Latest / Business Roundtable / Zero Trust Leadership: Dr. Victor Monga on AI, Security, and Scaling with Confidence

Transcript

Zero Trust Leadership: Dr. Victor Monga on AI, Security, and Scaling with Confidence · Business Roundtable

0:31
Speaker 1: Hello, and welcome back to the Business Roundtable podcast. I
0:35
Speaker 1: am your host, David Carr or stud your business where
0:37
Speaker 1: I bring people together to accomplish great things, and that
0:40
Speaker 1: includes Victor Manga, one of our new guests here to
0:43
Speaker 1: the podcast.
0:44
Speaker 2: Victor's got a wealth of experience.
0:45
Speaker 1: We're going to get into cybersecurity technology, all sorts of things,
0:49
Speaker 1: but before we do that, just want to welcome you,
0:51
Speaker 1: Victor to the podcast.
0:53
Speaker 3: Thanks very thanks for having me.
0:54
Speaker 1: Absolutely absolutely we cover so many different topics here on
0:58
Speaker 1: the Business Roundtable because we're trying to help business owners,
1:01
Speaker 1: team leaders lead better, be more aware and also know
1:04
Speaker 1: where to turn to get some resources to get some
1:06
Speaker 1: help along their journey. And Victor, I'm glad to have
1:09
Speaker 1: you here because you bring a different perspective and understanding
1:12
Speaker 1: in the world that we live of cybersecurity, AI technology.
1:18
Speaker 1: It's going very fast and we can easily get tripped up,
1:23
Speaker 1: and so you're going to dive us into this. But
1:26
Speaker 1: before we get into that, I want to I want
1:28
Speaker 1: folks to know a little about your journey, Victor.
1:31
Speaker 2: What got you to this place and why do you
1:33
Speaker 2: do what you do?
1:34
Speaker 1: What is it that you know makes you get up
1:35
Speaker 1: in the morning and say, man, this is important to
1:37
Speaker 1: be right into the.
1:39
Speaker 2: World, so just tell us a little about your journey.
1:42
Speaker 1: Uh and uh, we'll let everybody listen in to Victor
1:45
Speaker 1: here today.
1:46
Speaker 3: Yeah, thank you. So absolutely my show up at is
1:50
Speaker 3: I got it.
1:51
Speaker 4: I got into it cybersecurity by chance, not by choice.
1:55
Speaker 4: And what I mean by that is so I was
1:58
Speaker 4: born and raised in India and two older sisters. They
2:01
Speaker 4: both highly talented, and they wanted to study. Unlike me,
2:07
Speaker 4: I want I always find shortcuts. So they went into
2:10
Speaker 4: medical They studied medicine. And in a middle class family
2:15
Speaker 4: in India, especially in North India, usually you have two choices.
2:19
Speaker 4: You go into medicine or you become an engineer. Engineer
2:23
Speaker 4: is easier in a way, and that medicine for me,
2:28
Speaker 4: so I went. I went into engineering, and in that
2:31
Speaker 4: they had different majors. You can have civil engineer, mechanical, electrical, computers.
2:38
Speaker 4: I always liked playing computer games growing up, so like,
2:43
Speaker 4: why not let's try computer science for majors. And when
2:48
Speaker 4: I got into my college the first year, by the way,
2:52
Speaker 4: I'm going to age myself.
2:53
Speaker 3: At that time, Wi Fi was new, yeah yeah, and streaming.
2:57
Speaker 4: Services was new, so I want to learn more how
3:01
Speaker 4: to hack into college Wi Fi so I can stream
3:03
Speaker 4: movies and play view games later at night with my friends.
3:08
Speaker 4: That really took me, again by a chance, not by choice,
3:12
Speaker 4: into cybersecurity.
3:14
Speaker 3: I ended up founding a.
3:16
Speaker 4: Firm with two of my professors for ethical hacking, and
3:20
Speaker 4: again by a chance, because I wanted to always find
3:23
Speaker 4: a way to do the smart way, not the long
3:27
Speaker 4: way or the hard way. And that's just got into cybersecurity,
3:31
Speaker 4: did a lot of ethical hacking, and ultimately started helping
3:34
Speaker 4: Fortune five hundred companies here in the US to build
3:36
Speaker 4: their cybersecurity program so that at least they can minimize
3:40
Speaker 4: and contain the problem of cyber attacks. You can make
3:43
Speaker 4: a fool proof. It's not a thing. There's no one
3:46
Speaker 4: hundred percentile. So yeah, that's all I got it.
3:49
Speaker 2: Yeah, No, that's interesting.
3:52
Speaker 1: Well I'm glad that you turned it around your your
3:54
Speaker 1: hacking in college for hey you want to get streaming
3:58
Speaker 1: this that Yeah, I remember that, But then I actually
4:00
Speaker 1: taking it in and making it ethical, like saying, how
4:02
Speaker 1: do we help you know, identify these holes these areas.
4:07
Speaker 1: I think that's I mean, that's so important victory because
4:09
Speaker 1: you want somebody in a good way like right, testing
4:12
Speaker 1: your system where there's something before the bad guys come.
4:16
Speaker 4: Yeah, and again this is not natural or easy. I
4:20
Speaker 4: lot people, especially baby boomers like my dad or my granddad,
4:25
Speaker 4: they don't think it that way because they grew up
4:27
Speaker 4: in an era where it or interconnected systems were not
4:31
Speaker 4: a thing. Right now, from my computer that's connected to
4:35
Speaker 4: my cell phone, cell phone connected to my Amazon Echo
4:39
Speaker 4: that's connected to my doorball, I think about these things.
4:42
Speaker 4: They're connected, and all it takes is just have an
4:46
Speaker 4: adversary driving by your street. See there's an opener week
4:50
Speaker 4: Wi Fi network, get into that, get into a doorbell
4:53
Speaker 4: or an IoT or fridge or something new that you
4:56
Speaker 4: just pought which has Wi Fi, and you connected with
4:58
Speaker 4: your password that has connection to your laptop or phone.
