Latest / Inside West Palm Beach / Fighting Cybercrime: A Challenge For The City And For You

Transcript

Fighting Cybercrime: A Challenge For The City And For You · Inside West Palm Beach

• 13:02:00
  Welcome to the City Center podcast from
• 13:02:01
  West Palm Beach. I'm Jerry Marcello.
• 13:02:05
  Modern technology has led to fantastic
• 13:02:07
  modern conveniences like having access
• 13:02:09
  to bank accounts, utility services, and
• 13:02:12
  even your health records. The problem is
• 13:02:14
  that there's a lot of other bad actors
• 13:02:16
  who would like to access your
• 13:02:18
  information and use it against you. In
• 13:02:20
  today's episode we'll explore just how
• 13:02:22
  real the problem of cybercrime is, how
• 13:02:25
  the bad guys try to get your information,
• 13:02:27
  and what you can do to keep your
• 13:02:29
  information safe. That's coming up next.
• 13:02:36
  [Music]
• 13:02:38
  And joining us today is Paul Jones, the
• 13:02:41
  Chief Information Officer for the City
• 13:02:42
  of West Palm Beach. Paul, welcome. Thank
• 13:02:44
  you, glad to be here. First question that
• 13:02:46
  always comes up, people know that there
• 13:02:48
  is indeed cybercrime and things to be
• 13:02:50
  aware of. Really, how bad is it? It's
• 13:02:54
  bad. I mean, it is,
• 13:02:56
  it's just all relative to
• 13:02:58
  the world we live in now. And yes, it is
• 13:03:01
  constantly happening. I did, when I
• 13:03:04
  first came to the city, I did like 89, 90
• 13:03:08
  presentations on cyber security
• 13:03:10
  awareness because it hadn't been done.
• 13:03:12
  And in those sessions, I'd always ask,
• 13:03:15
  anybody been hit, anybody involved? And
• 13:03:18
  there wasn't but more than five
• 13:03:20
  presentations that somebody didn't say
• 13:03:22
  yes. And some of them were major. It is
• 13:03:25
  real, it is big, and it is something that
• 13:03:28
  everybody needs to be aware of. Okay, so
• 13:03:30
  we're not kidding. Is this something that
• 13:03:32
  folks really do need to worry about?
• 13:03:33
  Even the folks at home need to be
• 13:03:35
  concerned. Absolutely
• 13:03:37
  not kidding. And yes,
• 13:03:38
  the folks at home, there's no one safe.
• 13:03:41
  The bad actors are after any and
• 13:03:44
  everything they can get. And some people
• 13:03:45
  get confused. They think, oh, I
• 13:03:47
  don't have anything or they're after,
• 13:03:49
  they're not after a little money, they're
• 13:03:51
  after just big money. But you got to
• 13:03:53
  realize if I get a dollar from a million
• 13:03:56
  people, which is not out of the out of
• 13:03:58
  the scope in the online world, it's got a
• 13:04:00
  million dollars. Wow. And so it's not the
• 13:04:03
  big things, it's everything that they're
• 13:04:05
  after. Okay, so what are the things that
• 13:04:08
  concern you most? What
• 13:04:10
  techniques and things that people should
• 13:04:11
  be aware of? The biggest thing that
• 13:04:13
  concerns me is the word awareness. If you
• 13:04:17
  think about how new this
• 13:04:19
  world is that we're living in, I did a
• 13:04:21
  presentation a long ago and so I pulled
• 13:04:23
  up some dates, and the World Wide Web was
• 13:04:26
  1989. So you're talking 35 years ago.
• 13:04:29
  Yeah. And you think about in my lifetime,
• 13:04:32
  I didn't have any of these. And so
• 13:04:35
  you're talking about a world that's
• 13:04:36
  really, really new. And so to expect
• 13:04:39
  people to understand the depth of it and
• 13:04:41
  understand what can happen is not
• 13:04:43
  realistic. So making people aware and
• 13:04:46
  just making people cautious and making
• 13:04:48
  them understand what you can and can't
• 13:04:50
  trust is probably the biggest concern.
• 13:04:53
  Trust. I think that's one of the most
• 13:04:55
  important things that you could ever
• 13:04:56
  talk about in this area is that people
• 13:04:59
  work very hard to gain a false sense of
• 13:05:01
  trust from their victims. How should we
• 13:05:05
  always trust messages that we get to be
• 13:05:08
  email or from text or what should we do?
• 13:05:11
  Let's look at it in perspective.
• 13:05:13
  Yeah. Before the internet, we were in a
• 13:05:16
  physical world. So for you to be involved
• 13:05:18
  in a crime, you pretty much had to be in
• 13:05:21
  the wrong place at the wrong time. It was
• 13:05:22
  gonna be physical. Right. And that's what
• 13:05:24
  we all grew up in. So there's a thing
• 13:05:26
  that I call the bubble of trust. And so
• 13:05:28
  back then the bubble of trust was
• 13:05:30
  small because you weren't exposed. But
• 13:05:33
  when you talk about the internet now, all
• 13:05:35
  you have to do is turn on the computer to
• 13:05:37
  be involved in a crime. And when you
• 13:05:39
  think of the millions and gosh many
• 13:05:42
  millions of bad actors and folks that are
• 13:05:45
  out there to get you, it's a different
• 13:05:47
  world. So I do talk about popping the
• 13:05:50
  bubble of trust. You can't trust when you
• 13:05:53
  get on the internet.
