Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / Navigating Cryptocurrency Security: Sim Swaps, Vendor Risks and Assertive Measures

Transcript

Navigating Cryptocurrency Security: Sim Swaps, Vendor Risks and Assertive Measures · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:17
  Speaker 1: Hey guys, welcome to another podcast.
• 0:19
  Speaker 1: We've got Blake Ray Hello.
• 0:21
  Speaker 1: Today we're going to talk about SIM Swaps, top cybersecurity and compliance news, and there was another story.
• 0:31
  Speaker 2: Third party risk vendor management.
• 0:34
  Speaker 1: Yes, third party vendor risk management.
• 0:37
  Speaker 1: So SIM Swaps.
• 0:39
  Speaker 1: What is a SIM Swap?
• 0:41
  Speaker 1: A SIM Swap is when a bad actor impersonates you to the telecommunications or phone company.
• 0:50
  Speaker 1: So they pick up the phone, use social engineering and basically steal your identity to persuade the caller or representative at the carrier to send you a new, or send the bad actor a SIM card a new SIM card with your phone number tied to it.
• 1:11
  Speaker 1: So one of the things that people do, or that's recommended, to prevent a SIM Swap attack is, first and foremost, try to avoid using your telephone number, your cell phone mobile number, for SMS tokens, and what I mean by that is, when you go to a website and use the multi-factor authentication, try to avoid using your phone number to get the pin, because if that gets in the wrong hands AKA a SIM Swap well then they can get into those accounts and this is what has happened hundreds, if not thousands, of times especially targeting people that hold cryptocurrency or Bitcoin, and as those cryptocurrency values go up, so do SIM Swap attacks.
• 1:58
  Speaker 1: So SIM Swap attacks they look for lists and people that hold crypto, and they know that people in mass generally do not adopt.
• 2:07
  Speaker 1: Not saying you guys, your listeners, yours are smart ones.
• 2:10
  Speaker 1: I'm saying that most people don't take cybersecurity seriously enough minimum effective dose of security on their own personal devices and systems.
• 2:22
  Speaker 1: So the hackers know it's essentially low hanging fruit.
• 2:25
  Speaker 1: So they go after the carrier.
• 2:28
  Speaker 1: They try to figure out which carrier first.
• 2:31
  Speaker 1: They do recon on social media, figure out their victim list and then they figure out who they want to target and impersonate.
• 2:37
  Speaker 1: And it's happened so many times.
• 2:41
  Speaker 1: There's been cases all different carriers have been attacked with this, and it's an ongoing problem.
• 2:49
  Speaker 1: So you, as a consumer, the best things that you could do is try to protect your phone number as best as possible.
• 2:56
  Speaker 1: And what does that mean?
• 2:57
  Speaker 1: That means that you can call your mobile carrier.
• 2:59
  Speaker 1: Stop what you're doing right now.
• 3:01
  Speaker 1: Tell them that you want additional security on your account.
• 3:05
  Speaker 1: Set up a unique pin number for when you call the carrier, ask for any additional security controls that they can offer you to prove your identity.
• 3:16
  Speaker 1: So just make it more hoops to go through.
• 3:21
  Speaker 1: I know it might be inconvenient for you, but I mean really, how often do you call your carrier anyway?
• 3:26
  Speaker 1: So I mean nowadays, too, with the new iPhones and I'm sure that the new phones, droid devices, things like that they use what's called eSIM, so there's no physical SIM chip anymore, which helps.
• 3:40
  Speaker 1: So but still there's risk there and it's still possible to move your.
• 3:44
  Speaker 1: You know people can go get a new iPhone or a new device and still activate and move your phone number if they have enough information about you as the target.
• 3:53
  Speaker 1: So all that, blake, you can comment.
• 3:57
  Speaker 2: Yeah, yeah, I especially.
• 3:59
  Speaker 2: Once you get a new eSIM it'll cancel your old SIM.
• 4:02
  Speaker 2: So this actually happened to my dad, ironically, and his crypto got stolen.
• 4:07
  Speaker 2: Yeah, essentially they were they were migrating his phone number to Google voice and then so anytime you would call his phone, it would say the Google subscriber, whatever, leave a message.
• 4:21
  Speaker 2: And then he started getting, I guess they got text messages to his Google voice number for his Binance or whatever whatever crypto wallet, coinbase, and then they sent the money to themselves through Coinbase or Binance or whatever.
• 4:39
  Speaker 2: And of course, you know me being the forensics guy I essentially kind of traced the breadcrumbs trail from wallet to wallet and essentially what they were doing was they were taking crypto and then they were dividing it.
• 4:54
  Speaker 2: So, like they would take let's just say it was you know a thousand US dollars, they would send like 700 to one account and then 300 to another account, and then that 300 would be 100 there, 200 there, and then the 700 would be like 500 here, 300 there, and they just kept doing that, you know, pretty much infinitely.
