Latest / Breaching the Boardroom / The Anatomy of a Cyber Attack

Transcript

The Anatomy of a Cyber Attack · Breaching the Boardroom

• 0:01
  Hi everyone, we have David Mauro here and Natalie Suarez.
• 0:06
  Natalie is with ConnectWise, one of our partners.
• 0:12
  Natalie, can you tell us a little bit about your origin story?
• 0:15
  How did you get started in cybersecurity and IT?
• 0:20
  So that's a really strange story.
• 0:22
  I actually was working for a commercial real estate company.
• 0:25
  I was very young and I'd always been interested in computers and the owner of the real estate company needed someone to help him manage the computers for the commercial real estate agents.
• 0:38
  So he really took me under his wing and just showed me everything and absolutely loved it.
• 0:43
  Decided to go back to school, get my computer engineering degree.
• 0:46
  and then became a software developer for the MITRE Corporation, worked in the government space, helping intelligence analysts for the longest time.
• 0:53
  And it was a natural progression because threat intelligence is threat intelligence.
• 0:57
  It doesn't matter if it's for military or if it's for cyber threats, it's the same type of processes and moved into my first startup and just loved it.
• 1:09
  long story short, and here I am now at ConnectWise.
• 1:13
  That's phenomenal.
• 1:14
  Can I ask you a follow up to that?
• 1:16
  So explain for the listeners kind of the role of the MITRE organization.
• 1:22
  Like they're kind of a independent nonprofit.
• 1:26
  They kind of set standards.
• 1:27
  They create sandboxes so that when a lot of the software out there, you know, in the cybersecurity space or otherwise, when they can test it and see what it looks like, right?
• 1:39
  yeah, they do a lot of cool work.
• 1:41
  So MITRE is actually what's called a federally funded research and development center.
• 1:46
  So even as a software developer, we were doing a lot of experimental stuff.
• 1:50
  Like you said, a lot of working in sandboxes and making sure that what we did was actually helping and not messing things up for a data analysis or a cybersecurity perspective actually.
• 2:02
  MITRE publishes the MITRE attack framework, a lot of our listeners might be familiar with.
• 2:08
  I did not work on that project, but was aware of that and also publishes the common vulnerability and iterations, the CVEs, cve.mitre.org, MITRE.org.
• 2:20
  And it's not an acronym, allegedly.
• 2:25
  They do a lot of great, yeah.
• 2:27
  that MITRE ATT &CK framework.
• 2:28
  And can you kind of just explain to us, like I'm a third grader, kind of like what is it's the way I look at it.
• 2:37
  And I could it's a basic view, but it seems like a framework for evaluating the risks that are out there, the cyber crime risks, certain types of ransomwares.
• 2:51
  you know, remote access Trojans, things like that.
• 2:54
  So what it does is it's actually, we're gonna go back to MITRE's military roots here, believe it or not.
• 3:01
  They're called TTPs, and that's a military term.
• 3:03
  It stands for Tactics, Techniques, and Procedures.
• 3:06
  And basically what that is, is a taxonomy or a dictionary of the TTPs that the threat actors or the bad guys use so that we can, so we have to know what the bad guy is thinking and what they're.
• 3:20
  what, how they're going to do it.
• 3:22
  If we know what the bad guy, how the bad guy is going to accomplish their goal, which is stealing our data or, you know, conducting a distributed denial of service attack.
• 3:31
  If we know what they're going to do or how they're going to do it, it makes it that much easier to prevent it, to, you know, to have safeguards that mitigate our risk.
• 3:40
  And that's the purpose of the attack framework.
• 3:43
  As a matter of fact, our cyber research unit here at ConnectWise, I know you're aware, but our listeners may not be aware.
• 3:51
  They actually, all the threat research they do and the attacks and the threat actors that they investigate, they map all of that back to the MITRE ATT &CK framework.
• 4:01
  So it's easier to defend yourself against those attacks.
• 4:06
  So for most listeners, let's say there's business leaders or business owners of smaller businesses and they don't have the internal security teams or they're not versed in this.
• 4:23
  It seems to me like it's similar to traditional crime fighting that the police departments do or the standard detectives do.
• 4:35
  And then there's an element of understanding the modus operandi.