• 13:05:54
  And there's a, we use
• 13:05:55
  a principle here that we're really big
• 13:05:57
  on. It's called zero trust. I really
• 13:06:00
  emphasize you can't trust anything you
• 13:06:03
  hear. Just, you know, with the world of
• 13:06:06
  deepfakes today, anything you see, really
• 13:06:08
  anything you read. You used to say trust
• 13:06:11
  but verify. Today I say don't trust then
• 13:06:14
  verify. So we're really, zero trust to me
• 13:06:18
  is probably one of the biggest ways
• 13:06:19
  because again, like you said, the bad
• 13:06:21
  actors, they know what they're doing.
• 13:06:23
  These aren't, these aren't some anymore.
• 13:06:25
  This isn't somebody sitting in their
• 13:06:26
  garage. There's a professional, most of
• 13:06:28
  them are organized crime. And so they
• 13:06:31
  know, they know what they go after. They
• 13:06:32
  know what to get from you and what
• 13:06:34
  they're trying to do. So you just, you
• 13:06:37
  just have to be aware that there's
• 13:06:39
  probably as many, if not more bad actors
• 13:06:42
  out there trying to get something from
• 13:06:44
  you than there are good actors trying to
• 13:06:45
  help you. It's a little scary, but it's
• 13:06:47
  important for people to be aware that
• 13:06:50
  even if you get an email that looks like
• 13:06:53
  it's from someone you know, from a
• 13:06:54
  friend, from a known business or
• 13:06:57
  whatever, it might not be what it
• 13:06:59
  actually is. And chances are a lot of
• 13:07:02
  times it's not. And it should be scary
• 13:07:04
  because it is scary. Like I said, if I
• 13:07:07
  just look back at what the folks said
• 13:07:09
  they were involved in over the time that
• 13:07:12
  I've worked with or some of my friends,
• 13:07:14
  I saw people who've caught a million
• 13:07:15
  dollars in a real
• 13:07:16
  estate deal. So it's just,
• 13:07:18
  lose their identity which took four years
• 13:07:20
  to get back. You just think people
• 13:07:22
  just get like, "I don't have anything or
• 13:07:25
  it's not going to happen to me." It can
• 13:07:27
  happen to you. And if you're not careful,
• 13:07:29
  it probably will. When you talk about
• 13:07:31
  emails and you talk about phishing,
• 13:07:34
  there's some, there's some signs that,
• 13:07:36
  that we look for. Let's define phishing
• 13:07:38
  for folks. Okay. Well, phishing is when,
• 13:07:40
  phishing is what the person that's trying
• 13:07:42
  to get you to take the bait or
• 13:07:44
  click on something. And real quick, how
• 13:07:47
  you get infected, you don't get infected
• 13:07:49
  opening an email. How somebody gets
• 13:07:51
  infected or gets tricked is either
• 13:07:53
  clicking on a link, opening an
• 13:07:55
  attachment. And a lot of
• 13:07:56
  times that link is going to
• 13:07:57
  take you, say, "Oh, enter your
• 13:07:59
  credentials. It looks like
• 13:08:00
  your bank or something." So
• 13:08:02
  they're trying to get your username and
• 13:08:03
  password or they're trying to get you
• 13:08:05
  click on something that will infect you.
• 13:08:07
  So those phishing emails are designed to
• 13:08:10
  trick you. And so that's, that's the
• 13:08:13
  biggest, again, that's where the zero
• 13:08:14
  trust comes in. And these aren't little
• 13:08:16
  kids, like I said, in the garage trying
• 13:08:18
  to trick you. These are professionals.
• 13:08:20
  No. They know what's
• 13:08:20
  going to trigger you.
• 13:08:21
  They know how to, how to go after you. So
• 13:08:23
  it sounds like instead of the old
• 13:08:25
  mindset, "Okay, I'm going to get a virus
• 13:08:27
  and this virus is going to make my
• 13:08:28
  computer do something," we're seeing
• 13:08:31
  techniques and ploys that make you do
• 13:08:34
  something. They're give information or,
• 13:08:37
  or whatnot. Both. And, and still they'll
• 13:08:41
  get you to click on something that may
• 13:08:42
  load a virus or they'll get you to click
• 13:08:44
  on something. And, you know, one of the,
• 13:08:46
  one of the, the, the,
• 13:08:47
  the latest, this is a
• 13:08:49
  while back, was, was diner dinner cards.