• 5:18
  Speaker 2: I mean, I think it took me maybe 20 or 30 like layers, and then it actually went to the biggest whale wallet in the world.
• 5:33
  Speaker 2: So I find that super interesting.
• 5:37
  Speaker 2: So the person who has the largest you know, that I was aware of and of course I looked on the coin.
• 5:46
  Speaker 1: So so so that big whale wallet could be on an exchange somewhere though.
• 5:50
  Speaker 1: So it's kind of so when you say that it's probably not an individual that owns that wallet.
• 5:55
  Speaker 1: It's probably some exchange somewhere.
• 5:58
  Speaker 2: Could be.
• 5:58
  Speaker 2: But you know you can go to like I think it's the coin exchange or whatever, and it shows you like the most held the largest wallets and it traced right back to that wallet.
• 6:10
  Speaker 2: So I found that a little interesting and, yeah, it happened multiple times to him.
• 6:20
  Speaker 2: The second time they got into it they already tapped all of this crypto out and then, of course, there's nothing you can do.
• 6:28
  Speaker 2: I mean the money's gone.
• 6:31
  Speaker 1: Yeah, I mean I don't know if you've done this or not, but you can certainly fill out a report with the US cert and CISA and report it, which you should do.
• 6:39
  Speaker 1: And if you've been a victim of that, you can certainly keep digging and keep digging deeper and try to kind of triangulate where I know you said big whale wallet, but it most likely is some exchange somewhere.
• 6:55
  Speaker 1: But yeah, it takes a lot of time, like you said.
• 7:00
  Speaker 1: I mean they do these, I'll put it, I guess money laundering, kind of looping kind of things to kind of keep moving the money and in different numbers, like you mentioned, and then they keep kind of how many layers of that deep right.
• 7:16
  Speaker 1: And then you said that it ended up in some large whale wallet somewhere.
• 7:20
  Speaker 1: So I suspect that it's probably at some exchange somewhere or dumped there somewhere and then further got distributed from that point or converted or something Just got to keep.
• 7:35
  Speaker 1: Like you said, the breadcrumb trail.
• 7:36
  Speaker 1: I mean it could be a really long trail, sometimes take countless hours.
• 7:41
  Speaker 1: That's why this work is so specialized and it takes so much time.
• 7:44
  Speaker 1: It could take years.
• 7:45
  Speaker 1: Law enforcement is still using new technology to crack cases from 30, 40, 50 plus years ago with DNA and different kinds of tools that are new and they're catching criminals.
• 7:59
  Speaker 1: So I mean, I'm sure, as time progresses and the tools get better, hopefully one day you'll be able to track it down.
• 8:05
  Speaker 1: But yeah, I know that the short answer is there's nothing you can really do, but there is some things that you can do, and reporting it should be one of them.
• 8:15
  Speaker 1: You can certainly reach out to an attorney and explore those options too.
• 8:22
  Speaker 1: Sometimes they have access to different experts that can help.
• 8:28
  Speaker 1: It really just boils down to I don't know how much money it was, but it boils down to is it worth it or not?
• 8:35
  Speaker 1: Because you're going to end up paying for some of this stuff and sometimes it's not worth it.
• 8:39
  Speaker 1: But I think the learning lesson and not talking down on you or anything, I'm just saying the learning lesson here is don't keep your money on, don't keep crypto on exchanges, keep them on cold wallets.
• 8:50
  Speaker 1: We've talked about that before.
• 8:52
  Speaker 1: I don't know if you guys are aware with the whole.
• 8:55
  Speaker 1: People say Binance and then some people say Binance.
• 8:59
  Speaker 1: I say Binance, but there's a whole crackdown happening with CZ, the CEO of Binance, and how he has stepped down and paid over.
• 9:09
  Speaker 1: I think it was $4 billion.
• 9:11
  Speaker 1: This was last week in fines, and then I heard a couple of days ago that they're not going to let him leave the United States until his hearing.
• 9:25
  Speaker 1: So that's interesting.
• 9:28
  Speaker 1: So I guess the takeaway here, looping back to Simswap attacks, is don't trust your phone number to keep you safe and don't trust anyone.
• 9:38
  Speaker 1: Don't trust your carrier to keep you safe.
• 9:40
  Speaker 1: Like I said, there's ongoing cases around.
• 9:42
  Speaker 1: Whose fault is this?
• 9:43
  Speaker 1: Is this the carrier's fault because you had cryptocurrency and you were trusting the carrier to not move your phone number?
• 9:51
  Speaker 1: Could be.
• 9:53
  Speaker 1: I do agree that you shouldn't have your phone number moved without your authorization and there should be safeguards from carriers to make sure that you prove your identity and maybe even make it so that you absolutely have to go into a store and you have to show two forms of government ID.