• 4:39
  Like, you know, when you think of the old movies, if you will, right, like somebody would always kind of do a thing and leave a mark, right?
• 4:49
  Like that's their modus, that's their MO.
• 4:51
  That's how we know the Joker did it, right?
• 4:54
  Like that's how we know these people did it, right?
• 4:57
  Like, I'm not trying to make it too simplistic, but really it's, it's really not more complicated than that at the end of the day.
• 5:04
  Right.
• 5:04
  And that MO, that unique TTP that they use, right, kind of defines them.
• 5:11
  And then when we see evidence of that, we know how to defend it.
• 5:16
  Okay, and when threat researchers, the good guys, see certain TTPs, that's how they identify which threat actor it is too.
• 5:26
  So you could take that even further.
• 5:28
  It's useful both for us on the defense side and for the actual threat researchers to understand what may be coming next.
• 5:38
  If we know it's a certain threat actor and they're doing...
• 5:42
  these three things, well, they always do these three things first, and then they do steps four and five.
• 5:47
  So we can kind of get ahead of that.
• 5:49
  Yeah.
• 5:50
  Yeah, it's it's interesting.
• 5:52
  They don't always advertise what their plans are on the dark web, right in their forums when they're kind of getting together as gang members and they're talking and you see those chats going on.
• 6:03
  They don't always go, hey, we're about to hit, you know, this health care organization next Tuesday.
• 6:08
  They don't really tell us that.
• 6:10
  But the the researchers are able to tell by the way in the the software that's used, like certain gangs will write certain code in certain languages, you know, and by being able to identify that, then they can kind of attribute the cybercrime to a certain gang element.
• 6:33
  And then later on, the gang will like take credit for it, right?
• 6:36
  Like after it's kind of made the mainstream news.
• 6:39
  Yeah, then they're like, yeah, we did that.
• 6:41
  Right.
• 6:42
  Yeah.
• 6:43
  Interesting.
• 6:44
  Interesting.
• 6:47
  there've been so many changes and we've seen since, you know, 2011, 20, you know, back in the day, I always come back to like 25 years ago, we had two versions of our lives, right?
• 7:01
  Would you agree with that?
• 7:01
  Like we had a computer version, there were computers in the offices, right?
• 7:06
  But we also had our pen and paper or our physical world.
• 7:10
  And if the computers were down that day, we didn't skip a beat.
• 7:14
  We could still.
• 7:16
  pay bills, engage with clients, have meetings, take notes and have them all continue to operate.
• 7:26
  Today, all of that's changed.
• 7:28
  Thanks to digital transformation and as organizations have advanced and digitized, if any of us have ever received health care or been at a hospital or a doctor's office recently, they don't walk in with the physical charts, like with all your history right there, looking on the pieces of paper, flipping it over like they used to, it's all on a pad.
• 7:54
  It's all in a system, right?
• 7:55
  Like Epic or one of the healthcare systems.
• 8:01
  And when they go down, things come to a screeching halt.
• 8:08
  What have you been seeing lately in terms of, there, Are there any trends that you're seeing, you know, in the last six months?
• 8:19
  Any anything new or things that are being highlighted more that business owners and leaders can take into consideration?
• 8:30
  Yeah, that's really a loaded question.
• 8:32
  I was even at my doctor recently and the first question when it came in after he said hello was, do you mind if I have this HIPAA compliant AI agent?
• 8:44
  And I just like to use this to make sure that I'm not missing anything in our conversation so I can look back later.
• 8:51
  and make sure I didn't miss something.
• 8:53
  So I would say AI, know, everything is automated.
• 8:58
  There's so many ways to automate things.
• 9:00
  can automate from a marketing perspective, you know, take for instance, your digital signature as a small to mid-sized business.
• 9:08
  Think of the power of capturing all that information that your clients, how they're interacting with your website.
• 9:15
  It can tell you what's working on your website, what's not working.
• 9:19
  Look at some of What language you're using is resonating with your barriers, right?
• 9:25
  what's your buyer sentiment?
• 9:27
  Are they buying from you because you're their only alternative?
• 9:29
  Are they buying from you because they really love your company or love your service?
• 9:34
  Do they love your product but not so much your customer support or vice versa?
• 9:39
  There's just so much power there from a marketing perspective and a sales perspective.