• 13:08:52
  Filled out this
• 13:08:52
  information. We're doing a
• 13:08:53
  survey at the end. We'll send you a card
• 13:08:55
  for Applebee's or
• 13:08:56
  something, you know. And
• 13:08:58
  they start off and they're asking you
• 13:08:59
  pretty good questions. And then suddenly
• 13:09:01
  it starts getting pretty personal. I've
• 13:09:03
  never seen anybody get a dinner card, but
• 13:09:05
  I have seen people get
• 13:09:06
  their identity stolen.
• 13:09:07
  Paul, this may be out of left field, but
• 13:09:08
  let's see if I'm right here. Would you
• 13:09:10
  just describe, describe, sounds an awful
• 13:09:13
  like something you'll see often on social
• 13:09:15
  media where it is, "Hey, find out what
• 13:09:18
  kind of Disney
• 13:09:19
  character you are." And then
• 13:09:20
  you have a series of questions. "Do you
• 13:09:23
  like this? Do you
• 13:09:23
  like that? Did you go to
• 13:09:25
  school here? How old are you?" Blah,
• 13:09:26
  blah, blah. And what
• 13:09:27
  they're actually doing is
• 13:09:28
  they're pulling information out of you.
• 13:09:30
  Absolutely positively. And that's the
• 13:09:32
  whole, that's the
• 13:09:33
  whole game. I mean, what
• 13:09:34
  they're after is information. They're
• 13:09:36
  after, they're,
• 13:09:37
  they're, they're, you know,
• 13:09:38
  and again, it's interesting because
• 13:09:41
  again, it doesn't have
• 13:09:43
  to be large sums of money.
• 13:09:44
  I tell people to check your bank accounts
• 13:09:45
  constantly because I can't tell you how
• 13:09:47
  many people have said, "Where is this $5
• 13:09:49
  charge? It's from scam." Now again, you
• 13:09:52
  take a whole bunch of
• 13:09:53
  $5, you get a lot of money.
• 13:09:54
  That's right.
• 13:09:55
  And that's what they're after. So it's
• 13:09:56
  not, it's any and
• 13:09:59
  everybody, I have a good
• 13:10:00
  friend of mine, just a quick story, who,
• 13:10:03
  who was, I walked into his house one day
• 13:10:05
  and I, he's on the computer and I said,
• 13:10:08
  "John, you don't have any, any virus
• 13:10:10
  protection. You don't have anything. What
• 13:10:11
  are you doing?" He
• 13:10:12
  said, "Ah, I don't have
• 13:10:13
  anything I want to hear anybody wants.
• 13:10:15
  I'm not worried about
• 13:10:16
  it." Two months later,
• 13:10:17
  his wife called me, somebody, they got a
• 13:10:19
  virus and they lost all of their
• 13:10:21
  pictures, family pictures. So don't think
• 13:10:24
  you don't have something. Now I didn't
• 13:10:25
  tell her, tell him, he said that because
• 13:10:28
  I want to stay
• 13:10:29
  married. But you don't know
• 13:10:32
  what you have. You don't know what people
• 13:10:34
  want or what you could lose.
• 13:10:35
  Yeah. And I think the convenience, as you
• 13:10:38
  said earlier, the convenience of having a
• 13:10:40
  technology where your bank account is on
• 13:10:42
  your phone, access to, you know, ready
• 13:10:45
  information, a list of phone numbers, a
• 13:10:48
  list of email accounts, they're all
• 13:10:50
  located somewhere that
• 13:10:51
  has value to some people.
• 13:10:53
  Oh, what they're after, if you really
• 13:10:56
  look at, they're usually
• 13:10:57
  after a few things. One is
• 13:10:58
  they're looking at any way to identify
• 13:11:00
  you. It's called PII,
• 13:11:01
  Personally Identifiable
• 13:11:02
  Information. Your name, maybe social
• 13:11:04
  security number, something tied to a
• 13:11:06
  driver's license, some way that I can
• 13:11:08
  identify you because one of the big
• 13:11:10
  things, they want to stay your identity.
• 13:11:12
  And in doing that, they'll charge things
• 13:11:14
  in your name, you know, and then the
• 13:11:19
  other thing they're looking for, of
• 13:11:20
  course, any banking information, and then
• 13:11:23
  health information, HIPAA, and so on. So
• 13:11:25
  any of that stuff, and what people go,
• 13:11:28
  what do they do with
• 13:11:29
  it? They sell it on the
• 13:11:30
  dark web. And the dark web is really the
• 13:11:34
  criminal facility for...
• 13:11:36
  Criminal supermarket, yeah.
• 13:11:38
  It is. There's nothing, and I mean
• 13:11:40
  nothing, that you can't
• 13:11:41
  buy if you can get on.
• 13:11:44
  There are times when there's legitimate
• 13:11:45
  places, places on the web, say your bank,
• 13:11:49
  or whatever, where they'll need some sort
• 13:11:51
  of bits of information. Is there a way to
• 13:11:53
  tell if you're on a site
• 13:11:55
  that's not what it seems to be?
• 13:11:57
  Well, most of the sites that are going to
• 13:12:00
  be secure are going
• 13:12:01
  to end HTTPS. That's a
• 13:12:02
  secure site, but you know, it's getting
• 13:12:04
  to the point now to where you can't even
• 13:12:06
  really depend upon that. The best thing
• 13:12:08
  to do is call the bank and verify.