5:03
Speaker 4: That's all it's taking, honestly, and ever say that are
5:06
Speaker 4: becoming smarter. They are thinking that if I go fortion
5:09
Speaker 4: five hundred and I'll go after fortune five hundred. They
5:13
Speaker 4: have the world class cybersecurity technology, the best people, why
5:18
Speaker 4: not just multiply in the neighborhood where there's a wealth
5:22
Speaker 4: in their bank accounts and just hack into their WiFi,
5:25
Speaker 4: hack into their IoTs.
5:27
Speaker 3: That's becoming the new name of the game.
5:29
Speaker 2: Hm. Wow.
5:32
Speaker 1: And that's why I want you to have on here, Victor,
5:34
Speaker 1: because if you guys aren't hearing this or thinking about this,
5:36
Speaker 1: I know sometimes it isn't quote sexy cybersecurity that I see,
5:39
Speaker 1: but it's it's absolutely necessarily wanting to get into how
5:42
Speaker 1: it can be a growth engine if you're if you're
5:44
Speaker 1: playing it well.
5:45
Speaker 2: But Victor, to your point, you know you're moving from just.
5:49
Speaker 1: Tactical Hey, here's that and that, but I feel like strategically,
5:53
Speaker 1: like you said, maybe we're thinking about these things before,
5:55
Speaker 1: how interconnected. I really got to think more strategically in
5:58
Speaker 1: how we're addressing this. And I want to give you
6:00
Speaker 1: on the podcast. I mean, how did you how have
6:03
Speaker 1: you seen or how have you even yourself moved in
6:05
Speaker 1: that way?
6:07
Speaker 3: Yeah, what I've seen.
6:08
Speaker 4: I'll share a little research I did in twenty twenty four,
6:12
Speaker 4: So I wanted to know more about the small business
6:16
Speaker 4: space because again, enterprises, they have the best in the
6:19
Speaker 4: pre best best people, best resources, best technology when it
6:22
Speaker 4: comes to cybersecurity or I the innovation, all of that,
6:27
Speaker 4: but when it comes to small or medium sized businesses,
6:30
Speaker 4: I wanted to learn more about how did they protect
6:32
Speaker 4: their businesses. How do they think about when they go
6:37
Speaker 4: connect their new device to their current network, what goes
6:40
Speaker 4: in and out of their network? So I want to
6:42
Speaker 4: do a little research on my own, so I picked
6:45
Speaker 4: about fifty two I'm calling them companies, but merely their
6:49
Speaker 4: mom and pop shop like your liquor store at the
6:51
Speaker 4: corner or peed kitchen.
6:54
Speaker 3: We have it here.
6:56
Speaker 4: Again, it's it's something that you just see and use
6:59
Speaker 4: regular early. But they don't have the best it if
7:02
Speaker 4: you will. Yeah, almost ninety five percent of that research
7:07
Speaker 4: was they have a standard internet nothing wrong with it,
7:11
Speaker 4: but a standard internet line Wi Fi provided by that
7:14
Speaker 4: internet provider, and they connect everything from their POS sales
7:20
Speaker 4: system where they are actually taking your credit card from,
7:24
Speaker 4: to their anything bank accounts where they transfer funds to
7:28
Speaker 4: their vendors or pay invoices.
7:29
Speaker 3: Of course they have to pay that as well to
7:33
Speaker 3: their Wi Fi for the guests.
7:35
Speaker 4: So if I walk into that establishment, they'll say, hey, yeah,
7:40
Speaker 4: we provide free Wi Fi. That's the same Wi Fi
7:44
Speaker 4: they're using for their POS and invoicing and their bank
7:47
Speaker 4: accounts and their laptops all of that. So then I
7:51
Speaker 4: started asking the questions from the owners or the founders
7:54
Speaker 4: that who's also working there by the way most of
7:57
Speaker 4: the time. What do you do for it? And they're like, well,
8:01
Speaker 4: I have the Internet and I have the computer. That's
8:05
Speaker 4: the four by four they're thinking, when it comes to it,
8:08
Speaker 4: that's the box they're in that I have the Internet
8:10
Speaker 4: working and I have the computer working.
8:12
Speaker 3: That's about it.
8:14
Speaker 4: And then again, being the researcher, I asked them follow
8:17
Speaker 4: up questions, are you not worried that you'll have a
8:20
Speaker 4: cyber attack or if someone can actually attack your network?
8:24
Speaker 4: And the usual answer, I'm not kidding. And this cracked
8:28
Speaker 4: me up. They're like, why would they Why would they
8:30
Speaker 4: attack me? There are billions and trillions of dollars in
8:33
Speaker 4: the world. Why would they attack me? Now, that's that's
8:37
Speaker 4: where the problem is. Why would they attack me? Is
8:40
Speaker 4: the mentality which really is going to bring us down.
8:44
Speaker 4: Why would they attack me? Well, you have a penny
8:47
Speaker 4: to save us? Well, you have a bank account, you
8:50
Speaker 4: have something to lose. They will come after you. They
8:53
Speaker 4: just haven't yet. You just don't know about it. They
8:57
Speaker 4: will come after you. True story. Liquor store I won't
9:01
Speaker 4: name the name, and they picked up a new vending
9:05
Speaker 4: machine where you can just use Wi Fi to connect
9:09
Speaker 4: and people can pay with their phone or with their
9:12
Speaker 4: credit card so that the person doesn't have to come
9:14
Speaker 4: out of the cashier's desk. And actually so convenience right
9:19
Speaker 4: perfect connected to the same WiFi and which they use
9:24
Speaker 4: for their computer, their bank account, they log in and
9:27
Speaker 4: they pay the invoices, all of that right, what I
9:29
Speaker 4: just talked about, that vending machine had a vulnerability that
9:34
Speaker 4: the owner didn't know about it. Why would they That's
9:36
Speaker 4: not their job nor they should be aware of it. Again,
9:40
Speaker 4: at the end of the day, they are running the business.
