The Backup Wrap-Up

W. Curtis Preston (Mr. Backup)

Formerly known as "Restore it All," The Backup Wrap-up podcast turns unappreciated backup admins into cyber recovery heroes. After a brief analysis of backup-related news, each episode dives deep into one topic that you can use to better protect your organization from data loss, be it from accidents, disasters, or ransomware.   The Backup Wrap-up is hosted by W. Curtis Preston (Mr. Backup) and his co-host Prasanna Malaiyandi. Curtis' passion for backups began over 30 years ago when his employer, a $35B bank, lost its purchasing database – and the backups he was in charge of were worthless. After miraculously not being fired, he resolved to learn everything he could about a topic most people try to get away from.  His co-host, Prasanna, saw similar tragedies from the vendor side of the house and also wanted to do whatever he could to stop that from happening to others. A particular focus lately has been the scourge of ransomware that is plaguing IT organizations across the globe.  That's why in addition to backup and disaster recovery, we also touch on information security techniques you can use to protect your backup systems from ransomware.  If you'd like to go from being unappreciated to being a cyber recovery hero, this is the podcast for you. 

  1. 1 day ago

    Cybersecurity Best Practices for Individuals (Encore)

    Cybersecurity best practices for individuals aren't complicated — they're just often ignored, and that's exactly what this encore episode digs into. This is a rerun of one of our most-engaged episodes, brought back not just because of how many people downloaded it, but because of how much of it people actually stuck around for. Curtis and Prasanna sat down with Mark Shriner, host of the SecureTalk podcast, for a wide-ranging conversation about what it actually takes to protect yourself online — no jargon, no scare tactics, just the stuff that works. Mark's path into cybersecurity started with a career pivot in 2017, and what he found was a field that goes a mile wide and a mile deep — everything from pen testing to encryption to endpoint protection. But the through-line of this conversation is that security isn't just an IT department problem anymore. It's everybody's problem, whether you're an executive with sensitive data or a parent trying to explain phishing to your kids. The conversation opens with a genuinely shocking data point: in a University of Michigan study, researchers dropped USB drives around campus, and 48% of them got plugged into a computer, some within minutes. That's the kind of thing that makes MFA (multi-factor authentication) feel less optional. Curtis shares his own MFA journey — from skeptic to evangelist — and the group breaks down why SMS-based authentication is riskier than people think, especially with SIM swapping attacks on the rise. From there, the conversation covers a lot of ground: the gift card scam that almost caught Mark's son on his third day of an internship, why "didn't expect it, don't click it" is one of the best pieces of advice you'll hear, and how phone-based social engineering is just as dangerous as email-based phishing. On the business side, Mark and Prasanna talk through device management, BYOD policies, and tools for spotting anomalous network behavior. And of course, backups get their due. Mark's advice for individuals is refreshingly simple: use a cloud-based backup service if you can, but if you can't or won't, at least use whatever's already available to you — Time Machine, an external drive, anything. The point isn't the perfect solution. It's action. Which is exactly how the episode got its name: by the end, everyone agreed the real takeaway was just do something. Don't do nothing. If you've been meaning to turn on MFA, start backing up your laptop, or just get a better handle on the basics, this is the episode to catch up on. Chapter markers: 00:00 Cold open 00:03 Meet Mark Shriner 00:10 How Mark got into cybersecurity 00:15 The University of Michigan USB drive study 00:16 Turning on MFA: Curtis's personal journey 00:19 SIM swapping and SMS authentication risks 00:23 Top security concerns for individuals 00:24 Backups, ransomware emails, and phishing basics 00:25 Being aware and pausing before you click 00:26 The gift card scam story 00:28 Phone-based scams and social engineering 00:31 Careful what you post online 00:31 Company-level MFA and security best practices 00:34 Device management and BYOD 00:35 DDI tools and data leak detection 00:43 Cybersecurity best practices for individuals: backup edition 00:45 Just do something — the summary that named the episode

    Cybersecurity Best Practices for Individuals (Encore)

