The Backup Wrap-Up

The episode contains substantial security practitioner insights - the security cadence methodology, layered defense principles, and specific attack vectors (phishing, lateral movement, data exfiltration techniques) - but is diluted by extended off-topic discussion about ghee at the start and some conversational padding. The core security content is dense, but the episode could have been tighter.

“You probably already own the cybersecurity tools that you need. That's not the issue. The issue is that nobody's using them, or certainly not using them correctly.”

“never let perfect get in the way of being good”

Snorkel42's security cadence framework - implementing one deliberate change per week and focusing on attack lifecycle (initial breach, lateral movement, objectives) rather than specific threats - is contrarian and practical. However, the underlying principles (defense-in-depth, honeypots, behavioral monitoring) are established infosec doctrine repackaged through a methodological lens rather than fundamentally new thinking.

“every week, we have a security cadence of releasing a security update”

“don't focus on ransomware, just focus on how attacks function and you'll get ransomware taken care of by default”

Snorkel42 is a 20+ year infosec practitioner with real operational experience implementing security at scale at a large legacy company and publishing widely-engaged content (35k Reddit karma) on applied security. This is a genuine practitioner, not a consultant or pundit. However, we lack his current organizational context or title, which prevents a higher score.

“he was on the podcast before and. Is the author of the security cadence series on Reddit, been in IT for about 25 years and in InfoSec about 20 years”

“his posts have been incredibly popular with, uh, uh, he's got a, uh, a, uh, what do they call it over there? The karma of 35,000”

The episode includes some specific technical controls (disabling shadow copies, RACCINE tool, deceptive file shares, DNS filtering of new domains) and real attack examples (Conti, Lapsis, ProxyShell, Wannacry, Log4j), but lacks concrete metrics, timelines, or quantified outcomes from implementations. The methodology is illustrated but not validated with before/after data or specific dollar impact.

“I created, um, deceptive file shares on my network. So just file servers that, you know, on their own separate windows box, doesn't don't have any useful data on them. I actually just clone my actual production file names and structures and just put random data in them.”

“the tool I mentioned in one of my blog posts was raccine, which is so vaccine with an R, um, which is a tool that just monitors for shadow copy deletion, and just kills any process that does it.”

Curtis asks clarifying follow-ups on technical details (EDR tuning, shadow copy deletion impact on backups, SIM swapping) and occasionally pushes back (questioning ongoing posts, ribbing on post length), but much of the conversation is declarative. The host doesn't deeply challenge Snorkel42's claims or explore counter-arguments; the tone is largely affirming. The ghee tangent at the top signals weak editorial control.

“So, could you talk a little bit, I'm sure at the very beginning as you're starting this right. With any new process or new, any new endeavor, it's a little difficult, right. Sort of getting into what does it mean?”

“I had a question for you snorkel about that one. Is, does that prevent backup apps from actually running that might leverage VSS and shadow copies?”