• 10:14
  Speaker 1: My point here is that anybody around the world can call anyone else and a bad actor can wake up in a different country one day and say, oh, I'm going to attack Blake or whomever, and they can do that from anywhere in the world.
• 10:31
  Speaker 1: And if we don't have carriers and companies that follow these security and regulations that are put in place, I mean, that's why these things exist, because if people didn't put security in place for anyone, I mean, look at that.
• 10:47
  Speaker 1: This reminds me of back in the day.
• 10:48
  Speaker 1: I don't know if you remember Blake, do you remember phone freaking?
• 10:52
  Speaker 1: Do you know what that is?
• 10:55
  Speaker 1: So phone freaking is?
• 10:57
  Speaker 1: This is back when, I mean, 2600 is still around.
• 11:01
  Speaker 1: But my point is that phone freaking was like the fun thing to do for board teenagers.
• 11:09
  Speaker 1: Cyberpunks that wanted to hack into.
• 11:12
  Speaker 1: This was kind of like before the internet, more in the BBS or Bulletin Board system days.
• 11:19
  Speaker 1: That's a pretty good tip again board teenagers, board kids that wanted to break into carriers, phone companies, and the goal was to set up party lines.
• 11:36
  Speaker 1: Back then cell phones weren't in everybody's hand, so it was old school pick up the phone, dial and call somebody.
• 11:41
  Speaker 1: And most companies had corporate accounts with carriers, right.
• 11:45
  Speaker 1: So they'd call like the company might have an account with AT&T or whomever and they would have their business phone lines with them.
• 11:54
  Speaker 1: And this was back when T1s were more popular.
• 11:57
  Speaker 1: And anyway, you had these at risk companies that were relying upon the carrier to set up their company dial directory.
• 12:09
  Speaker 1: And sometimes these companies needed conference lines because maybe they were a global company and they needed people to dial in, kind of like what we're doing now with Zoom, right, only this didn't exist then.
• 12:20
  Speaker 1: So they did it all by audio, all by phone.
• 12:22
  Speaker 1: So what hackers in that day and that timeframe would do is they would hack into the phone carrier, break into the party line and either just goof around or lock people out or kind of like how, when COVID hit, a lot of people were hacking the Zoom channels and kicking the people out and doing crazy stuff.
• 12:43
  Speaker 1: Well, they were doing this stuff back in the day, only with audio.
• 12:46
  Speaker 1: So my point is back then, kevin Mitnick, you know, rest his soul.
• 12:52
  Speaker 1: He passed away recently, right, but this was in a lot of his books.
• 12:56
  Speaker 1: He used to do this kind of stuff and he went to prison for some of this that he did when he broke into some of the carriers.
• 13:02
  Speaker 1: But my point, in kind of bringing this full circle, is those were learning lessons for companies and carriers and that's what caused regulation and regulation continues to evolve, as we've seen with CMMC in different kinds of regulation and there are different laws and regulations that these carriers need to comply with.
• 13:23
  Speaker 1: In my opinion, there's not enough being done for companies and carriers, companies of all shapes and sizes around taking cyber seriously enough and taking compliance seriously enough to protect the consumers and to protect the companies.
• 13:38
  Speaker 1: But I think the best thing that you and I can do as consumers is advocate is push back at the company or the other person on the other line and say, look, we want more security, I want more privacy, what are you doing to protect me, what can I do, what can you do for me and what can I do to protect myself?
• 13:58
  Speaker 1: And then kind of bringing this full circle back to crypto.
• 14:01
  Speaker 1: Never put crypto, store it for long periods of time in software or hot wallets.
• 14:07
  Speaker 1: You know kind of best practices with crypto is.
• 14:10
  Speaker 1: You always want to make sure that you have a wallet ideally a cold wallet and that you spend coins, send and receive coins to that wallet before making large purchases and savings to those wallets, because you don't want to set up a brand new wallet and then just go put your life savings in crypto or whatever.
• 14:28
  Speaker 1: I'm not recommending any of this.
• 14:29
  Speaker 1: This is not financial advice.
• 14:31
  Speaker 1: My point is that you don't want to, in this case, trust a wallet, a software wallet or even a hardware wallet.
• 14:38
  Speaker 1: You don't want to trust that they're going to store everything either.
• 14:42
  Speaker 1: So you need to do things on your own, and what I'm saying to do on your own is test these things, make sure that they work properly.
• 14:48
  Speaker 1: Send and receive small transactions.
• 14:50
  Speaker 1: Always do that as a test before storing larger amounts.
• 14:54
  Speaker 1: Never trust one wallet, even if it's a cold wallet.
• 14:56
  Speaker 1: Use multiple cold wallets, different vendors.
• 14:59
  Speaker 1: You know, for security I use multiple vendors for cameras, multiple vendors for different layers of the ecosystem, because, again, I feel like we're in such a trustless world.
