Latest / Success Story with Scott Clary / Lessons - The Man Who Protects Millions of Dollars Online Every Day | John Downey - CISO at GoFundMe (Fmr PayPal)

Transcript

Lessons - The Man Who Protects Millions of Dollars Online Every Day | John Downey - CISO at GoFundMe (Fmr PayPal) · Success Story with Scott Clary

• 0:00
  In this lessons episode, explore why cybersecurity risks persist and how human behavior remains the weakest link.
• 0:06
  Discover how most attacks exploit simple vulnerabilities. Understand why awareness and strong habits
• 0:11
  prevent costly breaches and uncover how a culture of trust strengthens organizational security.
• 0:23
  I've seen that a lot, but that means that there's a lot of vulnerabilities and liabilities
• 0:28
  in the nonprofit sector. So maybe speak to some of the things that you see as attack vectors
• 0:37
  that could be a major issue if these are not more addressed and if people don't put more of an
• 0:42
  emphasis on information security. Because I feel like to your point before, private industry is
• 0:47
  taking it more seriously than they did before, but I feel like nonprofit is potentially still lagging.
• 0:53
  Now, I think that that's very true and I think one of the things I always recommend to folks is
• 0:59
  you know, you have a couple different types of attackers who may come after you, right?
• 1:02
  So you have people who are doing it just because they don't like you or they don't like what you stand for
• 1:06
  or they don't like someone involved with you, they kind of hacked us. You're going to have a hard time
• 1:11
  defending against them. And you know, if you're a nonprofit, like they're nonprofits that are politically motivated
• 1:16
  and they have and therefore they're going to have someone with the opposite persuasion attacking them.
• 1:21
  But the vast majority of people that they're probably going to deal with are people who are financially motivated.
• 1:25
  So financially motivated attackers are, you know, they're usually at the at the lower levels
• 1:31
  at these kind of smaller companies. It's more of a drive-by issue unless of a targeted issue, right? So I
• 1:36
  always describe it to, you know, it's not Tom Cruise and Emission Impossible, like breaking into the
• 1:41
  facility and like dropping down, you know, and like stealing the information. It's someone walking down
• 1:45
  the street and juggling the handles on the car doors, right? Like that's the kind of person. They're
• 1:49
  just looking for a car that was left unlocked that they can rob. And so what you need to do as an
• 1:54
  organization is do the things you have to do to lock your car doors and make sure that your employees
• 1:59
  are doing it. So that's things like good password hygiene. So, you know, having strong passwords,
• 2:04
  unique passwords per website, using a password manager, turning on multi-factor authentication,
• 2:09
  and probably the best thing you can do is enable MFA everywhere you can. And then last thing is
• 2:15
  patching. So like patching your software, patching your phones, encouraging everybody to make sure
• 2:20
  like, hey, keep everything up to date. And you're going to be at that point, you're going to be
• 2:24
  pretty close to being the one who's had their car door locked. The one I've added that we're very
• 2:28
  recently is just double checking that all your laptops are encrypted. So this is something that,
• 2:33
  you know, is starting to come more of a norm out of the gate, but like if you get a new windows
• 2:39
  or Mac laptop, just make sure that it's the encryption's enabled. And this is where it kind of,
• 2:43
  you know, helps to have a partner to do this, right? Like if you're a nonprofit, if you can partner
• 2:46
  somebody, because I don't expect an executive director at a local foundation to be an expert on
• 2:51
  technology, you know, how to turn on Bitlocker. But hopefully there is an organization they can work
• 2:55
  with an IT consultant or someone who can do that. And the reason I kind of go into the laptop
• 3:01
  thing is because people like any mobile device, the mobile phones are very good. Like, you know,
• 3:06
  mobile, modern mobile phones are pretty, are pretty secure. It's the mobile laptops just because
• 3:11
  you do lose them, you leave them in cabs, you leave them, you know, restaurants, like things
• 3:15
  happen. And when that happens, you want to make sure that you have a fairly high confidence that
• 3:18
  the data on it is safe. So you're saying like from what I'm hearing that the majority of problems
• 3:24
  still, the majority of potential attacks are still human, are still focused on the human,
• 3:30
  are still focused on the human screwing something on basically or getting fished or losing something.
