Trained to Protect: Creating a Culture of Security with Tiffany Ricks

1
00:00:00,000 --> 00:00:12,660
Welcome to Logically Speaking, where we discuss the latest trends and challenges in cybersecurity
2
00:00:12,660 --> 00:00:15,360
with the top experts in their field.
3
00:00:15,360 --> 00:00:19,540
You're going to learn how to keep your data safe, your operations sound, and your business
4
00:00:19,540 --> 00:00:21,540
ready for whatever comes next.
5
00:00:21,540 --> 00:00:23,160
This is Logically Speaking.
6
00:00:23,160 --> 00:00:30,020
Today we're speaking, we have the pleasure of speaking with Tiffany Ricks, who is a former
7
00:00:30,020 --> 00:00:35,960
or recovering ethical hacker, I guess we could say, former ethical hacker.
8
00:00:35,960 --> 00:00:40,840
She's worked with companies to protect them from phishing attacks and other malicious
9
00:00:40,840 --> 00:00:43,140
attacks.
10
00:00:43,140 --> 00:00:49,880
She's led many simulated hacks, and she's built a company that serves that market to
11
00:00:49,880 --> 00:00:55,920
help prevent breaches, data leakage, exfiltration, things of that nature.
12
00:00:55,920 --> 00:00:58,320
Tiffany, thank you so much for joining us today.
13
00:00:58,320 --> 00:01:04,280
I'm going to start out by just asking you if you could share your experience in cybersecurity,
14
00:01:04,280 --> 00:01:06,800
what led you to cybersecurity?
15
00:01:06,800 --> 00:01:14,040
I always find that some of my previous guests have very interesting paths that have led
16
00:01:14,040 --> 00:01:18,600
them into this phenomenal career that we call cyber.
17
00:01:18,600 --> 00:01:23,160
So maybe we could start there and talk a little bit more about that.
18
00:01:23,160 --> 00:01:24,160
Awesome.
19
00:01:24,160 --> 00:01:28,680
Well, Stephen, thank you so much for having me and the Logically team.
20
00:01:28,680 --> 00:01:31,840
I'm really excited to be here.
21
00:01:31,840 --> 00:01:36,360
My journey started out, at the time my journey was very standard.
22
00:01:36,360 --> 00:01:43,520
The exciting part about being in cyber now is there's so many ways that you can get in
23
00:01:43,520 --> 00:01:46,480
and you can, it's so broad and so vast.
24
00:01:46,480 --> 00:01:50,360
There's so many ways that you can contribute to try to solve this problem that we're solving
25
00:01:50,360 --> 00:01:54,760
for companies everywhere, but my path was through software.
26
00:01:54,760 --> 00:02:03,440
So I am a software engineer, went to school for that, for trade, and then I got a job
27
00:02:03,440 --> 00:02:08,440
working for one of the big four defense contractors.
28
00:02:08,440 --> 00:02:14,440
At the time they were called L3 Technologies, and they work with the Department of Defense.
29
00:02:14,440 --> 00:02:21,080
So they did contracts with the United States Air Force, the United States Navy, where I
30
00:02:21,080 --> 00:02:25,520
worked the Air Force, we were on an Air Force base.
31
00:02:25,520 --> 00:02:33,200
And what I did was I started out as a software engineer, and then as an engineer working
32
00:02:33,200 --> 00:02:38,720
for the government, that is one of, at that time, that was one of the top three cyber
33
00:02:38,720 --> 00:02:39,720
targets.
34
00:02:39,720 --> 00:02:43,920
And so as you're building for the government, they teach you that you need to make sure
35
00:02:43,920 --> 00:02:49,720
that your software is resilient, which means you're looking at it from a secure coding
36
00:02:49,720 --> 00:02:55,640
standpoint, trying to make sure that you're not creating bugs that could allow a cyber
37
00:02:55,640 --> 00:02:58,560
criminal to get access to their software and do harm.
38
00:02:58,560 --> 00:03:02,880
And so that sparked my curiosity into cybersecurity.
39
00:03:02,880 --> 00:03:07,760
Then I moved into security engineering, which was focused on making sure that we engineer
40
00:03:07,760 --> 00:03:15,040
software from a security standpoint, and then moved into security research and then ethical
41
00:03:15,040 --> 00:03:16,040
hacking.
42
00:03:16,040 --> 00:03:22,640
And really, that was where showing the military how cyber criminals could break into their
43
00:03:22,640 --> 00:03:28,320
infrastructure and then left started a consultancy, which we had managed services as a part of
44
00:03:28,320 --> 00:03:31,280
our offering.
45
00:03:31,280 --> 00:03:38,920
But working with companies of all sizes, they wanted to know how a cyber criminal could
46
00:03:38,920 --> 00:03:44,400
target them, and they wanted to be prepared to make sure that if someone did target them,
47
00:03:44,400 --> 00:03:46,440
they had the infrastructure to protect themselves.
48
00:03:46,440 --> 00:03:51,880
And so my job was to try to break their system so they can rebuild and fix it.
49
00:03:51,880 --> 00:03:59,280
And the systems that were easy to break were our human systems, our people that were on
50
00:03:59,280 --> 00:04:03,880
the front lines doing their job, but easily accessible.
51
00:04:03,880 --> 00:04:09,440
And you could send a phishing email to them, lure them in and lure them into giving you
52
00:04:09,440 --> 00:04:14,360
information that is closed and locked down behind some secure networks.
53
00:04:14,360 --> 00:04:17,360
And so I saw that that is a huge problem.
54
00:04:17,360 --> 00:04:25,240
It didn't matter the company size, the people were one of the easiest vulnerabilities.
55
00:04:25,240 --> 00:04:32,520
And what I wanted to do was build a software that can automate the workflow of these phishing
56
00:04:32,520 --> 00:04:35,840
exercises, but really make it a data driven approach.
57
00:04:35,840 --> 00:04:44,720
And so I built the Hackware platform to solve our internal problem in-house and then decided
58
00:04:44,720 --> 00:04:50,240
that this is a platform that can be used by many companies around the world.
59
00:04:50,240 --> 00:04:58,240
And so decided to deploy that out and been having fun with this, solving this problem
60
00:04:58,240 --> 00:05:00,520
ever since.
61
00:05:00,520 --> 00:05:07,520
I love the fact that you said, use the word curious, because I got into cybersecurity
62
00:05:07,520 --> 00:05:13,120
what feels like ages ago, but I got into cybersecurity in the 90s.
63
00:05:13,120 --> 00:05:22,800
And it was a curious nature, like I would look at systems or even machines and try to
64
00:05:22,800 --> 00:05:27,560
see how I could take advantage of them and circumvent certain things.
65
00:05:27,560 --> 00:05:35,720
And whether it was a computer, whether it was a payment system, whatever it was, a security
66
00:05:35,720 --> 00:05:40,280
closed circuit system, how can I gain access just to play?
67
00:05:40,280 --> 00:05:42,960
It was more of a curiosity.
68
00:05:42,960 --> 00:05:48,920
And then also, there was a part of me that was a generational paranoia that was passed
69
00:05:48,920 --> 00:05:49,920
down by my parents.
70
00:05:49,920 --> 00:05:51,960
I grew up in New York City.
71
00:05:51,960 --> 00:05:55,320
And so you always walk around New York City as looking over your shoulder.
72
00:05:55,320 --> 00:05:59,200
I took those two things and made a fantastic career out of it.
73
00:05:59,200 --> 00:06:05,160
So I love the fact that you started out with talking about curiosity.
74
00:06:05,160 --> 00:06:12,520
I wanted to ask you because my daughter, I'm a girl dad, and I'm always encouraging my
75
00:06:12,520 --> 00:06:21,840
daughter, I find that she apologizes often for when she asks for things from an employer
76
00:06:21,840 --> 00:06:28,920
that she believes she deserves or that she feels like are due to her.
77
00:06:28,920 --> 00:06:34,080
And it's almost like societal pressure for women.