• 9:44
  We have tools that we use with our partners like NetGain, all kinds of social media campaigns or email campaigns that we can automate and measure.
• 9:55
  And AI is so powerful.
• 9:57
  The only thing we have to remember is if we're going to automate something and it could be anything, could be a business, any type of business process can be automated, right?
• 10:05
  You just have to understand what the outcome should be so you can measure your automation.
• 10:10
  Don't just go wild automating everything, even though that sounds like a blast, doesn't it?
• 10:15
  We have to make sure we can still measure and we have to be cautious, right?
• 10:19
  Because with AI, even though I'm glass half full on AI, I know you know this David, I'm a huge AI proponent.
• 10:26
  I just see all the fantastic things it can do for us.
• 10:29
  We do have to be cautious, right?
• 10:32
  We wanna make sure we're using, like my provider was using a HIPAA compliant AI, right?
• 10:38
  Are we using a public AI?
• 10:39
  just an app that they downloaded on their phone.
• 10:41
  Right?
• 10:42
  Right.
• 10:43
  know, right?
• 10:44
  You want to make sure you're using a private AI if you're dealing with client financial information or HR information.
• 10:53
  You don't want to be using chat GPT or co-pilot on the web, right?
• 10:57
  Because we don't, mean, there's been companies like Samsung lost intellectual property, right?
• 11:02
  There's always.
• 11:04
  Yeah.
• 11:05
  I think about that all the time.
• 11:07
  When OpenAI first came out, Samsung engineers were putting in the design and the intellectual property to fix some code, but they were putting it out in the general AI as opposed to behind a private AI.
• 11:21
  Right, and you wanna talk about the old days.
• 11:23
  You remember, I mean, as a software developer, Stack Overflow is where we would go to get help with code, right?
• 11:29
  And it took longer.
• 11:31
  Now, if I'm writing a snippet of code, which they don't let me do that anymore, by the way, but if I was writing a snippet of code, I'd probably plug it into a GPT, like ChatGPT, your Gemini or Copilot, right?
• 11:43
  But what happens if a bad guy...
• 11:46
  it in there, then I could get it out.
• 11:48
  Right.
• 11:48
  Like if I'm on the other side and I say, what's the code for this?
• 11:52
  Right.
• 11:52
  And I prompt it correctly.
• 11:54
  It's going to spit out what you input it.
• 11:56
  definitely.
• 11:58
  Right.
• 11:58
  But what happens if a bad actor puts in a code snippet?
• 12:04
  It's really malicious.
• 12:06
  Right.
• 12:06
  We have to be cautious.
• 12:07
  This doesn't mean we can hire all brand new software developers out of college and they're just going to be fantastic because they're going to use AI.
• 12:15
  You need some experienced people on your staff too, right?
• 12:19
  Because I would know well, back in the day, I would have known the difference between real code and malicious code.
• 12:25
  but a really junior developer or a junior project manager may not understand the implications of what they're automating with AI because it's just there, it's just so easy.
• 12:38
  So you have to be careful that what data set was used to train your AI.
• 12:43
  And is your AI just hallucinating and making stuff up?
• 12:46
  We can't accept it.
• 12:50
  that Ashley and I talk about quite often are the risks of AI in social engineering.
• 12:58
  Social engineering, you know, there's, we can have all the threat hunting and all the security expertise, but when the people let them in around all those safeguards, then that's how a lot of the data breaches that are in the news wind up.
• 13:15
  AI and in particular synthetic media, deep fakes as we hear about them, like images, audio, voice, live picture, the face, hand movements, et cetera.
• 13:31
  When those are generated, it really can make social engineering very, very effective.
• 13:39
  And it's like on steroids.
• 13:41
  And what's amazing is there are a lot of legitimate companies that are promoting the use of these avatars, right, where you can make your own avatar and they're promoting it like two companies so that you can scale your efforts so that you can attend 15 sales meetings at the same time.
• 14:05
  You can attend several customer, you know, attend to several customer meetings or customer, you know, customer service calls.
• 14:14
  And you can think about the leverage that that can give you.
• 14:18
  But by training that AI avatar, it can speak like you.
• 14:22
  It'll look just like just like us.
• 14:24
  It'll sound just like us because it's trained on our voice, our syntax, our idiosyncrasies.