9:41
Speaker 4: Small business again, that vending machine. Someone actually I don't
9:48
Speaker 4: know how or where someone from the Internet were able
9:51
Speaker 4: to discover that. They didn't even come there physically. That's
9:54
Speaker 4: a surprising part. Wow, someone scanning the Internet. That happens
9:58
Speaker 4: a lot, by the way, just like people used to
10:00
Speaker 4: go dumpster diving, I don't know, in the eighties and
10:03
Speaker 4: nineties looking for stuff. They're just looking for a way in.
10:06
Speaker 2: Huh.
10:07
Speaker 3: Yeah.
10:07
Speaker 4: So someone from the Internet found out that vending machine
10:10
Speaker 4: had the Internet address directly connected with the Wi Fi
10:14
Speaker 4: that the person is using. They did not attack or
10:18
Speaker 4: they didn't do anything for about eight months. That adversary
10:23
Speaker 4: who found out about this vulnerability, this foothold didn't do
10:27
Speaker 4: anything for about six to eight months.
10:29
Speaker 3: After eight months, they got.
10:31
Speaker 4: The passwords, they knew hord to log in, what time
10:33
Speaker 4: the log in, what happens when is the right time
10:36
Speaker 4: of the traffic, and they were able to wipe out
10:40
Speaker 4: the bank account of the owner. FBI complaint was lodged.
10:44
Speaker 4: But again, think about the headache that the owner had
10:46
Speaker 4: to go through, now, the stress they had to face.
10:51
Speaker 3: You don't want to be one of that.
10:53
Speaker 4: Right Again, back to the mentality of why would they
10:56
Speaker 4: hack you? Why would they come after you? You have
10:59
Speaker 4: a money, you have a family, you have a business,
11:01
Speaker 4: they've come after you.
11:03
Speaker 1: Yeah, Well, to your point, Victor, I've seen this even,
11:05
Speaker 1: you know, because I do work a lot in the
11:06
Speaker 1: professional services world.
11:08
Speaker 2: Right, So same thing.
11:09
Speaker 1: Right, people are getting computers, getting access and I've worked
11:15
Speaker 1: on uh big big companies or utilities or you know,
11:21
Speaker 1: they're there. There's some protected information they need to be
11:23
Speaker 1: sure that's protected. And I can't tell you victory even
11:25
Speaker 1: just I mean, this is simple stuff. But you know
11:28
Speaker 1: they haven't updated, Like to your point, they haven't updated
11:30
Speaker 1: the computer. So now it's out of date and they're
11:33
Speaker 1: logging in somebody's priver server or whatever. And in end,
11:39
Speaker 1: like you said, that's the sinister part, like you said,
11:42
Speaker 1: is I mean, obviously they took advantage of it, but
11:45
Speaker 1: they're there, they were varis. They could have dived done
11:48
Speaker 1: something right away, but they waited for months gathering all
11:50
Speaker 1: this information. So you may not know until it's too late.
11:55
Speaker 1: Obviously in this case it was too late. And I
11:57
Speaker 1: do think a lot of people, like you said, Victors,
11:59
Speaker 1: say well, you know, why why.
12:02
Speaker 2: Would they pick be?
12:03
Speaker 3: You know?
12:04
Speaker 2: Yeah, and so we kind of defer.
12:06
Speaker 1: And I see this a lot in other areas of
12:08
Speaker 1: business where instead of being more proactive, And that's why
12:10
Speaker 1: I wanted to have you on the podcast, Victor, this
12:13
Speaker 1: does those wee folks can listen to say, well maybe
12:15
Speaker 1: I don't I don't know what to do, but I
12:17
Speaker 1: want to do something. I want to be proactive, right,
12:21
Speaker 1: you have something in there and look at like what's
12:23
Speaker 1: going on?
12:25
Speaker 4: Why do they weight? I get this question a lot.
12:27
Speaker 4: Why did they weight for six to eight months? So
12:31
Speaker 4: they already know about you, They already know the passwords,
12:33
Speaker 4: or they figured out where to log in, how to
12:34
Speaker 4: log in what they're really after after you where they
12:39
Speaker 4: go your friends, your contact list. You know, we all
12:43
Speaker 4: have seen those emails sometimes that.
12:46
Speaker 3: That we are like, why did I get it?
12:48
Speaker 4: Well, one of your friends was actually hacked who had
12:53
Speaker 4: your email address or phone number. The adversary or the
12:56
Speaker 4: cyber attacker is actually using that contact list to say
13:00
Speaker 4: you the phishing or scam email, so that maybe you
13:03
Speaker 4: might fall for that, because again, friends make friends who
13:07
Speaker 4: are kind of the same age range, if you will,
13:10
Speaker 4: or who like the same things, or like to go
13:11
Speaker 4: to the same bars, or maybe like to go to
13:14
Speaker 4: the same racing racing competitions or whatever that is, the
13:18
Speaker 4: habits are almost the same, so the attackers don't have
13:21
Speaker 4: to create a new scam. They can just follow the
13:24
Speaker 4: same scam around your friends as well. And if you
13:27
Speaker 4: were not fast enough to inform your friends, maybe they'll
13:31
Speaker 4: be able to fall for that as well. So it's
13:35
Speaker 4: it's it's a it's a funny way, not not so funny,
13:39
Speaker 4: I guess, but it's it's an ironic way of actually
13:42
Speaker 4: thinking where not only you were going to lose everything,
13:49
Speaker 4: you are also leaving a door open for your friends
13:51
Speaker 4: and family because they are also collected with you.
13:54
Speaker 1: So yes, think about that as well. Absolutely, No, you're
13:57
Speaker 1: absolutely right. How many times have we seen something go through?
14:02
Speaker 1: That's that's so important? So what I what I hear
14:05
Speaker 1: you say? So in this example you give this unfortunately
14:08
Speaker 1: clickuor store, it's not only doesn't protect it, but now
14:11
Speaker 1: it's actually like they they've now been exposed and now
14:14
Speaker 1: it's actually like their business has basically stopped. I mean,
14:18
Speaker 1: I mean if their their bank accounts are taken, they
14:20
Speaker 1: have no money, they've locked up their business. So on
14:24
Speaker 1: the flip side, Victor, I think we were talking before,
14:27
Speaker 1: but we can say that cybersecurity doesn't protect us, actually
14:29
Speaker 1: can fuel the business, can actually protect you and actually
14:32
Speaker 1: have the business grow if done right.