78
00:06:34,080 --> 00:06:40,320
And so I have to ask, have you ever faced that in cybersecurity?
79
00:06:40,320 --> 00:06:41,800
And how did you handle it?
80
00:06:41,800 --> 00:06:48,320
I would love for our listeners to learn, especially those who maybe have daughters or women trying
81
00:06:48,320 --> 00:06:52,480
to learn how to be successful in the industry.
82
00:06:52,480 --> 00:06:56,040
What kind of golden nuggets can you share with us?
83
00:06:56,040 --> 00:07:01,360
This was a great topic because it took time.
84
00:07:01,360 --> 00:07:03,320
And I definitely understand.
85
00:07:03,320 --> 00:07:09,680
And actually, what helped me is sort of what you're doing for your daughter is that I had
86
00:07:09,680 --> 00:07:11,400
an ally.
87
00:07:11,400 --> 00:07:15,840
I had a coworker.
88
00:07:15,840 --> 00:07:16,840
And I've always been the first.
89
00:07:16,840 --> 00:07:17,840
I've always been the first.
90
00:07:17,840 --> 00:07:20,520
I was the first in my family to go to college.
91
00:07:20,520 --> 00:07:26,480
I was the first to grow in corporate America.
92
00:07:26,480 --> 00:07:29,880
My family doesn't come from that, so they couldn't help me, but I'm glad that you can
93
00:07:29,880 --> 00:07:31,600
help your daughter.
94
00:07:31,600 --> 00:07:38,940
But what helped me was men because I was the only woman in these rooms.
95
00:07:38,940 --> 00:07:44,360
It was those who actively helped me and then also me watching.
96
00:07:44,360 --> 00:07:47,880
So I would watch how men would operate and how they would ask for certain things and
97
00:07:47,880 --> 00:07:50,840
how they would.
98
00:07:50,840 --> 00:07:58,520
And it was because they just knew that they had the confidence and the skills to go after
99
00:07:58,520 --> 00:07:59,520
that.
100
00:07:59,520 --> 00:08:01,880
And I think so that was passively.
101
00:08:01,880 --> 00:08:08,380
But then I had great leaders who were men who were champions, who sometimes saw things
102
00:08:08,380 --> 00:08:13,920
in me that I didn't see, who would tell me, I think when you like you want to make sure
103
00:08:13,920 --> 00:08:19,120
when you go for this review that you are prepared.
104
00:08:19,120 --> 00:08:22,720
So you go in there, you talk about all the things that you have done.
105
00:08:22,720 --> 00:08:25,620
Do not be shy about it.
106
00:08:25,620 --> 00:08:29,040
Come with facts and that and it's not a brag if it's back.
107
00:08:29,040 --> 00:08:32,320
So if you've done all of these facts, you lay them out there.
108
00:08:32,320 --> 00:08:41,440
And so that helped me switch my mindset because I think because I'm from the South and because
109
00:08:41,440 --> 00:08:49,520
I am a woman and probably because I am black, bragging and trying to feeling like I needed
110
00:08:49,520 --> 00:08:52,240
to brag was something that just wasn't in me.
111
00:08:52,240 --> 00:08:54,320
And I just didn't like the way I felt.
112
00:08:54,320 --> 00:09:00,200
But when my leader told me just lay the facts out there, I can I can do that.
113
00:09:00,200 --> 00:09:01,360
I can lay the facts out there.
114
00:09:01,360 --> 00:09:06,360
I can communicate all the great things that I have done and you can go check and find
115
00:09:06,360 --> 00:09:07,360
out.
116
00:09:07,360 --> 00:09:11,400
And this is why I need to get this type of salary.
117
00:09:11,400 --> 00:09:15,200
The facts are that this person at this salary makes this amount of money.
118
00:09:15,200 --> 00:09:19,080
And so I felt comfortable operating in that.
119
00:09:19,080 --> 00:09:20,080
True.
120
00:09:20,080 --> 00:09:24,800
So that kind of helped me in the beginning feel comfortable doing it.
121
00:09:24,800 --> 00:09:31,560
And now that I own my own company, I am that champion for my team members across the board.
122
00:09:31,560 --> 00:09:40,240
I am telling them I am I am excited when I see women that are coming to me asking for
123
00:09:40,240 --> 00:09:42,360
what they deserve.
124
00:09:42,360 --> 00:09:48,040
And I know when they watch this because in the meetings, I am smiling.
125
00:09:48,040 --> 00:09:56,000
I am smiling because, yes, I want to make sure that we are creating a culture where
126
00:09:56,000 --> 00:09:57,600
you should get what you deserve.
127
00:09:57,600 --> 00:09:59,720
You should feel confident doing that.
128
00:09:59,720 --> 00:10:05,040
And there's no shrinking and hiding because if the work that you're doing is facts is
129
00:10:05,040 --> 00:10:06,040
not a brag.
130
00:10:06,040 --> 00:10:07,040
Yeah.
131
00:10:07,040 --> 00:10:10,520
No, I thank you so much for sharing that.
132
00:10:10,520 --> 00:10:16,280
I think when we first met, I was sharing with you as a Hispanic leader, business leader,
133
00:10:16,280 --> 00:10:22,920
I tried to bring about that same being that champion because I'm in a position that I
134
00:10:22,920 --> 00:10:28,120
can actually have some some impact.
135
00:10:28,120 --> 00:10:31,840
And I know that we're talking about cybersecurity, but in the realm of cybersecurity, I had a
136
00:10:31,840 --> 00:10:39,820
conversation with one of our women employees recently who was asking for an increase.
137
00:10:39,820 --> 00:10:42,280
And I coached her.
138
00:10:42,280 --> 00:10:43,520
Don't apologize for it.
139
00:10:43,520 --> 00:10:46,720
If you deserve it, we're going to get it for you.
140
00:10:46,720 --> 00:10:51,400
And it was this I had to coach her to it's OK to self promote.
141
00:10:51,400 --> 00:10:55,960
Just like what you said, if you've accomplished these things and by all means, ask for it.
142
00:10:55,960 --> 00:10:56,960
So thank you for sharing that.
143
00:10:56,960 --> 00:10:57,960
Really, I really appreciate it.
144
00:10:57,960 --> 00:11:04,880
You know, I'm also I like to pivot and talk a little bit about cybersecurity and the industry
145
00:11:04,880 --> 00:11:08,520
that you believe may need more investment.
146
00:11:08,520 --> 00:11:14,880
Like from looking at the industries that have traditionally invested in cybersecurity, is
147
00:11:14,880 --> 00:11:22,280
there one industry that is lagging that you believe ought to invest more in cybersecurity?
148
00:11:22,280 --> 00:11:26,640
Like when you think about the industries like financial services, you think about retail
149
00:11:26,640 --> 00:11:31,800
hospitality, you think about manufacturing, oil and gas, you know, those verticalized
150
00:11:31,800 --> 00:11:40,040
industries, which one do you feel needs more investment in protecting their infrastructures?
151
00:11:40,040 --> 00:11:47,200
Yeah, just at a talk on this, I was at Black Hat and I kind of broke down.
152
00:11:47,200 --> 00:11:54,600
I broke down the attacker journey and I broke down the industries that they are targeting
153
00:11:54,600 --> 00:11:55,600
now.
154
00:11:55,600 --> 00:11:59,760
So when I got started, there was three big industries that cyber criminals targeted.
155
00:11:59,760 --> 00:12:06,340
They targeted the government, they targeted health care and they targeted financial institutions.
156
00:12:06,340 --> 00:12:10,680
Now what I'm seeing is there is a trend where finance institutions are at the top.
157
00:12:10,680 --> 00:12:12,440
So they're targeting financial institutions.
158
00:12:12,440 --> 00:12:13,600
They're at the top.
159
00:12:13,600 --> 00:12:19,280
They they have access to to capital and data.
160
00:12:19,280 --> 00:12:22,640
And so they're at the top and that trend has not went away.