• 15:11
  Speaker 1: You have to verify everything and you can't, unfortunately, trust a single person, company or carrier.
• 15:18
  Speaker 1: So there's some things that you can do on your own, as listeners, to kind of take matters into your own hands, because the fact of the matter is, all of our information is out there and we're all targets.
• 15:31
  Speaker 1: So what are you doing today to make it harder and becoming less of a mark?
• 15:37
  Speaker 1: At least, that's my philosophy on it.
• 15:40
  Speaker 2: Yeah, I mean it's like putting all your eggs in one basket.
• 15:43
  Speaker 2: You know that's the easiest way.
• 15:44
  Speaker 2: I'm sure I mean your mom has told you that, or your dad or somebody in your family, you know.
• 15:50
  Speaker 2: So spreading, you know, and with my dad's story, you know, obviously the hackers were spreading that money out, right, you know, because having it all in one place is too risky.
• 16:04
  Speaker 1: Yeah, and that goes for exchanges too.
• 16:05
  Speaker 1: You know, if you're trading crypto, like I said, try to avoid using your phone number for an authentication layer.
• 16:12
  Speaker 1: You know, don't trade on a single exchange.
• 16:15
  Speaker 1: You know, try to use multiple exchanges.
• 16:17
  Speaker 1: Try not to keep a large amount of money on an exchange.
• 16:20
  Speaker 1: Have a process to move it off the exchange to several different cold wallets, like Blake was saying, kind of spread things out so all your eggs are in one basket, because there could be a day in the future where one of those exchanges gets hacked or what happens and there's a government crackdown, they find some shady stuff happening, like what happened with FTX.
• 16:41
  Speaker 1: You know.
• 16:42
  Speaker 1: And then you know, if you guys have money on those exchanges, they can lock it all up and freeze it all up, and then it's going to take months, if not years, for you if you ever see that money again.
• 16:53
  Speaker 1: So why would you put yourself at those kinds of risks when we've had so much corruption?
• 16:58
  Speaker 1: And this corruption is everywhere.
• 17:00
  Speaker 1: It's all over the place at different companies, different levels.
• 17:03
  Speaker 1: It's just everywhere.
• 17:05
  Speaker 1: So we need to take matters into our own hands and take security more seriously and do our part.
• 17:13
  Speaker 2: Yeah, I mean I think in my opinion, you know there's probably going to get some heat for this, but you know I definitely want to see crypto regulated for those reasons.
• 17:23
  Speaker 2: You know that it's kind of been for the past 10 years or so like the wild, wild West, you know like it.
• 17:34
  Speaker 2: Just it needs to happen.
• 17:36
  Speaker 2: I think you know that way people can feel secure.
• 17:39
  Speaker 2: You know, investing in these crypto coins and I mean the fact is nothing, you know nothing really happens to these criminals, you know.
• 17:50
  Speaker 1: I mean Well, I don't know if that's entirely true.
• 17:54
  Speaker 1: As far as that, I mean, look at what.
• 17:56
  Speaker 1: Do it agree?
• 17:57
  Speaker 1: Yeah, I think your point is that and I think the speculation is that it's too easy.
• 18:03
  Speaker 1: It's too easy for anyone to kind of create a crap coin and make a bunch of money and then rip people off and there's no regulatory framework around.
• 18:13
  Speaker 1: You know the laws of the land, you know and I agree with that and I support that.
• 18:17
  Speaker 1: I do think that there needs to be more regulation and, again, you know compliance around.
• 18:23
  Speaker 1: What can you, what can you do, what can't you do?
• 18:26
  Speaker 1: I do feel like our country in America is is lagging behind.
• 18:31
  Speaker 1: I think that you know some other countries are more advanced in that regulation.
• 18:36
  Speaker 1: I'm hopeful and optimistic with the whole.
• 18:40
  Speaker 1: You know a lot of people are anticipating the Bitcoin ETF and the, the Ethereum ETF.
• 18:46
  Speaker 1: Now, I don't know if you've heard about those things, but you know there are.
• 18:50
  Speaker 1: Those are some real big players, like BlackRock and Fidelity Investments, and they're all now, you know, turning the corner on supporting Bitcoin and wanting to be the first to make it easy for people to buy Bitcoin on New York Stock Exchange, for example, and through traditional financial measures that are regulated.
• 19:16
  Speaker 1: So right now we have, like, the grayscale Bitcoin trust right, and that's an easy way for people to get exposure to Bitcoin through the normal financial channels, like on the stock market, for example.
• 19:29
  Speaker 1: You know you can buy MicroStrategy.
• 19:31
  Speaker 1: You know they're a big supporter of Bitcoin.