• 13:12:10
  Just take them in.
• 13:12:12
  Again, don't trust, verify.
• 13:12:14
  So, okay, and a lot of the times, we sort
• 13:12:16
  of get jumped ahead. We're now on like
• 13:12:18
  websites that we were told to go visit,
• 13:12:20
  but usually those requests to go to a
• 13:12:22
  website comes in the form of, say, an
• 13:12:24
  email or a text. An email would come and
• 13:12:27
  it will say, "There's a problem with your
• 13:12:29
  account. We need you to immediately
• 13:12:31
  contact this office or click on this link
• 13:12:34
  and we'll get information from you."
• 13:12:35
  Pardon me. How can you tell, bust by
• 13:12:39
  looking at an email, that you have
• 13:12:41
  something that's suspect?
• 13:12:42
  Well, I mean, you can and you can't. One
• 13:12:45
  of the things, I don't
• 13:12:46
  know if there's a mouse hover,
• 13:12:48
  and what you do is you
• 13:12:49
  hover your mouse over...
• 13:12:50
  The little cursor, right?
• 13:12:51
  Yeah, the cursor, you
• 13:12:52
  hover it over like the link.
• 13:12:54
  Yeah.
• 13:12:55
  And most of the time, you'll see the link
• 13:12:57
  has nothing to do, like, say, Kohl's or
• 13:13:00
  some shopping. Look, it has nothing to do
• 13:13:03
  with that. And so, you can kind of be
• 13:13:04
  suspect right there. In today's world,
• 13:13:09
  what, you know, we
• 13:13:09
  used to say, "Check for
• 13:13:10
  misspelling, check for all these things."
• 13:13:12
  It's kind of looks, but in today's world,
• 13:13:16
  with AI, chat TTP, a lot of the emails,
• 13:13:19
  the phishing emails you see are generated
• 13:13:21
  from AI. And so, they're almost perfect.
• 13:13:23
  You can say, "I want it to look like this
• 13:13:25
  and sound like this." So, the biggest
• 13:13:27
  thing that you always can look
• 13:13:30
  for is a sense of urgency. These bad
• 13:13:33
  actors, what they're going to do, they
• 13:13:34
  want you to act quickly and
• 13:13:36
  they want you to act in a rush.
• 13:13:38
  Without thinking.
• 13:13:39
  Without thinking. And I always say, if
• 13:13:41
  you really have been with a company that
• 13:13:45
  you're a day late, a little late, they're
• 13:13:47
  going to cut you off, they want your
• 13:13:48
  business. So, you know, always call and
• 13:13:52
  verify. That's the safest thing that you
• 13:13:55
  can do. Don't take for granted because
• 13:13:57
  these bad actors, if
• 13:13:59
  you don't respond in,
• 13:14:00
  you know, 24 hours, we're going to cut
• 13:14:01
  you off. I've never been cut off.
• 13:14:03
  And I don't know many people that have
• 13:14:05
  been, but that's what
• 13:14:06
  they're trying to do.
• 13:14:07
  They're trying to get you to respond. And
• 13:14:09
  just to tell you how smart they are,
• 13:14:10
  a while back, I was, had to, got to be,
• 13:14:13
  observe an FBI investigation to be part.
• 13:14:16
  And they had some video of the bad actors
• 13:14:19
  doing marketing plans. Let's see.
• 13:14:22
  We want to send emails. Gosh, we send
• 13:14:24
  them on, get them to
• 13:14:25
  them on Monday because we
• 13:14:26
  know they have a, "Boy, if we can figure
• 13:14:27
  out when they're on
• 13:14:28
  vacation, they can have
• 13:14:30
  an email." Because what they want you to
• 13:14:32
  do, they want you to hurry. They want you
• 13:14:34
  to be in a rush. They want you to whip
• 13:14:36
  through them. So, you know, there is no
• 13:14:38
  safe method. I think the safest is zero
• 13:14:42
  trust. All don't trust, verify.
• 13:14:45
  Verify. And that doesn't mean use a phone
• 13:14:47
  number that's in the email.
• 13:14:48
  Oh, yeah. Very smart, Jack. No. I mean,
• 13:14:51
  yeah, who do you think you're calling
• 13:14:52
  when you use the phone number?
• 13:14:54
  Do you think they're going to say, "Oh,
• 13:14:55
  no, we were just trying to trick you."
• 13:14:57
  We have heard in the news several
• 13:14:58
  instances where city government offices
• 13:15:02
  have fallen victim to
• 13:15:05
  malware and to having things encrypted.
• 13:15:08
  Well, first of all, let's define what
• 13:15:10
  malware is for folks.
• 13:15:11
  And what exactly is that? Malware is just
• 13:15:13
  really something that has
• 13:15:15
  some kind of illicit intent.
• 13:15:17
  It's something that's designed to do
• 13:15:20
  something to your system,
• 13:15:22
  even as simple as adware.
• 13:15:25
  But it's designed to really, it's
• 13:15:28
  something with some illicit intent.