161
00:12:22,640 --> 00:12:28,360
And so companies who operate in that space definitely should be making an investment
162
00:12:28,360 --> 00:12:33,360
in cybersecurity and they should be looking at all levels of where they need to protect
163
00:12:33,360 --> 00:12:39,000
themselves because, as I mentioned before, the easiest level to gain access into an organization
164
00:12:39,000 --> 00:12:40,240
is through their people.
165
00:12:40,240 --> 00:12:43,840
So they should be strengthening their people with continuous education.
166
00:12:43,840 --> 00:12:48,680
But now we need to also look at when we talk about the network, we need to make sure that
167
00:12:48,680 --> 00:12:49,920
the networks are resilient.
168
00:12:49,920 --> 00:12:55,280
We need to make sure that if the financial industry, if they have applications inside
169
00:12:55,280 --> 00:12:59,440
of their systems, that those applications have been scanned for vulnerabilities and
170
00:12:59,440 --> 00:13:00,440
fixed.
171
00:13:00,440 --> 00:13:07,240
And there's so many different layers that then financial industry, fintech, they have
172
00:13:07,240 --> 00:13:13,080
to definitely make sure that they are continuously looking at their vulnerabilities and trying
173
00:13:13,080 --> 00:13:18,960
to mitigate that because bad actors are the other industries that I've seen that I saw
174
00:13:18,960 --> 00:13:26,440
that was a target was, believe it or not, software based software companies, SAS companies,
175
00:13:26,440 --> 00:13:30,680
they are a big target this year.
176
00:13:30,680 --> 00:13:31,680
They're a big target.
177
00:13:31,680 --> 00:13:33,480
They're getting targeted quite frequently.
178
00:13:33,480 --> 00:13:39,240
And it could be that SAS software companies are growing rapidly.
179
00:13:39,240 --> 00:13:44,160
So there's a lot of movement and change that's happening in these software companies, although
180
00:13:44,160 --> 00:13:46,960
they are they may have tech talent.
181
00:13:46,960 --> 00:13:54,600
Tech talent has been highly vulnerable, has caused more vulnerabilities than any other
182
00:13:54,600 --> 00:14:01,920
group because there's a little bit of they are educated, but they're not taught in school
183
00:14:01,920 --> 00:14:09,800
about how to have a good cyber posture like that isn't taught at engineering disciplines,
184
00:14:09,800 --> 00:14:14,560
how to be how to have great cyber posture and how to build resilient applications.
185
00:14:14,560 --> 00:14:20,040
And so they make a lot of mistakes in cyber criminals are targeting them.
186
00:14:20,040 --> 00:14:32,480
And then the other industries that I've seen getting targeted is the so a new one is there's
187
00:14:32,480 --> 00:14:41,840
organizations in so organizations that focus on proprietary data like tax, tax organizations,
188
00:14:41,840 --> 00:14:43,100
those are getting targeted.
189
00:14:43,100 --> 00:14:46,800
Of course, the health care organizations are getting targeted.
190
00:14:46,800 --> 00:14:53,480
And then there's some new entrants that came in at the start of the pandemic were companies
191
00:14:53,480 --> 00:14:56,660
that are are focusing on cryptocurrency.
192
00:14:56,660 --> 00:15:00,360
So they're getting targeted quite frequently.
193
00:15:00,360 --> 00:15:06,460
So yeah, there's there's a lot of cyber criminals are definitely targeting industries that have
194
00:15:06,460 --> 00:15:11,660
access to financial resources.
195
00:15:11,660 --> 00:15:13,160
It could be data.
196
00:15:13,160 --> 00:15:17,640
We have cyber criminals that are hacked of it hack of this hack of this.
197
00:15:17,640 --> 00:15:18,640
So what does that mean?
198
00:15:18,640 --> 00:15:28,800
If you are managing or if you are working for a potential political campaign, there
199
00:15:28,800 --> 00:15:34,120
are cyber cyber criminals that will target your organization because they may not agree
200
00:15:34,120 --> 00:15:41,600
with your stance or if you're if you are protecting the cyber security and posture of a foundation,
201
00:15:41,600 --> 00:15:46,520
which could be doing some good in the world, there are hacked of it hack of this who don't
202
00:15:46,520 --> 00:15:51,280
care about trying to steal the foundation's money.
203
00:15:51,280 --> 00:15:56,320
They're just trying to take those that industry or that organization down.
204
00:15:56,320 --> 00:16:00,640
So there's a lot of motivations out there, but we have to make sure that we're diligent
205
00:16:00,640 --> 00:16:05,200
to know what our gaps are, which is what I love that what you all are doing.
206
00:16:05,200 --> 00:16:07,200
And it's a difference.
207
00:16:07,200 --> 00:16:10,000
It's a it's a gap between knowing and doing.
208
00:16:10,000 --> 00:16:13,920
So we have to actually do put those things into motion to protect ourselves.
209
00:16:13,920 --> 00:16:23,400
Yeah, I like the point you made about software developers and SAS companies because and I
210
00:16:23,400 --> 00:16:33,200
look back on my career, you know, I started out programming back in the mid 90s and it
211
00:16:33,200 --> 00:16:38,080
was all about user interface, ease of use access.
212
00:16:38,080 --> 00:16:39,880
That's what developers we want.
213
00:16:39,880 --> 00:16:44,640
We want that security was not even a thought or an afterthought.
214
00:16:44,640 --> 00:16:51,040
It was all about user experience and making sure that the application had access and it
215
00:16:51,040 --> 00:16:53,040
was fast.
216
00:16:53,040 --> 00:16:56,920
And I know that we've come a long way since then.
217
00:16:56,920 --> 00:16:57,920
But you're right.
218
00:16:57,920 --> 00:17:03,960
I think that there's still that inverse relationship between access and security.
219
00:17:03,960 --> 00:17:08,240
And that's a challenge in that industry.
220
00:17:08,240 --> 00:17:16,120
What we have seen recently has and you touched on it with with FinTech and those softer targets
221
00:17:16,120 --> 00:17:22,880
that we're starting to see law firms that specialize in mergers and acquisitions become
222
00:17:22,880 --> 00:17:30,160
that soft target because the hackers can then get inside information that they can actualize
223
00:17:30,160 --> 00:17:31,160
on the stock market.
224
00:17:31,160 --> 00:17:38,120
And it's we get a lot of law firms coming to us going, this is what we need.
225
00:17:38,120 --> 00:17:43,560
We're very concerned about that IP, that intellectual property that our clients have.
226
00:17:43,560 --> 00:17:46,000
So really great stuff.
227
00:17:46,000 --> 00:17:53,400
Let me let me ask you about the impact because you work your business is specific on, you
228
00:17:53,400 --> 00:17:58,000
know, protecting against phishing attacks and things of that nature.
229
00:17:58,000 --> 00:18:06,240
What are some of the unknown results and costs associated with a breach?
230
00:18:06,240 --> 00:18:07,240
Right.
231
00:18:07,240 --> 00:18:12,840
Can you speak to some of the unknown impacts of a breached or an impacted network due to
232
00:18:12,840 --> 00:18:14,960
ransomware or what have you?
233
00:18:14,960 --> 00:18:20,600
Because oftentimes some of our listeners think, well, it's just about getting back up and
234
00:18:20,600 --> 00:18:21,600
running.
235
00:18:21,600 --> 00:18:27,460
But then there's these ripples that I'm hoping that you could kind of clarify and these ripple
236
00:18:27,460 --> 00:18:29,560
effects of that impact.
237
00:18:29,560 --> 00:18:30,560
Definitely.
238
00:18:30,560 --> 00:18:34,720
And this is a great question because you're right.
239
00:18:34,720 --> 00:18:40,160
Initially we're thinking about this one moment in time, but also that one moment in time
240
00:18:40,160 --> 00:18:45,520
could be costly because that one moment of time of being down, what does that mean?