• 14:31
  And then it can think like us, which is really, really freaks me out because that is just something where you're just asking.
• 14:40
  We've seen several cases of breaches.
• 14:45
  mean, when we all imagine what happens when we get a phishing email and we spot it, right?
• 14:51
  We're like, I remember that training.
• 14:52
  There's a red flag here.
• 14:54
  I'm not going to click on that.
• 14:56
  But then they send you a calendar invite for a Teams meeting or a Zoom meeting.
• 15:00
  And then you go and you jump on it and it's your boss or somebody that you work with.
• 15:05
  And they sound like themselves.
• 15:07
  They're calm.
• 15:08
  They're answering all your questions.
• 15:10
  they resolve any questions or any suspicions that you had from that prior email, and then you go ahead and you make the wire transfer, or you release the W-2s of all the employees or whatever, whatever sensitive information that is being requested, only to find out later that that was a deep fake.
• 15:31
  Are you seeing that more and more out in all of your...
• 15:38
  deep fake video.
• 15:41
  There's a very publicized case in Hong Kong of a financial worker who had a web meeting with his CFO and other colleagues and wired the equivalent of $25 million.
• 15:56
  Yeah, there was apparently eight people on that meeting and the only real person was the victim.
• 16:02
  Yeah, everybody else was a coworker who a couple of them here she recognized and none of them.
• 16:11
  I know it's crazy.
• 16:12
  mean, and really the only thing that you can do to protect yourself from that is have policies in place and the training that goes with them.
• 16:20
  You know, we always recommend that businesses should have a personal relationship with their banking, their banker, because if you authorize that transaction, that does not come under FDIC insurance or fraud because it is a fraud, but you have entered a contract with the bad guy.
• 16:40
  Right?
• 16:40
  And you've said, hey, I'm going to give you this money.
• 16:42
  Now, unless the bank catches it on their own, your only protection is to say, have relationship with the banker and say things like, hey, over a certain threshold, someone from my company, this particular person from my company actually has to come in person to the bank to make changes to wire transfers or changes to ACHs.
• 17:01
  That's a great point.
• 17:02
  I'm so glad you brought that up because most people don't understand that.
• 17:07
  Right.
• 17:08
  It's different if somebody gets your credentials on the dark web or they buy them or they steal your credit card and they go and like they're making the transaction.
• 17:20
  But if you're calling up and you're making the transaction, it's not covered.
• 17:25
  Yeah, you're liable because you are you are the one doing it.
• 17:29
  The bank can't be held to to have to double check you and be like, are you being fooled?
• 17:34
  Are you under duress?
• 17:36
  Say vanilla, like say a word if you're, like, do you have a safe word together?
• 17:41
  Like something like that, right?
• 17:43
  It's so, that's a great point.
• 17:46
  So, Ashley, was there anything you wanted to, anything you were wondering, I you wanted to ask about like what best practices for small businesses.
• 17:59
  You had talked about that.
• 18:01
  also wanted to ask what actually happens during a data breach.
• 18:07
  so what happens during a data breach?
• 18:09
  Well, you know, the way it could happen could be different.
• 18:12
  mean, it could be someone, you know, purchase credentials on the dark web, because what happens is a lot of times people will use their work email and that same password that they use for accessing their Facebook or their Amazon, they'll use it for their work.
• 18:29
  So the first.
• 18:32
  Yes, I know it's crazy, isn't it?
• 18:36
  Well, it's funny because you and I have been doing security awareness trainings out in the public for decades, right?
• 18:41
  And in the beginning, we were like, let's use stronger passwords.
• 18:45
  And then I would do the same ones to the same groups and they'd come back and be like, I took your advice.
• 18:50
  I have a great password.
• 18:52
  I use it on everything.
• 18:54
  And I'm like, no, you didn't listen to the other part of it.
• 18:58
  Yeah, I know it really does.
• 19:01
  is really a big deal because with data brokers and everything, your data gets sold and you forget where you used it.
• 19:09
  Yeah, you forget what app you used it on.
• 19:12
  And even though it is a good password, it's going to get compromised by somebody that doesn't take security seriously.
• 19:19
  And now they can get into your bank as you.
• 19:22
  Now they can get into your work as you.
• 19:25
  Great point.