• 13:15:30
  And a lot of times where a city has
• 13:15:32
  fallen victim to a
• 13:15:33
  malware, it's an employee who's
• 13:15:35
  clicking on something that they think is
• 13:15:36
  innocent and it's not.
• 13:15:38
  Oh, absolutely. Again, it goes back to
• 13:15:40
  security awareness. You hear the term,
• 13:15:44
  cybersecurity is not IT's responsibility.
• 13:15:47
  It's not. Because I like
• 13:15:49
  to say this, how many people
• 13:15:51
  have the keys to your
• 13:15:52
  house? No, just my wife and I.
• 13:15:55
  You know how many people have the keys to
• 13:15:56
  the city's network house?
• 13:15:59
  Every employee. Every employee.
• 13:16:00
  So now you have something that people
• 13:16:02
  want and everybody has it.
• 13:16:04
  So that's what you really have
• 13:16:06
  to be careful of. And I always say when I
• 13:16:08
  do some presentations, you
• 13:16:10
  take Riviera Beach, Pensacola,
• 13:16:13
  any of these places they got here, rent
• 13:16:14
  somewhere. And I say, how
• 13:16:15
  would you like to be the person
• 13:16:16
  that caused that? Because these folks are
• 13:16:18
  just like you sitting in the
• 13:16:20
  chair and they just clicked
• 13:16:21
  on something. They did something that
• 13:16:23
  probably shouldn't have. And
• 13:16:25
  it ended up costing the city
• 13:16:29
  a million. So what did you do when you've
• 13:16:32
  been with us for been
• 13:16:33
  with the city for many years?
• 13:16:35
  When it first started, I
• 13:16:36
  think you've told the story that
• 13:16:38
  our performance as far as being aware of
• 13:16:41
  possible malware and
• 13:16:42
  phishing was fairly low.
• 13:16:44
  Oh, it was when I right before they
• 13:16:47
  they've done what you
• 13:16:47
  call a phishing test.
• 13:16:49
  Send something out there. We do a monthly
• 13:16:50
  now, but and it was a
• 13:16:52
  45 percent click rate.
• 13:16:54
  So that means almost one out of every two
• 13:16:56
  people were clicking on
• 13:16:57
  something and we're down below
• 13:16:58
  four now. And that is because we do
• 13:17:01
  phishing tests. We do
• 13:17:02
  training. Again, if somebody told you
• 13:17:06
  70 percent of your income comes from this
• 13:17:10
  area, you'd focus. If
• 13:17:12
  somebody say 70 percent of
• 13:17:14
  breaches come from people clicking on the
• 13:17:15
  wrong thing, we better
• 13:17:16
  focus. Yeah. So you all have a
• 13:17:20
  very stout and very in-depth process of
• 13:17:24
  training people here at
• 13:17:25
  the city to avoid clicking on
• 13:17:27
  things, to be aware, to report things
• 13:17:29
  that they see. Now,
• 13:17:30
  imagine that you have a family,
• 13:17:31
  family's family of four. We've got mom
• 13:17:33
  and dad and a couple of kids.
• 13:17:36
  That's a little tougher, especially when
• 13:17:37
  you have little kids. How
• 13:17:38
  can you work with young people
• 13:17:40
  and sort of educate them to the danger?
• 13:17:43
  You know, there's two
• 13:17:43
  things. First of all,
• 13:17:44
  one of the things that's really important
• 13:17:46
  that people don't
• 13:17:47
  realize, you've got to keep your
• 13:17:48
  systems up to date. You've got to keep
• 13:17:50
  them patched. Like you're
• 13:17:51
  always saying, hey, you know,
• 13:17:53
  you need to install this. You need to
• 13:17:55
  install it because how this
• 13:17:56
  works is the bad actors find
• 13:17:59
  somebody reports a hole in the system.
• 13:18:01
  Usually it's a security
• 13:18:02
  hole. Now the vendor will patch
• 13:18:04
  that. If you don't put that patch in,
• 13:18:07
  you've got a hole in the
• 13:18:08
  system that the bad actors know
• 13:18:10
  that you don't. And so keeping them
• 13:18:13
  updated, keeping them
• 13:18:14
  patched, keeping those systems
• 13:18:15
  where they need to be is critical. It's
• 13:18:17
  very, very important.
• 13:18:18
  Keeping your virus protection
• 13:18:20
  up to date. For example, how virus
• 13:18:22
  protection works is it's updated.