241
00:18:45,520 --> 00:18:53,960
If you are a hospital and you are down for an hour, two hours, a day, three days, you
242
00:18:53,960 --> 00:19:01,200
have you could potentially have customers who are in life threatening situations where
243
00:19:01,200 --> 00:19:09,760
they could lose a loss of life could happen or we could have the other impact is yes,
244
00:19:09,760 --> 00:19:10,760
financial loss.
245
00:19:10,760 --> 00:19:17,400
But the other thing I'm thinking about is we what happens after ransomware attack on
246
00:19:17,400 --> 00:19:24,120
the dark web is though that data, once you pay that ransom and you believe you're made
247
00:19:24,120 --> 00:19:32,160
whole the cyber criminal does not have although they may not use it, they are dumping that
248
00:19:32,160 --> 00:19:36,320
data six months later onto the dark web.
249
00:19:36,320 --> 00:19:40,600
And now this data could be used by another cyber criminal to go back.
250
00:19:40,600 --> 00:19:46,280
And so what I have seen is after a breach, yes, we have to notify if we're in a certain
251
00:19:46,280 --> 00:19:51,240
state, we have to notify the Secretary of State that we've been through a breach, we
252
00:19:51,240 --> 00:19:57,640
have to make sure that we are putting doing the proper steps of making sure that we make
253
00:19:57,640 --> 00:19:59,920
our organization whole.
254
00:19:59,920 --> 00:20:03,960
If we have to pay the ransom, we're paying our ransom.
255
00:20:03,960 --> 00:20:05,520
And so that's a moment in time.
256
00:20:05,520 --> 00:20:11,880
But what I have seen is that organizations have left the hole open after they have paid
257
00:20:11,880 --> 00:20:13,120
the ransom.
258
00:20:13,120 --> 00:20:16,080
They have not closed that hole.
259
00:20:16,080 --> 00:20:20,960
And I can guarantee you the cyber criminal six months to 12 months later has dumped that
260
00:20:20,960 --> 00:20:22,160
data.
261
00:20:22,160 --> 00:20:30,040
Another bad actor is going to go back to this same organization and try it again.
262
00:20:30,040 --> 00:20:34,880
And if the door is left open, now we have another incident.
263
00:20:34,880 --> 00:20:43,680
And so yes, the cyber criminals are going to go through they're going to if the first
264
00:20:43,680 --> 00:20:46,840
time work, they're going to try it again.
265
00:20:46,840 --> 00:20:53,080
And so that's the that's the impact of once you've been a part of a breach, you're going
266
00:20:53,080 --> 00:20:56,240
to keep get consistently getting tried again.
267
00:20:56,240 --> 00:20:59,960
And then the other thing that I'll say from an end user perspective, because for me, cyber
268
00:20:59,960 --> 00:21:05,920
security, people have to make sure that they were we have to think about how this is affect
269
00:21:05,920 --> 00:21:09,840
me personally for us to really care and make changes.
270
00:21:09,840 --> 00:21:14,520
And so what I've seen is when we've had users who have been a part of a breach and their
271
00:21:14,520 --> 00:21:23,880
data has been compromised, and it has been used in a where their identity has been taken,
272
00:21:23,880 --> 00:21:31,040
I have seen people go through so much work of trying to clear up their clear up these
273
00:21:31,040 --> 00:21:37,440
these charges and clear up their credit and freeze their their their their social security
274
00:21:37,440 --> 00:21:43,280
account, I have seen them have to continuously battle with their different creditors to tell
275
00:21:43,280 --> 00:21:47,640
them that it wasn't them and it was a cyber criminal in these.
276
00:21:47,640 --> 00:21:51,640
And once that battle is done, as I mentioned before, the cyber criminal may go back to
277
00:21:51,640 --> 00:21:56,920
the organization, but a cyber criminal may also try again to take your identity again.
278
00:21:56,920 --> 00:21:58,640
And then the battle starts over again.
279
00:21:58,640 --> 00:22:04,440
And so you just want to make sure that you're thinking about this long term because it could
280
00:22:04,440 --> 00:22:08,040
be a lengthy endeavor.
281
00:22:08,040 --> 00:22:13,800
It's not just that one moment in time that you're trying to resolve yourself from.
282
00:22:13,800 --> 00:22:19,940
Yeah, it's you mentioned something that made me think of a quote.
283
00:22:19,940 --> 00:22:25,480
You mentioned about how they keep coming back and it's.
284
00:22:25,480 --> 00:22:29,680
You know, I think it was I think it was the famous bank robber Willie Sutton who said
285
00:22:29,680 --> 00:22:31,800
when asked, why do you rob banks?
286
00:22:31,800 --> 00:22:35,680
He goes, well, that's where the money is.
287
00:22:35,680 --> 00:22:39,360
And people ask, well, why do why do malicious threat actors come back?
288
00:22:39,360 --> 00:22:41,760
It's like because you haven't patched a hole.
289
00:22:41,760 --> 00:22:43,540
You haven't you haven't stopped.
290
00:22:43,540 --> 00:22:49,880
You haven't developed the countermeasures and policies, procedures and set up the proper
291
00:22:49,880 --> 00:22:55,080
ways to detect and then mitigate that that threat.
292
00:22:55,080 --> 00:23:02,000
And it's it's just one of those things that we can't educate this community enough.
293
00:23:02,000 --> 00:23:04,000
So really great points.
294
00:23:04,000 --> 00:23:06,740
Thank you for bringing that up.
295
00:23:06,740 --> 00:23:12,720
I want you to take out a crystal ball and and and think about what's going to happen
296
00:23:12,720 --> 00:23:15,880
over the next five to 10 years.
297
00:23:15,880 --> 00:23:22,600
And I won't hold you to this, but how do you think the cybersecurity threat landscape will
298
00:23:22,600 --> 00:23:26,520
change over the next five to 10 years?
299
00:23:26,520 --> 00:23:30,000
I mean, I've been doing this now 25 years.
300
00:23:30,000 --> 00:23:36,040
I would have never thought that we would be challenged with things like A.I. being used
301
00:23:36,040 --> 00:23:43,160
by malicious threat actors, state sponsored, because when I got into cybersecurity, the
302
00:23:43,160 --> 00:23:47,480
biggest threat was website defacements.
303
00:23:47,480 --> 00:23:53,680
And so now we the threat landscape has evolved so quickly.
304
00:23:53,680 --> 00:23:55,240
Let's let's think about the future.
305
00:23:55,240 --> 00:24:00,400
What do you think the next five to 10 years will bring?
306
00:24:00,400 --> 00:24:03,560
On the bad actor side or on the bad actor side?
307
00:24:03,560 --> 00:24:05,280
Yeah, I think so.
308
00:24:05,280 --> 00:24:08,600
I think we have to think about bad actors.
309
00:24:08,600 --> 00:24:13,160
We have to think of them as people like you and I.
310
00:24:13,160 --> 00:24:19,040
We are and and we're we continuously evolve.
311
00:24:19,040 --> 00:24:20,440
We continuously adapt.
312
00:24:20,440 --> 00:24:25,040
We're continuously curious.
313
00:24:25,040 --> 00:24:29,360
And we're always looking to.
314
00:24:29,360 --> 00:24:32,240
Find ways to improve.
315
00:24:32,240 --> 00:24:41,320
And so I think the my my mind, I think about bad actors as engineers who are just there.
316
00:24:41,320 --> 00:24:44,080
They're utilizing technology for me.
317
00:24:44,080 --> 00:24:49,200
I love to use technology to solve problems, but for good.
318
00:24:49,200 --> 00:24:50,720
And I'm always I'm excited.
319
00:24:50,720 --> 00:24:58,240
I'm always looking at what's new, what's interesting and how can I use this tool to solve a problem
320
00:24:58,240 --> 00:25:02,320
that I'm trying to that I've been trying to solve for a very long time.
321
00:25:02,320 --> 00:25:10,800
And so I think that we have a lot of great tools that these engineering bad actors have
322
00:25:10,800 --> 00:25:17,640
to solve their problem, which is they want to get access to if their goal is to get access
323
00:25:17,640 --> 00:25:22,760
to data, I mean, to get to get access to data, they have access to so much data.