• 19:33
  Speaker 1: My point is that there's the traditional financial regulatory frameworks that exist now, with people trading stocks and derivatives and things like that, and then there's the Bitcoin and crypto world and, like Blake said, yeah, I do think that there needs to be more regulation and more you know of a blueprint of what you can and what you cannot do.
• 19:54
  Speaker 1: Now I think that there's also I know Coinbase, for example, which is a popular exchange in America, has requested clarity from the SEC on you know what are the rules, you know what can we do, what can't we do, and they're getting a lot of friction and not getting clear answers back.
• 20:14
  Speaker 1: So I think there's a lot of frustration there.
• 20:16
  Speaker 1: So I don't know why it's taking so long to get the clarity that these companies need.
• 20:24
  Speaker 1: I think that a lot of companies, especially exchanges, have moved out of America, which is sad to see, in my opinion.
• 20:30
  Speaker 1: I mean, I think that America is a great country to start a business and I think, at least on the crypto side of things, it's become very difficult and people are scared that they're going to get cracked down by the SEC and get fined, you know.
• 20:46
  Speaker 1: So I think that you know, people don't know what they can and can't do.
• 20:48
  Speaker 1: There's not a lot of clarity there.
• 20:50
  Speaker 1: So I 100% agree that there needs to be some clarity there, and I think that that is in the works, especially with this new Bitcoin ETF and Ethereum ETF, which is, you know, blackrock's, if not the biggest financial, I think they are the biggest financial company in the world.
• 21:08
  Speaker 1: So you're talking just tons of money that is on the sidelines right now.
• 21:13
  Speaker 1: So, anyway, that's the kind of the.
• 21:17
  Speaker 1: I guess we went off in a little tangent, but you know, the point is, you know, for SIM swaps at least, you know, try to protect yourself, take matters into your own hands, and we'll, you know, kind of shift gears into vendor risk management from here, and it goes back to the don't trust verify methodology.
• 21:35
  Speaker 1: You know, when you have a vendor that you want to do business with, or that vendor wants to do business with you, whatever, you should have a pot, a process around.
• 21:46
  Speaker 1: How do you vet the security of that vendor?
• 21:49
  Speaker 1: Are you exchanging confidential information?
• 21:51
  Speaker 1: You know, in the, in the, the Dib or the defense industrial base and in the CMMC world you have typically the prime vendors and then you have the sub vendors and it's called a trickle down effect.
• 22:04
  Speaker 1: So in our world with NIST and IST, 800171 and now 800172, and then you've got DeFars compliance and CMMC compliance.
• 22:14
  Speaker 1: Now the point is the big primes that you know, the Boeing, the Lockheed Martin, you know the real big company names that you've heard of in aerospace engineering and defense.
• 22:26
  Speaker 1: Those guys have a framework to follow, which is what I just mentioned with NIST and CMMC.
• 22:32
  Speaker 1: And if you are a small company that helps the big company, you're considered a sub.
• 22:39
  Speaker 1: And if there's what's called CUI or controlled unclassified information, or maybe it's even classified information, if there's some information flow that's sensitive, there's what's called a flow down from the prime to the sub.
• 22:53
  Speaker 1: The sub they don't care if you're one person working out of your house or a thousand people working in a corporate building across different locations.
• 23:02
  Speaker 1: You have to take all that same security of NIST, 800171, 172, cmmc.
• 23:09
  Speaker 1: All that stuff you have to do just like the big prime.
• 23:12
  Speaker 1: So there's no more.
• 23:13
  Speaker 1: Oh, I'm this small company, we don't need to do all this stuff.
• 23:17
  Speaker 1: No, if you want to participate in the ecosystem and have that supply chain and that vendor relationship and get that money, that grant money or whatever that business.
• 23:26
  Speaker 1: You need to take that security just as seriously as that big company.
• 23:30
  Speaker 1: So, going back to vendor risk management, you want to make sure that, at least on an annual basis, you're going through all the vendors you do business with and you're going through a framework like NIST 800171 and you're following along with.
• 23:46
  Speaker 1: Do I have all these policies and procedures in place?
• 23:48
  Speaker 1: Are they up to date?
• 23:49
  Speaker 1: Are they customized for my company?
• 23:51
  Speaker 1: What am I asking of my vendors?
• 23:53
  Speaker 1: Are you asking for proof of a pen test?
• 23:56
  Speaker 1: Are they allowed to do their own pen test or they have to do a third-party pen test?
• 24:00
  Speaker 1: We recommend third-party testing because it's not, in our opinion, Like a tunnel vision approach.
• 24:09
  Speaker 1: It's very fresh approach and there's teams that are doing this all day long and you know, using different team members and different expertise to exploit gaps in the system, so it's much more effective.
• 24:21
  Speaker 1: But there are things that small companies can do on their own.
• 24:26
  Speaker 1: They can do the policy work on their own.
