Cybersecurity Month: Protecting Your Personal Information Online

WEBVTT
00:00:10.320 --> 00:00:17.120
Welcome to Consumer Connection, a podcast brought to you by the Montgomery County Office of Consumer Protection.
00:00:17.120 --> 00:00:19.839
I'm your host, Michelle Escobar.
00:00:19.839 --> 00:00:31.600
October is Cybersecurity Month, and today we're focusing on one of the most important issues facing residents: protecting your personal information online.
00:00:31.600 --> 00:00:41.039
To help us break down what consumers need to know, we're joined by Keith Young, Montgomery County's Chief Information Security Officer.
00:00:41.039 --> 00:00:55.759
Keith oversees the county's cybersecurity strategy and brings a wealth of experience in identifying risks, understanding emerging threats, and helping residents stay safe in an increasingly digital world.
00:00:55.759 --> 00:01:07.760
In this episode, we'll explore the biggest cyber risks consumers face today, how threats have evolved, and practical steps you can take to protect your digital life.
00:01:07.760 --> 00:01:09.519
Let's get started.
00:01:09.519 --> 00:01:12.640
Keith, thank you so much for being here today.
00:01:13.200 --> 00:01:13.599
Thank you.
00:01:14.319 --> 00:01:22.480
And um, it's October is cybersecurity month, which you're I'm sure this is the a big month for you.
00:01:22.480 --> 00:01:27.920
I mean, it probably always, every day is the big day for you, I imagine, because cybersecurity doesn't end.
00:01:27.920 --> 00:01:30.159
But I guess just get started.
00:01:30.159 --> 00:01:38.879
Just talk a little bit about your role and what um the the what your your um agency leads in Montgomery County.
00:01:39.200 --> 00:01:39.680
Oh, sure.
00:01:39.680 --> 00:01:51.439
So uh as you mentioned, I am the chief information security officer, which is the fancy way of saying that my team and I are responsible for for protecting all of the data and systems within Montgomery County government.
00:01:51.439 --> 00:01:58.879
And that's across all the approximately 40 different departments, including police, fire rescue, corrections.
00:01:58.879 --> 00:02:08.479
And with that brings a fairly complex problem that most people don't think about when they think about county government is we have lots of sensitive data in critical systems.
00:02:08.479 --> 00:02:17.039
We have data of uh health and human services data on approximately 125,000 residents.
00:02:17.039 --> 00:02:22.080
We have critical infrastructure like jail cells and traffic lights.
00:02:22.080 --> 00:02:27.520
And we have even something down to the swimming pools that are in the rec centers.
00:02:27.520 --> 00:02:38.719
And so with that, becomes a very wide variety of security requirements that we have to try to protect across approximately 25,000 devices around the county government.
00:02:39.120 --> 00:02:39.439
Wow.
00:02:39.439 --> 00:02:42.879
That's incredible and a huge responsibility.
00:02:43.120 --> 00:02:46.479
That's I mean, look at me, I'm 25 years old.
00:02:46.479 --> 00:02:48.240
It's been a rough couple of years.
00:02:49.759 --> 00:02:52.639
Um, explain cybersecurity to us, though.
00:02:52.639 --> 00:02:55.039
Um, what what does that entail?
00:02:55.599 --> 00:03:06.319
So it's basically the same whether you're a home user that has a TV and a cell phone and a smart refrigerator.
00:03:06.319 --> 00:03:10.639
It's essentially the same in a county government, just at a much, much larger scale.
00:03:10.639 --> 00:03:15.520
It's protecting your basic things that you use on a day-to-day basis.
00:03:15.520 --> 00:03:28.639
Again, whether it's sensitive data that's here in the county or it's your own bank account information, it's just making sure that you have the appropriate protections around it and that you think about cybersecurity and think about how do you protect those on a regular basis.
00:03:28.639 --> 00:03:38.400
Many people lock their front doors and lock their windows as basic physical security protections, and they just have to expand that into the digital world.
00:03:38.800 --> 00:03:39.120
Yeah.
00:03:39.120 --> 00:03:43.439
It it certainly it has to somehow come naturally.
00:03:43.439 --> 00:03:45.039
We have to, because it's evolved.
00:03:45.039 --> 00:03:46.479
So we have to evolve with us.
00:03:46.479 --> 00:03:49.039
The threats have evolved.
00:03:49.039 --> 00:03:56.560
What what how do everyday users um I don't know, evolve with these threats?
00:03:56.560 --> 00:03:59.680
How how do we get used to, hey, I gotta lock this door?
00:03:59.680 --> 00:04:03.120
How do we do that?
00:04:03.360 --> 00:04:04.240
That's a great question.
00:04:04.240 --> 00:04:09.520
So what most people have to do is the advice that I give is be paranoid.
00:04:09.520 --> 00:04:30.480
Uh and they just have to think about is this really is this phone call that I'm getting really my daughter, or is it someone using uh a deep fake, essentially a copy of the of the person's voice, to do some sort of attack, like start try to steal my information or try to steal my data.
00:04:30.480 --> 00:04:41.360
And so I think the biggest challenge that people face, and and they're going to be facing very, very soon, is the threat of artificial intelligence.
00:04:41.360 --> 00:05:02.480
And so artificial intelligence will allow these bad actors, these hackers, to be able to copy people's voices, to be able to uh have very well-written uh emails and text messages to you and use some information that you already have out on the internet to be able to do these attacks.
00:05:02.480 --> 00:05:14.480
In fact, my team and I have been responding all morning to uh an attack against uh some people in Montgomery County that they spoofed a uh a payment.
00:05:14.480 --> 00:05:25.680
So they they they said Montgomery County sending you this payment, you need to pay this immediately, or we're going to uh remove you from our from our list or remove you remove you from our database.
00:05:25.680 --> 00:05:35.519
And so it's got the traditional sense of attacks of urgency and and uh you know asking for money that that we've all seen for 30 plus years.