324
00:25:22,760 --> 00:25:29,280
And so they're going to be using AI to be able to build these large data sets and to
325
00:25:29,280 --> 00:25:35,200
be able to have an intelligent and more of an intelligent understanding of how we operate
326
00:25:35,200 --> 00:25:37,480
as people.
327
00:25:37,480 --> 00:25:43,120
They will be able to surveillance us and have and be able to understand more about our trends.
328
00:25:43,120 --> 00:25:49,200
So if we're talking about a big fish, which is some cyber criminal is targeting a high
329
00:25:49,200 --> 00:25:56,800
profile individual, then I see them utilizing machine learning to be able to pull data to
330
00:25:56,800 --> 00:26:05,000
understand this person typically goes to these different locations without them leaving their
331
00:26:05,000 --> 00:26:07,320
home back in back in the day.
332
00:26:07,320 --> 00:26:13,480
You would have to have someone who would verify or you would have to be there to see that
333
00:26:13,480 --> 00:26:14,560
these are their trends.
334
00:26:14,560 --> 00:26:20,000
But we they would have access to data to understand how these people operate, where where do they
335
00:26:20,000 --> 00:26:21,000
go?
336
00:26:21,000 --> 00:26:27,480
Who do they talk to build this profile, which is going to allow them to make to allow them
337
00:26:27,480 --> 00:26:33,240
to get access to whatever data or information that they want.
338
00:26:33,240 --> 00:26:40,320
And so I definitely see cyber criminals using artificial intelligence to understand our
339
00:26:40,320 --> 00:26:42,040
trends and our patterns.
340
00:26:42,040 --> 00:26:49,000
I see them I see fishing evolving as it already has where fishing is no longer about misspell
341
00:26:49,000 --> 00:26:55,440
words and easily to identify and someone not speaking our language and we can identify
342
00:26:55,440 --> 00:26:58,920
that that is someone from somewhere else.
343
00:26:58,920 --> 00:27:04,200
We have large language models that can allow them to communicate with us without those
344
00:27:04,200 --> 00:27:05,200
cues.
345
00:27:05,200 --> 00:27:09,760
And I just think it's going to continue to to to evolve and get better.
346
00:27:09,760 --> 00:27:17,840
I think for us as individuals, as as AI evolves, I think we're going to move towards trying
347
00:27:17,840 --> 00:27:23,440
to find spaces in the physical space because we're not going to be able to trust if we're
348
00:27:23,440 --> 00:27:31,280
on this zoom call that you haven't created a deep fake of me to be able to get on this
349
00:27:31,280 --> 00:27:33,000
zoom call and talk to you.
350
00:27:33,000 --> 00:27:39,040
And and so I think we're going to be moving more into as people trying to move more into
351
00:27:39,040 --> 00:27:44,640
physical spaces to try to make sure we're actually speaking to who we thought we were
352
00:27:44,640 --> 00:27:45,640
talking to.
353
00:27:45,640 --> 00:27:49,240
Yeah, you know, it's interesting you brought that up because one of my previous guests,
354
00:27:49,240 --> 00:27:55,880
we talked about that about podcasts and webinars and these, you know, especially during the
355
00:27:55,880 --> 00:28:02,120
pandemic, we were doing everything virtually and recordings and and how quickly through
356
00:28:02,120 --> 00:28:06,440
AI you could easily impersonate someone.
357
00:28:06,440 --> 00:28:09,160
And and we're starting to see this trend.
358
00:28:09,160 --> 00:28:18,400
I see it in various ways where folks will get scammed because it's the voice of someone
359
00:28:18,400 --> 00:28:19,760
that's actually calling them.
360
00:28:19,760 --> 00:28:28,760
So it goes from a text to a voice to and it becomes harder and harder to validate.
361
00:28:28,760 --> 00:28:35,760
And it speaks to and we had a situation recently, you'll get a kick out of this, where our CEO
362
00:28:35,760 --> 00:28:40,600
texted me, allegedly from a brand new cell phone.
363
00:28:40,600 --> 00:28:43,040
Hey, this is Josh.
364
00:28:43,040 --> 00:28:44,360
I got a brand new cell phone.
365
00:28:44,360 --> 00:28:46,600
Can you let me know that you got this?
366
00:28:46,600 --> 00:28:52,160
And of course, I screenshotted that and sent the text to the actual cell phone and we had
367
00:28:52,160 --> 00:28:53,640
a good kick out of it.
368
00:28:53,640 --> 00:29:00,280
And I was like, but imagine if I would have called that number and his voice picked up.
369
00:29:00,280 --> 00:29:01,280
Yeah.
370
00:29:01,280 --> 00:29:07,800
I would have gotten really confused, but it's this culture that we are trying to foster
371
00:29:07,800 --> 00:29:10,840
that it's OK to question.
372
00:29:10,840 --> 00:29:15,640
And I think that that's the challenge, because oftentimes.
373
00:29:15,640 --> 00:29:24,040
New employees or field level employees will get a text from their CEO and snap to attention.
374
00:29:24,040 --> 00:29:31,720
And instead of questioning, I had a client who actually sent fifty thousand dollars in
375
00:29:31,720 --> 00:29:37,360
gift cards to that person they thought was the CEO on the other line.
376
00:29:37,360 --> 00:29:43,520
And so it's creating a culture where it's OK to question, slow down, let's not rush
377
00:29:43,520 --> 00:29:51,680
into and trying our best to to validate that because it's becoming more and more challenging.
378
00:29:51,680 --> 00:29:57,040
And it's it's frightening to me that someone could take my voice and try to extort my mother
379
00:29:57,040 --> 00:30:03,480
in law, who's eighty four of money because she thinks, you know, I've been kidnapped
380
00:30:03,480 --> 00:30:06,360
or the police have me and I need bail money.
381
00:30:06,360 --> 00:30:08,640
Those are some of the scenarios I've heard recently.
382
00:30:08,640 --> 00:30:09,640
Yeah.
383
00:30:09,640 --> 00:30:15,320
I mean, because it's so much in your public facing.
384
00:30:15,320 --> 00:30:22,760
So we have you on all of these podcasts and then getting your voice.
385
00:30:22,760 --> 00:30:28,920
It's going to be easier and easier to to to pull off these types of these types of scams.
386
00:30:28,920 --> 00:30:31,920
Yeah, yeah.
387
00:30:31,920 --> 00:30:36,720
I'm interested to know a little bit more about some of the creative approaches that you've
388
00:30:36,720 --> 00:30:42,160
taken to solve some of these tough cybersecurity problems.
389
00:30:42,160 --> 00:30:46,480
You know, when it comes to spearfishing or whale fishing, these
390
00:30:46,480 --> 00:30:51,000
what are some of the ways that you're tackling those today?
391
00:30:51,000 --> 00:30:54,540
Great question for us as a data driven approach.
392
00:30:54,540 --> 00:30:58,360
So we're using generative AI before it was a thing.
393
00:30:58,360 --> 00:31:03,160
We we've used it to try to simulate how attacks are happening today.
394
00:31:03,160 --> 00:31:12,600
So as I mentioned before, phishing emails and we do phishing text messages as well,
395
00:31:12,600 --> 00:31:18,920
but they have moved past these misspelled words because cyber criminals are using chat
396
00:31:18,920 --> 00:31:21,320
GPT to generate these emails.
397
00:31:21,320 --> 00:31:28,000
And so what our platform does at hack where is it minds and it finds these phishing emails
398
00:31:28,000 --> 00:31:33,880
and then we have a classifier that will allow us to determine what type of phishing attack
399
00:31:33,880 --> 00:31:34,880
this is.
400
00:31:34,880 --> 00:31:39,480
And then what we're also doing is we're integrating into the email platform.