• 3:36
  Yeah. So the, you know, Verizon every year publishes a great report that kind of outlines data
• 3:41
  statistics. And it's something like 80 plus percent of attacks that are, you know, going to be like
• 3:46
  really wildly successful, start with known credentials. So they start with someone, you know,
• 3:51
  it's not that like someone hacked the matrix and kind of broke in. It's like, no, they got scots
• 3:56
  using them in password and they logged in a scot. And I'm assuming actually, if you're, if you have
• 4:04
  a workforce that's not working from home, which is a reality post COVID, then you to your point
• 4:11
  actually. So you don't have, you don't have the proper encryption on the devices that people are
• 4:17
  working off of because they're taking something home or they're combingling the files from their work
• 4:22
  with the files on their personal computer at home. And every all the, all the security requirements
• 4:28
  that in office, you could sort of control. Now it's like the Wild West. It's like craziness
• 4:34
  because everybody goes home and they can use whatever device they want and using their personal
• 4:38
  device, using their work device, using personal phone, work phone. Is that what you're dealing with
• 4:41
  right now? I mean, I think so. And I think a lot of folks have been dealing with it since 2020,
• 4:46
  you know, March of 2020. I remember talking to competitors at the time when I, where I was,
• 4:52
  where they were sitting people home with desktops because it was all they had. They didn't have
• 4:56
  laptops for these people. You couldn't buy a laptop. I don't know if you, if you were in the
• 4:59
  mode of trying to buy a laptop in August, or sorry, in April, you know, it's like it just sell
• 5:04
  it panic. Yeah, you couldn't like, and like, because all the students were going to remote learning,
• 5:09
  all the employees were going to remote. If they didn't already have these, the supply chains were
• 5:13
  immediately jammed. And so because of this, things were skipped, you know, efficiency was needed
• 5:19
  to get people up and running. And so I think a lot of companies in places are dealing with the fact
• 5:24
  that they kind of, you know, there's still this COVID fog of like, you have this technology out there.
• 5:28
  Now, fortunately, unfortunately, you know, it's a couple of years old. So maybe it's
• 5:32
  you know, entering the place where it's going to be replaced. But you have a lot of technology
• 5:35
  out there that was kind of like rushed into production, if you will. And these kind of early days
• 5:40
  of COVID that maybe, you know, didn't get, you know, the firewalls didn't get configured or the
• 5:44
  laptops didn't get encrypted. If you're not a sophisticated organization, then, you know,
• 5:48
  has the remote management capabilities, like a small nonprofits, you may have this risk out there.
• 5:54
  And so, you know, kind of going back to what I mentioned a little bit earlier is partnering with
• 5:57
  someone who can help you out with this, like, I don't expect people to have this, you know,
• 6:01
  these people on staff at that level, you outsource it, you know, just like kind of how a startup would
• 6:07
  for, you know, for things that aren't going to be core to what they're trying to build,
• 6:10
  you kind of have to outsource it to someone as an expert. But also, like, so you're saying that
• 6:15
  a lot of this comes at, yes, so you're outsourcing some of the actual very technical items.
• 6:20
  But there's a lot, I'm sure there's a lot of education that can be built into an organization
• 6:24
  that probably also isn't there that could mitigate tons of these problems. So, I mean,
• 6:27
  let's talk about the human component and these breaches because the human, that's the fallacy,
• 6:33
  that's the weak point, right? That's the Achilles heel. So outside of pure technical, what are the,
• 6:38
  for us, for any, I was going to say small business owner, but for any business owner that doesn't
• 6:42
  have this knowledge in house, what are the like the best practices that you would teach over to your
• 6:47
  team or your employees so that they don't fall victim to this stuff? Because I'm even spouting off
• 6:52
  stuff like don't get fished. Okay, maybe people don't even know what that means. You know, I,
• 6:57
  I get the dude, I get these like scam emails all the time. They're getting actually quite complex
• 7:01
  and I can see it because I'm a technical person and I'm not, I'm not oblivious to this, but I get
• 7:05
  emails from my own team where they've like changed the name of the, of the email, but this, if you
• 7:12
  actually go into, or they change into the sender, but the email is this weird obscure email and it's
• 7:16
  like, hey, Scott, like, you know, oh, it's Patrick and it's like, change my banking information on my
• 7:22
  payroll. And I need my ACHF. Yeah, exactly. So it's like, he wants to pay me in iTunes gift cards.