00:05:35.519 --> 00:05:41.759
But the difference is that artificial intelligence was able to get all this information and make it relevant to the person.
00:05:41.759 --> 00:05:53.519
So rather than being a generic email from Nigeria, from a Nigerian prince like we saw 30 years ago, now it's okay, it came from someone you know and a reason uh that you should be getting it.
00:05:53.519 --> 00:05:59.519
It had a lot of the language that that the person that looked like it was from Montgomery County government would have said.
00:05:59.519 --> 00:06:04.560
And so AI just makes it so much more difficult to it to detect.
00:06:04.800 --> 00:06:05.199
Yeah.
00:06:05.199 --> 00:06:11.519
So our passwords and phrases, multi-authentication, is that enough now?
00:06:11.519 --> 00:06:14.480
Or what's the advice that you're giving now?
00:06:14.879 --> 00:06:22.639
So I would say my advice is the same thing that the same advice that I've given people and that the industry has talked about for years.
00:06:22.639 --> 00:06:24.639
It's just doing the basics.
00:06:24.639 --> 00:06:27.920
And the basics being have a good password.
00:06:27.920 --> 00:06:31.839
Don't put that password across multiple different systems.
00:06:31.839 --> 00:06:39.120
You know, if you have your bank account, it should not be the same password as your game password that you use to log into your gaming.
00:06:39.120 --> 00:06:42.800
It shouldn't be the same password as your refrigerator.
00:06:42.800 --> 00:06:54.560
And you should have multi-factor authentication, which means that, you know, if you log in, it should send it uh a text message to you or or require some interaction on your phone.
00:06:54.560 --> 00:07:02.639
You should also keep everything updated, uh including your phones and all the apps and all the devices in your in your uh home.
00:07:02.639 --> 00:07:04.720
Just again, the basics.
00:07:04.720 --> 00:07:08.800
And again, the basics also include being paranoid.
00:07:08.800 --> 00:07:26.480
Making sure that if you get the text message that appears to be from your daughter in the middle of the night, that you really think about it and you before you do action, you you verify that it's real and legit, because many times nowadays it's not.
00:07:26.879 --> 00:07:30.959
And I will say that I do like that multi- what multi-factor.
00:07:30.959 --> 00:07:42.399
Yes, I do like that because I prefer, even though it could sometimes, you know, for some people it might be like, oh man, I have to keep putting in the code or whatever, but I think it's worth it.
00:07:42.399 --> 00:07:55.360
I'd rather be, you know, putting in the code and have that text sent to me and instead of like, because sometimes I'll ask, um, do you want to just, you know, be able to uh log in automatically?
00:07:55.360 --> 00:07:57.600
I'm like, no, I don't want to log in automatically.
00:07:57.600 --> 00:08:01.199
I want that, I want that code and I want to put it in myself.
00:08:01.199 --> 00:08:04.160
I just I I trust, I like that a lot.
00:08:04.639 --> 00:08:05.279
Absolutely.
00:08:05.279 --> 00:08:24.399
And multi-factor is one of the basic things that that, like I said, is basic security protections because what happens is that, especially nowadays, hackers will break into a website, a well-known website, they will download all the users' logins and passwords and then sell that on the internet.
00:08:24.399 --> 00:08:35.679
And eventually that database of users' names and passwords gets posted somewhere in a hacker form, and they use those same user IDs and passwords to log into other websites.
00:08:35.679 --> 00:08:48.159
So even though it might, you might have a username and password for Facebook, they could use that to try to log into uh some other service like X or uh something like that and get access to your information.
00:08:48.159 --> 00:08:52.000
In fact, I stupidly shot myself in the foot.
00:08:52.000 --> 00:08:56.080
I had a shared password with uh one of my other accounts.
00:08:56.080 --> 00:08:58.639
Uh, it was for Spirit Airlines, actually.
00:08:58.639 --> 00:09:04.960
And the hackers used my same user ID and password at when Spirit Airlines was around.
00:09:04.960 --> 00:09:09.120
They didn't have multi-factor authentication, so I couldn't add that layer of protection.
00:09:09.120 --> 00:09:12.879
And they stole about 200,000 miles from me.
00:09:12.879 --> 00:09:14.799
They bought a bunch of plane tickets.
00:09:14.799 --> 00:09:22.399
And uh fortunately, Spirit Airlines initially didn't give it to me back, and eventually they did after me pleading with them.
00:09:22.399 --> 00:09:29.840
But I mean, that was a direct loss to me because I didn't have something as simple as multi-factor authentication place because they didn't have it available for Spirit.
00:09:30.159 --> 00:09:34.240
Yeah, and the updates, the the updates are super, super important.
00:09:34.559 --> 00:09:49.840
Um, talk to me about what so updating is just as simple as going into your phone, going into your TV, and typically there's something called a firmware screen or an update screen.
00:09:49.840 --> 00:09:53.200
Uh uh, just making sure that everything is kept update.
00:09:53.200 --> 00:10:06.559
And the reason for that is that attackers find ways of breaking into your device just by you visiting a website because of a security hole in your phone or your app or whatever you use.
00:10:06.559 --> 00:10:13.840
And so always recommend making sure that whatever devices that you use are kept update.
00:10:13.840 --> 00:10:19.120
And also the other risk is that the devices are purchased from someone well known.
00:10:19.120 --> 00:10:22.080
They're not bought, used off of eBay.
00:10:22.080 --> 00:10:39.120
Uh, in fact, we had a case specifically where uh a person had bought a cell phone off of eBay and someone had turned it into a device so that they could read everything that the person was doing on that cell phone even after it was sold.
00:10:39.120 --> 00:10:49.279
And so they had their retirement accounts drained, their bank account drained, everything, because again, it was essentially a hacked cell phone.
00:10:49.279 --> 00:10:53.440
Had they bought that new, then they wouldn't have had that problem.