401
00:31:39,480 --> 00:31:44,960
And so we're trying to give our customers insights into understanding what are their
402
00:31:44,960 --> 00:31:51,840
six risky behaviors you talked about before about the impact of a breach.
403
00:31:51,840 --> 00:31:56,320
We're trying to help you to understand what would the potential cost be with these six
404
00:31:56,320 --> 00:31:58,360
risky behaviors.
405
00:31:58,360 --> 00:32:04,800
And so what our platform then does is it will generate a spear phishing simulated email
406
00:32:04,800 --> 00:32:10,080
that's based off of attacks that are happening today versus what happened a quarter ago or
407
00:32:10,080 --> 00:32:11,320
a year ago.
408
00:32:11,320 --> 00:32:16,840
We're making it 100 percent automated where we can test these users with this type of
409
00:32:16,840 --> 00:32:18,080
spear phishing.
410
00:32:18,080 --> 00:32:25,120
Everyone gets a spear phishing simulation versus the reason why I created this platform
411
00:32:25,120 --> 00:32:27,360
is because I just didn't have the time.
412
00:32:27,360 --> 00:32:32,280
And so I would only have time to create a spear phishing simulation for 10 percent of
413
00:32:32,280 --> 00:32:33,280
the population.
414
00:32:33,280 --> 00:32:39,200
And that was typically the C suite or it was where the money was, which was in the accounting
415
00:32:39,200 --> 00:32:45,160
team and the rest of the department got generic phishing emails and they went out at the same
416
00:32:45,160 --> 00:32:46,160
time.
417
00:32:46,160 --> 00:32:52,520
But what I've done with this platform is we're looking at when is the best time to send this
418
00:32:52,520 --> 00:32:54,520
email to you as an individual.
419
00:32:54,520 --> 00:32:58,360
What is the best content to train you on?
420
00:32:58,360 --> 00:33:03,560
And then we're also looking at insights on have you been a part of a breach before that's
421
00:33:03,560 --> 00:33:04,640
on the dark web?
422
00:33:04,640 --> 00:33:11,480
Our platform will simulate and impersonate that brand to see have you closed the doors?
423
00:33:11,480 --> 00:33:17,280
Have you are you suspiciously looking at emails that are coming from this brand knowing that
424
00:33:17,280 --> 00:33:19,760
your information is on the dark web?
425
00:33:19,760 --> 00:33:25,000
So we're continuously automating and testing and then we train the user on what they need
426
00:33:25,000 --> 00:33:29,520
to learn in three minute or less videos to change their risky behavior.
427
00:33:29,520 --> 00:33:34,880
So we're trying to make it super easy for security teams to to train their human human
428
00:33:34,880 --> 00:33:35,880
work.
429
00:33:35,880 --> 00:33:36,880
I love that.
430
00:33:36,880 --> 00:33:42,720
I've got I've got a couple of follow up questions that are running through my mind here because
431
00:33:42,720 --> 00:33:50,520
in my past, we've done ethical hacking and designed some of these campaigns as well.
432
00:33:50,520 --> 00:33:58,500
And I'm always wondering what there's always in my experience, there's always a percentage
433
00:33:58,500 --> 00:34:05,760
of people that will click on a link no matter what you teach them, no matter what the stick
434
00:34:05,760 --> 00:34:08,480
or the carrot is.
435
00:34:08,480 --> 00:34:11,000
But in your experience, what percentage is that?
436
00:34:11,000 --> 00:34:15,160
I mean, it is a continuous clicker clickers.
437
00:34:15,160 --> 00:34:16,160
Yeah, yeah.
438
00:34:16,160 --> 00:34:25,160
I think it depends on the level of the fish because they could also it depends on because
439
00:34:25,160 --> 00:34:26,520
we have three levels.
440
00:34:26,520 --> 00:34:34,080
So on a fishing level, which is a generic fishing fishing email that has the cast a
441
00:34:34,080 --> 00:34:41,200
wide net for everyone to try to see who's going to respond in lure for those repeat
442
00:34:41,200 --> 00:34:42,200
offenders.
443
00:34:42,200 --> 00:34:48,880
I typically will see typically around it depends on the organization, but I'm going to say
444
00:34:48,880 --> 00:34:53,160
between five to 10 percent.
445
00:34:53,160 --> 00:34:57,760
I see repeat repeat offenders on those.
446
00:34:57,760 --> 00:35:04,520
But I've also worked with organizations who have come up with different programs to try
447
00:35:04,520 --> 00:35:11,840
to get them to understand the why, why this is important, how to create that pause, how
448
00:35:11,840 --> 00:35:18,240
to create this relationship with the security team where the reason why we're doing this
449
00:35:18,240 --> 00:35:23,760
is because we want to make sure that we create an environment where you know what to do if
450
00:35:23,760 --> 00:35:24,760
an attack happens.
451
00:35:24,760 --> 00:35:28,720
And even if you make a mistake and you click on something, trying to educate the team on
452
00:35:28,720 --> 00:35:35,200
what to do after that versus being afraid of communicating with your security team and
453
00:35:35,200 --> 00:35:40,760
you've clicked on a link and you're exposing your organization to a malware outbreak, but
454
00:35:40,760 --> 00:35:44,720
you're just going to be quiet and not say anything that's not helping the organization
455
00:35:44,720 --> 00:35:45,720
either.
456
00:35:45,720 --> 00:35:50,800
Yeah, I know it's it's all really great points.
457
00:35:50,800 --> 00:35:54,960
Is a hundred percent compliance a realistic goal?
458
00:35:54,960 --> 00:35:59,400
Oh, sure, that no one clicks on.
459
00:35:59,400 --> 00:36:03,920
I mean, is that even realistic or is it ninety five percent realistic?
460
00:36:03,920 --> 00:36:08,400
You know, and then you just mitigate for the other five.
461
00:36:08,400 --> 00:36:14,680
Do you know how do you it depends on how long you have that you have that one hundred percent
462
00:36:14,680 --> 00:36:20,400
compliance because that could be also an indicator that your users have.
463
00:36:20,400 --> 00:36:21,960
It's like going to the gym.
464
00:36:21,960 --> 00:36:28,440
Your users have gotten their bodies have gotten comfortable and adapted to this layer where
465
00:36:28,440 --> 00:36:29,920
they're not growing anymore.
466
00:36:29,920 --> 00:36:34,880
They're just they're just going with the flow.
467
00:36:34,880 --> 00:36:38,880
They're not being challenged to go to that next level.
468
00:36:38,880 --> 00:36:46,480
And for us as people, we have to continuously understand that we're here to continuously
469
00:36:46,480 --> 00:36:48,080
grow and evolve.
470
00:36:48,080 --> 00:36:51,960
And when we're at a level where we have one hundred percent compliance and this is happening
471
00:36:51,960 --> 00:36:58,840
over two to three campaigns, depending on how frequently you're you're having campaigns,
472
00:36:58,840 --> 00:37:03,240
then you should look at it as an indicator that I need to make some changes.
473
00:37:03,240 --> 00:37:09,560
I need to shock the system and try to move to our next level of security maturity because
474
00:37:09,560 --> 00:37:16,120
we've already hit a certain level of maturity and it's not good to stay there.
475
00:37:16,120 --> 00:37:24,280
That's wow, that's that can be a whole another podcast is this mindset of continual growth.
476
00:37:24,280 --> 00:37:25,280
Right.
477
00:37:25,280 --> 00:37:33,120
Like I do my very best to educate our customers that that security is not a point in time
478
00:37:33,120 --> 00:37:34,120
destination.
479
00:37:34,120 --> 00:37:35,120
Right.
480
00:37:35,120 --> 00:37:40,040
Because if you view it that way, then you're going to buy a product, you're going to buy
481
00:37:40,040 --> 00:37:43,520
a software and you're going to think that you're safe.
482
00:37:43,520 --> 00:37:48,600
And realistically, it's more of a journey and it's it's never really a sprint.
483
00:37:48,600 --> 00:37:49,600
It really is a marathon.