• 13:18:24
  Nowadays it's updated
• 13:18:26
  pretty much instantly, but if it gets
• 13:18:28
  behind and it's not doing
• 13:18:29
  those updates, think of how many
• 13:18:31
  millions of viruses are out there. This
• 13:18:32
  doesn't know about. So
• 13:18:34
  keeping those things updated is
• 13:18:36
  one way that's really, but there's,
• 13:18:38
  there's, you just got to talk. You just
• 13:18:40
  got to, you know, one
• 13:18:42
  of the things too is, is you can't help
• 13:18:45
  but be involved in this. I did a
• 13:18:46
  presentation for the,
• 13:18:48
  for the kids. I think it was the middle
• 13:18:51
  school kids, high school
• 13:18:52
  kids on the bring your kids to
• 13:18:54
  work day. And you know, it just, you
• 13:18:57
  don't realize how vulnerable
• 13:18:59
  they are. Talk to your kids,
• 13:19:01
  make sure they understand and make sure
• 13:19:02
  one of the important things
• 13:19:04
  is make sure that they'll come
• 13:19:07
  to you with anything. What happens a lot
• 13:19:09
  of times is these kids, young kids,
• 13:19:11
  they're, have a sleepover
• 13:19:12
  and they think they're talking to this
• 13:19:14
  young guy. And so they'll do something
• 13:19:15
  maybe they shouldn't
• 13:19:17
  have done. And now this, the bad actors
• 13:19:20
  and blackmail. So make it
• 13:19:22
  comfortable for your kids
• 13:19:24
  to come to you. That one mistake could be
• 13:19:27
  magnified a million times if they don't
• 13:19:29
  come to you. And so,
• 13:19:30
  you know, again, hopefully most people do
• 13:19:32
  that, but it's just
• 13:19:33
  important. This is a different world.
• 13:19:36
  And when I hear somebody say, well,
• 13:19:37
  you're in my business as
• 13:19:38
  my kid, I say, you bet I am.
• 13:19:40
  You have to be. All right. So I hear you
• 13:19:43
  on keeping your systems
• 13:19:45
  updated, get your computer,
• 13:19:46
  your software, uh, up to date. So you're,
• 13:19:49
  you're packing, patch,
• 13:19:50
  patching all the exploits. Is
• 13:19:52
  there, is this a myth that, Hey, you know
• 13:19:55
  what? I'm on a Mac. I
• 13:19:56
  don't have that to worry about,
• 13:19:57
  about that. Yeah, it's a myth. I mean,
• 13:19:59
  you're, you're vulnerable there too. Now,
• 13:20:02
  you're less vulnerable. And the reason,
• 13:20:05
  some of the reason there's a
• 13:20:06
  couple of them, but the Macs,
• 13:20:08
  you know, are, are more restricted than
• 13:20:10
  what they do and what they
• 13:20:11
  use. The, the DOS systems,
• 13:20:13
  the window systems are wide open. I just
• 13:20:15
  said, I just sold my agent.
• 13:20:20
  Is there a difference as far as security
• 13:20:22
  is concerned, if I were to
• 13:20:23
  go and click on something
• 13:20:25
  on a desktop rather than a phone? Cause a
• 13:20:27
  lot of people use their phones for
• 13:20:28
  everything these days.
• 13:20:29
  You know, phones are more restrictive.
• 13:20:31
  Phones aren't usually tied, you know, to,
• 13:20:33
  you don't have all your finance, all
• 13:20:35
  your, you think about all the
• 13:20:36
  applications you use at home.
• 13:20:38
  So they're usually more restrictive. They
• 13:20:39
  can still be damaging.
• 13:20:41
  The problem is if you're
• 13:20:42
  connected to the phone, it could exploit,
• 13:20:44
  but, um, it, you're, you
• 13:20:46
  definitely, you're less,
• 13:20:48
  it's interesting. I won't say what
• 13:20:50
  department, but there is a
• 13:20:51
  department that probably has,
• 13:20:52
  has had, they're making great strides.
• 13:20:54
  The highest number of
• 13:20:55
  clicks and it's the ones they're
• 13:20:57
  clicking on the phone. So, you know, what
• 13:21:00
  I say is because you, you
• 13:21:01
  can't really read it. And again,
• 13:21:03
  that's what they're trying to do. One of
• 13:21:05
  the, the, the things that I really
• 13:21:07
  recommend is never click
• 13:21:08
  on your first read. Don't click on
• 13:21:09
  anything on your phone. Don't click on
• 13:21:11
  the phone, get home,
• 13:21:13
  think it over, look at it, make sure,
• 13:21:15
  verify it. Don't click on
• 13:21:17
  first rate. That's what the bad
• 13:21:19
  actors want you to do. Right. They want
• 13:21:20
  you to rush. They want you to react
• 13:21:22
  immediately. They're
• 13:21:22
  going for an emotional response. Oh my
• 13:21:25
  gosh, someone's in my
• 13:21:25
  account. I gotta gotta get some
• 13:21:27
  help. And see, here's the thing. What we
• 13:21:29
  have a tendency in IT do
• 13:21:31
  sometimes is think people should
• 13:21:32
  know, oh my gosh, you should, why? This
• 13:21:35
  is new. Who, you know, I
• 13:21:37
  always ask that you lock your car.
• 13:21:40
  Yeah, I love your car. Because you know,
• 13:21:43
  the bad actors through
• 13:21:44
  years and generations,
• 13:21:45
  the bad actors either want your car,
• 13:21:47
  what's in your car. See, we haven't had
• 13:21:48
  that exposure to this
• 13:21:49
  world. Yeah. So it's not second nature
• 13:21:52
  and it's gotta be, but until
• 13:21:55
  it becomes that we've got to
• 13:21:56
  just be extremely careful and be aware of
• 13:22:01
  the ramifications.