00:10:53.440 --> 00:11:00.080
If they bought it new from a reputable place like their cell phone carrier or a reputable online store, they wouldn't have the problem.
00:11:00.080 --> 00:11:06.080
But now they're facing hundreds of thousands of dollars in financial loss because they tried to save a couple hundred dollars.
00:11:06.399 --> 00:11:22.000
Do you recommend, um, just thinking about the passwords, do you recommend when when um they when I don't know, the the when we get the automatic passwords, like and we just save it, they save it like maybe Microsoft might save the automatic password.
00:11:22.000 --> 00:11:22.960
Do you recommend that?
00:11:22.960 --> 00:11:26.159
And and if you do, what are the challenges that come with doing that?
00:11:26.639 --> 00:11:30.559
I would say what's more important is not to have a shared password.
00:11:30.559 --> 00:11:36.639
If you can use automatic passwords as a way not to share passwords between websites, that's great.
00:11:36.639 --> 00:11:45.519
The hackers aren't trying to guess your password anymore because the password requirements on these different websites are making it so it's a little bit more difficult.
00:11:45.519 --> 00:11:49.679
It's not just hello or one, two, three, four, five.
00:11:49.679 --> 00:11:52.559
You know, many websites don't allow those simple passwords anymore.
00:11:52.559 --> 00:12:01.039
So what they're doing, again, is they're they're getting password lists off the internet and using that to access other tools, access other websites.
00:12:01.039 --> 00:12:04.399
So uh that's a lot more important.
00:12:04.399 --> 00:12:15.200
Uh also the other thing that I would caution people on as it relates to passwords is they think, oh, I've got really strong passwords, but then they don't do the basics of security on your phone.
00:12:15.200 --> 00:12:19.519
Your security, your phone is essentially your master key nowadays.
00:12:19.519 --> 00:12:26.480
And if people get access to your phone, they can still get access to into your email.
00:12:26.480 --> 00:12:32.720
They can start uh resetting your passwords from there, they can break your two-factor off.
00:12:32.720 --> 00:12:38.080
Uh, and there are some hackers out there that are doing something called eSIM swapping.
00:12:38.080 --> 00:12:50.559
So they're basically making it that they'll call into the cell phone company, act like you, and say, Oh, I've got this new SIM card, which is a little uh number that's built into your phone.
00:12:50.559 --> 00:12:57.600
And they're able to then start getting your text messages and start getting uh all of your other app notifications.
00:12:57.600 --> 00:13:06.799
So again, making sure that your accounts are safe from your cell phone companies, making sure that your cell phone is protected and up to date is very, very critical.
00:13:08.000 --> 00:13:09.759
The face recognition.
00:13:10.000 --> 00:13:10.320
Yes.
00:13:10.639 --> 00:13:13.279
That's that include that, right?
00:13:13.600 --> 00:13:30.480
Include face recognition or at least a very good, like a uh a uh six-character password when you access your phone with some sort of a lock on it, so that if someone sits there and tries a bunch of numbers, it locks out for a certain period of time is absolutely recommended.
00:13:30.480 --> 00:13:30.720
Yeah.
00:13:30.879 --> 00:13:31.120
Yes.
00:13:31.279 --> 00:13:35.360
Because again, your cell phone is your master key into all of your accounts nowadays.
00:13:35.600 --> 00:13:36.080
That's true.
00:13:36.080 --> 00:13:36.799
Yes.
00:13:36.799 --> 00:13:41.039
So let's talk a little bit about recognizing these emerging threats.
00:13:41.039 --> 00:13:47.440
You talked, you you touched on it on it a little bit, but um, let's start with the phishing and and the smishing.
00:13:47.440 --> 00:13:51.200
I think those are like the OG scams of the digital world, right?
00:13:51.200 --> 00:13:53.919
So, what are the warning signs for those?
00:13:54.320 --> 00:14:00.960
The biggest thing is that the sense of urgency, because again, the attackers are going to use AI.
00:14:00.960 --> 00:14:05.039
They're gonna make, they're gonna use AI to make it seem very realistic.
00:14:05.039 --> 00:14:21.919
It's gonna have perfect English, it's going to uh have a lot of the information about you because they're gonna use the internet to gather all this information about you, such as who your children are, who your grandchildren are, or your parents, or uh where you work, or all this information.
00:14:21.919 --> 00:14:23.840
It's all already readily available on the internet.
00:14:23.840 --> 00:14:28.960
They're gonna use that to craft these sort of attacks against you.
00:14:28.960 --> 00:14:38.960
So my usual warning is first, is if there's a sense of urgency, that's a common thing that they use, is you need to do this now.
00:14:38.960 --> 00:14:40.559
Always be leery of that.
00:14:40.559 --> 00:14:48.159
And also always be leery if they say click here or call this phone number immediately.
00:14:48.159 --> 00:14:51.840
Because a lot of time those are spoofed, they go to the attackers.
00:14:51.840 --> 00:15:00.559
And so instead, use a common number, uh, a website that you're familiar with to be able to uh contact them back.
00:15:01.919 --> 00:15:04.799
I had to follow my own advice.
00:15:04.799 --> 00:15:11.600
I got a text from um from an account that I have with Robin Hood.
00:15:11.600 --> 00:15:24.080
And and I got a text that someone had hacked into my account and that I should call them um right away or something, and they gave me the phone number or clicked the link.
00:15:24.080 --> 00:15:26.240
So I said, Well, I'm not clicking a link.
00:15:26.240 --> 00:15:30.639
And then I looked at the number and I said, I'm not calling that number either.
00:15:30.639 --> 00:15:34.080
And like remembered all the practice what you preach.
00:15:34.080 --> 00:15:39.120
And I just called them directly and nothing happened.
00:15:39.120 --> 00:15:42.240
I even checked my account, I even got on my account and nothing had happened.
00:15:42.240 --> 00:15:43.519
I was like, well, I don't see anything.
00:15:43.519 --> 00:15:46.320
And then I called them, they said, yep, no, nothing happened.