484
00:37:49,600 --> 00:37:55,800
And you've got to stay in this and constantly evolve with because the threats will continue
485
00:37:55,800 --> 00:37:57,960
to evolve.
486
00:37:57,960 --> 00:38:03,400
And that that is, you know, that is the challenge, I think, in educating the community.
487
00:38:03,400 --> 00:38:09,280
I'd like to shift and maybe talk a little bit about the insider threat and what your
488
00:38:09,280 --> 00:38:13,280
experience has shown you on how to handle it.
489
00:38:13,280 --> 00:38:14,360
And I think there are two things.
490
00:38:14,360 --> 00:38:21,920
One is, is the malicious insider threat that is looking to purposely do harm to a business
491
00:38:21,920 --> 00:38:23,680
operations.
492
00:38:23,680 --> 00:38:31,400
And then there's the simple what we call misuse, like like innocent misuse.
493
00:38:31,400 --> 00:38:32,400
I'm not talking about that.
494
00:38:32,400 --> 00:38:34,040
I'm talking about that like the malicious.
495
00:38:34,040 --> 00:38:40,240
How does how does your experience how do you handle something like that, like an insider
496
00:38:40,240 --> 00:38:47,200
who is maliciously trying to either steal information or cause harm to an organization?
497
00:38:47,200 --> 00:38:55,520
Yeah, this one is definitely one where it's all about creating.
498
00:38:55,520 --> 00:38:59,720
You have to create the security team definitely wants to make sure that they're keeping an
499
00:38:59,720 --> 00:39:00,720
eye on this.
500
00:39:00,720 --> 00:39:06,880
But it's also important to to communicate with the entire organization where because
501
00:39:06,880 --> 00:39:15,400
security is getting lean, security has a lot to manage and they can't be omnipresent and
502
00:39:15,400 --> 00:39:16,400
everywhere.
503
00:39:16,400 --> 00:39:20,920
And so it's really important to make sure that we're educating everyone to understand
504
00:39:20,920 --> 00:39:23,920
what to look for in an insider threat.
505
00:39:23,920 --> 00:39:30,320
Like your co-workers should be trained on looking out for people for co-workers who
506
00:39:30,320 --> 00:39:37,640
are in places that they shouldn't be or in systems get trying to get access to systems
507
00:39:37,640 --> 00:39:43,720
that they their job as I work for the military, they don't have a need to know they don't
508
00:39:43,720 --> 00:39:48,040
have a need to know and to have access to this data.
509
00:39:48,040 --> 00:39:54,280
But they want you as a co-worker to give them access or they're asking for data that you
510
00:39:54,280 --> 00:39:59,820
have access to for you to email it to them and they have no reason for their to be able
511
00:39:59,820 --> 00:40:02,080
to do their job successfully to have that.
512
00:40:02,080 --> 00:40:07,360
So you have to train your team members to look out for that to be able to also create
513
00:40:07,360 --> 00:40:10,880
a pause and ask this co-worker is this something that you need?
514
00:40:10,880 --> 00:40:13,080
Why do you need it?
515
00:40:13,080 --> 00:40:19,880
And then it's really important as well just to just to make sure that we're creating this
516
00:40:19,880 --> 00:40:28,680
culture of I want to make sure that I am protecting it's not about me ratting out a co-worker,
517
00:40:28,680 --> 00:40:31,520
but we all are here to do a job.
518
00:40:31,520 --> 00:40:37,920
I need to make sure that I'm not putting my company and myself at risk by letting this
519
00:40:37,920 --> 00:40:43,040
co-worker gain access to information that they need that could potentially harm our
520
00:40:43,040 --> 00:40:45,240
company and my livelihood.
521
00:40:45,240 --> 00:40:50,240
And so it just I think what's really important is just to train all co-workers on what to
522
00:40:50,240 --> 00:40:52,880
look out for insider threats.
523
00:40:52,880 --> 00:41:01,240
And then the other insider threat I think is sometimes the security security team we
524
00:41:01,240 --> 00:41:08,640
have to make sure that we are creating an environment where our employees know how to
525
00:41:08,640 --> 00:41:18,240
be successful with cybersecurity and sometimes when an organization has a negative reinforcement
526
00:41:18,240 --> 00:41:24,760
strategy when employee makes a mistake with phishing or just different or handling data
527
00:41:24,760 --> 00:41:33,560
they made a mistake by emailing company proprietary data to a third party.
528
00:41:33,560 --> 00:41:40,560
I think it could also create an insider threat when we're not communicating to these employees
529
00:41:40,560 --> 00:41:47,280
about why we have these policies in place, how what role they have in place, what could
530
00:41:47,280 --> 00:41:52,600
be the negative outcome if they don't follow these policies, if there's a negative reinforcement
531
00:41:52,600 --> 00:41:55,200
type of culture.
532
00:41:55,200 --> 00:42:02,320
So we don't have disgruntled employees that are upset who feels like their security team
533
00:42:02,320 --> 00:42:11,720
is out to get them and now they're going to potentially create make things tough for the
534
00:42:11,720 --> 00:42:18,560
security team by clicking on links intentionally because they're upset.
535
00:42:18,560 --> 00:42:19,560
That's an interesting thought.
536
00:42:19,560 --> 00:42:31,400
I in all honesty have not considered the security team as a potential yes as an insider threat
537
00:42:31,400 --> 00:42:40,080
but like that they could cause an insider disgruntled because that employee satisfaction
538
00:42:40,080 --> 00:42:46,000
is an indicator of whether or not you have someone that is either protecting your data
539
00:42:46,000 --> 00:42:52,160
and being a good steward of that data or is loosey goosey and will leave their laptop on
540
00:42:52,160 --> 00:42:57,800
the front seat of their car as they go out to lunch.
541
00:42:57,800 --> 00:43:04,440
Those things are yeah that's a great I hadn't really thought about that but that is a really
542
00:43:04,440 --> 00:43:12,560
good topic and thank you for mentioning that.
543
00:43:12,560 --> 00:43:19,840
I would like to ask what you might be seeing or your team might be seeing with respect
544
00:43:19,840 --> 00:43:24,960
to emerging threat vectors now in the threat landscape.
545
00:43:24,960 --> 00:43:33,480
Is there anything that is of particular interest that's an emerging threat that could be that
546
00:43:33,480 --> 00:43:35,800
should be considered here?
547
00:43:35,800 --> 00:43:44,280
Yeah I think just thinking about what is happening today that is emerging.
548
00:43:44,280 --> 00:43:50,480
So there was a there and this is regard with regard to phishing but during the pandemic
549
00:43:50,480 --> 00:44:01,480
there were phishing attacks that would they were on the trend of you made this purchase
550
00:44:01,480 --> 00:44:09,600
it was a big purchase it was from a brand and they were just trying to shock you into
551
00:44:09,600 --> 00:44:15,080
you know complying and reaching out and saying you didn't make this purchase or clicking
552
00:44:15,080 --> 00:44:17,420
on the link to say you didn't make the purchase.
553
00:44:17,420 --> 00:44:22,500
So that was a trend in 2020 but now I see that they are doing more hybrid phishing which
554
00:44:22,500 --> 00:44:29,500
what you alluded to before which means they are bringing back that trend of saying that
555
00:44:29,500 --> 00:44:35,320
you made this purchase from a brand but they are also following it up sending you an email
556
00:44:35,320 --> 00:44:40,360
following it up with a call from the same number that's in that email and acting as
557
00:44:40,360 --> 00:44:45,880
if they're there that brand trying to trying to make sure you know you made this purchase
558
00:44:45,880 --> 00:44:49,880
or you didn't make this purchase and trying to create urgency around that.