• 13:22:02
  When you're online, again,
• 13:22:03
  I hate to continue to pound something,
• 13:22:06
  but zero trust. Trust. No
• 13:22:08
  one. Yes. So that's the best way
• 13:22:11
  to stay safe is always check and verify
• 13:22:13
  and then use alternate
• 13:22:15
  numbers and ways of contacting the
• 13:22:17
  original source to verify that that was
• 13:22:20
  really indeed what they
• 13:22:21
  were asking for. Absolutely.
• 13:22:22
  And again, I've never, I like this, when
• 13:22:25
  I first did the
• 13:22:27
  presentations here, the next, I didn't
• 13:22:29
  want to think on a Friday, next Monday, I
• 13:22:31
  got on the elevator with a
• 13:22:33
  sweet little lady and she was
• 13:22:35
  in tears. I said, what, can I help you
• 13:22:38
  with anything I can do?
• 13:22:39
  She says, oh no. The IRS has
• 13:22:42
  been after me all weekend. They say, oh,
• 13:22:44
  this money. And you know,
• 13:22:45
  I'm going back and gosh, I
• 13:22:47
  know I paid. And I said, okay, do you
• 13:22:51
  mind if I see your phone? She
• 13:22:52
  showed me the phone and there
• 13:22:54
  was no question. It was a hoax. And so I
• 13:22:57
  said, do you mind if I
• 13:22:58
  type? I said, please refer any
• 13:22:59
  communication. I made up a law firm name,
• 13:23:01
  boom, never heard anything
• 13:23:02
  else. But you know, why would
• 13:23:04
  we think she should know? She, again,
• 13:23:07
  when you talk about that
• 13:23:08
  bubble of trust, she can't imagine
• 13:23:11
  somebody spoofing the IRS. She can't
• 13:23:13
  imagine somebody, my mother,
• 13:23:15
  who gets online from time to
• 13:23:17
  time. She, she, if she sees something
• 13:23:21
  that says children's mission, she's
• 13:23:23
  probably going to give.
• 13:23:23
  One day I showed her up, she was going to
• 13:23:25
  Russia. You know what she
• 13:23:26
  said? I like Russian kids.
• 13:23:29
  She's not going to Russian kids. But
• 13:23:31
  again, she, just that, that not being
• 13:23:35
  able to trust is foreign.
• 13:23:37
  Sure. You know, when you tell people,
• 13:23:39
  when I say to people zero
• 13:23:41
  trust, it's almost like,
• 13:23:42
  because we've been, it seems dark. Yeah.
• 13:23:43
  We've grown up to trust.
• 13:23:45
  It's in fact, it's interesting
• 13:23:46
  when I did the, I do the presentation
• 13:23:48
  sometimes to the new
• 13:23:49
  leaders. And the first one I did,
• 13:23:51
  I was talking to zero trust and Mike
• 13:23:53
  Russell, who was the HR trainer, really,
• 13:23:56
  really good trainer,
• 13:23:57
  he came up to me and said, Paul, right,
• 13:23:59
  my next session is on the
• 13:24:01
  speed of trust by Stephen Covey.
• 13:24:03
  I said, okay, hold on. I want you to
• 13:24:04
  understand we're talking
• 13:24:05
  about online, not each other.
• 13:24:07
  We can trust each other. That's right.
• 13:24:09
  When you're in the room.
• 13:24:11
  Yeah, absolutely. Well,
• 13:24:12
  you know, we've covered a lot of stuff
• 13:24:14
  here and I think the
• 13:24:15
  most important thing,
• 13:24:17
  especially the folks at home is one to
• 13:24:19
  know that, that there are dangers. It is
• 13:24:22
  real. It is something
• 13:24:23
  that you need to be aware about. They
• 13:24:25
  are, but there are simple
• 13:24:26
  things you can do to protect
• 13:24:28
  yourself. Start by verifying anything
• 13:24:30
  that you may see, expect
• 13:24:32
  someone to send you something.
• 13:24:33
  I think that's one of the things that I
• 13:24:34
  know people get most. I've
• 13:24:36
  had folks come to me and say,
• 13:24:37
  oh my gosh, Jerry, there's this window
• 13:24:39
  that popped up that told me that I've
• 13:24:41
  gotten an infection and
• 13:24:42
  I need to call this number that's on the
• 13:24:44
  screen right now. What
• 13:24:45
  should I do? And I'm going,
• 13:24:48
  that's the thing you're trying to avoid.
• 13:24:50
  You know, it, that's it. That's what
• 13:24:54
  they're trying to do.