00:15:46.320 --> 00:15:51.440
And so I actually sent them the text so they know like this is this is this is going around.
00:15:51.440 --> 00:15:57.679
But yeah, uh, go back to your origin to the to their phone number, to their app.
00:15:57.679 --> 00:16:03.120
Don't click on any links or call any phone numbers that they that they have provided to you.
00:16:03.120 --> 00:16:06.000
Thank you.
00:16:06.639 --> 00:16:08.080
And I got a similar phone call.
00:16:08.080 --> 00:16:12.960
I got a phone call from my bank, same thing from the fraud department saying we've just got some charges.
00:16:12.960 --> 00:16:17.200
We're we're they're not gonna show up in your account yet because they're being investigated for fraud.
00:16:17.200 --> 00:16:20.159
The first five numbers of your of your credit card are this, right?
00:16:20.159 --> 00:16:21.840
And I said, Yeah, they are.
00:16:21.840 --> 00:16:25.120
And then they said, Okay, uh, what's the zip code?
00:16:25.120 --> 00:16:27.840
And I said, Okay, now they're asking me for information that they already have.
00:16:27.840 --> 00:16:31.360
They said, in order to validate this phone call, we want to make sure we're talking with Keith.
00:16:31.360 --> 00:16:32.879
Uh, what's the zip code in the account?
00:16:32.879 --> 00:16:36.000
And I gave them my zip code, which I knew was not really sensitive information.
00:16:36.000 --> 00:16:37.919
Again, anyone can find that out online.
00:16:37.919 --> 00:16:45.279
Uh, and then they started asking more questions, started going down the route of, have you done this charge and this charge and this charge?
00:16:45.279 --> 00:16:48.799
And then they said, Okay, what are the remaining 11 numbers on your credit card?
00:16:48.799 --> 00:16:51.360
You know, we just got to be able to put this into our system.
00:16:51.360 --> 00:16:56.480
And at that point, you know, I I my spidey sense was going off long before that.
00:16:56.480 --> 00:16:59.440
But at that point, I said, okay, this is absolutely a scam.
00:16:59.440 --> 00:17:05.680
So I gave them fake numbers I made up in my head and then just played along with them for a while.
00:17:05.680 --> 00:17:10.400
And uh eventually they just said, Oh, we're not scammers, we're not scammers, and hung up on me.
00:17:10.640 --> 00:17:11.279
Oh, wow.
00:17:11.440 --> 00:17:18.160
That's and sure enough, I went back to my bank and uh there were no fraud charges or anything that looked suspicious.
00:17:18.160 --> 00:17:18.400
Yeah.
00:17:18.400 --> 00:17:27.440
But again, they had enough information because they knew my bank because of a previous incident with my credit card where one of the websites that I used my credit card in was broken.
00:17:27.440 --> 00:17:28.720
So they knew what bank I had.
00:17:28.720 --> 00:17:31.279
They knew the first five numbers of my credit card.
00:17:31.279 --> 00:17:34.559
And so they used that as information to try to fool me.
00:17:34.880 --> 00:17:37.279
Because no matter what, our information is out there.
00:17:37.279 --> 00:17:44.559
And they can pick any, any, any small thing that they can grab a hold of, they're gonna pick it and they're gonna use it to their advantage.
00:17:44.799 --> 00:17:45.279
Absolutely.
00:17:45.279 --> 00:17:45.599
Yeah.
00:17:45.599 --> 00:17:53.359
And especially, like I said, if you pair that with AI, we're gonna be getting tens hundred phone calls a day.
00:17:53.359 --> 00:18:01.039
We're gonna be getting text messages constantly because there's no real cost to these attackers and these hackers doing it nowadays.
00:18:01.039 --> 00:18:02.240
They can automate it all.
00:18:02.240 --> 00:18:08.319
They can have a human-sounding voice do these phone calls and it might cost them a couple of pennies.
00:18:08.559 --> 00:18:08.880
Yeah.
00:18:09.119 --> 00:18:14.079
But they might gain a couple hundred or a couple thousand dollars off of doing a single phone call.
00:18:14.400 --> 00:18:16.000
And let's talk about AI.
00:18:16.000 --> 00:18:26.240
Um, you know, it it it it social engineering, they they manipulate, you know, uh everything they can, the our voices, the deep fake, the spoofing of the phone numbers.
00:18:26.240 --> 00:18:34.240
Um, sometimes these phone numbers, um, uh I've had people say, well, it said Montgomery County, or it said, you know, the the business.
00:18:34.240 --> 00:18:38.240
Um so you can't even trust those like caller IDs anymore.
00:18:38.240 --> 00:18:41.200
Um, so like you said, just be paranoid.
00:18:41.519 --> 00:18:42.400
Yeah, just be paranoid.
00:18:42.400 --> 00:18:47.279
The best advice is is don't don't trust anyone, especially if they're contacting you.
00:18:47.279 --> 00:18:49.039
Uh just be paranoid.
00:18:49.039 --> 00:18:56.240
And like like you mentioned, is go back to the original phone numbers, the original websites, uh, use that to contact them back.
00:18:56.240 --> 00:19:00.240
They'll have ways to validate you rather than you trying to validate them.
00:19:00.480 --> 00:19:01.599
Yeah, that's right.
00:19:01.599 --> 00:19:05.680
What other things uh that the AI um can use?
00:19:05.680 --> 00:19:07.920
Like, for example, the the deep fakes.
00:19:07.920 --> 00:19:12.799
Um, what does it take for them for AI to be able to clone your voice?
00:19:12.960 --> 00:19:14.640
Or great question.
00:19:14.640 --> 00:19:19.200
So uh funny enough, I talked to a company last week that's gonna deep fake me.
00:19:19.200 --> 00:19:35.519
Uh, and they used my previous podcast here uh to get my voice and get my face, and they're gonna uh send that back to me and say, here you go, here's something for Montgomery County Security Awareness Training, and we're gonna have you say whatever we want you to say, and you can put that up on your training.