559
00:44:49,880 --> 00:44:54,060
So seeing that happen I think the other trends I'm seeing is definitely cyber criminals are
560
00:44:54,060 --> 00:45:02,600
using chat GPT as a way to make their emails a little bit harder to spot and then smishing
561
00:45:02,600 --> 00:45:08,680
smish text message based phishing is more disarming so I see more cyber criminals using
562
00:45:08,680 --> 00:45:15,640
that as a way to lure people in and then yes the emerging trend is that we're doing more
563
00:45:15,640 --> 00:45:24,600
phishing voice simulated attacks and that is when they are using when they are using
564
00:45:24,600 --> 00:45:30,720
your voice or something to sound like your voice to try to pull off their attack and
565
00:45:30,720 --> 00:45:35,560
then outside of phishing I think the the other thing that we're seeing is just cyber criminals
566
00:45:35,560 --> 00:45:43,240
are trying to look for weak supply weak chains in the supply supply chain and so trying to
567
00:45:43,240 --> 00:45:52,640
figure out this organization where they fit within to help them get access to this big
568
00:45:52,640 --> 00:45:57,920
fish and so they're potentially going to target like you said a law firm so a law firm who
569
00:45:57,920 --> 00:46:05,760
has access to a lot of M&A information and lawyers as I talked about engineers lawyers
570
00:46:05,760 --> 00:46:13,800
are a big target because they get a lot of outbound information they have a lot of data
571
00:46:13,800 --> 00:46:21,480
that is sent to them they have to be accessible to their email but also they have a high education
572
00:46:21,480 --> 00:46:30,440
like they're very educated and so you have to train lawyers differently with new content
573
00:46:30,440 --> 00:46:36,320
bite-size because they're busy in order for them to be able to to get the security awareness
574
00:46:36,320 --> 00:46:42,480
training that they need they need that's tailored to them yeah no that's a great point because
575
00:46:42,480 --> 00:46:52,440
you mentioned health care earlier and it leads me to physicians yep surgeons these are these
576
00:46:52,440 --> 00:47:00,880
are the I mean they're brilliant they're they're highly intelligent but they're also apologize
577
00:47:00,880 --> 00:47:06,920
any listeners who are they're prima donnas right I was gonna say that but I was I'm glad
578
00:47:06,920 --> 00:47:14,200
you said it yeah they're the they're the moneymakers for the health care system so they want ease
579
00:47:14,200 --> 00:47:19,440
of use and when you know that inverse relationship between ease of use like we mentioned before
580
00:47:19,440 --> 00:47:26,680
in security the easier it is to use the less secure inherently oftentimes it is and and
581
00:47:26,680 --> 00:47:32,840
our health care clients they're challenged with that because the doctors want a certain
582
00:47:32,840 --> 00:47:36,960
level of access they want access to things they want they don't want to have to remember
583
00:47:36,960 --> 00:47:41,760
or to have to change passwords they they don't want to have to be restricted in what they
584
00:47:41,760 --> 00:47:51,160
can send and what they can't send and it patient privacy you've got security concerns HIPAA
585
00:47:51,160 --> 00:47:57,480
concerns all of these things kind of come into play and it sometimes can encumber their
586
00:47:57,480 --> 00:48:04,480
patient care and so making it easy while securing it is a challenge in that industry I know
587
00:48:04,480 --> 00:48:09,060
that kind of firsthand with some of our clients but you know what you mentioned is really
588
00:48:09,060 --> 00:48:20,560
really important you know I think I think about how threats evolve and we are constantly
589
00:48:20,560 --> 00:48:26,920
in this cat and mouse kind of game if I can call it a game it's it's so it's it's much
590
00:48:26,920 --> 00:48:34,680
more important than that but it feels oftentimes like we are reactive if you could give our
591
00:48:34,680 --> 00:48:41,200
listeners like two or three recommendations to try to get ahead of the next kind of wave
592
00:48:41,200 --> 00:48:47,520
what would they be like if they could accomplish two to three things by the end of the year
593
00:48:47,520 --> 00:48:54,440
and feel like this would absolutely help me be more secure and prevent phishing attack
594
00:48:54,440 --> 00:49:03,680
ransomware breach what would those two to three things be the two to three things and
595
00:49:03,680 --> 00:49:14,680
I think these two to three things are what could help across it's it's been a test of
596
00:49:14,680 --> 00:49:22,080
time like this is a class these are classic things that I think can help it has helped
597
00:49:22,080 --> 00:49:26,760
organizations in the past if they've done it right and if they do this in the future
598
00:49:26,760 --> 00:49:35,400
I feel like they will be able to be able to manage some of the evolving threats but first
599
00:49:35,400 --> 00:49:40,800
thing and foremost is you want to make sure that you are continuously training your people
600
00:49:40,800 --> 00:49:47,940
on the evolving threats because this is a a and this is a area that is continuously
601
00:49:47,940 --> 00:49:54,720
changing these as we mentioned I call them engineer bad actors they're continuously changing
602
00:49:54,720 --> 00:50:01,480
their attacks they're looking for opportunities to win and so we need to continuously educate
603
00:50:01,480 --> 00:50:13,320
our employees our end users on what's happening today and so it is like we are behind but
604
00:50:13,320 --> 00:50:19,040
when we're when we were at war we have to understand our attackers like we have to understand
605
00:50:19,040 --> 00:50:25,520
our opponent understand our opponent we have to understand what are they doing now what
606
00:50:25,520 --> 00:50:31,120
did they do in the past what are they emerging in doing potentially in the future we have
607
00:50:31,120 --> 00:50:37,800
to understand our opponent to be able to prepare ourselves on how we're going to move forward
608
00:50:37,800 --> 00:50:44,100
so education is key and then also because we are in different systems having a password
609
00:50:44,100 --> 00:50:53,840
manager or password strategy that you're continuously improving and evolving having a password manager
610
00:50:53,840 --> 00:50:59,700
and then the the master key that you're using if you're not continuously updating that working
611
00:50:59,700 --> 00:51:06,120
with your security team to update different policies around safeguarding passwords is
612
00:51:06,120 --> 00:51:11,920
something that continuously should be looked at and then the last and final thing is looking
613
00:51:11,920 --> 00:51:17,680
at device security like understanding the devices that our users have these devices
614
00:51:17,680 --> 00:51:23,320
will continuously evolve but the systems that our users are using we want to make sure that
615
00:51:23,320 --> 00:51:29,080
we're continuously updating those with what we have but you know the thing that I always
616
00:51:29,080 --> 00:51:36,400
tell people is that we we're because we are on the good side we can't do what bad actors
617
00:51:36,400 --> 00:51:42,720
are doing like we can't you know simulate a phishing simulation that's going to take
618
00:51:42,720 --> 00:51:51,840
down our customers network and have them off for days and so we have to operate within
619
00:51:51,840 --> 00:52:00,840
the within the environments that we we can and continuously train to do that and we can't
620
00:52:00,840 --> 00:52:05,000
when we're sending a phishing simulation we can't send things that are going to make a
621
00:52:05,000 --> 00:52:12,760
promise to people that they're going to get a raise or some incentives so we can't I would
622
00:52:12,760 --> 00:52:20,120
say another word but we can't create an environment where our employees are upset with us after
623
00:52:20,120 --> 00:52:26,080
the phishing and training exercise because that could create a whole sabotage type of
624
00:52:26,080 --> 00:52:31,240
a environment after that so we have to think about you know those are the three things
625
00:52:31,240 --> 00:52:38,760
that I think organizations should do and continuously evolve but we also have to we also have to
626
00:52:38,760 --> 00:52:43,680
operate in this environment where we're not the bad actors we can't be like them but we
627
00:52:43,680 --> 00:52:48,360
have to know what they can do and prepare ourselves to try to make sure that we don't
628
00:52:48,360 --> 00:52:49,720
fall victim to them.
629
00:52:49,720 --> 00:52:56,600
That is great and Tiffany thank you so much for your time.
630
00:52:56,600 --> 00:53:00,600
This has been a fantastic conversation I've been thoroughly enjoyed it.
631
00:53:00,600 --> 00:53:05,200
That is all for this episode make sure you tune in next time to Logically Speaking and
632
00:53:05,200 --> 00:53:32,240
stay cyber first and future ready.