• 19:26
  I think a lot of people that are, I guess, non-technical think, but what does it matter if somebody gets into my Gmail account?
• 19:37
  I don't do anything in my Gmail account that.
• 19:40
  What happens in your Gmail account?
• 19:43
  Well, are you using that Gmail for accessing your bank or your 401k?
• 19:50
  Or is it your backup for password resets?
• 19:55
  It doesn't take much from that one Gmail account or a certain other account that might not seem very important to you to become you.
• 20:07
  It's only a couple of steps because they can go and easily online because we curate our lives online.
• 20:15
  I can find out all the apps that you use.
• 20:17
  I can find out all of that stuff.
• 20:19
  And then from there, reset all of your passwords immediately to the Gmail account I now have.
• 20:25
  and then have new logins where you're locked out and I'm you and I can do everything.
• 20:31
  Like I can go and redo the banking easily or wipe out your 401k easily because if there's any confirmation, just send it to the Gmail account.
• 20:42
  And that's actually what does happen.
• 20:44
  And it's not like in the old days, even our personal email isn't just email.
• 20:48
  I if you have access to someone's Gmail account, have access to their, you probably have access to their web history.
• 20:54
  right?
• 20:54
  in their right there, their search history and their Google Drive, you know, and the first thing that in my interview of certain threat actors and hackers, the first thing they always do is go into your sent folder, because so many of us keep so much data that we've sent out our taxes, we send them to our accountant.
• 21:16
  It's not in my inbox.
• 21:18
  I don't think that it's in my email anymore.
• 21:21
  Yeah, it's still there.
• 21:22
  It's in the sent folder, right?
• 21:23
  Like we forget about that and all those confidential things are in there.
• 21:31
  Yeah, so typically that's how the bad guy first gets in is through your Gmail or through your work email or whatever, you know, because think about it when you first get your job offer wherever you're working, where does that come to?
• 21:44
  It comes to your Gmail.
• 21:45
  So then they're like, I know where this person works.
• 21:48
  You've emailed.
• 21:49
  be on there, the application, the direct deposit information.
• 21:53
  A lot of that oftentimes is right in your personal information.
• 21:58
  because what the bad guy does first is they do investigations.
• 22:01
  What is publicly available about this person?
• 22:04
  What's on their LinkedIn or their LinkedIn's linked to this Gmail?
• 22:08
  Well, I've got this breach here with this Gmail password.
• 22:11
  So let me figure this out.
• 22:13
  Who are they working with?
• 22:14
  What are they working on?
• 22:16
  You know, maybe they go to a company website and go, look, this company website provides VPN access.
• 22:21
  I can tell by this VPN access that it's this VPN.
• 22:25
  or they offer remote access to computers.
• 22:28
  Well, let me see if I can test this and see if I can get remote access to something.
• 22:33
  well, you're not really very interesting, but I see you're working on this project with these software developers.
• 22:40
  Maybe they have some cool stuff.
• 22:41
  So I send out some malware to them, right, that looks like the project we're working on.
• 22:48
  And one of them clicks on something, because it's someone they know.
• 22:53
  And it's something that they're expecting because they're working on a project with you.
• 22:57
  And I mean, we have all kinds of tools now.
• 22:59
  I don't want people to get too scared because there are all kinds of tools that can help detect this type of malicious activity.
• 23:04
  Right, David?
• 23:05
  We have, yeah.
• 23:07
  when we when you hear the phrase of threat hunting and MDR and EDR and things like that, that is what they're looking.
• 23:15
  There's 24 seven eyes on glass looking for anomalies, which is a fancy word for weird stuff that shouldn't be happening.
• 23:23
  Right.
• 23:24
  And it's looking for people moving from account to account.
• 23:28
  It's looking for data being exfiltrated, which is a fancy word for stolen.
• 23:34
  Right?
• 23:34
  Like, where they're just like downloading it all of a sudden, it's being downloaded over in Russia.
• 23:39
  You're like, we don't have a Russia office.
• 23:40
  What's going on?
• 23:42
  Right?
• 23:42
  Like in that type of thing.
• 23:44
  Yeah.
• 23:45
  But I mean, there's the question is a really good question, though, because a lot of business leaders don't understand that when when an attack like ransomware happens, it is very emotional.