• 24:28
  Speaker 1: They can do the, the mappings or the adaptation of those policies and procedures on their own.
• 24:33
  Speaker 1: So a lot of the heavy lifting can be done by the small company or even the larger company, but there should still be a professional that's hired to test it in the end, when you're done and you know, I think that the, the SPURS or the SPRS system, was a good way that the government, with the DFAR 70, 19 and 70, 20 and 70 21 that came out a few years ago now For defense contractors, they basically were like hey, we know that you guys are supposed to be compliant with NIST 800 171, but fact of the matter is we know most of you are not, because we're seeing all these headlines with hacks in the supply chain.
• 25:12
  Speaker 1: So let's see how compliant you are.
• 25:14
  Speaker 1: And that's where the whole SPRS scoring system came into play.
• 25:17
  Speaker 1: And if you did not have a system security plan, you were automatically failed and you had a score of negative 203.
• 25:25
  Speaker 1: And if you were Doing a great job, your perfect score is 110.
• 25:30
  Speaker 1: And if you had any gaps whatsoever, you had to document them into what's called a poem, plan of action and milestone and you had a time frame of how and when you were going to fix that gap.
• 25:41
  Speaker 1: And when you're done, then you get the points and there's a whole DOD methodology on how they calculate the score, then you're supposed to be uploading your score into the SPRS system on a regular basis and your score may change.
• 25:55
  Speaker 1: You may lose an employee or a key stakeholder and Maybe that unwinds some of the security and you have to go back and rewrite your policies and remap things and and maybe you were A 110 at one point and now you drop back to an 80 and now you got to do some extra work and get yourself back up to.
• 26:12
  Speaker 1: You know the speed.
• 26:13
  Speaker 1: But my point is you can use this methodology to score your vendors.
• 26:17
  Speaker 1: You can ask your vendors and put pressure on your vendors on.
• 26:21
  Speaker 1: Hey look, can you show me your policies and procedures?
• 26:24
  Speaker 1: Can you show us evidence of a pen test?
• 26:26
  Speaker 1: When was your last security risk assessment?
• 26:29
  Speaker 1: When was your last Vulnerability assessment?
• 26:31
  Speaker 1: What did what was tested?
• 26:33
  Speaker 1: What was not tested?
• 26:34
  Speaker 1: What, what, what did the remediation look like?
• 26:36
  Speaker 1: You know what I mean like.
• 26:37
  Speaker 1: So if you get a vendor that you're doing business with and they're looking at you like they don't know what any of this stuff is, obviously that's a red flag.
• 26:44
  Speaker 1: They're not doing anything for security, pretty much or very, you know, minimal.
• 26:47
  Speaker 1: So and for the hills, yeah.
• 26:51
  Speaker 1: So I mean that you know that these are things that you can do to kind of Essentially raise the bar, because if you do business with companies that take security more seriously, well then you're at a less likely risk of a breach, because a breach hurts everybody.
• 27:09
  Speaker 1: So if one of your vendors has a breach and you're in a Financial or business relationship with them, it affects you too and you can get pulled into it, so you know.
• 27:20
  Speaker 1: So it can get messy, especially in healthcare too, like.
• 27:22
  Speaker 1: So if you're like a you know a software as a service vendor in healthcare and you're collecting patient health information and you're subject to HIPAA compliance and Something happens and there's a breach, well you, you're affecting clients that you do business with that could be hospitals, that could be clinics, so it just gets messy, and it gets messy really fast.
• 27:46
  Speaker 1: So you definitely want to be careful with what vendors you do business with and how you're vetting them, and you want to do the vetting process at least on an annual basis.
• 27:55
  Speaker 1: And you want to push back and you want to.
• 27:57
  Speaker 1: You know a lot of these smaller companies especially.
• 28:00
  Speaker 1: The quick answer is, oh, we can't afford to do that, we can't.
• 28:04
  Speaker 1: You know, that's too expensive.
• 28:06
  Speaker 1: Well, I mean, like I said, a lot of this stuff you can do on your own, and it doesn't necessarily always cost money either.
• 28:13
  Speaker 1: So there are things that can be done that are more secure than doing nothing.
• 28:19
  Speaker 2: Yeah, I think that's a great point to hammer home.
• 28:22
  Speaker 2: You know, obviously it's dominoes, right, like if your vendor falls, you fall, and understanding that.
• 28:30
  Speaker 2: And you know we have a lot of people that approach us that don't agree with that, but that's the truth, you know.
• 28:38
  Speaker 2: Oh, I'm trusting this data with the vendor.
• 28:39
  Speaker 2: I don't need to do this because the vendor does this.
• 28:42
  Speaker 2: You know, it doesn't work like that.
• 28:45
  Speaker 1: Well, look at the biggest misconception.
• 28:47
  Speaker 1: Yeah, and look at you know, one of the common misconceptions that I hear is around password managers.