14:36
Speaker 4: Yes, And the analogy I want to give to you
14:40
Speaker 4: all is think about a venue, or think about your
14:44
Speaker 4: home or business something you want to protect. You buy doors,
14:49
Speaker 4: you have locks. Some of us buy CCTV cameras. Some
14:53
Speaker 4: of us actually get those sensors which will alert if
14:56
Speaker 4: the window was left open, or the door was open,
14:58
Speaker 4: or the garage door is left open. And the extreme
15:02
Speaker 4: case of that is you also get some sort of
15:04
Speaker 4: service that if the alarm goes off and nobody disarmed,
15:08
Speaker 4: that within ten minutes, then they'll call the local police station.
15:13
Speaker 3: It's the same.
15:15
Speaker 4: Exact same ways to protect your digital welts. Now, m
15:22
Speaker 4: we have the doors, we have the windows, we have
15:24
Speaker 4: the locks, we have the CCTV cameras, we have all
15:26
Speaker 4: of that. We just name them differently in cybersecurity, but
15:31
Speaker 4: that's what it is. You have physical security for your
15:34
Speaker 4: home or office or something else, you have cybersecurity for
15:37
Speaker 4: your digital footprint. That's the same mindset that you're going
15:42
Speaker 4: to have to start bringing it, especially again with the
15:47
Speaker 4: rise of AI, the autonomous things are gonna start saying
15:52
Speaker 4: now you're going to have to think about it where
15:55
Speaker 4: maybe I actually bought something.
15:58
Speaker 3: Three months ago that.
16:02
Speaker 4: Vendor or e commerce website was attacked, where they have
16:05
Speaker 4: my information, That information is going to get cataloged into AI.
16:09
Speaker 4: So if I go into a and asked for about myself,
16:12
Speaker 4: there's information something that I was like, well, I didn't
16:15
Speaker 4: know that.
16:15
Speaker 3: It's out died in the Internet.
16:18
Speaker 4: And as last month AI indexed the whole Internet, it
16:24
Speaker 4: knows it.
16:26
Speaker 3: Wow.
16:26
Speaker 1: Well to your point, Victor, I mean I've had I mean,
16:29
Speaker 1: thankfully I'm paying attention to these things, but I've had either.
16:33
Speaker 2: Text is one of them.
16:34
Speaker 1: I've noticed one technique where they'll text me and ask
16:37
Speaker 1: me to do something acting like another person that I know, right,
16:41
Speaker 1: because you're, like you said, your friends and if you're
16:43
Speaker 1: not being careful and now with AI can sound very
16:46
Speaker 1: authentic like the other person, and so you could easily.
16:50
Speaker 2: Be tripped up. So how have you I would love
16:52
Speaker 2: to ask, because.
16:53
Speaker 1: Before we start recording this human connected point of it,
16:56
Speaker 1: So how have you helped? Like you said, this mindset
16:59
Speaker 1: led teams are helped others in this you know, to
17:02
Speaker 1: start to think differently picture not just the business owners, right,
17:06
Speaker 1: I mean certain the business owner, but you've got to
17:07
Speaker 1: be the rest of the people in the organisms do
17:09
Speaker 1: thinking differently about our approaching.
17:12
Speaker 4: Yeah again back to the same analogy. You start thinking
17:15
Speaker 4: that if a stranger walks into your home, can they
17:19
Speaker 4: get to the safe that you have in your bedroom
17:22
Speaker 4: behind the walking closet and that you have your clothes
17:27
Speaker 4: in front of it?
17:28
Speaker 2: Mm hmm.
17:29
Speaker 3: Think into those those.
17:31
Speaker 4: Circles, if you will, they got into the outer circle,
17:34
Speaker 4: can they get into the inner circle?
17:36
Speaker 3: And that's the same thing in digital fort print.
17:39
Speaker 4: If I were to get to your bank account, or
17:42
Speaker 4: if I were to get to your wherever you keep
17:45
Speaker 4: your money.
17:46
Speaker 3: What are the steps? You know?
17:48
Speaker 4: It's it's a again. I did a research on this
17:51
Speaker 4: one as well a long time ago. It's one of
17:54
Speaker 4: the bad habits annoyance versus convenience. Annoyance is that to
17:59
Speaker 4: get to my bank account, I use a physical UBI key.
18:03
Speaker 4: That's the only way with my password. With the UBI key,
18:08
Speaker 4: which is a physical little USB or you can have
18:10
Speaker 4: a pass key these days that's digital that you don't
18:14
Speaker 4: have to carry around with you. But ultimately something more secure,
18:18
Speaker 4: something more which doesn't rely upon the one time passwords
18:21
Speaker 4: come into your phone because that can be hacked as
18:23
Speaker 4: well or intercepted. But anyways, the annoyance is that I
18:27
Speaker 4: can't just go into any computer a log into my bank.
18:30
Speaker 3: That's not a thing for me.
18:32
Speaker 4: But that's also annoying in a way because it is
18:35
Speaker 4: not convenient. I was traveling with my family and I
18:39
Speaker 4: needed to log into my bank acount and I forgot
18:42
Speaker 4: to bring my ubikey.
18:43
Speaker 3: You know how annoying that was.
18:44
Speaker 2: Oh yeah, I couldn't.
18:46
Speaker 4: Now that's where the convenience comes in. I wish I
18:49
Speaker 4: hadn't done all this, then I would have been able
18:51
Speaker 4: to log in. So that's the the balance. You're going
18:54
Speaker 4: to start thinking about how much risk can you take.