00:19:35.519 --> 00:19:39.440
So it's literally just 15 seconds of voice and video is all they need.
00:19:39.680 --> 00:19:40.640
That's incredible.
00:19:40.640 --> 00:19:44.240
What about what what is social and uh uh social engineering?
00:19:44.240 --> 00:19:45.119
What is that?
00:19:45.440 --> 00:19:52.480
So social engineering is just again a way to use information that they know about you to get you to do something.
00:19:52.480 --> 00:20:04.720
So uh there was a a case where my dad got a phone call and they said, Hi, this is your daughter, and mentioned my daughter's name and said, I'm stuck up here in Canada.
00:20:04.720 --> 00:20:07.759
I need you to uh send me money right away.
00:20:07.759 --> 00:20:08.720
Please, please.
00:20:08.720 --> 00:20:11.599
I I I got robbed and they stole my wallet.
00:20:11.599 --> 00:20:18.559
And my dad was, of course, you know, very concerned, hearing a panicked phone call from his granddaughter.
00:20:18.559 --> 00:20:23.599
And he then uh said, you know, are you okay?
00:20:23.599 --> 00:20:26.720
And and she mentioned, she said, Yeah, I am, and pop pop.
00:20:26.720 --> 00:20:31.039
And and he said, Wait a second, she's never called me by that nickname in my life.
00:20:31.039 --> 00:20:35.279
And he then just got a little questioning about it.
00:20:35.279 --> 00:20:38.160
He said, So are you up there with your boyfriend John?
00:20:38.160 --> 00:20:40.160
And that's not her boyfriend's name.
00:20:40.160 --> 00:20:42.000
And she said, Yeah, yeah, I'm here with John.
00:20:42.000 --> 00:20:45.440
And that's when my dad knew, okay, this is entirely fake.
00:20:45.440 --> 00:20:46.480
This is deep fake.
00:20:46.480 --> 00:20:48.960
They got somehow got my daughter's voice.
00:20:48.960 --> 00:20:54.799
And had I gone through with it, that uh, you know, they could have stolen a couple thousand dollars.
00:20:54.799 --> 00:21:00.079
I he said, I would have been done anything to take care of my granddaughter, but I'm not gonna give the money to these scammers.
00:21:00.319 --> 00:21:01.680
Yeah, absolutely.
00:21:01.680 --> 00:21:16.000
So then social engineering, that's because I know that people hear those words, and so it's basically whatever information they that that we have out there, these scammers are using that information to engineer a scam.
00:21:16.480 --> 00:21:16.960
Absolutely.
00:21:16.960 --> 00:21:20.079
And like I said, it it's going to happen very shortly.
00:21:20.079 --> 00:21:23.039
In fact, it's already started to happen where it's entirely automated.
00:21:23.039 --> 00:21:25.920
You're it's not even going to be people doing these attacks.
00:21:25.920 --> 00:21:28.079
They're gonna be doing it at the speed of technology.
00:21:28.079 --> 00:21:33.440
You're gonna be getting tens, if not hundreds, of phone calls, text messages, et cetera, a day.
00:21:33.440 --> 00:21:37.440
Uh, because again, the tools are out there to be able to do these types of attacks.
00:21:37.759 --> 00:21:38.400
Yeah.
00:21:38.400 --> 00:21:41.200
Oh, that's a scary thought.
00:21:41.200 --> 00:21:42.960
It's so quick.
00:21:42.960 --> 00:21:45.839
Everything is is just so is happening so quickly.
00:21:45.839 --> 00:21:46.960
We have to keep up.
00:21:47.440 --> 00:21:49.759
Yeah, we have to keep up, but the basics are still there.
00:21:49.759 --> 00:21:55.200
Just keep everything updated, have good passwords with MFA, be paranoid.
00:21:55.200 --> 00:21:57.519
Always be paranoid.
00:21:57.519 --> 00:22:04.559
And uh whether it's a huge Human doing it, whether it's a computer doing it, again, just focus on the basics.
00:22:04.559 --> 00:22:07.519
Don't be, don't be scared, just be paranoid.
00:22:07.839 --> 00:22:08.240
Yes.
00:22:08.240 --> 00:22:14.799
So those everyday habits, build on those everyday habits that will help you protect yourself.
00:22:14.799 --> 00:22:22.640
Because things like passwords and the multi-factor authentication updates, they still work and protect you.
00:22:22.640 --> 00:22:25.839
You just have to keep up with that, with those things.
00:22:26.079 --> 00:22:26.480
Absolutely.
00:22:26.480 --> 00:22:32.960
Absolutely the same way that you lock your front door, lock your car door because you don't want someone stealing stuff out of your car.
00:22:32.960 --> 00:22:34.640
It's the same recommendations.
00:22:34.640 --> 00:22:38.079
Just do the basics and for the most part, you'll be safe.
00:22:38.319 --> 00:22:42.799
And how do people keep informed with these, with these, with, with anything that's that's that's going on?
00:22:42.799 --> 00:22:49.359
Is there a are there are there any um tools or or resources that they should definitely be?
00:22:49.359 --> 00:22:51.119
Hey, you should be on this website.
00:22:51.119 --> 00:22:52.319
It'll help you.
00:22:52.319 --> 00:22:56.720
Um, is there anything like that that maybe we can um let them know about, our listeners?
00:22:57.039 --> 00:22:57.839
So that's a good question.
00:22:57.839 --> 00:23:01.599
What I would do is I would actually use AI against it, the attackers.
00:23:01.599 --> 00:23:05.119
So I would go on Google and ask some basic questions.
00:23:05.119 --> 00:23:10.640
You know, what do I need to do to protect myself against this, whatever this is?
00:23:10.640 --> 00:23:20.640
Or uh how do I report uh if I've been a victim of a crime, how do I report that to the local police, FBI, et cetera?