• 7:28
  Right. Exactly. And it's like, oh, don't, don't, don't, don't call me. I'm in a meeting,
• 7:33
  just do this urgently, like stuff like that. So I mean, not everyone's going to fall for that.
• 7:38
  Yeah, no, so you say that, you know, the recent, so a few days ago, the FBI released their
• 7:44
  2022 cybercrime statistics. And so they categorized that under kind of this thing called BEC or
• 7:50
  business email compromise. And it, for years and years and years was the number one thing on
• 7:55
  their cybercrime, always a, you know, a couple billion lost reported to them. Wow. This year
• 8:00
  actually dropped number two. The number one is now investment scam, so the crypto scams.
• 8:06
  But it's still number two, it's still a huge deal. And it takes the form that you mentioned,
• 8:10
  which is, you know, often somebody will reach out, usually they'll impersonate an executive or
• 8:16
  CEO, CFO, president, someone, they'll send, we've been, we've actually been seeing a lot more
• 8:21
  text messages than emails recently, where they'll text or email and say like, hey, I'm the CEO,
• 8:27
  I have something really important. You can't reach me, but I need you to do something and it
• 8:31
  always involves like wiring money or changing in an ACH information or buying gift cards or
• 8:36
  something for some reason. Anything that you can do to extract value out of the person or the
• 8:41
  organization. And you know, they're playing to a couple things, right? They're playing to
• 8:44
  urgency. They're playing towards people's sense of wanting to help out, especially like the CEO,
• 8:49
  you know, hey, like I, you know, I'm special. They reached out to me because they thought I could
• 8:53
  handle it. I want to let them down. And, you know, and people unfortunately do fall for it. And
• 8:58
  that's the, you know, to the tune of a couple billion a year that we know of so far, at least from
• 9:02
  the FBI and in the US. And like that, I think a lot of that kind goes back to creating a foundation
• 9:09
  of trust inside the organization to, you know, no, you know, basically you have to make people
• 9:13
  where these are big things. So, you know, awareness and security, awareness and training is a big
• 9:18
  for organizations of all size. You know, make sure people have the feel, feel comfortable to kind of
• 9:23
  stop and say like, hey, this is weird. Like, maybe I should like validate this. And so, yeah,
• 9:28
  how would I go about validating that the email that the email I just got from the CEO isn't correct?
• 9:33
  Like, is the CEO even approachable at my company? So, you know, I'm very fortunate at the place
• 9:38
  where I work at GoFundMe. Our CEO is actually like, you know, come out in town halls and say like,
• 9:42
  I will never text you. I will never email you and ask you to do this. We will always use proper
• 9:46
  channels. And that's helpful. But for organizations that are a little bit smaller, they haven't seen
• 9:50
  this before. You know, I, I, I'm involved in an organization where they, they have this and the
• 9:56
  person actually kind of went along with it for a little bit. And this is at an organization I've
• 10:00
  consulted with in the past. What do you mean they went along with it? They, they, they were like
• 10:04
  down the street about to buy gift cards for long rains. When they stopped and said, wait a minute,
• 10:09
  this makes no sense. Why should I be doing this? Yeah. And they felt super embarrassed as you
• 10:13
  wouldn't. They like didn't want to report it. Didn't want to talk about it because it's very
• 10:16
  natural. You know, you, you, you can be embarrassed. You can, and you know, you can find yourself like
• 10:22
  feeling like a fool. And that's why it's important to always create this like, you have to lead with
• 10:26
  empathy. You have to say like, look, this happened. It could have happened to anybody. I would feel
• 10:29
  embarrassed too. Here's what we can do to like make sure that we, you know, we're resilient to this
• 10:33
  in the future. And just sort of, you know, focus on improving the situation. There's, there's an
• 10:39
  aspect in security, we call the human firewall, which is, you know, knowing that we could have the
• 10:43
  best security in the world. But we, you know, if we don't have humans out there kind of helping us
• 10:48
  out as well, like we're going to miss things. And the example I always go back to with this is the
• 10:52
  SolarWinds breach from a few years ago. So the SolarWinds got compromised. You know, the U.S.