18:57
Speaker 1: It's a family, yeah you go to be yeah, yeah,
19:01
Speaker 1: but what's the risk of and so you have I think,
19:04
Speaker 1: you know, you have to evaluate that of like you said,
19:07
Speaker 1: the convenience versus being you know, inconvenient. You know, like
19:11
Speaker 1: you said, it's at some point. I was talking to
19:14
Speaker 1: my wife the other day where I log into website.
19:16
Speaker 1: She's like, why does it have this multi factor thing?
19:18
Speaker 1: And then I gotta go this and then it checks
19:20
Speaker 1: me email. I'm like, well, it's just because of the
19:23
Speaker 1: things that you're saying. It is an inconvenience to a degree,
19:26
Speaker 1: but it's protecting you for Like you said, if a
19:28
Speaker 1: minute like wide open, that's not good either.
19:31
Speaker 4: Right, It's the same thing. If you are annoyed, it's
19:35
Speaker 4: always going to be the hacker that who's trying to
19:37
Speaker 4: get to you. If you make convenient for yourself, you're
19:41
Speaker 4: making convenient for them as well. It's literally that simple.
19:44
Speaker 4: Think about this. Your bank account or your saving account
19:48
Speaker 4: or your for one K account, wherever you keep your money,
19:51
Speaker 4: and if that's substantial money that you have and then
19:54
Speaker 4: you care for it, then yeah, protected, and money is
19:58
Speaker 4: not the only thing. Actually, I should really high at
20:00
Speaker 4: one part your important documents.
20:02
Speaker 3: Where you have your let's say, your.
20:04
Speaker 4: Home deed or your insurance document, your driving license, your passports.
20:08
Speaker 4: Everybody liked to scan these days because we have to
20:10
Speaker 4: upload two different platforms to prove your identity. Don't keep
20:14
Speaker 4: into one folder. First of all, don't have that folder unprotected.
20:18
Speaker 4: Make sure that's protected, because that is also money. You
20:21
Speaker 4: don't realize. We actually worked, you know, on a case
20:23
Speaker 4: where someone identity from California, Los Angeles was stolen and
20:29
Speaker 4: they actually had two mortgages going on.
20:32
Speaker 3: They bought a house.
20:33
Speaker 4: They didn't realize they were living on a rental here
20:37
Speaker 4: any scores. They figured that out eventually. Then they froze
20:41
Speaker 4: their credits and all that. But again convenience annoyance. They
20:45
Speaker 4: had all of their folders in a G drive. They
20:48
Speaker 4: didn't realize that ged drivers open public. Anyone on the
20:51
Speaker 4: internet can scan that. Anyone literally, you think that randomly
20:57
Speaker 4: generated you are that nobody will be able to remember
21:01
Speaker 4: they don't need to. There are scanners on the internet
21:03
Speaker 4: who are looking for those g drive links.
21:06
Speaker 1: Just those open links are basically unprotected. You have nobody
21:09
Speaker 1: shared it, but it's made available if you knew how
21:11
Speaker 1: to find find it right.
21:13
Speaker 4: Wow, that's annoyance. Remember conveniences, it's open. I can share
21:17
Speaker 4: with my friends and family. I don't need to reshare
21:19
Speaker 4: every time. Convenience is good for them as well, the
21:23
Speaker 4: attackers because now they were able to find that they
21:25
Speaker 4: were able to open a mortgage house because online you
21:28
Speaker 4: can buy houses these days.
21:29
Speaker 3: Apparently you don't have to go anywhere.
21:32
Speaker 1: So, oh my god, I got a question for you, Victory,
21:36
Speaker 1: because a number of our clients have not all, but
21:39
Speaker 1: many of them are professional services. I've spent twenty five
21:42
Speaker 1: years in the environmental consultings and there's a question of
21:45
Speaker 1: oftentimes I deal with business owners of should we issue
21:49
Speaker 1: hardware to our employees or contractors? Did they use their own?
21:54
Speaker 1: You know, because you can obviously control the different ways.
21:57
Speaker 1: What's been your experience, Victor, as far as an annoyance
22:00
Speaker 1: versus convenience in ways with the way you work with clients.
22:04
Speaker 4: Annoy people who have the most power. So I'll give
22:08
Speaker 4: you an example. People with the most access. I know
22:11
Speaker 4: this is going to sound very rude, but the CEOs
22:13
Speaker 4: or the CFOs or the CIOs who have the most access,
22:16
Speaker 4: they can log into the places that no other person
22:19
Speaker 4: can annoy them. Why because if their identity is stolen
22:24
Speaker 4: the attacker, the hacker can get into everything.
22:28
Speaker 3: Convenience.
22:29
Speaker 4: Make it convenient for the people who are working which
22:32
Speaker 4: has the least access. Maybe they only have access to
22:35
Speaker 4: upload documents or work on an ACCEL or open a
22:37
Speaker 4: software with multi factor authentication already and they can't damage
22:43
Speaker 4: that much. To you, every organization is different, every tier
22:46
Speaker 4: is different, every workforce, how they plan for their organization
22:51
Speaker 4: is different. So don't annoy everybody, but don't make it
22:55
Speaker 4: convenient for everybody, especially the top executives who have the
22:59
Speaker 4: most acts for the IT super admins who have the
23:03
Speaker 4: most access.
23:05
Speaker 2: Mm hmm. That's a great point.
23:07
Speaker 1: Yeah, make it make it more inconvenient for them, because
23:10
Speaker 1: there's more risk. Just again we're saying evaluate that. What
23:14
Speaker 1: makes sense. And I think Victor, I would imagine as
23:19
Speaker 1: you're doing this and working with folks you have, it's
23:22
Speaker 1: not probably a one. And then like TIG ongoing training
23:25
Speaker 1: and awareness, Victor, as you you know right, speak a
23:28
Speaker 1: little bit to that.
23:30
Speaker 3: Yeah, I'll give you a good example.