  2. 27 Jul

    Stopping Ransomware Lateral Movement Before It Spreads

    Ransomware lateral movement is exactly what it sounds like — once an attacker's inside your network, they start crawling around looking for more to encrypt, and stopping that crawl is often the difference between a bad day and a catastrophe. In this encore episode, part four of our seven-episode series pulling the best of the archives back into your feed, W. Curtis Preston and Prasanna Malaiyandi sit down with networking expert Tom Hollingsworth to break down exactly how attackers move once they're in, and what you can actually do about it. This one's back because listeners didn't just download it — they stuck with it, and a fair number of you came back for a second listen. That kind of engagement told us this conversation was worth surfacing again, especially with ransomware attacks as common as they are right now. Tom walks through the fundamentals of network segmentation — VLANs, air gaps, and why a "flat" network (where everything can talk to everything) is a gift to any attacker who gets in. From there the conversation moves into Zero Trust Network Architecture, what it actually takes to implement it at scale, and why flipping the switch from "allow everything" to "deny by default" is both the right move and the one that generates a thousand help desk tickets on day one. There's a good stretch on how schools, stadiums, and hotels handle network isolation differently than a typical enterprise, plus a practical rundown of incident response — locking down external access, isolating infected segments, keeping communication running when your own network is down, and why every kill switch needs to actually be wired to something. If you've ever wondered how much of this is built into your existing networking gear versus something you have to buy separately, or you just want a clearer mental model for how ransomware spreads once it's past the perimeter, this is a great one to revisit. Chapter Markers: 00:00:00 - Intro and why ransomware lateral movement matters right now 00:01:25 - Welcome back, meet Tom Hollingsworth 00:04:06 - Why isolating the network is step one after a ransomware attack 00:06:07 - Networking basics: how ransomware exploits flat networks 00:09:31 - VLANs, air gaps, and network segmentation 00:14:12 - Zero Trust Network Architecture explained 00:19:02 - Managing zero trust at scale across teams 00:25:48 - Special cases: schools, stadiums, and hotels 00:34:31 - Blocking newly registered domains to stop command and control 00:38:01 - Incident response: locking down the network 00:42:12 - Keeping communication running during an attack 00:44:54 - A real-world story: isolating infected devices 00:50:01 - Building segmentation in from the start

    Stopping Ransomware Lateral Movement Before It Spreads

  3. 20 Jul

    Ransomware Response Checklist: Prevent It, Slow It, Survive It

    This episode is built around a ransomware response checklist — a three-part Reddit series by a security specialist who goes by snorkel42, breaking down exactly how to prevent, contain, and recover from a ransomware attack. This is an encore episode, and it's back not just because a lot of people downloaded it originally, but because so many of you listened all the way through — some of you more than once. That kind of engagement told us this one was worth bringing back. Curtis Preston and Prasanna Malaiyandi dig into snorkel42's series, which breaks the whole problem into three parts: how to stop ransomware from getting in, how to slow it down if it does, and what to actually do once you've been hit. Curtis and Prasanna go section by section — covering phishing and dropper prevention, application whitelisting, blocking lateral movement between servers, locking down RDP and SSH, honeypot files for catching intruders in the act, and building a real incident response plan before you ever need one. They also get into the messier parts most people don't talk about — what it's actually like to negotiate for a decryption key, why getting your data back isn't the end of the story, and why a ransomware attack is nothing like a normal disaster recovery scenario. Along the way, Curtis makes the case that most organizations already have the gaps this attacker needs — and that fixing them now is a lot cheaper than fixing them after the fact. Whether you're building your first incident response plan or just want to stress-test the one you've already got, this episode gives you a practical, section-by-section framework to work from. Chapter Markers: 00:00 – Encore intro & episode setup 00:01:37 – Show intro and banter 00:06:21 – Preventing the breach: phishing, droppers, and whitelisting 00:14:46 – Blocking lateral movement, RDP/SSH lockdown 00:20:28 – Detecting exfiltration and honeypot files 00:24:19 – What to do once you've been hit 00:25:58 – Building your incident response plan 00:30:43 – Decryption, ransom payments, and why it's not over yet

    Ransomware Response Checklist: Prevent It, Slow It, Survive It

  4. 13 Jul

    How to Protect Backups from Ransomware (Encore)

    How to protect backups from ransomware starts with a hard truth: attackers aren't just encrypting your data anymore, they're stealing it first — and no backup system on earth undoes an exfiltration. In this encore episode of The Backup Wrap-Up, Curtis and Prasanna dig into what real immutability looks like versus the marketing version, why root access quietly undermines most "immutable" storage claims, the difference between virtual and true physical air gaps, and the exact questions you should be firing at your backup vendor before you trust them with your last line of defense. This one's an encore for a reason — it was one of the most listened-to episodes in the show's history, with listeners sticking around for the full runtime and then some. That's the kind of signal that tells you it's worth a second run. Along the way, they cover S3 object lock and what actually happens if your account gets deleted or your credit card stops working, why compromised admin credentials are involved in the majority of attacks and what your vendor should be able to undo, and why bit rot — rare, but nasty when it's silent — still belongs on your checklist. If you manage backup or DR for a living, or you're just trying to figure out whether your current setup would actually hold up, this episode gives you a concrete list of questions to ask and red flags to watch for. Chapters: 00:00 – Cold Open: Ransomware Is After Your Backups 01:19 – Welcome & Banter 05:50 – Topic Setup: Protecting Backups from Ransomware 07:36 – The Extortion & Exfiltration Playbook 15:25 – What Is an Air Gap? 18:22 – Virtual Air Gaps 27:57 – Real (Physical) Air Gaps 28:12 – What Is Immutability, Really? 29:23 – Bit Rot 30:42 – Root Access & the Limits of Immutability 32:51 – S3 Object Lock 40:20 – Questions to Ask Your Backup Vendor 42:31 – What Happens If You Delete Your Account? 44:29 – Compromised Credentials & Worst-Case Scenarios 46:41 – Final Thoughts