00:23:20.640 --> 00:23:27.599
And again, use AI against them, and you can remain up to date by using those same tools.
00:23:27.920 --> 00:23:39.119
Yeah, because you go on Google now and you can look something up, but then it will ask you a question, like if you want to go further into, I guess, whatever whatever subject you've you've looked up.
00:23:39.119 --> 00:23:39.519
Absolutely.
00:23:39.519 --> 00:23:40.559
Is that what you're okay?
00:23:40.799 --> 00:23:45.680
Yep, that's so right underneath that is is gonna have an AI generated response.
00:23:45.680 --> 00:23:51.680
And again, that needs to be validated, much like much like these these phone calls and text messages, et cetera.
00:23:51.680 --> 00:24:10.640
So click on the links and see if it's coming, if the answers are coming from a reputable website such as the FBI or or ic3.gov, something like that, where it's a it's a known reputable website for providing information on how to avoid being scammed or what to do if you have been.
00:24:10.960 --> 00:24:22.160
Does Montgomery County uh do anything um with um education for the community um or anything that that maybe the that that the listener should be aware of?
00:24:22.559 --> 00:24:22.880
Yeah.
00:24:22.880 --> 00:24:28.000
So actually, I know that the Office of Consumer Protection does a lot of reach out.
00:24:28.000 --> 00:24:30.799
I know that the police department does reach out.
00:24:30.799 --> 00:24:45.680
Uh I'm usually on various different webinars or various different uh panels discussing how people need to protect themselves, whether you're a small business, whether you're a resident, or whether you're just passing through.
00:24:45.680 --> 00:24:49.680
Uh there's lots of resources that the county government will provide to you.
00:24:50.000 --> 00:24:56.960
Are there any uh certain resources that you that you use or how to or how if there is an issue, um, how people can report it?
00:24:56.960 --> 00:25:05.119
I know OCP is definitely one, but any anything, anything else that you uh like I said, there's IC3, uh there's local police.
00:25:05.279 --> 00:25:16.720
It all depends on what your role is in Montgomery County, whether you're a business owner and you're reporting a business loss, uh, whether you're a resident reporting you lost a couple hundred dollars.
00:25:16.720 --> 00:25:23.279
It it all depends on uh what your uh what you're what you're concerned about.
00:25:23.279 --> 00:25:32.640
But again, starting with the Office of Consumer Protection and uh OCP can redirect you in the right place, uh, but that would be a good place to start.
00:25:32.640 --> 00:25:37.119
And I believe you can contact OCP through uh 311 if you're in the county.
00:25:37.359 --> 00:25:38.160
Absolutely.
00:25:38.160 --> 00:25:44.160
And you can contact us directly at uh 240-777-3636.
00:25:44.160 --> 00:25:47.759
But thank you for putting that in.
00:25:47.759 --> 00:25:57.200
Um, no, and the thing is that we just we can't um everybody has to deal with the digital world one way or another.
00:25:57.200 --> 00:26:04.240
So it's so important to stay informed, um, to stay updated on on new things.
00:26:04.240 --> 00:26:11.839
What is the is there the is there like a certain newest thing that you just have to tell us about um that we should, you know, watch out for?
00:26:12.720 --> 00:26:15.359
Uh I think the newest thing is still AI.
00:26:15.359 --> 00:26:22.480
I think that's what's going to be the biggest threat to people's online persona.
00:26:22.480 --> 00:26:29.359
Uh and as an offshoot of AI, there's something called AI agents.
00:26:29.359 --> 00:26:39.920
So that's essentially something that can act as you and do some tasks on your behalf that that utilizes artificial intelligence to do the task.
00:26:39.920 --> 00:26:47.759
And so for me, I I don't like to have to track timesheets, for instance, for my staff.
00:26:47.759 --> 00:26:49.359
I want to make sure that they do it.
00:26:49.359 --> 00:27:01.680
So I I want to be able to write an AI agent that that if they don't do their timesheets by a certain time before I get notified, I'm notifying my staff saying, okay, you've got to get it, you've got one hour to get your timesheet done.
00:27:01.680 --> 00:27:07.279
Uh today I'm doing that manually, but if I can automate that, then I can use an AI agent.
00:27:07.279 --> 00:27:14.640
But similarly, if if I can use an AI agent for good, then it attackers can use AI agents for bad.
00:27:14.799 --> 00:27:15.039
Yeah.
00:27:15.039 --> 00:27:15.279
Yeah.
00:27:15.759 --> 00:27:26.640
And they can use and so if I don't protect my username and password and two-factor for that, they can also use those AI agents to do something as me.
00:27:26.640 --> 00:27:39.039
And so that I think is the biggest thing AI and AI agents that people really need to think about, uh, along with the whole world of digital privacy and and what information you're actually putting out there.
00:27:39.039 --> 00:27:42.400
Uh, is your doorbell camera, for instance, protected?
00:27:42.400 --> 00:27:47.200
Can they use that information anyway that that would be concerning to you?
00:27:47.200 --> 00:27:52.640
So do some basic research on the tools that you have, the products that you have at your house.
00:27:52.960 --> 00:27:55.359
I was gonna, I was just about to touch on that.
00:27:55.359 --> 00:28:01.759
The products that we have in our house, I was just like even thinking about our kids on um on video games.
00:28:01.759 --> 00:28:09.599
Is there, is there a certain is there, because there's they're really they have their information out there, they're playing with different people.
00:28:09.599 --> 00:28:11.599
Um, so be very weary of that.
00:28:11.599 --> 00:28:14.240
Is there, are there any tips on on maybe that?
00:28:14.240 --> 00:28:23.200
And we're like, hey, I I gotta make sure my my ring is is is updated or or I don't know, like what devices should we other than our computer?
00:28:23.200 --> 00:28:28.480
Because we always think of our computers, our tablets, you know, um, and our phone.