23:31
Speaker 4: Actually, recently I was setting up a direct way from
23:34
Speaker 4: my vendor in Wells Fargo, and kudos to Wells Fargo
23:37
Speaker 4: by the way, and they had a simple option there
23:41
Speaker 4: low threshold which was I think one thousand dollars or
23:44
Speaker 4: five thousand dollars. Can remember you can go through a
23:47
Speaker 4: multi factor with your pass key my threshold. You must
23:51
Speaker 4: take the hardware or set token and in it you
23:55
Speaker 4: click on that little question mark. They had a proper
23:57
Speaker 4: videos why they're asking. It's a kind of enablement training
24:01
Speaker 4: that I would like to see in organizations. Again, it's
24:04
Speaker 4: not easy for the small or medium sized businesses to
24:08
Speaker 4: do it because it requires planning, it requires resources, requires money.
24:13
Speaker 4: They would rather fill up inventory then spend money on
24:16
Speaker 4: the cybersecurity or digital security, your training and all that.
24:20
Speaker 4: So again, nothing wrong, that's what's working out in the past,
24:24
Speaker 4: but now it's not going to The cases are increasing
24:28
Speaker 4: where the small and medium sized businesses are being attacked
24:31
Speaker 4: and targeted. So back to training. Make your vendors train
24:38
Speaker 4: your employees so that you don't have to What I
24:41
Speaker 4: mean by that, you must have some sort of solution,
24:44
Speaker 4: You must have some sort of a platform that you're
24:47
Speaker 4: using in your SMB. Ask them simple question you can
24:51
Speaker 4: ask your Internet service provider, Hey, do you give internet
24:54
Speaker 4: security or cybersecurity trainings? Or do you have any videos
24:57
Speaker 4: I can share with my employees free? Doesn't cost you anything.
25:02
Speaker 4: Leverage those trainings. Now, if you are above the threshold
25:06
Speaker 4: of SMB, obviously you're gonna create tailored content for your organization.
25:11
Speaker 4: If you are a healthcare institution, you might create content
25:14
Speaker 4: for that. If you are a financial institution, you might
25:17
Speaker 4: create content for that, or you might leverage companies to
25:20
Speaker 4: create content for you. Again, it really depends on the
25:23
Speaker 4: risk factor. What are you're trying to tell people? Your
25:26
Speaker 4: employees the point or I'll give you, don't overtrain them.
25:31
Speaker 4: Nobody likes to actually listen to the information that's not
25:35
Speaker 4: relevant to you or cannot apply. Give them scenarios that's
25:39
Speaker 4: their day job. Don't give them scenarios that is so
25:42
Speaker 4: hypothetical that they're like, well.
25:45
Speaker 3: That's only going to happen in Matrix the movie.
25:47
Speaker 1: Want Yeah, right, Well, and I know you know, cybersecurity
25:53
Speaker 1: insurance is becoming Obviously it's benefit, but it seems to
25:56
Speaker 1: be more.
25:56
Speaker 2: Because of like you said, these attacks.
25:58
Speaker 1: Now, AI right, and if correct me if I'm wrong, Victor,
26:03
Speaker 1: But if we're if we're engaging somebody obviously like you
26:06
Speaker 1: are getting the training, does that help at least show
26:09
Speaker 1: the insurance ass that're working them, like, hey, look we're
26:12
Speaker 1: doing taking proactive measures to like you're always like looking
26:15
Speaker 1: to say costs, right, so if hey, like we were
26:17
Speaker 1: paying for this, it could produce some costs and maybe
26:19
Speaker 1: you know, the insurance that we're going to be paying
26:21
Speaker 1: or whatnot. I don't know if that something in the
26:22
Speaker 1: industry that you're seeing victor.
26:24
Speaker 4: One percent and that's that's not something that I have
26:28
Speaker 4: seen the SMBs even like entertaining cyber insurance. But for
26:32
Speaker 4: those who are considering old enterprises or corporations or organizations,
26:37
Speaker 4: cyber insurance used to be and vivially, I remember about
26:41
Speaker 4: twenty twelve one checkbox do you have network security? They
26:46
Speaker 4: used to even not call cybersecurity network security, which means
26:49
Speaker 4: you have a firewall and that's about it, or antibidrus
26:52
Speaker 4: and then yes, you get these waivers which means if
26:55
Speaker 4: your premium was nineteen thousand, since you have network security,
27:00
Speaker 4: maybe sixteen thousand. Now there's about one hundred and ten
27:04
Speaker 4: page document, Oh my gosh, that you have to prove
27:08
Speaker 4: that you have a skilled person on staff or retainer,
27:14
Speaker 4: what security solutions are using, How can they protect if
27:17
Speaker 4: the ransomware comes in? Because what happened between twenty twelve
27:20
Speaker 4: and twenty twenty five, ransomware attacks happened, companies turned to
27:26
Speaker 4: cyber insurance that well, pay up. That's what I bobb.
27:29
Speaker 4: The issuance for underwriters became smart. They said, well, if
27:33
Speaker 4: we're gonna keep paying, let's make sure that they're doing
27:36
Speaker 4: everything in their power. It's exactly the same thing. If
27:39
Speaker 4: you buy a home insurance, they ask you, do you
27:41
Speaker 4: a paadlock? Do you have a CCTV camera? Do you
27:44
Speaker 4: have locks? It's exact same again. I keep comparing to
27:48
Speaker 4: the physical security because that's what it's been there from
27:52
Speaker 4: since the dawn, right ciber insurance NUMBERK, security insurance or
27:56
Speaker 4: whatever you want to call it. Today, at the end
27:58
Speaker 4: of the day, you have to prove that you are
28:00
Speaker 4: doing everything in your power to protect yourself. Then I'm
28:04
Speaker 4: going to ensure you. And then something happens. Let's talk
28:07
Speaker 4: about it. It's not as simple as a checkbox that
28:11
Speaker 4: now security, yes, lower premium off you go.
28:15
Speaker 1: Yeah, absolutely, Well, so to the point, victor, walk me
28:19
Speaker 1: through a little bit. So if I'm a small or
28:21
Speaker 1: medium sized business and I know you've been helping and
28:23
Speaker 1: targeting this area, looking like, hey, they don't have a
28:25
Speaker 1: lot of security expertise.
28:27
Speaker 2: You highlighted what can they is there?