• 28:54
  Speaker 1: A lot of people are scared to use a password manager because their belief is oh well, that vendor is, if they get breached, then I'm screwed, and there is some truth to that.
• 29:06
  Speaker 1: However, if you're doing your own due diligence and you're doing your own methodology and protecting yourself, let's say you've got 10 different places, 10 different accounts, and you store those 10 different accounts on something like a last pass and those 10 different accounts almost every company supports multi-factor authentication.
• 29:29
  Speaker 1: If you took those 10 accounts and you and you used an authenticator app with each of those accounts, well, if somebody got your password, they're still not getting in your account right, because they don't have your authenticator token.
• 29:39
  Speaker 1: So my point is that if you make it harder Now, if you use a dumb password like password 123, and you reusing that password at multiple accounts, maybe five or seven of those 10 accounts well you're your own worst enemy You're making.
• 29:55
  Speaker 1: Obviously you don't want your passwords to get exposed.
• 29:58
  Speaker 1: I'm not saying that that's good or that's even tolerable.
• 30:01
  Speaker 1: What I'm saying, though, is that, as a consumer, you can do more to protect yourself by using complex, unique passwords in addition to multi-factor, and choosing a multi-factor method not an SMS, not text message a authenticator app that is known to be more secure, like Google authenticator, microsoft authenticator, et cetera.
• 30:24
  Speaker 1: Those are ways that you can take matters into your own hands that, yes, it does make it harder for you to log into your sites that you need to do business with or bank or whatever, but you're protecting, you're doing your part, you're taking advantage of the security that's being offered to you.
• 30:39
  Speaker 1: If you're the type of person that's just you, minimum effective.
• 30:42
  Speaker 1: Hey, give me the eight-character password or whatever, and I'm using the same one for the past 10 years.
• 30:48
  Speaker 1: Well, I mean, now is the time to change that habit.
• 30:51
  Speaker 1: But my point is that it is a myth that using a password manager is not as secure, because we're all human.
• 31:00
  Speaker 1: I don't even know what my passwords are.
• 31:02
  Speaker 1: My point is I have a proven methodology of complex passwords, tokens using software and different.
• 31:10
  Speaker 1: I even use proximity tokens for certain things, or hardware tokens in addition to a software.
• 31:16
  Speaker 1: My point is that you choose the methodology and the layers dependent upon what you're going to protect, and use all of the controls that are given to you and take advantage of them to protect yourself.
• 31:30
  Speaker 1: Because if everybody were to follow this which I don't think will ever happen but my point is that if most people were to use what's given to them and the depth of what's given to them, then when a breach because it's not a matter of if it's when a breach happens, then you won't be suffering the damages from that, because, think about, let's kind of fast forward and play a game where, let's say, all your passwords were in last pass If you followed what I just said, who cares?
• 32:00
  Speaker 1: Everybody's got your information anyway, right.
• 32:02
  Speaker 1: But the point is that if you put in multiple layers to protect yourself, well, yeah, that one layer got compromised and that's bad.
• 32:09
  Speaker 1: And then you just go and you move on about your day.
• 32:13
  Speaker 1: You choose a better solution, you go back, you change your passwords, but you're the one that's still in control, you're the one that still has access to your account, because you took it seriously and because you had these extra layers in place, so you didn't suffer damages, whereas most people that were not doing that, yeah, now they suffered big time and maybe they even lost something like crypto, because they again weren't possibly using all the methodology around securing their accounts as best they could.
• 32:44
  Speaker 2: Yeah, I agree 100%.
• 32:46
  Speaker 2: You need to stay diligent.
• 32:47
  Speaker 2: Obviously, look, it helps to reflect in words.
• 32:52
  Speaker 2: Look at yourself, look at your company, look at your brand, look at yourself as a victim, like what would I do?
• 33:02
  Speaker 2: Obviously, you know your vulnerabilities.
• 33:05
  Speaker 2: I could tell you I'm not the best, strongest bodybuilder, right.
• 33:10
  Speaker 2: So use those in your understanding of your company to help progress your security, right.
• 33:19
  Speaker 2: Take that with if you're using a third party company consultants like us to help.
• 33:28
  Speaker 2: Hey, I know I'm weak here.
• 33:30
  Speaker 2: I know I'm weak there.
• 33:31
  Speaker 2: You know, don't get defensive in that strategy.
• 33:37
  Speaker 2: Don't be ignorant, because communicating that to, let's just say, you're seeking help to secure your business, like with companies like ours Just knowing that you know we can help streamline things a little quicker as well.
• 33:54
  Speaker 2: So, yeah, I'm ignorant.
• 33:57
  Speaker 1: The other thing just to add to that too is don't assume that big company or big healthcare vendor, hospital doctors, whomever don't assume that if they're a prime, oh, they got all this covered.