    How to Protect Backups from Ransomware (Encore)

  5. 6 Jul

    What Is Data Deduplication? (Encore)

    What is data deduplication, and why does Curtis call it the single most important development in backup over the last 30 years? In this encore episode, W. Curtis Preston and Prasanna Malaiyandi break down exactly how dedupe works, why it's not the same as compression, and why the fine print of your dedupe domain determines how much storage you actually save. This episode originally aired as part of the Backup to Basics series, and it's back because listeners couldn't get enough of it — not just downloads, but people who stuck around for the whole conversation, some more than once. That says something, because this isn't a surface-level explainer. Curtis and Prasanna get into fingerprints, dedupe indexes, and the real-world tradeoffs between file-level and block-level dedupe. You'll hear why Curtis argues that file-level dedupe isn't "real" dedupe at all, just single-instance storage wearing a costume. Then the conversation shifts to the split that shapes entire product categories: source-side dedupe versus target-side dedupe. Curtis walks through why source dedupe requires you to essentially replace your backup software, while target dedupe lets you bolt an appliance onto whatever you're already running. Prasanna pushes back on some of the assumptions along the way, which is exactly the kind of back-and-forth that made this episode stick with listeners the first time around. By the end, they even get into hybrid dedupe, a concept that splits the difference and confuses almost everyone the first time they hear about it. If you've ever wondered why your backup storage doesn't need to be 30 or 40 times the size of your production data, or you just want to finally understand what your backup vendor means when they throw around terms like "dedupe ratio," this is the episode that clears it up. Chapters: 00:00 – Intro 08:10 – What Is Data Deduplication? 12:24 – Dedupe vs. Compression 16:13 – Fingerprints and the Dedupe Index 16:52 – What's a Dedupe Domain? 19:48 – Is File-Level Dedupe Really Dedupe? 21:53 – Source Dedupe vs. Target Dedupe 28:20 – What Is Hybrid Dedupe?

    What Is Data Deduplication? (Encore)

  6. 22 Jun

    The REDCap Attack that Phishing-Resistant MFA Could Have Stopped

    Phishing-resistant MFA could have stopped a Chinese state-sponsored threat actor from spending over a year inside North American academic and medical research networks — and we're going to tell you exactly how it happened and what you need to do about it. A group called UNC5608, tracked by Google's Threat Intelligence Group (GTIG), exploited a vulnerability unique to REDCap — a research data platform that allows multiple software versions to run simultaneously. They got in via stolen admin credentials, planted custom malware called Infinite.red directly into REDCap's upgrade process, harvested credentials for over a year, then used those credentials to log into Google Workspace as a domain admin and create fake compliance rules to silently forward sensitive research emails — military strategy, geostrategic policy, advanced tech, specific pathogens — straight to Gmail accounts they controlled. And nobody noticed for a very long time. Prasanna and I break down the full attack chain, then walk through every prevention layer that could have stopped it: inventory management, patching, password hygiene, SSO, phishing-resistant MFA, passkeys, DBSC, context-aware access, compliance rule monitoring, credential separation across security domains, and logging. We also get into what backups can and can't do for you in a long-dwell-time attack like this — and why infrastructure-as-code and truly immutable golden images matter more than you might think. If you're running any kind of research platform, academic institution, or medical network — or honestly any organization that uses Google Workspace — this one's for you. Chapters: 00:00 — Intro: The attack that phishing-resistant MFA could have stopped 01:03 — Show intro & woodworking banter 03:26 — What is a living-off-the-land attack? 04:02 — Who is UNC5608 and who did they target? 05:08 — How REDCap's multi-version design was exploited 06:11 — Infinite.red malware and credential harvesting 09:01 — Google Workspace infiltration via fake compliance rules 10:18 — The keywords they were stealing: pathogens, military strategy, and more 11:50 — What could the victims have done differently? 12:42 — Inventory management, patching, and legacy version removal 14:00 — Why you can't trust application-level authentication alone — use SSO 15:18 — Phishing-resistant MFA and why it matters 16:00 — Passkeys, FIDO, and why there are zero known attacks against them 17:57 — Device-bound session credentials (DBSC) and context-aware access 19:38 — Monitor your compliance rules — have a compliance rule for the compliance rule 20:40 — Credential separation across security domains 23:00 — Get some logging — XDR, SIEM, and catching exfiltration in progress 24:00 — What can backups actually do in a long-dwell-time attack? 27:00 — Infrastructure-as-code and the right cyber recovery approach 28:58 — Protecting your golden images with immutable storage 31:59 — Wrap-up