28:30
Speaker 1: Like, I mean walk me through there like a checklist
28:33
Speaker 1: or way that they can start to be aware. Obviously
28:36
Speaker 1: they can engage somebody like you. I want them to
28:38
Speaker 1: like talk to How do they know who's a good
28:42
Speaker 1: person to talk right that knows their stuff is ask
28:46
Speaker 1: you know, asking the right questions so that.
28:47
Speaker 3: They're it's funny you asked here.
28:51
Speaker 4: I actually so I asked the during my research, I
28:55
Speaker 4: asked would you pay for clybri insurance? And about again
29:00
Speaker 4: ninety percent people said why would I I have an
29:03
Speaker 4: insurance that covers my organization or my establishment?
29:08
Speaker 3: And they don't. First, they don't.
29:09
Speaker 4: See the difference what cebrations versus there whatever the business insurance. Second,
29:16
Speaker 4: it's going to be chicken an egg. Cebration is going
29:19
Speaker 4: to require you to have some sort of dow care
29:22
Speaker 4: for your organization when it comes to cyber like maybe
29:24
Speaker 4: a firewall, antivirus, slash dr slash XTR, maybe a separated
29:29
Speaker 4: network for your guest versus your critical applications. If you
29:33
Speaker 4: don't have the basics, cybrations will not make sense because
29:37
Speaker 4: the premium is going to be so high that you
29:39
Speaker 4: won't be able to digest. So the five things I
29:43
Speaker 4: had suggested as a walk away and that that was
29:45
Speaker 4: my deal, that hey, let me, you will research on you,
29:48
Speaker 4: and I'll give you five things that you can do.
29:50
Speaker 4: Common five things most of the organizations that who are
29:53
Speaker 4: either starting in IT security or have not even considered
29:58
Speaker 4: first was steparate your network using a firewall, your guest
30:03
Speaker 4: network and your critical network. It is easy to do it.
30:06
Speaker 4: You can have a firewall expert come in. It's one
30:10
Speaker 4: time set up, not a whole lot that you have
30:12
Speaker 4: to care and love, but if you want to, sure,
30:15
Speaker 4: but at the end of the day, it's a bare minimum.
30:18
Speaker 4: Steparate networks first thing. Second, if you bring your personal
30:24
Speaker 4: computer at work as well. Yes I'm using the terms
30:27
Speaker 4: that only enterprises use, but if you're using the same
30:30
Speaker 4: computer at home for your kids assignment and same computer
30:33
Speaker 4: at work to pay your vendors, start considering a password manager.
30:40
Speaker 4: There are plenty out there. I'm happy to give recommendations
30:43
Speaker 4: if anybody wants to reach out to me on LinkedIn.
30:45
Speaker 4: I advocate some of them, but at the end of
30:48
Speaker 4: the day, get a pastor manager. Why the new passwor managers.
30:52
Speaker 4: You don't have to have the two factors separate on
30:55
Speaker 4: your phone or email. All of that is integrated as
30:58
Speaker 4: a past key, which means convenience, but you get more security.
31:02
Speaker 3: Now.
31:04
Speaker 4: Third, what I recommended was again, now you have your organization,
31:10
Speaker 4: start considering if you have IoTs separate network again going
31:15
Speaker 4: back to the first point, separate network for that. So
31:17
Speaker 4: if you're a vending machine, if you have a door bell,
31:19
Speaker 4: if you're a camera, if you have automatic locks or.
31:22
Speaker 3: Anything separting that.
31:25
Speaker 4: The last and the most important is start informing your
31:30
Speaker 4: employees when they punch in or pus system what is
31:34
Speaker 4: cyber hygiene. And rely upon your vendors like Internet service
31:38
Speaker 4: provider or reach out to your local IT security guys
31:41
Speaker 4: if they can give you a free trading if you will,
31:45
Speaker 4: and if you like it, maybe put them on retainer.
31:47
Speaker 4: But try to get something so you start getting mindset
31:51
Speaker 4: where your people punch in punch out. Maybe you're on
31:55
Speaker 4: a laptop, iPad or traditional way of a machine. I
32:00
Speaker 4: have the latest cyber threat news which has been very
32:03
Speaker 4: impactful by the way, because it's top of your mind
32:06
Speaker 4: when you're punching in or clocking out, and you're like,
32:09
Speaker 4: oh my god, if this happened to organizations, or this
32:13
Speaker 4: happened to our local news, by the way, if this
32:16
Speaker 4: happened to you in my neighborhood, I should be worried
32:18
Speaker 4: about it. Yeah, simple things. Again, tiny habits can change it.
32:24
Speaker 4: But the biggest the takeaway is start somewhere, which is
32:28
Speaker 4: network segmentation. You can't use the same network. And that's
32:32
Speaker 4: been the most important and the fundamental thing that people
32:36
Speaker 4: when they change it, they drastically change their tack surface.
32:40
Speaker 4: Because now if I'm coming to your organization, if I'm
32:43
Speaker 4: coming to your shop from the guest Wi Fi, I
32:46
Speaker 4: can get your laptop from the doorbell or vending machine.
32:50
Speaker 4: I can get your laptop from Internet. I can directly
32:53
Speaker 4: go to your laptop. Yes, it will require a person
32:56
Speaker 4: or someone expert in that domain to do it, but
33:00
Speaker 4: that's what the doorbells, and that's where the CCTV cameras,
33:02
Speaker 4: and that's where the doors and windows you are investing in.
33:06
Speaker 3: This is another form of it. This is another line item.
33:08
Speaker 4: This is not I don't need to get fancy this
33:11
Speaker 4: is bare minimum doors for your ID assets.
33:15
Speaker 3: Yeah.
33:15
Speaker 1: I think if you're anybody's hearing that, you're like, okay,
33:17
Speaker 1: that's definitely one thing. Will follow up question you mentioned
33:19
Speaker 1: about like a past which I happen to use a
33:22
Speaker 1: password because you mentioned them.
33:26
Speaker 2: I know this is the fact for.