00:28:28.480 --> 00:28:34.720
But are there any other devices that we have to just make sure that, hey, this needs to be updated, this needs to be secure?
00:28:34.960 --> 00:28:37.839
I would say every device, every device that you have.
00:28:37.839 --> 00:28:46.559
So if you think about your your Wi-Fi device that is either you bought yourself or you got from your cable company, how old is it?
00:28:46.559 --> 00:28:51.119
And should you go back to your cable company or go out to the store and get a new one?
00:28:51.119 --> 00:28:56.720
Uh, your ring cameras or your uh your doorbell cameras, you know, how old are they?
00:28:56.720 --> 00:29:01.039
Are you going and logging in at least every once in a while to make sure that software is up to date?
00:29:01.039 --> 00:29:02.960
Because hackers could use that to break it.
00:29:02.960 --> 00:29:08.720
Your printers and your refrigerators, you know, do you have those online?
00:29:08.720 --> 00:29:12.799
And you if they are online, are they updated?
00:29:12.799 --> 00:29:18.640
And if they're online and you're like, I don't know why this is online, why not take it offline?
00:29:19.279 --> 00:29:20.000
Okay, yep.
00:29:20.000 --> 00:29:21.519
Because I was just thinking of that.
00:29:21.519 --> 00:29:35.519
Like my refrigerator's online, and I do get on there and once in a while, I mean, once every blue moon, but to see that it's updated, but also my thermostat is online, my television is online, like everything really is online.
00:29:35.519 --> 00:29:39.680
And now I'm thinking to myself, what do I need my refrigerator online for?
00:29:40.000 --> 00:29:44.319
Your TV, because everyone wants to be able to stream that necessarily, that has to be online.
00:29:44.319 --> 00:29:46.799
But does your flower pot need to be online?
00:29:46.799 --> 00:29:48.480
Does your toaster need to be online?
00:29:48.480 --> 00:29:49.440
Probably not.
00:29:49.440 --> 00:29:49.839
Yeah.
00:29:49.839 --> 00:29:53.200
And so there's a saying in computer security called KISS.
00:29:53.200 --> 00:29:55.680
It's called, it's keep it simple, stupid.
00:29:55.680 --> 00:30:01.759
And the the easiest way to protect something is making sure that it has no connectivity to anything.
00:30:01.759 --> 00:30:08.480
The most secure device on the planet has no cords plugged into it and is buried in under 30 feet of concrete.
00:30:08.480 --> 00:30:11.279
Anything greater than that adds a little bit of risk.
00:30:11.440 --> 00:30:11.839
Yes.
00:30:12.240 --> 00:30:17.200
And so if you put something online, there's a risk that hackers somehow somehow could get access to it.
00:30:17.200 --> 00:30:21.119
And do you want them accessing your bank account through your toaster?
00:30:21.119 --> 00:30:21.920
I don't think so.
00:30:22.079 --> 00:30:22.400
Yeah.
00:30:22.400 --> 00:30:23.680
No, and that's the truth.
00:30:23.680 --> 00:30:30.160
And I, and and you know, when when when social uh media first came out, um, it was fun.
00:30:30.160 --> 00:30:32.000
It was about staying connected.
00:30:32.000 --> 00:30:37.519
Um and and and I think people we put all kinds of stuff out there.
00:30:37.519 --> 00:30:43.200
And now it's just like, gotta go back and make sure that that information is like taken out.
00:30:43.200 --> 00:30:51.680
Because I think on I had my phone number out there when um when we first, when I first got um Facebook, I had put my phone number on there.
00:30:51.680 --> 00:30:53.920
And now I'm just like, why is my phone number there?
00:30:53.920 --> 00:30:54.880
Take it off.
00:30:54.880 --> 00:30:56.240
You know, there's certain things.
00:30:56.240 --> 00:30:59.920
I was like, no, people don't need to know everything.
00:30:59.920 --> 00:31:06.880
And unfortunately, everything is out there at this point, but you know, it just keep your information as safe as possible.
00:31:07.279 --> 00:31:07.759
Absolutely.
00:31:07.759 --> 00:31:13.200
And and people that post, they say, Oh, I'm going on vacation, or they post they're on a flight.
00:31:13.200 --> 00:31:19.519
I mean, that tells all of all of your friends at a minimum that you're at out of the house.
00:31:19.680 --> 00:31:19.920
Right.
00:31:20.079 --> 00:31:27.759
And if you're not careful, you post that out to the wild uh internet, then you told everyone that you're not home.
00:31:27.759 --> 00:31:34.480
And there's going to be there's tools to search through all of people's public posts on social media.
00:31:34.480 --> 00:31:44.319
And so all it takes is someone to search through vacation and the fact that they're leaving the area, and you just mapped out that that your home is available for robbery.
00:31:44.319 --> 00:31:46.960
You have a ring camera, you post ring videos.
00:31:46.960 --> 00:31:49.359
Again, you provide more and more information.
00:31:49.519 --> 00:31:49.920
Yeah.
00:31:50.160 --> 00:31:55.119
And it just allows people to do some bad things that you really don't want them to do.
00:31:55.279 --> 00:31:55.440
Yeah.
00:31:55.680 --> 00:32:02.799
So be very sensitive about what information you post publicly, what you tell people who you don't know, etc.
00:32:03.200 --> 00:32:03.599
Yeah.
00:32:03.599 --> 00:32:05.200
Okay.
00:32:05.200 --> 00:32:11.440
Quick questions, short answer, then rapid fire questions.
00:32:11.440 --> 00:32:12.240
All right.
00:32:12.240 --> 00:32:16.400
Um, what's the biggest mistake that consumers make online?
00:32:17.519 --> 00:32:20.240
I think the biggest mistake is again trusting.
00:32:20.240 --> 00:32:21.680
You have to be paranoid.
00:32:22.400 --> 00:32:22.799
Yes.
00:32:22.799 --> 00:32:26.640
One cybersecurity myth you wish would go away.