• 23:58
  It is it is there have been there are people that are have passed out.
• 24:03
  They've had heart attacks.
• 24:05
  They see their kids not go to college now.
• 24:09
  They see their homes foreclosed.
• 24:11
  They see all that because everything that they've been using is gone.
• 24:15
  Like their icons on their desktop don't work.
• 24:18
  It's all white.
• 24:19
  There's a text file and it says, you know, talk to us on this talks channel.
• 24:27
  And you're like, what?
• 24:29
  You're like, what is that?
• 24:31
  You like it.
• 24:31
  Now you have to go and negotiate with a, you know, foreign ransomware gang that is very good at their job.
• 24:41
  Like that's all they do.
• 24:43
  And they make hundreds of millions of dollars.
• 24:46
  Like this is what they're doing.
• 24:48
  Like they know what they're doing.
• 24:50
  Yeah.
• 24:51
  their job.
• 24:51
  It's a total criminal enterprise.
• 24:56
  It's not like some guy or girl in their basement, right, just packing away at a keyboard.
• 25:02
  Most of this is automated.
• 25:04
  And with AI, it's even more automated.
• 25:08
  You can see in some of the threat reports that you read or the cyber trends that you read, like the Verizon Data Breach Investigations Report.
• 25:16
  a great, that's like one of the original, it's like the, yeah, it's very, they translate it well.
• 25:25
  They do.
• 25:25
  I mean, they just show the exponential increase from last year to the beginning of this year.
• 25:31
  I can't wait till the next one comes out, right?
• 25:33
  From January to January 24, how the mention of AI in criminal forms is almost like a straight line up, right?
• 25:42
  Because like you're to go back to the deep fakes.
• 25:45
  I mean, you can even do it with an email.
• 25:48
  If I have several emails from David, I can say, hey, chat GPT, I want you to write an email.
• 25:54
  to Ashley and ask for this, but write it in David's tone.
• 25:59
  Here's a sample.
• 26:02
  Nuances.
• 26:03
  probably laughing going, yeah, all the spelling errors and the all caps.
• 26:07
  I left my caps lock on all that stuff.
• 26:11
  I'm like, sorry.
• 26:13
  But she'll get one and it'll look and sound just like it was me.
• 26:17
  Yeah.
• 26:18
  And that's how they get people.
• 26:20
  And that's why it's just so important.
• 26:22
  You know, talking about new things, I really also recommend that you have an AI use policy.
• 26:28
  I don't recommend that you weave AI into your other policies.
• 26:32
  Absolutely.
• 26:33
  that is something.
• 26:34
  Yeah.
• 26:34
  And they're out there.
• 26:35
  There's templates out there.
• 26:37
  But there that is something that anybody that engages with a security company that has some some virtual see.
• 26:44
  So ours like having an AI use policy because you don't want to not use it.
• 26:48
  Right.
• 26:49
  Like like let's be let's I'm I'm I know you're glass glass half empty on AI.
• 26:55
  I'm right down the middle.
• 26:56
  Like, yeah, I'm right.
• 26:58
  I'm sorry.
• 26:59
  Half full.
• 27:00
  I'm I'm half full and then very paranoid at the same time.
• 27:05
  So I've got a layer of paranoia on it.
• 27:08
  But it's really important because you don't want to be like, I personally don't believe, I'm not one of these people that believe that AI is going to come taking jobs.
• 27:18
  I think that people leveraging AI will be more productive than those that don't.
• 27:23
  And so you want your employees to embrace it and to test it and to try it and to leverage it and to get good with it.
• 27:31
  like the prompting is a it's an art as well as a skill.
• 27:35
  And so just like, yeah.
• 27:37
  And once it spits out, you know, if you're ever going to post something publicly, if it starts with like in this digital age, like just delete that part, because that's the telltale sign that it's been written by.
• 27:54
  Other than that, I mean, no, but it's so important to have a policy, right?
• 27:58
  Like to actually have.
• 27:59
  a policy of like, this is how we use it.
• 28:03
  What are some other, so you've identified some good best practices, having the threat hunting, having an AI policy, right?
• 28:13
  I mean, today, to me, the two least lower expense, like the least expensive efforts that make the most impact is ongoing education, like the phishing, the platforms that are out there.
