Having an immutable backup system is no longer optional—it’s survival. But here’s the thing: immutability alone isn’t enough to protect your organization from ransomware attacks and data destruction. If bad actors can compromise your backup infrastructure through weak authentication or misconfigured access controls, your fancy immutable backup system becomes worthless. I’ve seen it happen too…
Look, I’ve been doing this backup thing for a long time. And I can tell you right now that most companies think they have backups when they really don’t. They’re missing key pieces that turn what looks like a solid backup system into a house of cards waiting to collapse. This blog post summarizes the…
The 3-2-1 rule is dead. I know that’s a bold statement, especially coming from someone who has spent decades preaching the gospel of three copies, two media types, one offsite. But here’s the thing – ransomware killed it. Not because the fundamentals were wrong, but because the threat landscape changed so dramatically that the old…
Let’s talk about something that drives me crazy in the backup world – the disconnect between what organizations say their recovery point objective RPO is and what their actual backup practices support. I see this all the time: companies claiming they can only afford to lose an hour of data when they’re backing up once…
Let me tell you something that most IT professionals won’t admit: they can’t meet their recovery time objective. Not even close. And you know what? It’s not because they’re incompetent. It’s because they’ve never actually tested whether they can do what they’ve promised. This blog post summarizes the main points of my latest podcast episode….
Ransomware detection has become one of the most critical capabilities any organization can develop. The statistics are sobering—if you’re connected to the internet with users accessing email and websites, ransomware should be at the top of your risk assessment list. But here’s the problem: most organizations don’t know where to start when it comes to…
An ArcGIS hack that went undetected for 12 months should be a wake-up call for every IT professional managing infrastructure today. The attack by Chinese threat group Flax Typhoon didn’t just compromise a customer’s environment—it turned their backup strategy into a malware preservation system. Every time they backed up their ArcGIS server, they were saving…
Deepfake attacks represent one of the fastest-growing threats to business security, and your organization is probably not prepared. With AI technology advancing at breakneck speed, cybercriminals can now clone voices with just 30 seconds of audio and create convincing video impersonations of executives. The result? Nearly 50% of businesses have already experienced deepfake attacks, and…
When a cyber attack hits your organization, your cyber attack notification strategy can determine whether you emerge stronger or become another cautionary tale. The harsh reality is that how you communicate about security incidents often matters more than the technical details of the breach itself. This blog post summarizes the main points of my latest…
When most people think about cybersecurity, they picture hackers in hoodies breaking through firewalls from some remote location. But here’s the uncomfortable truth: your biggest security risk probably has a desk in your office. Insider threats represent one of the most dangerous and often overlooked vulnerabilities in modern cybersecurity – and they’re way more common…