00:32:28.559 --> 00:32:30.240
Uh, that's a great question.
00:32:30.240 --> 00:32:37.759
I would say the fact that cybersecurity is just a techie problem.
00:32:37.759 --> 00:32:39.839
It's it's a problem that everyone faces.
00:32:39.839 --> 00:32:41.680
Everyone needs to think about security.
00:32:42.240 --> 00:32:43.200
That is so true.
00:32:43.200 --> 00:32:43.920
Yes.
00:32:43.920 --> 00:32:48.240
One action listeners can take today to be safer online.
00:32:48.640 --> 00:32:49.440
MFA.
00:32:49.440 --> 00:32:50.960
Multifactor authentication.
00:32:50.960 --> 00:32:53.359
Enable that for every account.
00:32:53.359 --> 00:33:01.839
And if you have the opportunity to use an app that goes along with it, an authenticator app, and there's multiple ones out there, I enable that.
00:33:02.319 --> 00:33:03.200
Excellent.
00:33:03.200 --> 00:33:07.200
Um the most underrated safety practice.
00:33:08.319 --> 00:33:16.880
I think the most underrated safety practice would probably be lack of paranoia.
00:33:16.880 --> 00:33:19.200
I I think I still go back to that.
00:33:19.200 --> 00:33:24.000
I think if you're paranoid, that covers a lot of different attacks that can that you can face.
00:33:24.240 --> 00:33:24.640
Yes.
00:33:24.640 --> 00:33:30.319
I really like your answer about the cybersecurity myth because it really it it's it's our responsibility.
00:33:30.319 --> 00:33:35.200
Um we we we have to take responsibility for that and make sure that our stuff is safe.
00:33:35.200 --> 00:33:37.279
Um, so I really like that.
00:33:37.279 --> 00:33:43.039
Um, because it's not just professionals, I thank you for for everything you all do.
00:33:43.039 --> 00:33:48.640
But at the end of the day, you give us the tools or the professionals give us the tools to stay safe.
00:33:48.640 --> 00:33:49.839
So use them.
00:33:49.839 --> 00:33:52.240
Um, so I I appreciate that.
00:33:52.240 --> 00:33:59.200
Anything else you want to just add to before we um stop here or or end our conversation?
00:34:00.160 --> 00:34:09.599
Uh I think the thing that I would add is just making sure that the classic thing of if you see something, say something.
00:34:09.599 --> 00:34:19.920
If you get some sort of attack, notify the Office of Consumer Protection, notify IC3, even just tell your friends.
00:34:19.920 --> 00:34:26.880
The more that people think about cybersecurity in their day-to-day practice, or think about security in general.
00:34:26.880 --> 00:34:33.360
Uh you know, there's different neighborhood groups and and things online that you can join.
00:34:33.360 --> 00:34:40.320
And if there's someone going around and breaking into cars that are unlocked, I I think everyone would want to know about that.
00:34:40.320 --> 00:34:40.800
Yes.
00:34:40.800 --> 00:34:51.599
And so just again, being more vocal about security and cybersecurity in general is probably the most the the best thing for people to do.
00:34:51.920 --> 00:34:55.119
We are huge on that here at the office.
00:34:55.119 --> 00:34:58.719
We want people to sp tell us their story.
00:34:58.719 --> 00:35:10.480
We want people to to um to speak about it, to voice it, because we get to know patterns, we get to know tendencies um when it comes to scams or something.
00:35:10.480 --> 00:35:12.880
So the same thing goes for the cybersecurity.
00:35:12.880 --> 00:35:14.880
If something happens, say something.
00:35:15.119 --> 00:35:15.519
Absolutely.
00:35:15.599 --> 00:35:18.000
Um, because it does, we have to watch out for each other.
00:35:18.400 --> 00:35:18.719
Absolutely.
00:35:19.039 --> 00:35:27.760
And and I think that advice is goes across the platform for everybody and for almost anything.
00:35:27.760 --> 00:35:29.760
Um I appreciate that.
00:35:29.760 --> 00:35:30.880
That's great advice.
00:35:30.880 --> 00:35:31.360
Thank you.
00:35:31.679 --> 00:35:32.159
You're welcome.
00:35:32.400 --> 00:35:33.039
All right.
00:35:33.039 --> 00:35:38.800
Thank you for joining us for the Cybersecurity Month episode of Consumer Connection.
00:35:38.800 --> 00:35:48.800
A special thank you to our guest, Keith Young, for sharing his expertise and helping us better understand how to protect our personal information online.
00:35:48.800 --> 00:36:02.719
Remember, even small actions like enabling multi-factor authentication, staying alert to phishing attempts, and keeping your device updated can make a big difference in staying secure.
00:36:02.719 --> 00:36:09.039
Stay safe online, stay informed, and we'll see you next time on Consumer Connection.
00:36:09.039 --> 00:36:20.800
Don't forget to subscribe on your favorite podcast platform and keep an eye out for upcoming episodes where we'll continue to bring you important updates and insights on consumer protection.
00:36:20.800 --> 00:36:25.199
Have a topic in mind for a future episode or a question for our team?
00:36:25.199 --> 00:36:30.639
Drop us an email at consumerconnection at Montgomery CountyMD.gov.
00:36:30.639 --> 00:36:42.079
If you enjoyed this episode, please share it with your friends and family and stay in the loop with OCP by searching the hashtag MCGOCP on social media.
00:36:42.079 --> 00:36:46.960
Remember, knowledge is key for safeguarding your consumer rights.
00:36:46.960 --> 00:36:50.880
Stay informed, stay protected, and stay connected.
00:36:50.880 --> 00:36:52.480
Until next time.
00:36:53.280 --> 00:37:00.960
This podcast is brought to you by County Cable Montgomery, your source for news and information from the Montgomery County government.
00:37:00.960 --> 00:37:07.760
Connect with us via cable, Facebook, Instagram, or YouTube by searching for County Cable Moco.