• 28:30
  I know it's not perfect, but it does give a good baseline of a constant reminder.
• 28:38
  Like it's ongoing job embedded, like regular professional development should be.
• 28:43
  And it's something that just keeps everybody at a heightened alert.
• 28:46
  And then to me, just doing fire drills once a year, having an incident response plan that's updated, right?
• 28:55
  And when I'm speaking with leaders a lot, they'll say, well, I've got a disaster recovery.
• 29:00
  And I'm like, no, no.
• 29:02
  I'm like, that's good.
• 29:03
  But no, no, I'm not talking about a flood or a fire.
• 29:07
  We're talking about a ransomware attack.
• 29:09
  We're talking about a data breach.
• 29:10
  We're talking about something like that.
• 29:12
  Do you have a plan for that?
• 29:14
  Meaning in hour one, who does what?
• 29:17
  Who's responsible, accountable, needs consulted, and then needs informed.
• 29:21
  In hour two, same thing.
• 29:23
  Right.
• 29:24
  Because it shifts over time.
• 29:26
  At what point are we telling our customers?
• 29:29
  At what point are we contacting law enforcement?
• 29:32
  At what point?
• 29:33
  Like who's going to negotiate?
• 29:34
  Who like do we have insurance?
• 29:36
  How much insurance will they cover?
• 29:39
  Will they decline coverage?
• 29:42
  Like all of those things.
• 29:44
  You need those those variables kind of fettered out.
• 29:47
  And and we all did fire drills as kids in school.
• 29:51
  And it's.
• 29:52
  very similar to just doing a once a year fire drill.
• 29:54
  And so having those, just think if organizations would do those things, would reduce the amount of risk goes down.
• 30:07
  It's never down to zero, but it definitely would improve.
• 30:12
  When you think of people started...
• 30:15
  putting rubber mats by the front doors when it rained.
• 30:18
  Now people are falling less.
• 30:20
  You're getting sued less, right?
• 30:22
  Like it's that type of thing that if we just do what's kind of obvious that it's been talked about for a long time, then we'll start to see some some stemming of the tide of all this growth in cyber.
• 30:38
  Now, the other thing I would say is they definitely have to have someone in their corner like NetGain.
• 30:43
  It's a very complicated landscape.
• 30:47
  No, you didn't.
• 30:48
  They didn't even pay me to say that.
• 30:50
  It's true.
• 30:51
  You have to have someone who's keeping up to date because you're concentrating on your business vertical, whether you're a law firm or healthcare provider or a real retail or whatever job you're in.
• 31:04
  That's your specialty.
• 31:06
  When it comes to technology and cybersecurity, that's net gain specialty, right?
• 31:12
  And they're gonna have a much broader understanding of what you should do.
• 31:16
  And David's 1000 % right.
• 31:18
  I want you all to notice that when he talked about the most important things to have, he did not really talk about technology.
• 31:26
  He really concentrated on people and process.
• 31:28
  Now, of course, the security awareness training has a technology component, but right, you have to have...
• 31:35
  in the background.
• 31:36
  That's in the background.
• 31:38
  Yep.
• 31:38
  You have to have all three.
• 31:40
  And people, a lot of cybersecurity people say that your people are your ricas link.
• 31:45
  I refer to them as your human firewall.
• 31:47
  They are your best first defense.
• 31:50
  Yeah.
• 31:51
  Yeah.
• 31:52
  And the more we I mean, this is why I've been doing a podcast for a long time.
• 31:57
  Like the more we just translate all the complex technology speak into like things that matter for business leaders, the better and the more safe the business leaders will be so that they can focus on what they're really good at.
• 32:14
  They're really good at practicing law, practicing medicine, building, you know, running financial organizations, know, building widgets, they're really good at that.
• 32:24
  We want them to be able to build and grow and not get torpedoed unexpectedly.
• 32:30
  You know, because that's what's in the news.
• 32:32
  Like all we hear about in the news is this great organization that's been around since 1964 is closing their doors.
• 32:40
  They had this data breach and then they had some other rocky like sometimes it's not a data breach that may put them out of business.
• 32:47
  Right.
• 32:47
  they're financials, if they're having a rough year, that data breach will tip them over the scales.
