackers count on.
Chapters:
00:00 – Cold open: the hacker on your backup server
01:34 – Welcome and episode setup
04:17 – The Duane Lafleur red team story
06:41 – Backup servers as an exfiltration risk
08:19 – Service accounts: the invisible attack surface
28:40 – Locking down the admin account
30:08 – MFA vs. passkeys for backup security

Building a cybersecurity culture in your company doesn't take a bigger budget — it takes a weekly habit. In this final episode of our encore series, returning guest snorkel42, a longtime Reddit voice in InfoSec, breaks down how he turned a company with zero dedicated security staff into one with a real security culture, just by committing to one small improvement every week instead of waiting on the next six-figure product.
We picked this one to bring back because of how it performed with you — not just downloads, but how much of the episode people actually stuck around for. That combination told us this conversation landed, and a lot of you came back to it more than once.
snorkel42 walks through where the term "security cadence" came from: a network engineering team, no InfoSec department, and a room full of unused tools nobody had the bandwidth to run. Instead of asking for more products, the team set a rule — one security change a week, no new vendor purchases allowed — for six months straight. What happened next is the real story: leadership noticed, and the team went from begging for resources to being handed them.
From there we get into what it actually took to build that cybersecurity culture day to day — the early challenges, how the team picked what to tackle first, and how a scrappy internal habit turned into something leadership actively championed. We also cover MFA, including why not all MFA is created equal, the SIM jacking risk that undercuts SMS-based codes, and the push-notification fatigue tactics attackers use to wear users down until they hit "yes" out of exhaustion. snorkel42 closes with a piece of advice worth sitting with: stop chasing the latest zero-day and start building your cybersecurity culture around how attacks actually function, start to finish. Do that, and ransomware protection comes along for free.
If you're the person in your company quietly carrying the security load, or you're trying to convince leadership that culture matters more than another line-item purchase, this one's for you.
00:00:00 — Cold open: you already own the tools you need
00:01:36 — Show intro and disclaimers
00:04:05 — Guest introduction: snorkel42's Reddit history and security cadence series
00:05:53 — Where the term "security cadence" came from
00:08:40 — Early challenges building the habit
00:44:57 — MFA, password security, and why not all MFA is equal
00:47:46 — SIM jacking and push-notification fatigue attacks
00:51:45 — Patching, WannaCry, and why chasing zero-days misses the point

Cybersecurity best practices for individuals aren't complicated — they're just often ignored, and that's exactly what this encore episode digs into. This is a rerun of one of our most-engaged episodes, brought back not just because of how many people downloaded it, but because of how much of it people actually stuck around for. Curtis and Prasanna sat down with Mark Shriner, host of the SecureTalk podcast, for a wide-ranging conversation about what it actually takes to protect yourself online — no jargon, no scare tactics, just the stuff that works.
Mark's path into cybersecurity started with a career pivot in 2017, and what he found was a field that goes a mile wide and a mile deep — everything from pen testing to encryption to endpoint protection. But the through-line of this conversation is that security isn't just an IT department problem anymore. It's everybody's problem, whether you're an executive with sensitive data or a parent trying to explain phishing to your kids.
The conversation opens with a genuinely shocking data point: in a University of Michigan study, researchers dropped USB drives around campus, and 48% of them got plugged into a computer, some within minutes. That's the kind of thing that makes MFA (multi-factor authentication) feel less optional. Curtis shares his own MFA journey — from skeptic to evangelist — and the group breaks down why SMS-based authentication is riskier than people think, especially with SIM swapping attacks on the rise.
From there, the conversation covers a lot of ground: the gift card scam that almost caught Mark's son on his third day of an internship, why "didn't expect it, don't click it" is one of the best pieces of advice you'll hear, and how phone-based social engineering is just as dangerous as email-based phishing. On the business side, Mark and Prasanna talk through device management, BYOD policies, and tools for spotting anomalous network behavior.
And of course, backups get their due. Mark's advice for individuals is refreshingly simple: use a cloud-based backup service if you can, but if you can't or won't, at least use whatever's already available to you — Time Machine, an external drive, anything. The point isn't the perfect solution. It's action. Which is exactly how the episode got its name: by the end, everyone agreed the real takeaway was just do something. Don't do nothing.
If you've been meaning to turn on MFA, start backing up your laptop, or just get a better handle on the basics, this is the episode to catch up on.
Chapter markers:
00:00 Cold open
00:03 Meet Mark Shriner
00:10 How Mark got into cybersecurity
00:15 The University of Michigan USB drive study
00:16 Turning on MFA: Curtis's personal journey
00:19 SIM swapping and SMS authentication risks
00:23 Top security concerns for individuals
00:24 Backups, ransomware emails, and phishing basics
00:25 Being aware and pausing before you click
00:26 The gift card scam story
00:28 Phone-based scams and social engineering
00:31 Careful what you post online
00:31 Company-level MFA and security best practices
00:34 Device management and BYOD
00:35 DDI tools and data leak detection
00:43 Cybersecurity best practices for individuals: backup edition
00:45 Just do something — the summary that named the episode