• 10:57
  has blamed the Russian government for doing this. And they, they were in organizations like
• 11:02
  Microsoft and the State Department and they come to call it fire. Fire is a very famous security
• 11:06
  company. It was actually an employee at FireEye got a multifactor authentication reset email
• 11:13
  reached out to their security team said, I didn't do this. This is weird. Launched investigation
• 11:18
  found that they had this breach that had stemmed from SolarWinds. And that's how the whole
• 11:22
  thing was uncovered. If they, if this human hadn't kind of been aware, it felt comfortable going
• 11:28
  to their security team with this that the whole SolarWinds incident may have lasted for another
• 11:32
  few months of nine years. That's wild. That is absolutely wild that like such a, it's such a,
• 11:39
  somebody who needs to feel psychologically safe to speak up. And that's really what stopped
• 11:46
  this from going on. Actually, I was just thinking, you know, as you're telling me that story,
• 11:50
  I actually do have a friend who ran a very large business. And I think, I think it was just
• 11:56
  under 500,000. And it was a payment. It was a payment for a service. And basically, there was an
• 12:01
  email sent to change the wire information or the ACH information. And it was gone. But that
• 12:07
  employee in particular felt embarrassed while I spoke up immediately. And the founder and CEO
• 12:13
  of the company was like a very good friend. And he's a good person. So like obviously not,
• 12:16
  not an ass about it. But yeah, I could see that. And I could actually see this is almost like a
• 12:22
  leadership lesson can do more for reinforcing the security of your organization than anything,
• 12:28
  really, because if you create a psychologically safe environment and somebody's going to be
• 12:33
  willing to speak up and like raise their hand when they screw something up, that's great. That's
• 12:36
  a very healthy organization. If somebody screw something up and you reprimand them and you fire
• 12:41
  them, that is actually potentially going to do more harm to your organization in the long term.
• 12:46
  Because everybody who saw that action is going to be like scared out of their mind to ever say
• 12:51
  anything if they ever do anything wrong. And that's going to cause more repercussions.
• 12:54
  Yeah, it's very similar to in the DevOps world coming up Etsy. There's this thing called
• 13:00
  Blameless Post Portems. I don't know if you're familiar with it, but the idea is, you know, so if you
• 13:04
  haven't incident the site goes down, there's an outage. Somebody, you know, somebody maybe misconfigured
• 13:09
  something. And there's this idea that we can kind of get together to talk about what happened
• 13:13
  and find the improvements going forward that you do in a blameless fashion. So you don't say
• 13:18
  John pushed this update and John caused the site to go down. You'd be like an update was pushed
• 13:24
  to site went down. Here's what we're going to do going forward. You don't, but not attaching blame,
• 13:28
  you're creating this, you know, this environment in which you can kind of lead with empathy,
• 13:33
  create this space for people to, you know, kind of, you know, be safe to share these things,
• 13:37
  own it, not, you know, you kind of create this, you, you know, actually create a situation which
• 13:41
  they won't try to cover it up ideally. Like they, if you do go with blame first, maybe somebody's
• 13:47
  like, okay, I messed up, but like I can fix it really quickly. I don't need anybody else to help
• 13:51
  me. And then nobody will know. And then I'll be, I'll be fine. Nobody. I won't get fired.
• 13:56
  Instead, you can kind of stop and say, oh, I messed something up. I need to ring the bell, call for
• 14:00
  help because I can't fix this on my own. Thanks for tuning in. If you found this valuable,
• 14:04
  don't forget to hit that subscribe button so you never miss an episode. And if you want to dive
• 14:08
  deeper into this conversation, check out the links in the description to watch the full episode.
• 14:13
  See you in the next one.