• 32:52
  And that's what we want to avoid, because the more we look at them, they can all be prevented.
• 32:58
  Right.
• 32:58
  want to protect your people, right?
• 33:00
  You we all talk about mental health in the workplace.
• 33:02
  An incident response plan is like a mental health policy, right?
• 33:06
  Because we don't have people running around crazy, you scared and confused.
• 33:12
  We know if we have an incident response plan, we don't have to think about our next action in the crisis.
• 33:18
  We've planned before the crisis so we can be much more relaxed and calm and know what to do and know who to talk to and know what to say and what not to say.
• 33:29
  Right.
• 33:29
  yeah, you're right.
• 33:30
  mean, it is very similar to a fire drill because like if a fire breaks out in the corner of the the room and all we have our paper plates on us and we have no planning, like what are we going to do?
• 33:42
  We're going to freak out.
• 33:44
  We're going to make it worse.
• 33:45
  Right.
• 33:45
  Like and that is literally what does happen as opposed to, hey, every room's got a fire extinguisher.
• 33:52
  We're ready.
• 33:53
  If it happens bad, it might damage a little wall.
• 33:57
  Might have to get some drywall.
• 33:58
  But we stopped it.
• 34:00
  Didn't burn down the whole building.
• 34:03
  The drama was a lot less, and we're back on building our widgets and practicing law and practicing medicine, et cetera.
• 34:12
  Natalie, I love that you referred to it as a human firewall.
• 34:17
  I think it starts with just fostering that security culture in your organization, beginning with cybersecurity awareness training, simulated fish tests.
• 34:27
  In the description of this podcast, I'm going to link out a webinar that we recently did called Human Firewall, Fostering a Cyber Safe Culture.
• 34:36
  Awesome.
• 34:37
  give business leaders really great resource for getting that started, getting buy-in by your employees, buy-in by the executive team, because it really starts at the top.
• 34:50
  it does.
• 34:51
  it's so important to, I mean, that's a great way to, to protect your organization is to do those kinds of things and have a good culture of cybersecurity, which means, you know, because you have to remember it's not, it's not always because we didn't know better.
• 35:06
  You know, we're so busy today.
• 35:08
  We're doing 50 things at once.
• 35:10
  And sometimes we click on something and then afterwards we're like, I can't believe I clicked on that.
• 35:16
  Right.
• 35:17
  And if I know who to go to and say, hey, because I've had the training, hey, I clicked on this.
• 35:23
  That person can say, you're okay.
• 35:25
  You just need to take some more remedial training.
• 35:27
  That was a test.
• 35:28
  Or they can say, Ooh, we're not okay.
• 35:30
  Let's log you out of everything.
• 35:32
  Let's take these, you know, five steps to make sure that that's as far as the bad guy's going to get.
• 35:38
  Right.
• 35:39
  So you really want to have build up that human firewall and build up that good culture of cybersecurity.
• 35:45
  So people aren't afraid to say, hey, I made a mistake because time is so critical when something like that happens because those threat actors, they're automated, they're working fast.
• 35:56
  And if I click on something by accident, first thing you should do, disconnect yourself from the network and then contact whoever you have to contact, right?
• 36:06
  Yes, exactly.
• 36:07
  It's really important.
• 36:10
  And then as far as, you you mentioned people in process, as far as technology, in my opinion, the two most cost effective technology things you can deploy are a password manager and good multifactor authentication, right?
• 36:25
  Not a text message on my phone, but you know, something like a hardware token or even authenticator app is better than a, than a text message because you know, Time marches on, technology just moves faster and faster and it's easier and easier to take advantage of, you know, old technology like sending a code to this phone is very easy to intercept.
• 36:49
  Right.
• 36:51
  Excellent.
• 36:51
  Well, thank you so much for your insight today.
• 36:55
  That was just, yeah, was really useful and I hope that the listeners got a lot of practical insight from it.
• 37:05
  Mm-hmm.
• 37:05
  Thank you for having me.
• 37:06
  I really appreciate it.
• 37:08
  Thank you and thank you for all you do.
• 37:10
  talking with you, Natalie.
• 37:12
  I learn something every time.
• 37:13
  I love it.
• 37:16
  Thank you.
• 37:17
  Me too.
• 37:18
  You too.
• 37:18
  Thanks.