• 13:24:54
  It's so interesting because I have a
• 13:24:57
  cousin who is a really brilliant
• 13:25:00
  businessman. So I walked into
• 13:25:02
  his house one day and I wanted to talk to
• 13:25:04
  him and he kind of
• 13:25:04
  shucked me off. I said, okay,
• 13:25:06
  what he said, what's wrong? He said, I
• 13:25:08
  got somebody and they found a virus on my
• 13:25:10
  computer and they're
• 13:25:10
  fixing it. I unplugged this computer. I
• 13:25:13
  said, you probably didn't
• 13:25:15
  have one, but you do now.
• 13:25:16
  And again, it goes back to that thinking
• 13:25:19
  people should know. If
• 13:25:21
  you're not in this world,
• 13:25:22
  you don't know. And, but you've got,
• 13:25:25
  we've got to build that paranoia. I do
• 13:25:28
  what I call a healthy
• 13:25:28
  paranoia. You go into it, you have a
• 13:25:31
  paranoia. Now unhealthy paranoia is I'm
• 13:25:33
  not going to use it.
• 13:25:35
  So that's pretty unhealthy. So what we,
• 13:25:37
  but what we want to use
• 13:25:38
  it, but we want to use it
• 13:25:40
  with the understanding of what it can be.
• 13:25:42
  Wow. Okay. Very good. We've
• 13:25:45
  covered a lot of ground here.
• 13:25:47
  Is there a single message you would like
• 13:25:49
  to share with folks who live
• 13:25:50
  here in West Palm and actually
• 13:25:51
  anyone who happens to be listening to
• 13:25:53
  this about what they
• 13:25:55
  should be doing and to keep,
• 13:25:56
  keep themselves, their information, their
• 13:25:58
  family safe? Yeah. I
• 13:26:00
  say, you know, be, be,
• 13:26:01
  be just be aware, be smart. And, and,
• 13:26:04
  and, you know, people aren't
• 13:26:07
  afraid of anything they don't
• 13:26:08
  think can happen to them. Be, be, be
• 13:26:11
  concerned and be cautious and
• 13:26:12
  be afraid. I mean, one of the
• 13:26:14
  biggest things we do in security weather
• 13:26:16
  stranding is we try to get
• 13:26:18
  your attention and sometimes
• 13:26:19
  that's scaring you, but we're scaring you
• 13:26:21
  with reality. We're not
• 13:26:23
  scaring you like the bad
• 13:26:24
  actors online are with this makeup. Hey,
• 13:26:27
  do this and we'll take care
• 13:26:29
  of you. Just, you need to keep
• 13:26:31
  your systems up days. We talked about you
• 13:26:33
  just need to be careful.
• 13:26:35
  Don't, you know, public
• 13:26:36
  wifi don't do business on the public
• 13:26:38
  wifi. Make sure you're in a secure area
• 13:26:41
  when you're sharing,
• 13:26:42
  make sure your, your information is
• 13:26:44
  locked down. There's just, just, you
• 13:26:47
  know, just be careful.
• 13:26:48
  There's so much online that you can get
• 13:26:50
  even YouTube about how to
• 13:26:51
  lock things down, how to be
• 13:26:53
  careful. Just continue what happens. I
• 13:26:56
  always call it, you know,
• 13:26:57
  the, the, the curve. If you think
• 13:26:59
  about what happens, you know, when, when
• 13:27:01
  it goes along and something
• 13:27:02
  happens, the curve is really
• 13:27:04
  high and then suddenly nothing happens
• 13:27:06
  for a while, the curve
• 13:27:07
  drops off, right? Then something
• 13:27:09
  happens, boom. So what we try to do, our
• 13:27:11
  focus is to keep the curve
• 13:27:13
  like this, not like this. And
• 13:27:15
  you've got to do that by just continually
• 13:27:17
  understanding and
• 13:27:19
  realizing that this next venture
• 13:27:22
  you do online could be very costly.
• 13:27:25
  Gotcha. Paul Jones, thank
• 13:27:27
  you so much for your time
• 13:27:28
  of day. I want to let the people know at
• 13:27:30
  home that, you know, the
• 13:27:31
  city of West Palm Beach is
• 13:27:32
  working hard to keep its systems safe and
• 13:27:35
  keep things operating as
• 13:27:37
  smoothly as possible here.
• 13:27:39
  And the advice that you give, we've
• 13:27:40
  shared today will help
• 13:27:41
  folks at home do the same thing.
• 13:27:44
  One thing, that's why I like what I did
• 13:27:46
  because the same things
• 13:27:47
  that I talk about keeping the
• 13:27:48
  city safe keeps you personally safe. And
• 13:27:52
  it's such an important
• 13:27:53
  thing. And I do want to say to
• 13:27:55
  the people that we, we have a very
• 13:27:58
  professional team and we take this very,
• 13:28:00
  very serious. Because
• 13:28:02
  again, it's, it's all of us that suffer
• 13:28:05
  if we don't. Absolutely.
• 13:28:07
  Paul Jones, thank you so much
• 13:28:08
  for your time. Appreciate it. Thank you.
• 13:28:10
  And thank you for joining us. This has
• 13:28:12
  been the City Center
• 13:28:13
  podcast from West Palm Beach, Florida.
• 13:28:15
  I'm Jerry Marcello.
• 13:28:17
  We'll see you next time.