    The REDCap Attack that Phishing-Resistant MFA Could Have Stopped

  7. 15 Jun

    California Election Fraud? (Pt 2)

    California election fraud claims are flooding social media — and most of them fall apart under basic scrutiny. In this follow-up episode, longtime San Diego County poll worker W. Curtis Preston tackles the wave of viral fraud allegations head-on, with sources so you can check his work yourself. Topics covered: the LA mayoral race "statistically impossible" surge for Nithya Raman, the AP reporting error that got blamed on fraud, claims that Spencer Pratt voters were having ballots rejected for signatures, the "gym membership card" voter ID myth, the Skid Row "paid to vote" controversy, and yes — the one claim that turned out to be true (a woman who actually did register her dog to vote). If you've seen these claims and wondered whether there's anything to them, this episode walks through the actual data, the actual law, and the actual outcomes — no spin, just the facts from someone counting the votes. Here are some sources: Los Angeles 2026 Mayor primary results: https://results.lavote.gov/#year=2026&election=4338 Donald Trump got 27% of City of LA vote in 2024: https://xtown.la/2024/12/16/a-city-country-divide-more-than-70-percent-of-los-angeles-voters-picked-kamala-harris-for-president/ There were 12,700 rejected ballots in all of LA county: https://perma.cc/E5Y9-NURQ Orange County woman registered her dog: https://www.foxla.com/news/costa-mesa-woman-dog-voter-fraud-sentencing Heritage Foundation Voter Fraud Database: https://electionfraud.heritage.org/search

    California Election Fraud? (Pt 2)

  8. 8 Jun

    California Election Counting Explained by an Actual Poll Worker

    California election counting has confused — and frankly ticked off — a lot of people, and I get it. I'm W. Curtis Preston, I've worked every California election since the 2016 presidential primary, and I've managed the polls at multiple elections here in San Diego County. This episode, I'm going solo to explain exactly what's going on, why it takes so long, what the "red mirage" actually is, and why none of it is fraud. Sorry to disappoint some of you. If you've ever had a family member call you asking "what the hell is going on over there?" — this one's for you. I walk through the specific changes California made to election law, how our system compares to Florida's, why human nature is a big part of the problem, and what the chain of custody for every single ballot actually looks like from the inside. This isn't punditry. This is someone who has stood at those poll books, sealed those ballot cartons, and escorted those ballots to the DART team. Chapters: 0:00 – Introduction: What the hell is going on in California? 1:23 – Who I am and why I can speak to this 2:12 – How California election law changed six years ago 4:43 – The mail ballot window: postmark by 8 PM, received within 7 days 5:09 – Vote centers vs. the old precinct model 7:39 – California vs. Florida: why the laws produce such different results 9:09 – Why California voters wait until the last minute 14:12 – The red mirage explained: it's not fraud, it's math 15:31 – Signature verification: 80,000–100,000 per day in San Diego alone 16:35 – How computers count ballots — and the 1% manual audit that checks them 19:11 – Chain of custody: two people, sealed cartons, tracked numbers 20:17 – Debunking the "law enforcement can't observe" myth 21:24 – Dead people voting? Let's talk about what's actually happening 22:47 – Wrap-up

    California Election Counting Explained by an Actual Poll Worker
See All (359)

About

Formerly known as "Restore it All," The Backup Wrap-up podcast turns unappreciated backup admins into cyber recovery heroes. After a brief analysis of backup-related news, each episode dives deep into one topic that you can use to better protect your organization from data loss, be it from accidents, disasters, or ransomware.   The Backup Wrap-up is hosted by W. Curtis Preston (Mr. Backup) and his co-host Prasanna Malaiyandi. Curtis' passion for backups began over 30 years ago when his employer, a $35B bank, lost its purchasing database – and the backups he was in charge of were worthless. After miraculously not being fired, he resolved to learn everything he could about a topic most people try to get away from.  His co-host, Prasanna, saw similar tragedies from the vendor side of the house and also wanted to do whatever he could to stop that from happening to others. A particular focus lately has been the scourge of ransomware that is plaguing IT organizations across the globe.  That's why in addition to backup and disaster recovery, we also touch on information security techniques you can use to protect your backup systems from ransomware.  If you'd like to go from being unappreciated to being a cyber recovery hero, this is the podcast for you. 

Information

  • Creator
    W. Curtis Preston (Mr. Backup)
  • Years Active
    2019 - 2026
  • Episodes
    359
  • Rating
    Clean
  • Copyright
    © All rights reserved
  • Show Website
    The Backup Wrap-Up

You Might Also Like