33:27
Speaker 1: A lot of professional services I you work with in
33:29
Speaker 1: the environmental world anyway, because they are using a personal laptop.
33:32
Speaker 1: Let's say, Victor, would you also add to say, I've
33:35
Speaker 1: really send this. I would love your thoughts on this.
33:37
Speaker 1: To create maybe a two different log in accounts. So
33:41
Speaker 1: one that's a business specific log in account, personal account.
33:45
Speaker 3: Yeah, that's what I'm in.
33:46
Speaker 4: So when i'm pastor manager like your company passor manager
33:49
Speaker 4: if you want so, I have completely two separate so
33:52
Speaker 4: every person they are free to choose whatever they want,
33:55
Speaker 4: however they want to keep their passwords on a sticky note,
33:58
Speaker 4: or they remember the same password for all the accounts.
34:01
Speaker 4: Terrible idea, by the way, Yes, but for your company,
34:04
Speaker 4: for your organization, it's four or five bucks per month
34:07
Speaker 4: these days, it's not that expensive investment. Honestly, it will
34:10
Speaker 4: save you that hassle that the liquor store had to
34:13
Speaker 4: go through where the passwords were literally in a plain
34:16
Speaker 4: text file on their desktop.
34:19
Speaker 3: The file name was passwords.
34:21
Speaker 2: Oh my goodness, and that's when.
34:23
Speaker 3: You're attracting everybody that come come find.
34:26
Speaker 1: Me please, Oh my gosh. I know we're getting to
34:28
Speaker 1: the end of the podcast episode Victory here. You've hit
34:31
Speaker 1: so many good points on these last few ones have
34:33
Speaker 1: been fantastic. And and to make sure that everybody can
34:36
Speaker 1: again connect with you on LinkedIn.
34:37
Speaker 2: Victor and I are on LinkedIn.
34:38
Speaker 1: We're going to put the ways you connect with him
34:40
Speaker 1: on there. He's got so many great initiatives there, you
34:42
Speaker 1: guys are we're just scratching the surface. He's got his
34:45
Speaker 1: own podcast as well. You can go check that out.
34:48
Speaker 1: And so I hope everybody's listening and they're thinking a
34:52
Speaker 1: little differently about technology, cybersecurity, about how they can approach
34:55
Speaker 1: it differently mentioned mindset, how we can do this and
34:59
Speaker 1: recogniz seeing that unfortunately in today's world, we all you know,
35:03
Speaker 1: it's just you know, it's just a matter of time
35:05
Speaker 1: where all can be attacked at some point because most
35:08
Speaker 1: of us have something maybe you know, maybe you don't
35:10
Speaker 1: think it's super valuable, but somebody else doesn't have it.
35:12
Speaker 1: And they want but you don't, but they don't have, so,
35:15
Speaker 1: you know, being proactive, being more strategic. That's the one
35:19
Speaker 1: thing I definitely heard from you, Victory. Okay, don't just
35:22
Speaker 1: be just tactical. There's some more things we do here.
35:24
Speaker 1: And then, of course, I'm sure Victor, depending on the business.
35:27
Speaker 1: As you get in there, you can you're gonna unveil
35:29
Speaker 1: or you find some other things you're like, hey, I
35:31
Speaker 1: didn't even know about that.
35:32
Speaker 2: I didn't think about that.
35:33
Speaker 1: And that's why binding somebody like yourself, Victor, come in
35:37
Speaker 1: look at it, do an audit, get a better sense
35:38
Speaker 1: of what's the exposure really is. Victor, again, I want
35:44
Speaker 1: to thank you for being here. Last, I just want
35:45
Speaker 1: to give you an opportunity last maybe thoughts or if
35:48
Speaker 1: if anybody's listening and we've covered a lot of ground
35:50
Speaker 1: here that you'd want to share with them, just say
35:52
Speaker 1: if there's something they should do today or consider.
35:56
Speaker 4: The one thing I would recommend, especially everybody who's listening,
36:00
Speaker 4: either for personal or for your small business, small medium business,
36:05
Speaker 4: one hour. Just think of one hour per day, per week,
36:09
Speaker 4: per month, per year, whatever that is. One hour start today,
36:12
Speaker 4: then one hour thinking about your it cybersecurity. Just one hour.
36:17
Speaker 4: Put a timeer on your phone as another one hour.
36:20
Speaker 4: Get up, start going back to your business, start doing
36:22
Speaker 4: your day thing for one hour. Just commit that one
36:25
Speaker 4: hour and then grow from there. Because that one hour
36:28
Speaker 4: is the eye opener, light bulb moment that you're going
36:31
Speaker 4: to need. You just haven't been able to dedicate that.
36:33
Speaker 4: So if you listen to this podcast today, just one
36:36
Speaker 4: hour per day, per week, per month, per year, I'll
36:39
Speaker 4: let it let I'll let you choose that second. Whatever
36:43
Speaker 4: your net and will gross income is one percent of that,
36:48
Speaker 4: start putting into piggyback whatever that that one percent looks like,
36:55
Speaker 4: that is your for you to spend on it cybersecurity
36:59
Speaker 4: and grow there.
37:01
Speaker 3: One hour, one percent. That's all I'm asking for.
37:04
Speaker 1: There you go. Thank you so much, Victor. Of course,
37:07
Speaker 1: we appreciate all of you guys following along forget them where,
37:16
Speaker 1: whether you're finding us on YouTube or your favorite podcast platform,
37:20
Speaker 1: we appreciate you coming along the journey with us. I
37:22
Speaker 1: hope you'll come back a week after week. We great
37:25
Speaker 1: guests like Victor on here. If you're interested, you want
37:27
Speaker 1: to join us, You're more than welcome. Reach out to
37:29
Speaker 1: me Podcasts judyourbusiness dot com. I appreciate you all being here. Victor,
37:33
Speaker 1: thanks again for being with us on the podcast.
37:35
Speaker 3: And thank you, thanks David, and thank you everybody listening
37:38
Speaker 3: to us today.
37:39
Speaker 2: Thanks everybody. Until next time, be well,