• 34:10
  Speaker 1: No, that's not how it works.
• 34:12
  Speaker 1: Again, we're trying to drive home the fact that when you do business with a vendor or a hospital, whatever, ask for the secure portal.
• 34:24
  Speaker 1: If they don't have one, give them a secure portal that you manage and maintain from a trusted vendor.
• 34:30
  Speaker 1: Don't send information via insecure text message or insecure email.
• 34:36
  Speaker 1: Use an encrypted email platform.
• 34:38
  Speaker 1: These are different, just examples of just.
• 34:40
  Speaker 1: I'm not saying that they're silver bullets or cure-alls.
• 34:44
  Speaker 1: I'm just saying that these are things that to look out for.
• 34:46
  Speaker 1: If your law firm is sending you a questionnaire to fill and this questionnaire is pretty detailed around your first name, middle name, last name, social security number, birth date you know there's some stuff in there that's private Don't send it back to them via insecure email.
• 35:04
  Speaker 1: Say, look, do you have a law firm dashboard that's encrypted where I can send this to you?
• 35:12
  Speaker 1: Or if they are like, no, we just do this by email, then you need to be educated enough as a smart listener of our podcast and be like, no, I'm not going to do that.
• 35:22
  Speaker 1: What other methods do you have?
• 35:24
  Speaker 1: If they don't have one, you need to be one to give them a method and say look, we're going to use this.
• 35:30
  Speaker 1: Simple things that are free, like signal.
• 35:33
  Speaker 1: You could exchange encrypted messages with signal.
• 35:37
  Speaker 1: There's all different platforms, different capabilities of each of these platforms.
• 35:43
  Speaker 1: Not necessarily all of them cost money.
• 35:46
  Speaker 1: The point here is that don't trust that big company or whomever has all this covered, because they don't.
• 35:53
  Speaker 1: It's a common myth that, oh, they're a huge company or they're a big bank, they got all this taken care of, whatever.
• 35:59
  Speaker 1: No, not necessarily they don't.
• 36:02
  Speaker 1: We're here to educate you that most often they do not and that you should take matters into your own hands, especially when you're dealing with any kind of sensitive information.
• 36:12
  Speaker 1: These extra safeguards that you're doing yeah, they put a hurdle in place, but they make it more difficult.
• 36:18
  Speaker 1: In the event that something is exposed and there's a breach, it pays back dividends and protections to you.
• 36:26
  Speaker 1: Look at what happened with Equifax.
• 36:27
  Speaker 1: Equifax, all of us were affected.
• 36:30
  Speaker 1: Now, if Equifax was encrypting, then the payload would have been encrypted to the bad actors.
• 36:36
  Speaker 1: Again, I'm sure there's more to it in the investigation.
• 36:40
  Speaker 1: I wasn't part of the investigation.
• 36:41
  Speaker 1: My point, though, is that, again, big company.
• 36:44
  Speaker 1: I think the knee jerk reaction is oh big companies got our back, they're securing us.
• 36:51
  Speaker 1: Well, we find, more often than not, that the big companies, as well as the small companies, are still not doing enough for cyber and protection and compliance.
• 37:03
  Speaker 2: Yeah, I know this one also.
• 37:05
  Speaker 2: Don't give them more information than they need, even if it's on the form push back.
• 37:14
  Speaker 1: Say look, why do you need my social security number?
• 37:16
  Speaker 1: Why do you need this?
• 37:17
  Speaker 1: There's information that you should push back on.
• 37:20
  Speaker 1: Just because it's on the form, don't fill it.
• 37:25
  Speaker 2: Yeah, same thing.
• 37:26
  Speaker 2: Let's just say, for example, you're collecting information from your clients and then you're storing that information in X, y, z software.
• 37:36
  Speaker 2: If you don't need their social security numbers and that software, that vendor doesn't require that that they have the social security number, why are you collecting it and why are you storing it there?
• 37:46
  Speaker 2: I know that sounds obvious, but people do that.
• 37:51
  Speaker 2: They try and make their life easy.
• 37:53
  Speaker 2: Oh, I'm just going to get as much information as I can.
• 37:55
  Speaker 2: I'm just going to put it all in one place.
• 37:57
  Speaker 2: If you don't need your clients' social security numbers, like, don't collect it, don't store it.
• 38:06
  Speaker 2: I know that sounds really obvious, but it happens and people do that surprisingly.
• 38:14
  Speaker 2: They're like oh what if I need it later?
• 38:16
  Speaker 2: No, no, don't do it.
• 38:17
  Speaker 2: Yeah, I should probably definitely wrap up on that note.
• 38:23
  Speaker 2: It's a good ending point, agreed.
• 38:28
  Speaker 1: All right, thanks guys.
• 38:30
  Speaker 2: See you in the next one.